@warlock.js/auth 5.12.0 → 5.14.0

package/esm/services/auth.service.mjs

@@ -1,5 +1,7 @@
 import { AccessToken } from "../models/access-token/access-token.model.mjs";
 import "../models/access-token/index.mjs";
+import { OneTimeToken } from "../models/one-time-token/one-time-token.model.mjs";
+import "../models/one-time-token/index.mjs";
 import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 import "../models/refresh-token/index.mjs";
 import { authConfig } from "./auth-config.mjs";
@@ -26,6 +28,12 @@ var AuthService = class {
 		return config.key("auth.refreshToken.model", RefreshToken);
 	}
 	/**
+	* Resolve the active one-time-token model (default or registered override).
+	*/
+	get oneTimeTokenModel() {
+		return config.key("auth.oneTimeToken.model", OneTimeToken);
+	}
+	/**
 	* Build the default access-token JWT payload from a user.
 	*/
 	buildAccessTokenPayload(user) {
@@ -188,6 +196,23 @@ var AuthService = class {
 	async login(Model, credentials, deviceInfo) {
 		const user = await this.attemptLogin(Model, credentials);
 		if (!user) return null;
+		return this.finalizeLogin(user, deviceInfo);
+	}
+	/**
+	* Log in a user some OTHER method already authenticated — a provider
+	* callback, a passkey assertion, a one-time code. Applies the
+	* `auth.canAuthenticate` policy (403 on refusal), then produces exactly
+	* what {@link login} produces: the same tokens, rows and events. Pair with
+	* {@link setAuthCookie} for a cookie session, as with password login.
+	*
+	* Never call this for a user you have not authenticated.
+	*/
+	async completeLogin(user, deviceInfo) {
+		await this.assertCanAuthenticate(user);
+		return this.finalizeLogin(user, deviceInfo);
+	}
+	/** The one token-issuing tail every login method shares. */
+	async finalizeLogin(user, deviceInfo) {
 		if (!authConfig.refreshToken.enabled()) return {
 			user,
 			tokens: { accessToken: await this.issueAccessToken(user, deviceInfo?.payload) }
@@ -261,7 +286,8 @@ var AuthService = class {
 		authEvents.emit("token.familyRevoked", familyId, revokedTokens);
 	}
 	/**
-	* Delete expired tokens (refresh + access). Emits `token.expired` per refresh
+	* Delete expired tokens (refresh + access) and spent one-time tokens
+	* (expired or consumed verification/reset/OTP/passkey rows). Emits `token.expired` per refresh
 	* token and `cleanup.completed` with the refresh count. Drives the
 	* `auth.cleanup` CLI command.
 	*/
@@ -269,6 +295,7 @@ var AuthService = class {
 		const expiredTokens = await this.refreshTokenModel.purgeExpired();
 		for (const token of expiredTokens) authEvents.emit("token.expired", token);
 		await this.accessTokenModel.purgeExpired();
+		await this.oneTimeTokenModel.purgeSpent();
 		authEvents.emit("cleanup.completed", expiredTokens.length);
 		return expiredTokens.length;
 	}

