@warlock.js/auth 5.20.0 → 5.21.0

package/esm/services/auth-config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth-config.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport { type Algorithm } from \"fast-jwt\";\r\nimport ms from \"ms\";\r\nimport type {\r\n  AuthNotification,\r\n  CanAuthenticate,\r\n  LogoutWithoutTokenBehavior,\r\n  OneTimeTokenUrlBuilder,\r\n  PasswordSetter,\r\n} from \"../contracts/types\";\r\nimport type {\r\n  AppleProviderConfig,\r\n  AuthProvider,\r\n  DiscordProviderConfig,\r\n  FacebookProviderConfig,\r\n  GitHubProviderConfig,\r\n  GoogleProviderConfig,\r\n  LinkedInProviderConfig,\r\n  OtpSender,\r\n  PasskeysConfig,\r\n  ProviderUserCreator,\r\n  XProviderConfig,\r\n} from \"../contracts/providers\";\r\nimport type { Auth } from \"../models/auth.model\";\r\n\r\nconst warnedLegacyKeys = new Set<string>();\r\n\r\nconst permitAuthentication: CanAuthenticate = (): boolean => true;\r\n\r\n/**\r\n * `ms` accepts anything at runtime and answers `undefined` for a string it\r\n * cannot parse (`\"30dayz\"`), a *formatted string* for a number (`2592000` ⇒\r\n * `\"43m\"`), and throws for `\"\"`. Its published types claim the far narrower\r\n * `(value: ms.StringValue) => number`, which is exactly what let an\r\n * `as ms.StringValue` cast smuggle arbitrary config text past the compiler and\r\n * hand `undefined` to the JWT signer. Declare the honest runtime signature once,\r\n * here, so every caller is forced to deal with the `undefined`.\r\n */\r\nconst parseMs = ms as unknown as (value: unknown) => number | string | undefined;\r\n\r\n/**\r\n * Turn a configured lifetime into a positive number of milliseconds, or throw\r\n * naming the key.\r\n *\r\n * A token lifetime is a security boundary, so an unusable value is a hard error\r\n * rather than a silent fallback: substituting a default would trade one\r\n * unintended lifetime for another, just as quietly — and quiet is the whole\r\n * problem. Every non-positive, non-finite or non-numeric parse is rejected:\r\n *\r\n * - `\"30dayz\"` / `\"thirty days\"` ⇒ `undefined` ⇒ a JWT signed with **no `exp`\r\n *   claim** and an `Invalid Date` written to the token row.\r\n * - `\"0d\"` ⇒ parses cleanly to `0`, which `fast-jwt` treats as falsy and also\r\n *   emits with **no `exp` claim** — it survives any guard that only rejects\r\n *   `undefined`. `\"-1h\"` signs an already-expired token.\r\n * - `2592000` (a bare number) ⇒ `ms` *formats* it as `\"43m\"`, a string, which\r\n *   then turns `Date.now() + expiresIn` into an `Invalid Date`.\r\n */\r\nfunction parseDuration(key: string, raw: unknown): number {\r\n  let parsed: number | string | undefined;\r\n\r\n  try {\r\n    parsed = parseMs(raw);\r\n  } catch {\r\n    // ms throws (rather than returning undefined) for \"\" and non-strings\r\n    parsed = undefined;\r\n  }\r\n\r\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\r\n    throw new Error(\r\n      `auth.${key}: ${JSON.stringify(raw)} is not a valid ms duration — ` +\r\n        `use a positive duration string such as \"1h\", \"7d\", or NO_EXPIRATION.