package/esm/services/auth.service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"sourcesContent":["import { Random } from \"@mongez/reinforcements\";\nimport type { ChildModel } from \"@warlock.js/cascade\";\nimport {\n  config,\n  ForbiddenError,\n  hashPassword,\n  type Response,\n  verifyPassword,\n} from \"@warlock.js/core\";\nimport type {\n  AccessTokenOutput,\n  AuthCredentials,\n  ClearAuthCookieOptions,\n  DeviceInfo,\n  LoginResult,\n  SetAuthCookieOptions,\n  TokenPair,\n} from \"../contracts/types\";\nimport { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport { RefreshToken } from \"../models/refresh-token\";\nimport { authConfig } from \"./auth-config\";\nimport { authEvents } from \"./auth-events\";\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\n\nclass AuthService {\n  /**\n   * Resolve the active access-token model — the package default, or a subclass\n   * an app registered under `config.auth.accessToken.model` (e.g. to add a\n   * tenant column). The service never references the concrete class directly so\n   * an override is a pure config change.\n   */\n  private get accessTokenModel(): typeof AccessToken {\n    return config.key(\"auth.accessToken.model\", AccessToken);\n  }\n\n  /**\n   * Resolve the active refresh-token model (default or registered override).\n   */\n  private get refreshTokenModel(): typeof RefreshToken {\n    return config.key(\"auth.refreshToken.model\", RefreshToken);\n  }\n\n  /**\n   * Build the default access-token JWT payload from a user.\n   */\n  public buildAccessTokenPayload(user: Auth): Record<string, unknown> {\n    return {\n      id: user.id,\n      userType: user.userType,\n      created_at: Date.now(),\n    };\n  }\n\n  /** One policy seam keeps account-state checks identical across all auth paths. */\n  public async canAuthenticate(user: Auth): Promise<boolean> {\n    return authConfig.canAuthenticate(user);\n  }\n\n  private async assertCanAuthenticate(user: Auth): Promise<void> {\n    if (!(await this.canAuthenticate(user))) {\n      throw new ForbiddenError(\"This user cannot authenticate.\");\n    }\n  }\n\n  private async issueAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n  ): Promise<AccessTokenOutput> {\n    const data = payload || this.buildAccessTokenPayload(user);\n    // Validate before signing so an unusable lifetime cannot mint an immortal token.\n    const expiresIn = authConfig.accessToken.expiresInMs();\n\n    const token = await jwt.generate(data, { expiresIn });\n    const expiresAt = new Date(Date.now() + expiresIn);\n\n    await this.accessTokenModel.issue(user, token, expiresAt);\n\n    return { token, expiresAt: expiresAt.toISOString() };\n  }\n\n  /**\n   * Sign + persist an access token for the user and return the token with its\n   * expiry. The expiry is computed locally from `expiresIn` rather than by\n   * re-verifying the token we just signed.\n   */\n  public async generateAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n  ): Promise<AccessTokenOutput> {\n    await this.assertCanAuthenticate(user);\n\n    return this.issueAccessToken(user, payload);\n  }\n\n  private async issueRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    // Validate the lifetime first — before the per-user cap is enforced, before\n    // anything is signed — so a bad value can never revoke a user's oldest\n    // session on its way to failing.\n    const expiresIn = authConfig.refreshToken.expiresInMs();\n\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    const payload = {\n      userId: user.id,\n      userType: user.userType,\n      familyId,\n    };\n\n    const expiresAt = new Date(Date.now() + expiresIn).toISOString();\n\n    await this.refreshTokenModel.enforceMax(user, authConfig.refreshToken.maxPerUser());\n\n    const token = await jwt.generateRefreshToken(payload, { expiresIn });\n\n    return this.refreshTokenModel.issue(user, token, { familyId, expiresAt, deviceInfo });\n  }\n\n  /**\n   * Sign + persist a refresh token for the user (enforcing the per-user cap\n   * first). Resolves to `undefined` when refresh tokens are disabled in config.\n   */\n  public async createRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    await this.assertCanAuthenticate(user);\n\n    return this.issueRefreshToken(user, deviceInfo);\n  }\n\n  private async issueTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    const accessToken = await this.issueAccessToken(user, deviceInfo?.payload);\n    const refreshToken = await this.issueRefreshToken(user, deviceInfo);\n\n    const tokenPair: TokenPair = {\n      accessToken,\n      refreshToken: refreshToken\n        ? {\n            token: refreshToken.get(\"token\"),\n            expiresAt: refreshToken.get(\"expires_at\"),\n          }\n        : undefined,\n    };\n\n    authEvents.emit(\"token.created\", user, tokenPair);\n\n    if (refreshToken) {\n      authEvents.emit(\"session.created\", user, refreshToken, deviceInfo);\n    }\n\n    return tokenPair;\n  }\n\n  /**\n   * Issue both an access and a refresh token, emitting the creation events.\n   */\n  public async createTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    await this.assertCanAuthenticate(user);\n\n    return this.issueTokenPair(user, deviceInfo);\n  }\n\n  /**\n   * Exchange a refresh token for a new token pair, with rotation + replay\n   * detection. A concurrent reuse of the same token loses the atomic revoke and\n   * is treated as a breach — the whole family is revoked and the request fails.\n   */\n  public async refreshTokens(\n    refreshTokenString: string,\n    deviceInfo?: DeviceInfo,\n  ): Promise<TokenPair | null> {\n    let decoded:\n      | {\n          userId: number;\n          userType: string;\n          familyId: string;\n        }\n      | null;\n\n    try {\n      decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n    }>(refreshTokenString);\n    } catch (error) {\n      if (isInvalidCredentialError(error)) return null;\n\n      throw error;\n    }\n\n    if (!decoded) return null;\n\n    const refreshToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n\n    if (!refreshToken?.isValid) {\n      // An already-invalid token may be a replay of a rotated credential.\n      if (refreshToken) {\n        await this.revokeTokenFamily(refreshToken.familyId);\n      }\n\n      return null;\n    }\n\n    const UserModel = config.key(`auth.userType.${decoded.userType}`);\n\n    if (!UserModel) {\n      throw new Error(`User type ${decoded.userType} is unknown type.`);\n    }\n\n    const user = (await UserModel.find(decoded.userId)) as Auth | null;\n\n    if (!user) return null;\n\n    if (!(await this.canAuthenticate(user))) return null;\n\n    const rotationEnabled = authConfig.refreshToken.rotation();\n\n    if (rotationEnabled) {\n      const won = await refreshToken.revokeIfActive();\n\n      if (!won) {\n        // A concurrent request already rotated this token.\n        await this.revokeTokenFamily(refreshToken.familyId);\n\n        return null;\n      }\n    } else {\n      await refreshToken.markAsUsed();\n    }\n\n    const newTokenPair = await this.issueTokenPair(user, {\n      ...deviceInfo,\n      familyId: refreshToken.familyId,\n    });\n\n    authEvents.emit(\"token.refreshed\", user, newTokenPair, refreshToken);\n\n    return newTokenPair;\n  }\n\n  /**\n   * Verify a plaintext password against a stored hash.\n   */\n  public async verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean> {\n    return verifyPassword(plainPassword, hashedPassword);\n  }\n\n  /**\n   * Hash a plaintext password.\n   */\n  public async hashPassword(password: string): Promise<string> {\n    return hashPassword(password);\n  }\n\n  /**\n   * Resolve a user by credentials, verifying the password. Returns `null` on a\n   * missing user or a wrong password, emitting `login.failed` either way.\n   */\n  public async attemptLogin<T extends Auth>(\n    Model: ChildModel<T>,\n    data: AuthCredentials,\n  ): Promise<T | null> {\n    const { password, ...otherData } = data;\n\n    authEvents.emit(\"login.attempt\", otherData);\n\n    const user = (await Model.first(otherData)) as T | null;\n\n    if (!user) {\n      authEvents.emit(\"login.failed\", otherData, \"User not found\");\n\n      return null;\n    }\n\n    if (!(await this.verifyPassword(password, user.string(\"password\")!))) {\n      authEvents.emit(\"login.failed\", otherData, \"Invalid password\");\n\n      return null;\n    }\n\n    if (!(await this.canAuthenticate(user))) {\n      authEvents.emit(\"login.failed\", otherData, \"Authentication not allowed\");\n\n      return null;\n    }\n\n    return user;\n  }\n\n  /**\n   * Full login flow: validate credentials, issue tokens, emit events. Returns\n   * the user + token pair on success, `null` on failure.\n   */\n  public async login<T extends Auth>(\n    Model: ChildModel<T>,\n    credentials: AuthCredentials,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    const user = await this.attemptLogin(Model, credentials);\n\n    if (!user) {\n      return null;\n    }\n\n    if (!authConfig.refreshToken.enabled()) {\n      const accessToken = await this.issueAccessToken(user, deviceInfo?.payload);\n\n      return { user, tokens: { accessToken } };\n    }\n\n    const tokens = await this.issueTokenPair(user, deviceInfo);\n\n    authEvents.emit(\"login.success\", user, tokens, deviceInfo);\n\n    return { user, tokens };\n  }\n\n  /**\n   * Log a user out.\n   *\n   * @param accessToken - access token string to revoke (optional)\n   * @param refreshToken - refresh token string to revoke (optional)\n   *\n   * When no refresh token is supplied, `config.auth.refreshToken.logoutWithoutToken`\n   * decides the behavior: `\"revoke-all\"` (default, fail-safe) revokes every\n   * refresh token; `\"error\"` requires the caller to pass one.\n   */\n  public async logout(user: Auth, accessToken?: string, refreshToken?: string): Promise<void> {\n    if (accessToken) {\n      await this.removeAccessToken(user, accessToken);\n    }\n\n    if (refreshToken) {\n      const token = await this.refreshTokenModel.findForUser(user, refreshToken);\n\n      if (token) {\n        await token.revoke();\n        authEvents.emit(\"session.destroyed\", user, token);\n      }\n    } else {\n      const behavior = authConfig.refreshToken.logoutWithoutToken();\n\n      if (behavior === \"error\") {\n        throw new Error(\"Refresh token required for logout\");\n      }\n\n      await this.revokeAllTokens(user);\n      authEvents.emit(\"logout.failsafe\", user);\n    }\n\n    authEvents.emit(\"logout\", user);\n  }\n\n  /**\n   * Remove a specific access token belonging to the user.\n   */\n  public async removeAccessToken(user: Auth, token: string): Promise<void> {\n    await this.accessTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Remove every access token belonging to the user.\n   */\n  public async removeAllAccessTokens(user: Auth): Promise<void> {\n    await this.accessTokenModel.deleteAllForUser(user);\n  }\n\n  /**\n   * Remove a specific refresh token belonging to the user.\n   */\n  public async removeRefreshToken(user: Auth, token: string): Promise<void> {\n    await this.refreshTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Revoke every active refresh token for the user and delete their access\n   * tokens — \"log out of all devices\". Revocation is a single bulk update; an\n   * event fires per revoked token.\n   */\n  public async revokeAllTokens(user: Auth): Promise<void> {\n    const revokedTokens = await this.refreshTokenModel.revokeAllFor(user);\n\n    for (const token of revokedTokens) {\n      authEvents.emit(\"token.revoked\", user, token);\n    }\n\n    await this.removeAllAccessTokens(user);\n\n    authEvents.emit(\"logout.all\", user);\n  }\n\n  /**\n   * Revoke an entire token family — rotation breach containment.\n   */\n  public async revokeTokenFamily(familyId: string): Promise<void> {\n    const revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\n\n    authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens);\n  }\n\n  /**\n   * Delete expired tokens (refresh + access). Emits `token.expired` per refresh\n   * token and `cleanup.completed` with the refresh count. Drives the\n   * `auth.cleanup` CLI command.\n   */\n  public async cleanupExpiredTokens(): Promise<number> {\n    const expiredTokens = await this.refreshTokenModel.purgeExpired();\n\n    for (const token of expiredTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    await this.accessTokenModel.purgeExpired();\n\n    authEvents.emit(\"cleanup.completed\", expiredTokens.length);\n\n    return expiredTokens.length;\n  }\n\n  /**\n   * Find every persisted token — access and refresh — that can never retire\n   * itself: an unusable `expires_at`, or a token carrying no `exp` claim.\n   *\n   * This is the remediation read for the pre-4.12.0 `expiresIn` defect (#25).\n   * Nothing else surfaces these rows: `auth.cleanup` selects `expires_at < now`,\n   * which an `Invalid Date` never satisfies, and a row whose date column is\n   * perfectly fine can still hold a token with no deadline in it. Read-only —\n   * pair with {@link purgeNeverExpiringTokens} to act on the answer.\n   */\n  public async findNeverExpiringTokens(): Promise<{\n    accessTokens: AccessToken[];\n    refreshTokens: RefreshToken[];\n  }> {\n    return {\n      accessTokens: await this.accessTokenModel.findNeverExpiring(),\n      refreshTokens: await this.refreshTokenModel.findNeverExpiring(),\n    };\n  }\n\n  /**\n   * Revoke every never-expiring token by deleting its row, emitting\n   * `token.revoked` per refresh token. Drives `warlock auth.purge-never-expiring`.\n   *\n   * Access tokens first: deleting one is immediate revocation, while a refresh\n   * token left in place for a moment can only mint an access token through a\n   * verifier that now rejects it for the missing `exp`.\n   */\n  public async purgeNeverExpiringTokens(): Promise<{\n    accessTokens: number;\n    refreshTokens: number;\n  }> {\n    const accessTokens = await this.accessTokenModel.purgeNeverExpiring();\n    const refreshTokens = await this.refreshTokenModel.purgeNeverExpiring();\n\n    // `token.expired` (the event `auth.cleanup` already emits for a removed\n    // refresh token) rather than `token.revoked`, which carries a loaded `Auth`\n    // this batch path has no reason to fetch a user row for.\n    for (const token of refreshTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    return { accessTokens: accessTokens.length, refreshTokens: refreshTokens.length };\n  }\n\n  /**\n   * Active, unexpired sessions for the user, newest first.\n   */\n  public async getActiveSessions(user: Auth): Promise<RefreshToken[]> {\n    return this.refreshTokenModel.activeFor(user);\n  }\n\n  /**\n   * `Max-Age` (seconds) `setAuthCookie` should apply, derived from an\n   * `AccessTokenOutput`'s `expiresAt` — or `undefined` for a bare token\n   * string (a session cookie) or an unparseable `expiresAt`.\n   */\n  private cookieMaxAgeFromToken(token: string | AccessTokenOutput): number | undefined {\n    if (typeof token === \"string\") return undefined;\n\n    const expiresAt = new Date(token.expiresAt).getTime();\n\n    if (Number.isNaN(expiresAt)) return undefined;\n\n    return Math.max(0, Math.round((expiresAt - Date.now()) / 1000));\n  }\n\n  /**\n   * Write the auth cookie on `response` — the write side of the `cookie:<name>`\n   * token source `authMiddleware([], \"cookie:<name>\")` already reads. An explicit\n   * app-controller call, never a side effect of {@link login}, so an existing\n   * bearer-only app never starts emitting `Set-Cookie` just by upgrading.\n   *\n   * Attribute flags (`HttpOnly`, `SameSite=Lax`, `Secure` outside dev) come\n   * from `response.cookie()`'s own `secureCookieDefaults()` floor — this\n   * method never overrides them, only `name`/`path`/`maxAge`. `raw: true`\n   * writes the token unquoted, so the same string a `cookie:<name>` source\n   * reads back is exactly what was issued, not a JSON-wrapped copy.\n   *\n   * @param token - the token string, or an `AccessTokenOutput` (e.g. from\n   *   {@link login}) whose `expiresAt` sets `Max-Age` automatically when\n   *   `options.maxAge` is not given. A bare string with no `options.maxAge`\n   *   produces a session cookie.\n   *\n   * @example\n   * const { user, tokens } = await authService.login(User, credentials);\n   * authService.setAuthCookie(response, tokens.accessToken);\n   */\n  public setAuthCookie(\n    response: Response,\n    token: string | AccessTokenOutput,\n    options: SetAuthCookieOptions = {},\n  ): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n    const tokenValue = typeof token === \"string\" ? token : token.token;\n    const maxAge = options.maxAge ?? this.cookieMaxAgeFromToken(token);\n\n    response.cookie(name, tokenValue, {\n      raw: true,\n      path,\n      ...(maxAge !== undefined ? { maxAge } : {}),\n    });\n  }\n\n  /**\n   * Clear the auth cookie {@link setAuthCookie} wrote. An explicit\n   * app-controller call — pair it with {@link logout} after the token row is\n   * revoked. `path` must match what the cookie was set with, or the browser\n   * silently ignores the clear (see `response.clearCookie`'s own doc comment).\n   *\n   * @example\n   * await authService.logout(user, accessToken, refreshToken);\n   * authService.clearAuthCookie(response);\n   */\n  public clearAuthCookie(response: Response, options: ClearAuthCookieOptions = {}): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n\n    response.clearCookie(name, { path });\n  }\n}\n\nexport const authService = new AuthService();\n"],"mappings":";;;;;;;;;;;AAyBA,IAAM,cAAN,MAAkB;;;;;;;CAOhB,IAAY,mBAAuC;EACjD,OAAO,OAAO,IAAI,0BAA0B,WAAW;CACzD;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,AAAO,wBAAwB,MAAqC;EAClE,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,YAAY,KAAK,IAAI;EACvB;CACF;;CAGA,MAAa,gBAAgB,MAA8B;EACzD,OAAO,WAAW,gBAAgB,IAAI;CACxC;CAEA,MAAc,sBAAsB,MAA2B;EAC7D,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GACnC,MAAM,IAAI,eAAe,gCAAgC;CAE7D;CAEA,MAAc,iBACZ,MACA,SAC4B;EAC5B,MAAM,OAAO,WAAW,KAAK,wBAAwB,IAAI;EAEzD,MAAM,YAAY,WAAW,YAAY,YAAY;EAErD,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM,EAAE,UAAU,CAAC;EACpD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;EAEjD,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,SAAS;EAExD,OAAO;GAAE;GAAO,WAAW,UAAU,YAAY;EAAE;CACrD;;;;;;CAOA,MAAa,oBACX,MACA,SAC4B;EAC5B,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,iBAAiB,MAAM,OAAO;CAC5C;CAEA,MAAc,kBACZ,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAKxC,MAAM,YAAY,WAAW,aAAa,YAAY;EAEtD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAEzD,MAAM,UAAU;GACd,QAAQ,KAAK;GACb,UAAU,KAAK;GACf;EACF;EAEA,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,YAAY;EAE/D,MAAM,KAAK,kBAAkB,WAAW,MAAM,WAAW,aAAa,WAAW,CAAC;EAElF,MAAM,QAAQ,MAAM,IAAI,qBAAqB,SAAS,EAAE,UAAU,CAAC;EAEnE,OAAO,KAAK,kBAAkB,MAAM,MAAM,OAAO;GAAE;GAAU;GAAW;EAAW,CAAC;CACtF;;;;;CAMA,MAAa,mBACX,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAExC,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,kBAAkB,MAAM,UAAU;CAChD;CAEA,MAAc,eAAe,MAAY,YAA6C;EACpF,MAAM,cAAc,MAAM,KAAK,iBAAiB,MAAM,YAAY,OAAO;EACzE,MAAM,eAAe,MAAM,KAAK,kBAAkB,MAAM,UAAU;EAElE,MAAM,YAAuB;GAC3B;GACA,cAAc,eACV;IACE,OAAO,aAAa,IAAI,OAAO;IAC/B,WAAW,aAAa,IAAI,YAAY;GAC1C,IACA;EACN;EAEA,WAAW,KAAK,iBAAiB,MAAM,SAAS;EAEhD,IAAI,cACF,WAAW,KAAK,mBAAmB,MAAM,cAAc,UAAU;EAGnE,OAAO;CACT;;;;CAKA,MAAa,gBAAgB,MAAY,YAA6C;EACpF,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,eAAe,MAAM,UAAU;CAC7C;;;;;;CAOA,MAAa,cACX,oBACA,YAC2B;EAC3B,IAAI;EAQJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAInB,kBAAkB;EACrB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAE5C,MAAM;EACR;EAEA,IAAI,CAAC,SAAS,OAAO;EAErB,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAEhF,IAAI,CAAC,cAAc,SAAS;GAE1B,IAAI,cACF,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAGpD,OAAO;EACT;EAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;EAEhE,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;EAGlE,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;EAEjD,IAAI,CAAC,MAAM,OAAO;EAElB,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;EAIhD,IAFwB,WAAW,aAAa,SAE9B,GAGhB;OAAI,CAAC,MAFa,aAAa,eAAe,GAEpC;IAER,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IAElD,OAAO;GACT;SAEA,MAAM,aAAa,WAAW;EAGhC,MAAM,eAAe,MAAM,KAAK,eAAe,MAAM;GACnD,GAAG;GACH,UAAU,aAAa;EACzB,CAAC;EAED,WAAW,KAAK,mBAAmB,MAAM,cAAc,YAAY;EAEnE,OAAO;CACT;;;;CAKA,MAAa,eAAe,eAAuB,gBAA0C;EAC3F,OAAO,eAAe,eAAe,cAAc;CACrD;;;;CAKA,MAAa,aAAa,UAAmC;EAC3D,OAAO,aAAa,QAAQ;CAC9B;;;;;CAMA,MAAa,aACX,OACA,MACmB;EACnB,MAAM,EAAE,UAAU,GAAG,cAAc;EAEnC,WAAW,KAAK,iBAAiB,SAAS;EAE1C,MAAM,OAAQ,MAAM,MAAM,MAAM,SAAS;EAEzC,IAAI,CAAC,MAAM;GACT,WAAW,KAAK,gBAAgB,WAAW,gBAAgB;GAE3D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE,GAAI;GACpE,WAAW,KAAK,gBAAgB,WAAW,kBAAkB;GAE7D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI;GACvC,WAAW,KAAK,gBAAgB,WAAW,4BAA4B;GAEvE,OAAO;EACT;EAEA,OAAO;CACT;;;;;CAMA,MAAa,MACX,OACA,aACA,YACgC;EAChC,MAAM,OAAO,MAAM,KAAK,aAAa,OAAO,WAAW;EAEvD,IAAI,CAAC,MACH,OAAO;EAGT,IAAI,CAAC,WAAW,aAAa,QAAQ,GAGnC,OAAO;GAAE;GAAM,QAAQ,EAAE,mBAFC,KAAK,iBAAiB,MAAM,YAAY,OAAO,EAEpC;EAAE;EAGzC,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,UAAU;EAEzD,WAAW,KAAK,iBAAiB,MAAM,QAAQ,UAAU;EAEzD,OAAO;GAAE;GAAM;EAAO;CACxB;;;;;;;;;;;CAYA,MAAa,OAAO,MAAY,aAAsB,cAAsC;EAC1F,IAAI,aACF,MAAM,KAAK,kBAAkB,MAAM,WAAW;EAGhD,IAAI,cAAc;GAChB,MAAM,QAAQ,MAAM,KAAK,kBAAkB,YAAY,MAAM,YAAY;GAEzE,IAAI,OAAO;IACT,MAAM,MAAM,OAAO;IACnB,WAAW,KAAK,qBAAqB,MAAM,KAAK;GAClD;EACF,OAAO;GAGL,IAFiB,WAAW,aAAa,mBAE9B,MAAM,SACf,MAAM,IAAI,MAAM,mCAAmC;GAGrD,MAAM,KAAK,gBAAgB,IAAI;GAC/B,WAAW,KAAK,mBAAmB,IAAI;EACzC;EAEA,WAAW,KAAK,UAAU,IAAI;CAChC;;;;CAKA,MAAa,kBAAkB,MAAY,OAA8B;EACvE,MAAM,KAAK,iBAAiB,cAAc,MAAM,KAAK;CACvD;;;;CAKA,MAAa,sBAAsB,MAA2B;EAC5D,MAAM,KAAK,iBAAiB,iBAAiB,IAAI;CACnD;;;;CAKA,MAAa,mBAAmB,MAAY,OAA8B;EACxE,MAAM,KAAK,kBAAkB,cAAc,MAAM,KAAK;CACxD;;;;;;CAOA,MAAa,gBAAgB,MAA2B;EACtD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,IAAI;EAEpE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,MAAM,KAAK;EAG9C,MAAM,KAAK,sBAAsB,IAAI;EAErC,WAAW,KAAK,cAAc,IAAI;CACpC;;;;CAKA,MAAa,kBAAkB,UAAiC;EAC9D,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;EAExE,WAAW,KAAK,uBAAuB,UAAU,aAAa;CAChE;;;;;;CAOA,MAAa,uBAAwC;EACnD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa;EAEhE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,MAAM,KAAK,iBAAiB,aAAa;EAEzC,WAAW,KAAK,qBAAqB,cAAc,MAAM;EAEzD,OAAO,cAAc;CACvB;;;;;;;;;;;CAYA,MAAa,0BAGV;EACD,OAAO;GACL,cAAc,MAAM,KAAK,iBAAiB,kBAAkB;GAC5D,eAAe,MAAM,KAAK,kBAAkB,kBAAkB;EAChE;CACF;;;;;;;;;CAUA,MAAa,2BAGV;EACD,MAAM,eAAe,MAAM,KAAK,iBAAiB,mBAAmB;EACpE,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,mBAAmB;EAKtE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,OAAO;GAAE,cAAc,aAAa;GAAQ,eAAe,cAAc;EAAO;CAClF;;;;CAKA,MAAa,kBAAkB,MAAqC;EAClE,OAAO,KAAK,kBAAkB,UAAU,IAAI;CAC9C;;;;;;CAOA,AAAQ,sBAAsB,OAAuD;EACnF,IAAI,OAAO,UAAU,UAAU,OAAO;EAEtC,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ;EAEpD,IAAI,OAAO,MAAM,SAAS,GAAG,OAAO;EAEpC,OAAO,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,KAAK,IAAI,KAAK,GAAI,CAAC;CAChE;;;;;;;;;;;;;;;;;;;;;;CAuBA,AAAO,cACL,UACA,OACA,UAAgC,CAAC,GAC3B;EACN,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;EAC7D,MAAM,SAAS,QAAQ,UAAU,KAAK,sBAAsB,KAAK;EAEjE,SAAS,OAAO,MAAM,YAAY;GAChC,KAAK;GACL;GACA,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;EAC3C,CAAC;CACH;;;;;;;;;;;CAYA,AAAO,gBAAgB,UAAoB,UAAkC,CAAC,GAAS;EACrF,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EAEpD,SAAS,YAAY,MAAM,EAAE,KAAK,CAAC;CACrC;AACF;AAEA,MAAa,cAAc,IAAI,YAAY"}
+{"version":3,"file":"auth.service.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"sourcesContent":["import { Random } from \"@mongez/reinforcements\";\nimport type { ChildModel } from \"@warlock.js/cascade\";\nimport {\n  config,\n  ForbiddenError,\n  hashPassword,\n  type Response,\n  verifyPassword,\n} from \"@warlock.js/core\";\nimport type {\n  AccessTokenOutput,\n  AuthCredentials,\n  ClearAuthCookieOptions,\n  DeviceInfo,\n  LoginResult,\n  SetAuthCookieOptions,\n  TokenPair,\n} from \"../contracts/types\";\nimport { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport { OneTimeToken } from \"../models/one-time-token\";\nimport { RefreshToken } from \"../models/refresh-token\";\nimport { authConfig } from \"./auth-config\";\nimport { authEvents } from \"./auth-events\";\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\n\nclass AuthService {\n  /**\n   * Resolve the active access-token model — the package default, or a subclass\n   * an app registered under `config.auth.accessToken.model` (e.g. to add a\n   * tenant column). The service never references the concrete class directly so\n   * an override is a pure config change.\n   */\n  private get accessTokenModel(): typeof AccessToken {\n    return config.key(\"auth.accessToken.model\", AccessToken);\n  }\n\n  /**\n   * Resolve the active refresh-token model (default or registered override).\n   */\n  private get refreshTokenModel(): typeof RefreshToken {\n    return config.key(\"auth.refreshToken.model\", RefreshToken);\n  }\n\n  /**\n   * Resolve the active one-time-token model (default or registered override).\n   */\n  private get oneTimeTokenModel(): typeof OneTimeToken {\n    return config.key(\"auth.oneTimeToken.model\", OneTimeToken);\n  }\n\n  /**\n   * Build the default access-token JWT payload from a user.\n   */\n  public buildAccessTokenPayload(user: Auth): Record<string, unknown> {\n    return {\n      id: user.id,\n      userType: user.userType,\n      created_at: Date.now(),\n    };\n  }\n\n  /** One policy seam keeps account-state checks identical across all auth paths. */\n  public async canAuthenticate(user: Auth): Promise<boolean> {\n    return authConfig.canAuthenticate(user);\n  }\n\n  private async assertCanAuthenticate(user: Auth): Promise<void> {\n    if (!(await this.canAuthenticate(user))) {\n      throw new ForbiddenError(\"This user cannot authenticate.\");\n    }\n  }\n\n  private async issueAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n  ): Promise<AccessTokenOutput> {\n    const data = payload || this.buildAccessTokenPayload(user);\n    // Validate before signing so an unusable lifetime cannot mint an immortal token.\n    const expiresIn = authConfig.accessToken.expiresInMs();\n\n    const token = await jwt.generate(data, { expiresIn });\n    const expiresAt = new Date(Date.now() + expiresIn);\n\n    await this.accessTokenModel.issue(user, token, expiresAt);\n\n    return { token, expiresAt: expiresAt.toISOString() };\n  }\n\n  /**\n   * Sign + persist an access token for the user and return the token with its\n   * expiry. The expiry is computed locally from `expiresIn` rather than by\n   * re-verifying the token we just signed.\n   */\n  public async generateAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n  ): Promise<AccessTokenOutput> {\n    await this.assertCanAuthenticate(user);\n\n    return this.issueAccessToken(user, payload);\n  }\n\n  private async issueRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    // Validate the lifetime first — before the per-user cap is enforced, before\n    // anything is signed — so a bad value can never revoke a user's oldest\n    // session on its way to failing.\n    const expiresIn = authConfig.refreshToken.expiresInMs();\n\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    const payload = {\n      userId: user.id,\n      userType: user.userType,\n      familyId,\n    };\n\n    const expiresAt = new Date(Date.now() + expiresIn).toISOString();\n\n    await this.refreshTokenModel.enforceMax(user, authConfig.refreshToken.maxPerUser());\n\n    const token = await jwt.generateRefreshToken(payload, { expiresIn });\n\n    return this.refreshTokenModel.issue(user, token, { familyId, expiresAt, deviceInfo });\n  }\n\n  /**\n   * Sign + persist a refresh token for the user (enforcing the per-user cap\n   * first). Resolves to `undefined` when refresh tokens are disabled in config.\n   */\n  public async createRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    await this.assertCanAuthenticate(user);\n\n    return this.issueRefreshToken(user, deviceInfo);\n  }\n\n  private async issueTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    const accessToken = await this.issueAccessToken(user, deviceInfo?.payload);\n    const refreshToken = await this.issueRefreshToken(user, deviceInfo);\n\n    const tokenPair: TokenPair = {\n      accessToken,\n      refreshToken: refreshToken\n        ? {\n            token: refreshToken.get(\"token\"),\n            expiresAt: refreshToken.get(\"expires_at\"),\n          }\n        : undefined,\n    };\n\n    authEvents.emit(\"token.created\", user, tokenPair);\n\n    if (refreshToken) {\n      authEvents.emit(\"session.created\", user, refreshToken, deviceInfo);\n    }\n\n    return tokenPair;\n  }\n\n  /**\n   * Issue both an access and a refresh token, emitting the creation events.\n   */\n  public async createTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    await this.assertCanAuthenticate(user);\n\n    return this.issueTokenPair(user, deviceInfo);\n  }\n\n  /**\n   * Exchange a refresh token for a new token pair, with rotation + replay\n   * detection. A concurrent reuse of the same token loses the atomic revoke and\n   * is treated as a breach — the whole family is revoked and the request fails.\n   */\n  public async refreshTokens(\n    refreshTokenString: string,\n    deviceInfo?: DeviceInfo,\n  ): Promise<TokenPair | null> {\n    let decoded: {\n      userId: number;\n      userType: string;\n      familyId: string;\n    } | null;\n\n    try {\n      decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n      }>(refreshTokenString);\n    } catch (error) {\n      if (isInvalidCredentialError(error)) return null;\n\n      throw error;\n    }\n\n    if (!decoded) return null;\n\n    const refreshToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n\n    if (!refreshToken?.isValid) {\n      // An already-invalid token may be a replay of a rotated credential.\n      if (refreshToken) {\n        await this.revokeTokenFamily(refreshToken.familyId);\n      }\n\n      return null;\n    }\n\n    const UserModel = config.key(`auth.userType.${decoded.userType}`);\n\n    if (!UserModel) {\n      throw new Error(`User type ${decoded.userType} is unknown type.`);\n    }\n\n    const user = (await UserModel.find(decoded.userId)) as Auth | null;\n\n    if (!user) return null;\n\n    if (!(await this.canAuthenticate(user))) return null;\n\n    const rotationEnabled = authConfig.refreshToken.rotation();\n\n    if (rotationEnabled) {\n      const won = await refreshToken.revokeIfActive();\n\n      if (!won) {\n        // A concurrent request already rotated this token.\n        await this.revokeTokenFamily(refreshToken.familyId);\n\n        return null;\n      }\n    } else {\n      await refreshToken.markAsUsed();\n    }\n\n    const newTokenPair = await this.issueTokenPair(user, {\n      ...deviceInfo,\n      familyId: refreshToken.familyId,\n    });\n\n    authEvents.emit(\"token.refreshed\", user, newTokenPair, refreshToken);\n\n    return newTokenPair;\n  }\n\n  /**\n   * Verify a plaintext password against a stored hash.\n   */\n  public async verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean> {\n    return verifyPassword(plainPassword, hashedPassword);\n  }\n\n  /**\n   * Hash a plaintext password.\n   */\n  public async hashPassword(password: string): Promise<string> {\n    return hashPassword(password);\n  }\n\n  /**\n   * Resolve a user by credentials, verifying the password. Returns `null` on a\n   * missing user or a wrong password, emitting `login.failed` either way.\n   */\n  public async attemptLogin<T extends Auth>(\n    Model: ChildModel<T>,\n    data: AuthCredentials,\n  ): Promise<T | null> {\n    const { password, ...otherData } = data;\n\n    authEvents.emit(\"login.attempt\", otherData);\n\n    const user = (await Model.first(otherData)) as T | null;\n\n    if (!user) {\n      authEvents.emit(\"login.failed\", otherData, \"User not found\");\n\n      return null;\n    }\n\n    if (!(await this.verifyPassword(password, user.string(\"password\")!))) {\n      authEvents.emit(\"login.failed\", otherData, \"Invalid password\");\n\n      return null;\n    }\n\n    if (!