`,\r\n    );\r\n  }\r\n\r\n  return parsed;\r\n}\r\n\r\n/** Email-verification token lifetime used when nothing is configured. */\r\nconst DEFAULT_VERIFICATION_EXPIRES_IN = \"24h\";\r\n\r\n/** Password-reset token lifetime used when nothing is configured. */\r\nconst DEFAULT_PASSWORD_RESET_EXPIRES_IN = \"60m\";\r\n\r\n/** Passkey challenge lifetime used when nothing is configured. */\r\nconst DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN = \"5m\";\r\n\r\n/** OTP lifetime used when nothing is configured. */\r\nconst DEFAULT_OTP_EXPIRES_IN = \"5m\";\r\n\r\n/** Access-token lifetime used when nothing is configured. */\r\nconst DEFAULT_ACCESS_TOKEN_EXPIRES_IN = \"1h\";\r\n\r\n/**\r\n * Resolve an auth setting, preferring the new `auth.accessToken.*` /\r\n * `auth.refreshToken.*` key and falling back to the deprecated `auth.jwt.*`\r\n * shape — warning once per legacy key. Returns `fallback` when neither is set.\r\n *\r\n * This is the backward-compatible shim that lets existing `auth.jwt.*` configs\r\n * keep working after the config split.\r\n */\r\nfunction resolve<T>(newKey: string, legacyKey: string, fallback?: T): T {\r\n  const fromNew = config.key(`auth.${newKey}`);\r\n\r\n  if (fromNew !== undefined && fromNew !== null) {\r\n    return fromNew as T;\r\n  }\r\n\r\n  const fromLegacy = config.key(`auth.${legacyKey}`);\r\n\r\n  if (fromLegacy !== undefined && fromLegacy !== null) {\r\n    if (!warnedLegacyKeys.has(legacyKey)) {\r\n      warnedLegacyKeys.add(legacyKey);\r\n      log.warn(\r\n        \"auth\",\r\n        \"config-deprecation\",\r\n        `auth.${legacyKey} is deprecated — use auth.${newKey}`,\r\n      );\r\n    }\r\n\r\n    return fromLegacy as T;\r\n  }\r\n\r\n  return fallback as T;\r\n}\r\n\r\n/**\r\n * Typed, backward-compatible access to auth configuration. The service and the\r\n * jwt signer read configuration exclusively through here, so the new split\r\n * config and the legacy `auth.jwt.*` shape both resolve the same way.\r\n */\r\nexport const authConfig = {\r\n  canAuthenticate: async (user: Auth): Promise<boolean> => {\r\n    const canAuthenticate = config.key<CanAuthenticate>(\r\n      \"auth.canAuthenticate\",\r\n      permitAuthentication,\r\n    );\r\n\r\n    return canAuthenticate(user);\r\n  },\r\n  accessToken: {\r\n    /** Signing secret (legacy: `auth.jwt.secret`). Throws if neither is set. */\r\n    secret: (): string => {\r\n      const secret = resolve<string | undefined>(\"accessToken.secret\", \"jwt.secret\");\r\n\r\n      if (!secret) {\r\n        throw new Error(\"auth: no JWT secret configured — set `auth.accessToken.secret`.\");\r\n      }\r\n\r\n      return secret;\r\n    },\r\n    /** Signing algorithm (legacy: `auth.jwt.algorithm`). */\r\n    algorithm: (): Algorithm => resolve(\"accessToken.algorithm\", \"jwt.algorithm\", \"HS256\"),\r\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.expiresIn`). */\r\n    expiresIn: (): string | undefined => resolve(\"accessToken.expiresIn\", \"jwt.expiresIn\"),\r\n    /**\r\n     * Lifetime in milliseconds — the only form a token issuer may use. Defaults\r\n     * to 1 hour when unset; throws naming the key when the configured value is\r\n     * not a positive `ms` duration. See {@link parseDuration}.\r\n     */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"accessToken.expiresIn\",\r\n        authConfig.accessToken.expiresIn() ?? DEFAULT_ACCESS_TOKEN_EXPIRES_IN,\r\n      ),\r\n  },\r\n  pageAuth: {\r\n    /**\r\n     * Login path a guarded PAGE route redirects a logged-out browser to.\r\n     *\r\n     * Unset (the default) ⇒ page-route auth failures keep the JSON 401 API\r\n     * contract, so existing apps see NO behavior change. Set it (e.g. \"/login\")\r\n     * to opt a browser-facing app into login-redirect UX: a logged-out human\r\n     * navigating to a guarded page lands on the login screen instead of reading\r\n     * a raw JSON error blob. Finding b9ab9804.\r\n     */\r\n    loginPath: (): string | undefined => config.key(\"auth.pageAuth.loginPath\"),\r\n    /**\r\n     * Query parameter the redirect carries the originally-requested path in, so\r\n     * the login flow can send the user back where they were headed. Defaults to\r\n     * `\"returnUrl\"`.\r\n     */\r\n    returnUrlParam: (): string => config.key(\"auth.pageAuth.returnUrlParam\", \"returnUrl\"),\r\n  },\r\n  cookie: {\r\n    /** Cookie name `setAuthCookie`/`clearAuthCookie` use. @default \"access_token\" */\r\n    name: (): string => config.key(\"auth.cookie.name\", \"access_token\"),\r\n    /** Cookie `Path` attribute `setAuthCookie`/`clearAuthCookie` use. @default \"/\" */\r\n    path: (): string => config.key(\"auth.cookie.path\", \"/\"),\r\n  },\r\n  csrf: {\r\n    /**\r\n     * Extra origins allowed on a cookie-authenticated unsafe-method request,\r\n     * beyond the request's own origin. @default []\r\n     */\r\n    allowedOrigins: (): string[] => config.key(\"auth.csrf.allowedOrigins\", []),\r\n  },\r\n  verification: {\r\n    /** Lifetime in ms of an email-verification token; throws naming the key when unusable. @default \"24h\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"verification.expiresIn\",\r\n        config.key(\"auth.verification.expiresIn\", DEFAULT_VERIFICATION_EXPIRES_IN),\r\n      ),\r\n    /** User attribute stamped with the verification date. @default \"emailVerifiedAt\" */\r\n    field: (): string => config.key(\"auth.verification.field\", \"emailVerifiedAt\"),\r\n    /** App notification replacing the default verification email. */\r\n    notification: (): AuthNotification | undefined => config.key(\"auth.verification.notification\"),\r\n    /** Link builder whose result is handed to the notification as `url`. */\r\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.verification.url\"),\r\n  },\r\n  passwordReset: {\r\n    /** Lifetime in ms of a password-reset token; throws naming the key when unusable. @default \"60m\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"passwordReset.expiresIn\",\r\n        config.key(\"auth.passwordReset.expiresIn\", DEFAULT_PASSWORD_RESET_EXPIRES_IN),\r\n      ),\r\n    /** User attribute `requestPasswordReset` looks the account up by. @default \"email\" */\r\n    identifierField: (): string => config.key(\"auth.passwordReset.identifierField\", \"email\"),\r\n    /** App notification replacing the default reset email. */\r\n    notification: (): AuthNotification | undefined => config.key(\"auth.passwordReset.notification\"),\r\n    /** Link builder whose result is handed to the notification as `url`. */\r\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.passwordReset.url\"),\r\n    /** App-owned password writer replacing the default. */\r\n    setPassword: (): PasswordSetter | undefined => config.key(\"auth.passwordReset.setPassword\"),\r\n  },\r\n  providers: {\r\n    /** `auth.providers.google`, when