(await this.canAuthenticate(user))) {\n      authEvents.emit(\"login.failed\", otherData, \"Authentication not allowed\");\n\n      return null;\n    }\n\n    return user;\n  }\n\n  /**\n   * Full login flow: validate credentials, issue tokens, emit events. Returns\n   * the user + token pair on success, `null` on failure.\n   */\n  public async login<T extends Auth>(\n    Model: ChildModel<T>,\n    credentials: AuthCredentials,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    const user = await this.attemptLogin(Model, credentials);\n\n    if (!user) {\n      return null;\n    }\n\n    return this.finalizeLogin(user, deviceInfo);\n  }\n\n  /**\n   * Log in a user some OTHER method already authenticated — a provider\n   * callback, a passkey assertion, a one-time code. Applies the\n   * `auth.canAuthenticate` policy (403 on refusal), then produces exactly\n   * what {@link login} produces: the same tokens, rows and events. Pair with\n   * {@link setAuthCookie} for a cookie session, as with password login.\n   *\n   * Never call this for a user you have not authenticated.\n   */\n  public async completeLogin<T extends Auth>(\n    user: T,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T>> {\n    await this.assertCanAuthenticate(user);\n\n    return this.finalizeLogin(user, deviceInfo);\n  }\n\n  /** The one token-issuing tail every login method shares. */\n  private async finalizeLogin<T extends Auth>(\n    user: T,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T>> {\n    if (!authConfig.refreshToken.enabled()) {\n      const accessToken = await this.issueAccessToken(user, deviceInfo?.payload);\n\n      return { user, tokens: { accessToken } };\n    }\n\n    const tokens = await this.issueTokenPair(user, deviceInfo);\n\n    authEvents.emit(\"login.success\", user, tokens, deviceInfo);\n\n    return { user, tokens };\n  }\n\n  /**\n   * Log a user out.\n   *\n   * @param accessToken - access token string to revoke (optional)\n   * @param refreshToken - refresh token string to revoke (optional)\n   *\n   * When no refresh token is supplied, `config.auth.refreshToken.logoutWithoutToken`\n   * decides the behavior: `\"revoke-all\"` (default, fail-safe) revokes every\n   * refresh token; `\"error\"` requires the caller to pass one.\n   */\n  public async logout(user: Auth, accessToken?: string, refreshToken?: string): Promise<void> {\n    if (accessToken) {\n      await this.removeAccessToken(user, accessToken);\n    }\n\n    if (refreshToken) {\n      const token = await this.refreshTokenModel.findForUser(user, refreshToken);\n\n      if (token) {\n        await token.revoke();\n        authEvents.emit(\"session.destroyed\", user, token);\n      }\n    } else {\n      const behavior = authConfig.refreshToken.logoutWithoutToken();\n\n      if (behavior === \"error\") {\n        throw new Error(\"Refresh token required for logout\");\n      }\n\n      await this.revokeAllTokens(user);\n      authEvents.emit(\"logout.failsafe\", user);\n    }\n\n    authEvents.emit(\"logout\", user);\n  }\n\n  /**\n   * Remove a specific access token belonging to the user.\n   */\n  public async removeAccessToken(user: Auth, token: string): Promise<void> {\n    await this.accessTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Remove every access token belonging to the user.\n   */\n  public async removeAllAccessTokens(user: Auth): Promise<void> {\n    await this.accessTokenModel.deleteAllForUser(user);\n  }\n\n  /**\n   * Remove a specific refresh token belonging to the user.\n   */\n  public async removeRefreshToken(user: Auth, token: string): Promise<void> {\n    await this.refreshTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Revoke every active refresh token for the user and delete their access\n   * tokens — \"log out of all devices\". Revocation is a single bulk update; an\n   * event fires per revoked token.\n   */\n  public async revokeAllTokens(user: Auth): Promise<void> {\n    const revokedTokens = await this.refreshTokenModel.revokeAllFor(user);\n\n    for (const token of revokedTokens) {\n      authEvents.emit(\"token.revoked\", user, token);\n    }\n\n    await this.removeAllAccessTokens(user);\n\n    authEvents.emit(\"logout.all\", user);\n  }\n\n  /**\n   * Revoke an entire token family — rotation breach containment.\n   */\n  public async revokeTokenFamily(familyId: string): Promise<void> {\n    const revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\n\n    authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens);\n  }\n\n  /**\n   * Delete expired tokens (refresh + access) and spent one-time tokens\n   * (expired or consumed verification/reset/OTP/passkey rows). Emits `token.expired` per refresh\n   * token and `cleanup.completed` with the refresh count. Drives the\n   * `auth.cleanup` CLI command.\n   */\n  public async cleanupExpiredTokens(): Promise<number> {\n    const expiredTokens = await this.refreshTokenModel.purgeExpired();\n\n    for (const token of expiredTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    await this.accessTokenModel.purgeExpired();\n    await this.oneTimeTokenModel.purgeSpent();\n\n    authEvents.emit(\"cleanup.completed\", expiredTokens.length);\n\n    return expiredTokens.length;\n  }\n\n  /**\n   * Find every persisted token — access and refresh — that can never retire\n   * itself: an unusable `expires_at`, or a token carrying no `exp` claim.\n   *\n   * This is the remediation read for the pre-4.12.0 `expiresIn` defect (#25).\n   * Nothing else surfaces these rows: `auth.cleanup` selects `expires_at < now`,\n   * which an `Invalid Date` never satisfies, and a row whose date column is\n   * perfectly fine can still hold a token with no deadline in it. Read-only —\n   * pair with {@link purgeNeverExpiringTokens} to act on the answer.\n   */\n  public async findNeverExpiringTokens(): Promise<{\n    accessTokens: AccessToken[];\n    refreshTokens: RefreshToken[];\n  }> {\n    return {\n      accessTokens: await this.accessTokenModel.findNeverExpiring(),\n      refreshTokens: await this.refreshTokenModel.findNeverExpiring(),\n    };\n  }\n\n  /**\n   * Revoke every never-expiring token by deleting its row, emitting\n   * `token.revoked` per refresh token. Drives `warlock auth.purge-never-expiring`.\n   *\n   * Access tokens first: deleting one is immediate revocation, while a refresh\n   * token left in place for a moment can only mint an access token through a\n   * verifier that now rejects it for the missing `exp`.\n   */\n  public async purgeNeverExpiringTokens(): Promise<{\n    accessTokens: number;\n    refreshTokens: number;\n  }> {\n    const accessTokens = await this.accessTokenModel.purgeNeverExpiring();\n    const refreshTokens = await this.refreshTokenModel.purgeNeverExpiring();\n\n    // `token.expired` (the event `auth.cleanup` already emits for a removed\n    // refresh token) rather than `token.revoked`, which carries a loaded `Auth`\n    // this batch path has no reason to fetch a user row for.\n    for (const token of refreshTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    return { accessTokens: accessTokens.length, refreshTokens: refreshTokens.length };\n  }\n\n  /**\n   * Active, unexpired sessions for the user, newest first.\n   */\n  public async getActiveSessions(user: Auth): Promise<RefreshToken[]> {\n    return this.refreshTokenModel.activeFor(user);\n  }\n\n  /**\n   * `Max-Age` (seconds) `setAuthCookie` should apply, derived from an\n   * `AccessTokenOutput`'s `expiresAt` — or `undefined` for a bare token\n   * string (a session cookie) or an unparseable `expiresAt`.\n   */\n  private cookieMaxAgeFromToken(token: string | AccessTokenOutput): number | undefined {\n    if (typeof token === \"string\") return undefined;\n\n    const expiresAt = new Date(token.expiresAt).getTime();\n\n    if (Number.isNaN(expiresAt)) return undefined;\n\n    return Math.max(0, Math.round((expiresAt - Date.now()) / 1000));\n  }\n\n  /**\n   * Write the auth cookie on `response` — the write side of the `cookie:<name>`\n   * token source `authMiddleware([], \"cookie:<name>\")` already reads. An explicit\n   * app-controller call, never a side effect of {@link login}, so an existing\n   * bearer-only app never starts emitting `Set-Cookie` just by upgrading.\n   *\n   * Attribute flags (`HttpOnly`, `SameSite=Lax`, `Secure` outside dev) come\n   * from `response.cookie()`'s own `secureCookieDefaults()` floor — this\n   * method never overrides them, only `name`/`path`/`maxAge`. `raw: true`\n   * writes the token unquoted, so the same string a `cookie:<name>` source\n   * reads back is exactly what was issued, not a JSON-wrapped copy.\n   *\n   * @param token - the token string, or an `AccessTokenOutput` (e.g. from\n   *   {@link login}) whose `expiresAt` sets `Max-Age` automatically when\n   *   `options.maxAge` is not given. A bare string with no `options.maxAge`\n   *   produces a session cookie.\n   *\n   * @example\n   * const { user, tokens } = await authService.login(User, credentials);\n   * authService.setAuthCookie(response, tokens.accessToken);\n   */\n  public setAuthCookie(\n    response: Response,\n    token: string | AccessTokenOutput,\n    options: SetAuthCookieOptions = {},\n  ): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n    const tokenValue = typeof token === \"string\" ? token : token.token;\n    const maxAge = options.maxAge ?? this.cookieMaxAgeFromToken(token);\n\n    response.cookie(name, tokenValue, {\n      raw: true,\n      path,\n      ...(maxAge !== undefined ? { maxAge } : {}),\n    });\n  }\n\n  /**\n   * Clear the auth cookie {@link setAuthCookie} wrote. An explicit\n   * app-controller call — pair it with {@link logout} after the token row is\n   * revoked. `path` must match what the cookie was set with, or the browser\n   * silently ignores the clear (see `response.clearCookie`'s own doc comment).\n   *\n   * @example\n   * await authService.logout(user, accessToken, refreshToken);\n   * authService.clearAuthCookie(response);\n   */\n  public clearAuthCookie(response: Response, options: ClearAuthCookieOptions = {}): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n\n    response.clearCookie(name, { path });\n  }\n}\n\nexport const authService = new AuthService();\n"],"mappings":";;;;;;;;;;;;;AA0BA,IAAM,cAAN,MAAkB;;;;;;;CAOhB,IAAY,mBAAuC;EACjD,OAAO,OAAO,IAAI,0BAA0B,WAAW;CACzD;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,AAAO,wBAAwB,MAAqC;EAClE,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,YAAY,KAAK,IAAI;EACvB;CACF;;CAGA,MAAa,gBAAgB,MAA8B;EACzD,OAAO,WAAW,gBAAgB,IAAI;CACxC;CAEA,MAAc,sBAAsB,MAA2B;EAC7D,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GACnC,MAAM,IAAI,eAAe,gCAAgC;CAE7D;CAEA,MAAc,iBACZ,MACA,SAC4B;EAC5B,MAAM,OAAO,WAAW,KAAK,wBAAwB,IAAI;EAEzD,MAAM,YAAY,WAAW,YAAY,YAAY;EAErD,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM,EAAE,UAAU,CAAC;EACpD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;EAEjD,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,SAAS;EAExD,OAAO;GAAE;GAAO,WAAW,UAAU,YAAY;EAAE;CACrD;;;;;;CAOA,MAAa,oBACX,MACA,SAC4B;EAC5B,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,iBAAiB,MAAM,OAAO;CAC5C;CAEA,MAAc,kBACZ,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAKxC,MAAM,YAAY,WAAW,aAAa,YAAY;EAEtD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAEzD,MAAM,UAAU;GACd,QAAQ,KAAK;GACb,UAAU,KAAK;GACf;EACF;EAEA,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,YAAY;EAE/D,MAAM,KAAK,kBAAkB,WAAW,MAAM,WAAW,aAAa,WAAW,CAAC;EAElF,MAAM,QAAQ,MAAM,IAAI,qBAAqB,SAAS,EAAE,UAAU,CAAC;EAEnE,OAAO,KAAK,kBAAkB,MAAM,MAAM,OAAO;GAAE;GAAU;GAAW;EAAW,CAAC;CACtF;;;;;CAMA,MAAa,mBACX,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAExC,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,kBAAkB,MAAM,UAAU;CAChD;CAEA,MAAc,eAAe,MAAY,YAA6C;EACpF,MAAM,cAAc,MAAM,KAAK,iBAAiB,MAAM,YAAY,OAAO;EACzE,MAAM,eAAe,MAAM,KAAK,kBAAkB,MAAM,UAAU;EAElE,MAAM,YAAuB;GAC3B;GACA,cAAc,eACV;IACE,OAAO,aAAa,IAAI,OAAO;IAC/B,WAAW,aAAa,IAAI,YAAY;GAC1C,IACA;EACN;EAEA,WAAW,KAAK,iBAAiB,MAAM,SAAS;EAEhD,IAAI,cACF,WAAW,KAAK,mBAAmB,MAAM,cAAc,UAAU;EAGnE,OAAO;CACT;;;;CAKA,MAAa,gBAAgB,MAAY,YAA6C;EACpF,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,eAAe,MAAM,UAAU;CAC7C;;;;;;CAOA,MAAa,cACX,oBACA,YAC2B;EAC3B,IAAI;EAMJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAE5C,MAAM;EACR;EAEA,IAAI,CAAC,SAAS,OAAO;EAErB,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAEhF,IAAI,CAAC,cAAc,SAAS;GAE1B,IAAI,cACF,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAGpD,OAAO;EACT;EAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;EAEhE,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;EAGlE,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;EAEjD,IAAI,CAAC,MAAM,OAAO;EAElB,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;EAIhD,IAFwB,WAAW,aAAa,SAE9B,GAGhB;OAAI,CAAC,MAFa,aAAa,eAAe,GAEpC;IAER,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IAElD,OAAO;GACT;SAEA,MAAM,aAAa,WAAW;EAGhC,MAAM,eAAe,MAAM,KAAK,eAAe,MAAM;GACnD,GAAG;GACH,UAAU,aAAa;EACzB,CAAC;EAED,WAAW,KAAK,mBAAmB,MAAM,cAAc,YAAY;EAEnE,OAAO;CACT;;;;CAKA,MAAa,eAAe,eAAuB,gBAA0C;EAC3F,OAAO,eAAe,eAAe,cAAc;CACrD;;;;CAKA,MAAa,aAAa,UAAmC;EAC3D,OAAO,aAAa,QAAQ;CAC9B;;;;;CAMA,MAAa,aACX,OACA,MACmB;EACnB,MAAM,EAAE,UAAU,GAAG,cAAc;EAEnC,WAAW,KAAK,iBAAiB,SAAS;EAE1C,MAAM,OAAQ,MAAM,MAAM,MAAM,SAAS;EAEzC,IAAI,CAAC,MAAM;GACT,WAAW,KAAK,gBAAgB,WAAW,gBAAgB;GAE3D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE,GAAI;GACpE,WAAW,KAAK,gBAAgB,WAAW,kBAAkB;GAE7D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI;GACvC,WAAW,KAAK,gBAAgB,WAAW,4BAA4B;GAEvE,OAAO;EACT;EAEA,OAAO;CACT;;;;;CAMA,MAAa,MACX,OACA,aACA,YACgC;EAChC,MAAM,OAAO,MAAM,KAAK,aAAa,OAAO,WAAW;EAEvD,IAAI,CAAC,MACH,OAAO;EAGT,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;;;CAWA,MAAa,cACX,MACA,YACyB;EACzB,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;CAGA,MAAc,cACZ,MACA,YACyB;EACzB,IAAI,CAAC,WAAW,aAAa,QAAQ,GAGnC,OAAO;GAAE;GAAM,QAAQ,EAAE,mBAFC,KAAK,iBAAiB,MAAM,YAAY,OAAO,EAEpC;EAAE;EAGzC,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,UAAU;EAEzD,WAAW,KAAK,iBAAiB,MAAM,QAAQ,UAAU;EAEzD,OAAO;GAAE;GAAM;EAAO;CACxB;;;;;;;;;;;CAYA,MAAa,OAAO,MAAY,aAAsB,cAAsC;EAC1F,IAAI,aACF,MAAM,KAAK,kBAAkB,MAAM,WAAW;EAGhD,IAAI,cAAc;GAChB,MAAM,QAAQ,MAAM,KAAK,kBAAkB,YAAY,MAAM,YAAY;GAEzE,IAAI,OAAO;IACT,MAAM,MAAM,OAAO;IACnB,WAAW,KAAK,qBAAqB,MAAM,KAAK;GAClD;EACF,OAAO;GAGL,IAFiB,WAAW,aAAa,mBAE9B,MAAM,SACf,MAAM,IAAI,MAAM,mCAAmC;GAGrD,MAAM,KAAK,gBAAgB,IAAI;GAC/B,WAAW,KAAK,mBAAmB,IAAI;EACzC;EAEA,WAAW,KAAK,UAAU,IAAI;CAChC;;;;CAKA,MAAa,kBAAkB,MAAY,OAA8B;EACvE,MAAM,KAAK,iBAAiB,cAAc,MAAM,KAAK;CACvD;;;;CAKA,MAAa,sBAAsB,MAA2B;EAC5D,MAAM,KAAK,iBAAiB,iBAAiB,IAAI;CACnD;;;;CAKA,MAAa,mBAAmB,MAAY,OAA8B;EACxE,MAAM,KAAK,kBAAkB,cAAc,MAAM,KAAK;CACxD;;;;;;CAOA,MAAa,gBAAgB,MAA2B;EACtD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,IAAI;EAEpE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,MAAM,KAAK;EAG9C,MAAM,KAAK,sBAAsB,IAAI;EAErC,WAAW,KAAK,cAAc,IAAI;CACpC;;;;CAKA,MAAa,kBAAkB,UAAiC;EAC9D,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;EAExE,WAAW,KAAK,uBAAuB,UAAU,aAAa;CAChE;;;;;;;CAQA,MAAa,uBAAwC;EACnD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa;EAEhE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,MAAM,KAAK,iBAAiB,aAAa;EACzC,MAAM,KAAK,kBAAkB,WAAW;EAExC,WAAW,KAAK,qBAAqB,cAAc,MAAM;EAEzD,OAAO,cAAc;CACvB;;;;;;;;;;;CAYA,MAAa,0BAGV;EACD,OAAO;GACL,cAAc,MAAM,KAAK,iBAAiB,kBAAkB;GAC5D,eAAe,MAAM,KAAK,kBAAkB,kBAAkB;EAChE;CACF;;;;;;;;;CAUA,MAAa,2BAGV;EACD,MAAM,eAAe,MAAM,KAAK,iBAAiB,mBAAmB;EACpE,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,mBAAmB;EAKtE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,OAAO;GAAE,cAAc,aAAa;GAAQ,eAAe,cAAc;EAAO;CAClF;;;;CAKA,MAAa,kBAAkB,MAAqC;EAClE,OAAO,KAAK,kBAAkB,UAAU,IAAI;CAC9C;;;;;;CAOA,AAAQ,sBAAsB,OAAuD;EACnF,IAAI,OAAO,UAAU,UAAU,OAAO;EAEtC,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ;EAEpD,IAAI,OAAO,MAAM,SAAS,GAAG,OAAO;EAEpC,OAAO,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,KAAK,IAAI,KAAK,GAAI,CAAC;CAChE;;;;;;;;;;;;;;;;;;;;;;CAuBA,AAAO,cACL,UACA,OACA,UAAgC,CAAC,GAC3B;EACN,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;EAC7D,MAAM,SAAS,QAAQ,UAAU,KAAK,sBAAsB,KAAK;EAEjE,SAAS,OAAO,MAAM,YAAY;GAChC,KAAK;GACL;GACA,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;EAC3C,CAAC;CACH;;;;;;;;;;;CAYA,AAAO,gBAAgB,UAAoB,UAAkC,CAAC,GAAS;EACrF,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EAEpD,SAAS,YAAY,MAAM,EAAE,KAAK,CAAC;CACrC;AACF;AAEA,MAAa,cAAc,IAAI,YAAY"}

package/esm/services/email-verification.d.mts

@@ -0,0 +1,35 @@
+import { Auth } from "../models/auth.model.mjs";
+
+//#region ../auth/src/services/email-verification.d.ts
+/**
+ * Whether the user has verified their email — the configured
+ * `auth.verification.field` (default `emailVerifiedAt`) holds a value.
+ */
+declare function isEmailVerified(user: Pick<Auth, "get">): boolean;
+/**
+ * Issue an email-verification token for the user and send it through the
+ * verification notification (`auth.verification.notification`, else auth's
+ * default mail). Earlier verification links keep working until they expire or
+ * one of them is used.
+ *
+ * @throws NotificationsUnavailableError before any token is issued when
+ *   `@warlock.js/notifications` is not installed or not configured.
+ *
+ * @example
+ * const user = await User.create(data);
+ * await sendEmailVerification(user);
+ */
+declare function sendEmailVerification(user: Auth): Promise<void>;
+/**
+ * Consume a verification token and stamp the user's verified field with the
+ * current date. Resolves to the verified user.
+ *
+ * @throws InvalidOneTimeTokenError for an unknown, reset-purpose, expired or
+ *   already-used token.
+ * @throws Error when the save did not keep the field — the user schema must
+ *   declare it (e.g. `emailVerifiedAt: v.date().optional()`).
+ */
+declare function verifyEmail(token: string): Promise<Auth>;
+//#endregion
+export { isEmailVerified, sendEmailVerification, verifyEmail };
+//# sourceMappingURL=email-verification.d.mts.map

package/esm/services/email-verification.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.d.mts","names":[],"sources":["../../../../../../../auth/src/services/email-verification.ts"],"mappings":";;;;;AASA;;iBAAgB,eAAA,CAAgB,IAAA,EAAM,IAAI,CAAC,IAAA;;;;;;AAAY;AAiBvD;;;;;;;iBAAsB,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAO;AAAA;AAuBhE;;;;;;;;AAvBgE,iBAuB1C,WAAA,CAAY,KAAA,WAAgB,OAAO,CAAC,IAAA"}

package/esm/services/email-verification.mjs

@@ -0,0 +1,55 @@
+import { authConfig } from "./auth-config.mjs";
+import { consumeOneTimeToken, issueOneTimeToken } from "./one-time-tokens.mjs";
+import { resolveTokenNotification } from "./token-notifications.mjs";
+
+//#region ../auth/src/services/email-verification.ts
+/**
+* Whether the user has verified their email — the configured
+* `auth.verification.field` (default `emailVerifiedAt`) holds a value.
+*/
+function isEmailVerified(user) {
+	return !!user.get(authConfig.verification.field());
+}
+/**
+* Issue an email-verification token for the user and send it through the
+* verification notification (`auth.verification.notification`, else auth's
+* default mail). Earlier verification links keep working until they expire or
+* one of them is used.
+*
+* @throws NotificationsUnavailableError before any token is issued when
+*   `@warlock.js/notifications` is not installed or not configured.
+*
+* @example
+* const user = await User.create(data);
+* await sendEmailVerification(user);
+*/
+async function sendEmailVerification(user) {
+	const notification = await resolveTokenNotification("email-verification");
+	const { token, expiresAt } = await issueOneTimeToken(user, "email-verification", authConfig.verification.expiresInMs());
+	const url = authConfig.verification.url()?.(token, user);
+	await notification.send(user, {
+		token,
+		expiresAt,
+		...url ? { url } : {}
+	});
+}
+/**
+* Consume a verification token and stamp the user's verified field with the
+* current date. Resolves to the verified user.
+*
+* @throws InvalidOneTimeTokenError for an unknown, reset-purpose, expired or
+*   already-used token.
+* @throws Error when the save did not keep the field — the user schema must
+*   declare it (e.g. `emailVerifiedAt: v.date().optional()`).
+*/
+async function verifyEmail(token) {
+	const user = await consumeOneTimeToken(token, "email-verification");
+	const field = authConfig.verification.field();
+	await user.merge({ [field]: /* @__PURE__ */ new Date() }).save();
+	if (!isEmailVerified(user)) throw new Error(`@warlock.js/auth: verifyEmail could not persist "${field}" on the user — declare it in the user schema (e.g. \`${field}: v.date().optional()\`) or set \`auth.verification.field\` to an existing attribute.`);
+	return user;
+}
+
+//#endregion
+export { isEmailVerified, sendEmailVerification, verifyEmail };
+//# sourceMappingURL=email-verification.mjs.map

package/esm/services/email-verification.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-verification.mjs","names":[],"sources":["../../../../../../../auth/src/services/email-verification.ts"],"sourcesContent":["import type { Auth } from \"../models/auth.model\";\nimport { authConfig } from \"./auth-config\";\nimport { consumeOneTimeToken, issueOneTimeToken } from \"./one-time-tokens\";\nimport { resolveTokenNotification } from \"./token-notifications\";\n\n/**\n * Whether the user has verified their email — the configured\n * `auth.verification.field` (default `emailVerifiedAt`) holds a value.\n */\nexport function isEmailVerified(user: Pick<Auth, \"get\">): boolean {\n  return !!user.get(authConfig.verification.field());\n}\n\n/**\n * Issue an email-verification token for the user and send it through the\n * verification notification (`auth.verification.notification`, else auth's\n * default mail). Earlier verification links keep working until they expire or\n * one of them is used.\n *\n * @throws NotificationsUnavailableError before any token is issued when\n *   `@warlock.js/notifications` is not installed or not configured.\n *\n * @example\n * const user = await User.create(data);\n * await sendEmailVerification(user);\n */\nexport async function sendEmailVerification(user: Auth): Promise<void> {\n  const notification = await resolveTokenNotification(\"email-verification\");\n\n  const { token, expiresAt } = await issueOneTimeToken(\n    user,\n    \"email-verification\",\n    authConfig.verification.expiresInMs(),\n  );\n\n  const url = authConfig.verification.url()?.(token, user);\n\n  await notification.send(user, { token, expiresAt, ...(url ? { url } : {}) });\n}\n\n/**\n * Consume a verification token and stamp the user's verified field with the\n * current date. Resolves to the verified user.\n *\n * @throws InvalidOneTimeTokenError for an unknown, reset-purpose, expired or\n *   already-used token.\n * @throws Error when the save did not keep the field — the user schema must\n *   declare it (e.g. `emailVerifiedAt: v.date().optional()`).\n */\nexport async function verifyEmail(token: string): Promise<Auth> {\n  const user = await consumeOneTimeToken(token, \"email-verification\");\n  const field = authConfig.verification.field();\n\n  await user.merge({ [field]: new Date() } as never).save();\n\n  if (!isEmailVerified(user)) {\n    throw new Error(\n      `@warlock.js/auth: verifyEmail could not persist \"${field}\" on the user — ` +\n        `declare it in the user schema (e.g. \\`${field}: v.date().optional()\\`) ` +\n        \"or set `auth.verification.field` to an existing attribute.\",\n    );\n  }\n\n  return user;\n}\n"],"mappings":";;;;;;;;;AASA,SAAgB,gBAAgB,MAAkC;CAChE,OAAO,CAAC,CAAC,KAAK,IAAI,WAAW,aAAa,MAAM,CAAC;AACnD;;;;;;;;;;;;;;AAeA,eAAsB,sBAAsB,MAA2B;CACrE,MAAM,eAAe,MAAM,yBAAyB,oBAAoB;CAExE,MAAM,EAAE,OAAO,cAAc,MAAM,kBACjC,MACA,sBACA,WAAW,aAAa,YAAY,CACtC;CAEA,MAAM,MAAM,WAAW,aAAa,IAAI,CAAC,GAAG,OAAO,IAAI;CAEvD,MAAM,aAAa,KAAK,MAAM;EAAE;EAAO;EAAW,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;CAAG,CAAC;AAC7E;;;;;;;;;;AAWA,eAAsB,YAAY,OAA8B;CAC9D,MAAM,OAAO,MAAM,oBAAoB,OAAO,oBAAoB;CAClE,MAAM,QAAQ,WAAW,aAAa,MAAM;CAE5C,MAAM,KAAK,MAAM,GAAG,wBAAQ,IAAI,KAAK,EAAE,CAAU,CAAC,CAAC,KAAK;CAExD,IAAI,CAAC,gBAAgB,IAAI,GACvB,MAAM,IAAI,MACR,oDAAoD,MAAM,wDACf,MAAM,sFAEnD;CAGF,OAAO;AACT"}

package/esm/services/index.d.mts

@@ -2,4 +2,7 @@ import { AuthEventCallback, AuthEventName, AuthEventPayloads, authEvents } from
 import { authService } from "./auth.service.mjs";
 import { currentUser } from "./current-user.mjs";
 import { generateJWTSecret } from "./generate-jwt-secret.mjs";
-import { TokenType, TokenTypeError, isInvalidCredentialError, jwt } from "./jwt.mjs";
+import { TokenType, TokenTypeError, isInvalidCredentialError, jwt } from "./jwt.mjs";
+import { isEmailVerified, sendEmailVerification, verifyEmail } from "./email-verification.mjs";
+import { IssuedOneTimeToken, consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel } from "./one-time-tokens.mjs";
+import { requestPasswordReset, resetPassword } from "./password-reset.mjs";

package/esm/services/index.mjs

@@ -3,5 +3,8 @@ import { TokenTypeError, isInvalidCredentialError, jwt } from "./jwt.mjs";
 import { authService } from "./auth.service.mjs";
 import { generateJWTSecret } from "./generate-jwt-secret.mjs";
 import { currentUser } from "./current-user.mjs";
+import { consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel } from "./one-time-tokens.mjs";
+import { isEmailVerified, sendEmailVerification, verifyEmail } from "./email-verification.mjs";
+import { requestPasswordReset, resetPassword } from "./password-reset.mjs";
 
 export {  };

package/esm/services/one-time-tokens.d.mts

@@ -0,0 +1,32 @@
+import { Auth } from "../models/auth.model.mjs";
+import { OneTimeToken, OneTimeTokenPurpose } from "../models/one-time-token/one-time-token.model.mjs";
+//#region ../auth/src/services/one-time-tokens.d.ts
+/** The raw token handed to the notification, with its expiry. */
+type IssuedOneTimeToken = {
+  token: string;
+  expiresAt: Date;
+};
+/** Resolve the active one-time-token model — the default or `auth.oneTimeToken.model`. */
+declare function oneTimeTokenModel(): typeof OneTimeToken;
+/** SHA-256 hex digest of a raw one-time token — the only form ever persisted. */
+declare function hashOneTimeToken(token: string): string;
+/**
+ * Create and persist a one-time token for the user: 32 random bytes,
+ * base64url-encoded. Only the hash reaches storage.
+ *
+ * @param invalidatePrevious - consume the user's still-unused tokens of the
+ *   same purpose first (password reset: only the newest link works).
+ */
+declare function issueOneTimeToken(user: Auth, purpose: OneTimeTokenPurpose, expiresInMs: number, invalidatePrevious?: boolean): Promise<IssuedOneTimeToken>;
+/**
+ * Consume a raw one-time token of the given purpose and resolve its user.
+ *
+ * Unknown, other-purpose, expired, already-consumed, lost-the-race and
+ * orphaned (user gone) tokens all throw the same {@link InvalidOneTimeTokenError}.
+ * The consume is a conditional update, so of N concurrent callers exactly one
+ * proceeds.
+ */
+declare function consumeOneTimeToken(rawToken: string, purpose: OneTimeTokenPurpose): Promise<Auth>;
+//#endregion
+export { IssuedOneTimeToken, consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel };
+//# sourceMappingURL=one-time-tokens.d.mts.map

package/esm/services/one-time-tokens.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-tokens.d.mts","names":[],"sources":["../../../../../../../auth/src/services/one-time-tokens.ts"],"mappings":";;;;KAOY,kBAAA;EACV,KAAA;EACA,SAAA,EAAW,IAAI;AAAA;;iBAID,iBAAA,WAA4B,YAAY;;iBAKxC,gBAAA,CAAiB,KAAa;;;AAT7B;AAIjB;;;;iBAgBsB,iBAAA,CACpB,IAAA,EAAM,IAAA,EACN,OAAA,EAAS,mBAAA,EACT,WAAA,UACA,kBAAA,aACC,OAAA,CAAQ,kBAAA;AAhBX;;;;AAA8C;AAW9C;;;AAXA,iBAuCsB,mBAAA,CACpB,QAAA,UACA,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,IAAA"}

package/esm/services/one-time-tokens.mjs

@@ -0,0 +1,56 @@
+import { OneTimeToken } from "../models/one-time-token/one-time-token.model.mjs";
+import "../models/one-time-token/index.mjs";
+import { InvalidOneTimeTokenError } from "../errors/invalid-one-time-token.error.mjs";
+import { config } from "@warlock.js/core";
+import { createHash, randomBytes } from "node:crypto";
+
+//#region ../auth/src/services/one-time-tokens.ts
+/** Resolve the active one-time-token model — the default or `auth.oneTimeToken.model`. */
+function oneTimeTokenModel() {
+	return config.key("auth.oneTimeToken.model", OneTimeToken);
+}
+/** SHA-256 hex digest of a raw one-time token — the only form ever persisted. */
+function hashOneTimeToken(token) {
+	return createHash("sha256").update(token).digest("hex");
+}
+/**
+* Create and persist a one-time token for the user: 32 random bytes,
+* base64url-encoded. Only the hash reaches storage.
+*
+* @param invalidatePrevious - consume the user's still-unused tokens of the
+*   same purpose first (password reset: only the newest link works).
+*/
+async function issueOneTimeToken(user, purpose, expiresInMs, invalidatePrevious = false) {
+	const Model = oneTimeTokenModel();
+	if (invalidatePrevious) await Model.invalidateActiveFor(user, purpose);
+	const token = randomBytes(32).toString("base64url");
+	const expiresAt = new Date(Date.now() + expiresInMs);
+	await Model.issue(user, purpose, hashOneTimeToken(token), expiresAt);
+	return {
+		token,
+		expiresAt
+	};
+}
+/**
+* Consume a raw one-time token of the given purpose and resolve its user.
+*
+* Unknown, other-purpose, expired, already-consumed, lost-the-race and
+* orphaned (user gone) tokens all throw the same {@link InvalidOneTimeTokenError}.
+* The consume is a conditional update, so of N concurrent callers exactly one
+* proceeds.
+*/
+async function consumeOneTimeToken(rawToken, purpose) {
+	if (typeof rawToken !== "string" || rawToken.length === 0) throw new InvalidOneTimeTokenError();
+	const row = await oneTimeTokenModel().findByHash(hashOneTimeToken(rawToken), purpose);
+	if (!row || row.isConsumed || row.isExpired) throw new InvalidOneTimeTokenError();
+	const UserModel = config.key(`auth.userType.${row.userType}`);
+	if (!UserModel) throw new Error(`User type ${row.userType} is unknown type.`);
+	const user = await UserModel.find(row.userId);
+	if (!user) throw new InvalidOneTimeTokenError();
+	if (!await row.consumeIfActive()) throw new InvalidOneTimeTokenError();
+	return user;
+}
+
+//#endregion
+export { consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel };
+//# sourceMappingURL=one-time-tokens.mjs.map

package/esm/services/one-time-tokens.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-time-tokens.mjs","names":[],"sources":["../../../../../../../auth/src/services/one-time-tokens.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\nimport { createHash, randomBytes } from \"node:crypto\";\nimport { InvalidOneTimeTokenError } from \"../errors/invalid-one-time-token.error\";\nimport type { Auth } from \"../models/auth.model\";\nimport { OneTimeToken, type OneTimeTokenPurpose } from \"../models/one-time-token\";\n\n/** The raw token handed to the notification, with its expiry. */\nexport type IssuedOneTimeToken = {\n  token: string;\n  expiresAt: Date;\n};\n\n/** Resolve the active one-time-token model — the default or `auth.oneTimeToken.model`. */\nexport function oneTimeTokenModel(): typeof OneTimeToken {\n  return config.key(\"auth.oneTimeToken.model\", OneTimeToken);\n}\n\n/** SHA-256 hex digest of a raw one-time token — the only form ever persisted. */\nexport function hashOneTimeToken(token: string): string {\n  return createHash(\"sha256\").update(token).digest(\"hex\");\n}\n\n/**\n * Create and persist a one-time token for the user: 32 random bytes,\n * base64url-encoded. Only the hash reaches storage.\n *\n * @param invalidatePrevious - consume the user's still-unused tokens of the\n *   same purpose first (password reset: only the newest link works).\n */\nexport async function issueOneTimeToken(\n  user: Auth,\n  purpose: OneTimeTokenPurpose,\n  expiresInMs: number,\n  invalidatePrevious = false,\n): Promise<IssuedOneTimeToken> {\n  const Model = oneTimeTokenModel();\n\n  if (invalidatePrevious) {\n    await Model.invalidateActiveFor(user, purpose);\n  }\n\n  const token = randomBytes(32).toString(\"base64url\");\n  const expiresAt = new Date(Date.now() + expiresInMs);\n\n  await Model.issue(user, purpose, hashOneTimeToken(token), expiresAt);\n\n  return { token, expiresAt };\n}\n\n/**\n * Consume a raw one-time token of the given purpose and resolve its user.\n *\n * Unknown, other-purpose, expired, already-consumed, lost-the-race and\n * orphaned (user gone) tokens all throw the same {@link InvalidOneTimeTokenError}.\n * The consume is a conditional update, so of N concurrent callers exactly one\n * proceeds.\n */\nexport async function consumeOneTimeToken(\n  rawToken: string,\n  purpose: OneTimeTokenPurpose,\n): Promise<Auth> {\n  if (typeof rawToken !== \"string\" || rawToken.length === 0) {\n    throw new InvalidOneTimeTokenError();\n  }\n\n  const row = await oneTimeTokenModel().findByHash(hashOneTimeToken(rawToken), purpose);\n\n  if (!row || row.isConsumed || row.isExpired) {\n    throw new InvalidOneTimeTokenError();\n  }\n\n  const UserModel = config.key(`auth.userType.${row.userType}`);\n\n  if (!UserModel) {\n    throw new Error(`User type ${row.userType} is unknown type.`);\n  }\n\n  const user = (await UserModel.find(row.userId)) as Auth | null;\n\n  if (!user) {\n    throw new InvalidOneTimeTokenError();\n  }\n\n  if (!(await row.consumeIfActive())) {\n    throw new InvalidOneTimeTokenError();\n  }\n\n  return user;\n}\n"],"mappings":";;;;;;;;AAaA,SAAgB,oBAAyC;CACvD,OAAO,OAAO,IAAI,2BAA2B,YAAY;AAC3D;;AAGA,SAAgB,iBAAiB,OAAuB;CACtD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AACxD;;;;;;;;AASA,eAAsB,kBACpB,MACA,SACA,aACA,qBAAqB,OACQ;CAC7B,MAAM,QAAQ,kBAAkB;CAEhC,IAAI,oBACF,MAAM,MAAM,oBAAoB,MAAM,OAAO;CAG/C,MAAM,QAAQ,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CAClD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW;CAEnD,MAAM,MAAM,MAAM,MAAM,SAAS,iBAAiB,KAAK,GAAG,SAAS;CAEnE,OAAO;EAAE;EAAO;CAAU;AAC5B;;;;;;;;;AAUA,eAAsB,oBACpB,UACA,SACe;CACf,IAAI,OAAO,aAAa,YAAY,SAAS,WAAW,GACtD,MAAM,IAAI,yBAAyB;CAGrC,MAAM,MAAM,MAAM,kBAAkB,CAAC,CAAC,WAAW,iBAAiB,QAAQ,GAAG,OAAO;CAEpF,IAAI,CAAC,OAAO,IAAI,cAAc,IAAI,WAChC,MAAM,IAAI,yBAAyB;CAGrC,MAAM,YAAY,OAAO,IAAI,iBAAiB,IAAI,UAAU;CAE5D,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,aAAa,IAAI,SAAS,kBAAkB;CAG9D,MAAM,OAAQ,MAAM,UAAU,KAAK,IAAI,MAAM;CAE7C,IAAI,CAAC,MACH,MAAM,IAAI,yBAAyB;CAGrC,IAAI,CAAE,MAAM,IAAI,gBAAgB,GAC9B,MAAM,IAAI,yBAAyB;CAGrC,OAAO;AACT"}

package/esm/services/optional-peer.mjs

@@ -0,0 +1,37 @@
+import { AuthProviderSdkMissingError } from "../errors/auth-provider-sdk-missing.error.mjs";
+
+//#region ../auth/src/services/optional-peer.ts
+/**
+* Whether `error` (or an error it wraps as `cause`) is the resolver reporting
+* that `packageName` ITSELF is absent. A missing transitive dependency names
+* a different package and is not treated as "not installed".
+*/
+function isPackageMissing(error, packageName) {
+	for (let current = error, depth = 0; current && depth < 5; depth++) {
+		const { code, message } = current;
+		if ((code === "ERR_MODULE_NOT_FOUND" || code === "MODULE_NOT_FOUND") && typeof message === "string" && message.includes(`'${packageName}'`)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+/**
+* Load an optional vendor SDK lazily. The specifier reaches `import()` as a
+* variable, so neither the type-checker nor a bundler ever requires the peer;
+* nothing is loaded until a login method actually runs.
+*
+* @param packageName - the optional peer, e.g. `"jose"`.
+* @param feature - the `warlock add` feature that installs it, e.g. `"auth-google"`.
+* @throws AuthProviderSdkMissingError when the package is not installed.
+*/
+async function loadOptionalPeer(packageName, feature) {
+	try {
+		return await import(packageName);
+	} catch (error) {
+		if (isPackageMissing(error, packageName)) throw new AuthProviderSdkMissingError(packageName, feature, error);
+		throw error;
+	}
+}
+
+//#endregion
+export { loadOptionalPeer };
+//# sourceMappingURL=optional-peer.mjs.map

package/esm/services/optional-peer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"optional-peer.mjs","names":[],"sources":["../../../../../../../auth/src/services/optional-peer.ts"],"sourcesContent":["import { AuthProviderSdkMissingError } from \"../errors/auth-provider-sdk-missing.error\";\n\n/**\n * Whether `error` (or an error it wraps as `cause`) is the resolver reporting\n * that `packageName` ITSELF is absent. A missing transitive dependency names\n * a different package and is not treated as \"not installed\".\n */\nfunction isPackageMissing(error: unknown, packageName: string): boolean {\n  for (let current = error, depth = 0; current && depth < 5; depth++) {\n    const { code, message } = current as { code?: unknown; message?: unknown };\n\n    if (\n      (code === \"ERR_MODULE_NOT_FOUND\" || code === \"MODULE_NOT_FOUND\") &&\n      typeof message === \"string\" &&\n      message.includes(`'${packageName}'`)\n    ) {\n      return true;\n    }\n\n    current = (current as { cause?: unknown }).cause;\n  }\n\n  return false;\n}\n\n/**\n * Load an optional vendor SDK lazily. The specifier reaches `import()` as a\n * variable, so neither the type-checker nor a bundler ever requires the peer;\n * nothing is loaded until a login method actually runs.\n *\n * @param packageName - the optional peer, e.g. `\"jose\"`.\n * @param feature - the `warlock add` feature that installs it, e.g. `\"auth-google\"`.\n * @throws AuthProviderSdkMissingError when the package is not installed.\n */\nexport async function loadOptionalPeer<TModule extends object>(\n  packageName: string,\n  feature: string,\n): Promise<TModule> {\n  try {\n    return (await import(packageName)) as TModule;\n  } catch (error) {\n    if (isPackageMissing(error, packageName)) {\n      throw new AuthProviderSdkMissingError(packageName, feature, error);\n    }\n\n    throw error;\n  }\n}\n"],"mappings":";;;;;;;;AAOA,SAAS,iBAAiB,OAAgB,aAA8B;CACtE,KAAK,IAAI,UAAU,OAAO,QAAQ,GAAG,WAAW,QAAQ,GAAG,SAAS;EAClE,MAAM,EAAE,MAAM,YAAY;EAE1B,KACG,SAAS,0BAA0B,SAAS,uBAC7C,OAAO,YAAY,YACnB,QAAQ,SAAS,IAAI,YAAY,EAAE,GAEnC,OAAO;EAGT,UAAW,QAAgC;CAC7C;CAEA,OAAO;AACT;;;;;;;;;;AAWA,eAAsB,iBACpB,aACA,SACkB;CAClB,IAAI;EACF,OAAQ,MAAM,OAAO;CACvB,SAAS,OAAO;EACd,IAAI,iBAAiB,OAAO,WAAW,GACrC,MAAM,IAAI,4BAA4B,aAAa,SAAS,KAAK;EAGnE,MAAM;CACR;AACF"}

package/esm/services/password-reset.d.mts

@@ -0,0 +1,34 @@
+import { Auth } from "../models/auth.model.mjs";
+import { ChildModel } from "@warlock.js/cascade";
+
+//#region ../auth/src/services/password-reset.d.ts
+/**
+ * Start a password reset for the account whose `auth.passwordReset.identifierField`
+ * (default `email`) equals `identifier`: invalidate the account's unused reset
+ * tokens, issue a new one, and send it through the reset notification.
+ *
+ * **Anti-enumeration:** resolves `undefined` whether or not the account exists
+ * — an unknown identifier simply sends nothing. Notification availability is
+ * checked before the lookup, so a misconfigured app fails identically for both.
+ *
+ * @throws NotificationsUnavailableError when `@warlock.js/notifications` is not installed or not configured.
+ *
+ * @example
+ * await requestPasswordReset(User, request.input("email"));
+ * return response.success({ message: "If the account exists, we sent a reset link." });
+ */
+declare function requestPasswordReset<T extends Auth>(Model: ChildModel<T>, identifier: string): Promise<void>;
+/**
+ * Complete a password reset: consume the token, store the new password, then
+ * revoke every access token, refresh token and cookie session the user holds
+ * (`authService.revokeAllTokens`). Resolves to the user.
+ *
+ * Validate password strength BEFORE calling this — the token is consumed first.
+ *
+ * @throws InvalidOneTimeTokenError for an unknown, verification-purpose,
+ *   expired, superseded or already-used token.
+ */
+declare function resetPassword(token: string, newPassword: string): Promise<Auth>;
+//#endregion
+export { requestPasswordReset, resetPassword };
+//# sourceMappingURL=password-reset.d.mts.map

package/esm/services/password-reset.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.d.mts","names":[],"sources":["../../../../../../../auth/src/services/password-reset.ts"],"mappings":";;;;;;AAwDA;;;;;;;;;;;;;iBAAsB,oBAAA,WAA+B,IAAA,EACnD,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,UAAA,WACC,OAAA;;;;AAAO;AAmCV;;;;;;iBAAsB,aAAA,CAAc,KAAA,UAAe,WAAA,WAAsB,OAAO,CAAC,IAAA"}

package/esm/services/password-reset.mjs

@@ -0,0 +1,81 @@
+import { authConfig } from "./auth-config.mjs";
+import { authEvents } from "./auth-events.mjs";
+import { authService } from "./auth.service.mjs";
+import { consumeOneTimeToken, issueOneTimeToken } from "./one-time-tokens.mjs";
+import { resolveTokenNotification } from "./token-notifications.mjs";
+
+//#region ../auth/src/services/password-reset.ts
+/**
+* Default password writer. Login verifies with `authService.verifyPassword`,
+* so that is the authority on what "stored correctly" means:
+*
+* 1. Save `hashPassword(plain)` — right for a model that stores what it's given.
+* 2. If that no longer verifies, the model hashed on save (core's
+*    `useHashedPassword()`), double-hashing it: save the plaintext so the
+*    model's own transformer hashes it once.
+* 3. Still not verifiable ⇒ throw. Never leave a reset that "succeeded" with a
+*    password nobody can log in with.
+*
+* The first write is always a hash, so a model without a transformer never
+* has plaintext written.
+*/
+async function writePassword(user, plainPassword) {
+	await user.merge({ password: await authService.hashPassword(plainPassword) }).save();
+	if (await authService.verifyPassword(plainPassword, user.string("password") ?? "")) return;
+	await user.merge({ password: plainPassword }).save();
+	const stored = user.string("password") ?? "";
+	if (stored !== plainPassword && await authService.verifyPassword(plainPassword, stored)) return;
+	throw new Error("@warlock.js/auth: resetPassword could not store a password that verifies — set `auth.passwordReset.setPassword` to write it the way your user model expects.");
+}
+/**
+* Start a password reset for the account whose `auth.passwordReset.identifierField`
+* (default `email`) equals `identifier`: invalidate the account's unused reset
+* tokens, issue a new one, and send it through the reset notification.
+*
+* **Anti-enumeration:** resolves `undefined` whether or not the account exists
+* — an unknown identifier simply sends nothing. Notification availability is
+* checked before the lookup, so a misconfigured app fails identically for both.
+*
+* @throws NotificationsUnavailableError when `@warlock.js/notifications` is not installed or not configured.
+*
+* @example
+* await requestPasswordReset(User, request.input("email"));
+* return response.success({ message: "If the account exists, we sent a reset link." });
+*/
+async function requestPasswordReset(Model, identifier) {
+	const notification = await resolveTokenNotification("password-reset");
+	if (typeof identifier !== "string" || identifier.length === 0) return;
+	const user = await Model.first({ [authConfig.passwordReset.identifierField()]: identifier });
+	if (!user) return;
+	const { token, expiresAt } = await issueOneTimeToken(user, "password-reset", authConfig.passwordReset.expiresInMs(), true);
+	authEvents.emit("password.resetRequested", user, token);
+	const url = authConfig.passwordReset.url()?.(token, user);
+	await notification.send(user, {
+		token,
+		expiresAt,
+		...url ? { url } : {}
+	});
+}
+/**
+* Complete a password reset: consume the token, store the new password, then
+* revoke every access token, refresh token and cookie session the user holds
+* (`authService.revokeAllTokens`). Resolves to the user.
+*
+* Validate password strength BEFORE calling this — the token is consumed first.
+*
+* @throws InvalidOneTimeTokenError for an unknown, verification-purpose,
+*   expired, superseded or already-used token.
+*/
+async function resetPassword(token, newPassword) {
+	const user = await consumeOneTimeToken(token, "password-reset");
+	const setPassword = authConfig.passwordReset.setPassword();
+	if (setPassword) await setPassword(user, newPassword);
+	else await writePassword(user, newPassword);
+	await authService.revokeAllTokens(user);
+	authEvents.emit("password.reset", user);
+	return user;
+}
+
+//#endregion
+export { requestPasswordReset, resetPassword };
+//# sourceMappingURL=password-reset.mjs.map

package/esm/services/password-reset.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.mjs","names":[],"sources":["../../../../../../../auth/src/services/password-reset.ts"],"sourcesContent":["import type { ChildModel } from \"@warlock.js/cascade\";\nimport type { Auth } from \"../models/auth.model\";\nimport { authConfig } from \"./auth-config\";\nimport { authEvents } from \"./auth-events\";\nimport { authService } from \"./auth.service\";\nimport { consumeOneTimeToken, issueOneTimeToken } from \"./one-time-tokens\";\nimport { resolveTokenNotification } from \"./token-notifications\";\n\n/**\n * Default password writer. Login verifies with `authService.verifyPassword`,\n * so that is the authority on what \"stored correctly\" means:\n *\n * 1. Save `hashPassword(plain)` — right for a model that stores what it's given.\n * 2. If that no longer verifies, the model hashed on save (core's\n *    `useHashedPassword()`), double-hashing it: save the plaintext so the\n *    model's own transformer hashes it once.\n * 3. Still not verifiable ⇒ throw. Never leave a reset that \"succeeded\" with a\n *    password nobody can log in with.\n *\n * The first write is always a hash, so a model without a transformer never\n * has plaintext written.\n */\nasync function writePassword(user: Auth, plainPassword: string): Promise<void> {\n  await user.merge({ password: await authService.hashPassword(plainPassword) } as never).save();\n\n  if (await authService.verifyPassword(plainPassword, user.string(\"password\") ?? \"\")) return;\n\n  await user.merge({ password: plainPassword } as never).save();\n\n  const stored = user.string(\"password\") ?? \"\";\n\n  if (stored !== plainPassword && (await authService.verifyPassword(plainPassword, stored))) {\n    return;\n  }\n\n  throw new Error(\n    \"@warlock.js/auth: resetPassword could not store a password that verifies — \" +\n      \"set `auth.passwordReset.setPassword` to write it the way your user model expects.\",\n  );\n}\n\n/**\n * Start a password reset for the account whose `auth.passwordReset.identifierField`\n * (default `email`) equals `identifier`: invalidate the account's unused reset\n * tokens, issue a new one, and send it through the reset notification.\n *\n * **Anti-enumeration:** resolves `undefined` whether or not the account exists\n * — an unknown identifier simply sends nothing. Notification availability is\n * checked before the lookup, so a misconfigured app fails identically for both.\n *\n * @throws NotificationsUnavailableError when `@warlock.js/notifications` is not installed or not configured.\n *\n * @example\n * await requestPasswordReset(User, request.input(\"email\"));\n * return response.success({ message: \"If the account exists, we sent a reset link.\" });\n */\nexport async function requestPasswordReset<T extends Auth>(\n  Model: ChildModel<T>,\n  identifier: string,\n): Promise<void> {\n  const notification = await resolveTokenNotification(\"password-reset\");\n\n  if (typeof identifier !== \"string\" || identifier.length === 0) return;\n\n  const user = (await Model.first({\n    [authConfig.passwordReset.identifierField()]: identifier,\n  })) as T | null;\n\n  if (!user) return;\n\n  const { token, expiresAt } = await issueOneTimeToken(\n    user,\n    \"password-reset\",\n    authConfig.passwordReset.expiresInMs(),\n    true,\n  );\n\n  authEvents.emit(\"password.resetRequested\", user, token);\n\n  const url = authConfig.passwordReset.url()?.(token, user);\n\n  await notification.send(user, { token, expiresAt, ...(url ? { url } : {}) });\n}\n\n/**\n * Complete a password reset: consume the token, store the new password, then\n * revoke every access token, refresh token and cookie session the user holds\n * (`authService.revokeAllTokens`). Resolves to the user.\n *\n * Validate password strength BEFORE calling this — the token is consumed first.\n *\n * @throws InvalidOneTimeTokenError for an unknown, verification-purpose,\n *   expired, superseded or already-used token.\n */\nexport async function resetPassword(token: string, newPassword: string): Promise<Auth> {\n  const user = await consumeOneTimeToken(token, \"password-reset\");\n\n  const setPassword = authConfig.passwordReset.setPassword();\n\n  if (setPassword) {\n    await setPassword(user, newPassword);\n  } else {\n    await writePassword(user, newPassword);\n  }\n\n  await authService.revokeAllTokens(user);\n\n  authEvents.emit(\"password.reset\", user);\n\n  return user;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsBA,eAAe,cAAc,MAAY,eAAsC;CAC7E,MAAM,KAAK,MAAM,EAAE,UAAU,MAAM,YAAY,aAAa,aAAa,EAAE,CAAU,CAAC,CAAC,KAAK;CAE5F,IAAI,MAAM,YAAY,eAAe,eAAe,KAAK,OAAO,UAAU,KAAK,EAAE,GAAG;CAEpF,MAAM,KAAK,MAAM,EAAE,UAAU,cAAc,CAAU,CAAC,CAAC,KAAK;CAE5D,MAAM,SAAS,KAAK,OAAO,UAAU,KAAK;CAE1C,IAAI,WAAW,iBAAkB,MAAM,YAAY,eAAe,eAAe,MAAM,GACrF;CAGF,MAAM,IAAI,MACR,8JAEF;AACF;;;;;;;;;;;;;;;;AAiBA,eAAsB,qBACpB,OACA,YACe;CACf,MAAM,eAAe,MAAM,yBAAyB,gBAAgB;CAEpE,IAAI,OAAO,eAAe,YAAY,WAAW,WAAW,GAAG;CAE/D,MAAM,OAAQ,MAAM,MAAM,MAAM,GAC7B,WAAW,cAAc,gBAAgB,IAAI,WAChD,CAAC;CAED,IAAI,CAAC,MAAM;CAEX,MAAM,EAAE,OAAO,cAAc,MAAM,kBACjC,MACA,kBACA,WAAW,cAAc,YAAY,GACrC,IACF;CAEA,WAAW,KAAK,2BAA2B,MAAM,KAAK;CAEtD,MAAM,MAAM,WAAW,cAAc,IAAI,CAAC,GAAG,OAAO,IAAI;CAExD,MAAM,aAAa,KAAK,MAAM;EAAE;EAAO;EAAW,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;CAAG,CAAC;AAC7E;;;;;;;;;;;AAYA,eAAsB,cAAc,OAAe,aAAoC;CACrF,MAAM,OAAO,MAAM,oBAAoB,OAAO,gBAAgB;CAE9D,MAAM,cAAc,WAAW,cAAc,YAAY;CAEzD,IAAI,aACF,MAAM,YAAY,MAAM,WAAW;MAEnC,MAAM,cAAc,MAAM,WAAW;CAGvC,MAAM,YAAY,gBAAgB,IAAI;CAEtC,WAAW,KAAK,kBAAkB,IAAI;CAEtC,OAAO;AACT"}