configured. */\r\n    google: (): GoogleProviderConfig | undefined => config.key(\"auth.providers.google\"),\r\n    /** `auth.providers.github`, when configured. */\r\n    github: (): GitHubProviderConfig | undefined => config.key(\"auth.providers.github\"),\r\n    /** `auth.providers.discord`, when configured. */\r\n    discord: (): DiscordProviderConfig | undefined => config.key(\"auth.providers.discord\"),\r\n    /** `auth.providers.linkedin`, when configured. */\r\n    linkedin: (): LinkedInProviderConfig | undefined => config.key(\"auth.providers.linkedin\"),\r\n    /** `auth.providers.apple`, when configured. */\r\n    apple: (): AppleProviderConfig | undefined => config.key(\"auth.providers.apple\"),\r\n    /** `auth.providers.facebook`, when configured. */\r\n    facebook: (): FacebookProviderConfig | undefined => config.key(\"auth.providers.facebook\"),\r\n    /** `auth.providers.x`, when configured. */\r\n    x: (): XProviderConfig | undefined => config.key(\"auth.providers.x\"),\r\n    /** An app-registered provider under `auth.providers.custom.<name>`. */\r\n    custom: (name: string): AuthProvider | undefined => {\r\n      const providers = config.key<Record<string, AuthProvider>>(\"auth.providers.custom\", {});\r\n\r\n      // Own keys only: `name` arrives from a URL, and \"constructor\" must not resolve to Object.\r\n      return Object.hasOwn(providers, name) ? providers[name] : undefined;\r\n    },\r\n    /** User attribute a verified provider email is matched against. @default \"email\" */\r\n    emailField: (): string => config.key(\"auth.providers.emailField\", \"email\"),\r\n    /** App-owned user creation for a first provider login. */\r\n    createUser: (): ProviderUserCreator | undefined => config.key(\"auth.providers.createUser\"),\r\n  },\r\n  passkeys: {\r\n    /** `auth.passkeys`; throws naming the keys when `rpID`, `rpName` or `origin` is missing. */\r\n    settings: (): PasskeysConfig => {\r\n      const settings = config.key<PasskeysConfig | undefined>(\"auth.passkeys\");\r\n\r\n      if (!settings?.rpID || !settings.rpName || !settings.origin) {\r\n        throw new Error(\r\n          \"@warlock.js/auth: passkeys need `auth.passkeys.rpID`, `auth.passkeys.rpName` and `auth.passkeys.origin`.\",\r\n        );\r\n      }\r\n\r\n      return settings;\r\n    },\r\n    /** Allowed ceremony origins, as a list. */\r\n    origins: (): string[] => {\r\n      const { origin } = authConfig.passkeys.settings();\r\n\r\n      return Array.isArray(origin) ? origin : [origin];\r\n    },\r\n    /** Challenge lifetime in ms; throws naming the key when unusable. @default \"5m\" */\r\n    challengeExpiresInMs: (): number =>\r\n      parseDuration(\r\n        \"passkeys.challengeExpiresIn\",\r\n        config.key(\"auth.passkeys.challengeExpiresIn\", DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN),\r\n      ),\r\n  },\r\n  otp: {\r\n    /** Notifications channel the code is sent through. @default \"sms\" */\r\n    channel: (): string => config.key(\"auth.otp.channel\", \"sms\"),\r\n    /** User attribute holding the phone number. @default \"phone\" */\r\n    phoneField: (): string => config.key(\"auth.otp.phoneField\", \"phone\"),\r\n    /** Code lifetime in ms; throws naming the key when unusable. @default \"5m\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\"otp.expiresIn\", config.key(\"auth.otp.expiresIn\", DEFAULT_OTP_EXPIRES_IN)),\r\n    /** Verify attempts before the code is invalidated. @default 5 */\r\n    maxAttempts: (): number => config.key(\"auth.otp.maxAttempts\", 5),\r\n    /** The message text for a code. */\r\n    message: (code: string): string => {\r\n      const build = config.key<((code: string) => string) | undefined>(\"auth.otp.message\");\r\n\r\n      return build ? build(code) : `Your verification code is ${code}`;\r\n    },\r\n    /** App-owned delivery replacing the notifications channel send. */\r\n    send: (): OtpSender | undefined => config.key(\"auth.otp.send\"),\r\n  },\r\n  refreshToken: {\r\n    /** Separate refresh secret (legacy: `auth.jwt.refresh.secret`); empty ⇒ fall back to the access secret. */\r\n    secret: (): string | undefined => resolve(\"refreshToken.secret\", \"jwt.refresh.secret\"),\r\n    /** Whether refresh tokens are enabled (legacy: `auth.jwt.refresh.enabled`). */\r\n    enabled: (): boolean => resolve(\"refreshToken.enabled\", \"jwt.refresh.enabled\", true),\r\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.refresh.expiresIn`). */\r\n    expiresIn: (): string => resolve(\"refreshToken.expiresIn\", \"jwt.refresh.expiresIn\", \"7d\"),\r\n    /**\r\n     * Lifetime in milliseconds — the only form a token issuer may use. Throws\r\n     * naming the key when the configured value is not a positive `ms` duration.\r\n     */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\"refreshToken.expiresIn\", authConfig.refreshToken.expiresIn()),\r\n    /** Rotate-on-use (legacy: `auth.jwt.refresh.rotation`). */\r\n    rotation: (): boolean => resolve(\"refreshToken.rotation\", \"jwt.refresh.rotation\", true),\r\n    /** Max active tokens per user (legacy: `auth.jwt.refresh.maxPerUser`). */\r\n    maxPerUser: (): number => resolve(\"refreshToken.maxPerUser\", \"jwt.refresh.maxPerUser\", 5),\r\n    /** Logout-without-token behavior (legacy: `auth.jwt.refresh.logoutWithoutToken`). */\r\n    logoutWithoutToken: (): LogoutWithoutTokenBehavior =>\r\n      resolve(\"refreshToken.logoutWithoutToken\", \"jwt.refresh.logoutWithoutToken\", \"revoke-all\"),\r\n  },\r\n};\r\n"],"mappings":";;;;;AA0BA,MAAM,mCAAmB,IAAI,IAAY;AAEzC,MAAM,6BAAuD;;;;;;;;;;AAW7D,MAAM,UAAU;;;;;;;;;;;;;;;;;;AAmBhB,SAAS,cAAc,KAAa,KAAsB;CACxD,IAAI;CAEJ,IAAI;EACF,SAAS,QAAQ,GAAG;CACtB,QAAQ;EAEN,SAAS;CACX;CAEA,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACtE,MAAM,IAAI,MACR,QAAQ,IAAI,IAAI,KAAK,UAAU,GAAG,EAAE,mGAEtC;CAGF,OAAO;AACT;;AAGA,MAAM,kCAAkC;;AAGxC,MAAM,oCAAoC;;AAG1C,MAAM,uCAAuC;;AAG7C,MAAM,yBAAyB;;AAG/B,MAAM,kCAAkC;;;;;;;;;AAUxC,SAAS,QAAW,QAAgB,WAAmB,UAAiB;CACtE,MAAM,UAAU,OAAO,IAAI,QAAQ,QAAQ;CAE3C,IAAI,YAAY,UAAa,YAAY,MACvC,OAAO;CAGT,MAAM,aAAa,OAAO,IAAI,QAAQ,WAAW;CAEjD,IAAI,eAAe,UAAa,eAAe,MAAM;EACnD,IAAI,CAAC,iBAAiB,IAAI,SAAS,GAAG;GACpC,iBAAiB,IAAI,SAAS;GAC9B,IAAI,KACF,QACA,sBACA,QAAQ,UAAU,4BAA4B,QAChD;EACF;EAEA,OAAO;CACT;CAEA,OAAO;AACT;;;;;;AAOA,MAAa,aAAa;CACxB,iBAAiB,OAAO,SAAiC;EAMvD,OALwB,OAAO,IAC7B,wBACA,oBAGmB,CAAC,CAAC,IAAI;CAC7B;CACA,aAAa;;EAEX,cAAsB;GACpB,MAAM,SAAS,QAA4B,sBAAsB,YAAY;GAE7E,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,iEAAiE;GAGnF,OAAO;EACT;;EAEA,iBAA4B,QAAQ,yBAAyB,iBAAiB,OAAO;;EAErF,iBAAqC,QAAQ,yBAAyB,eAAe;;;;;;EAMrF,mBACE,cACE,yBACA,WAAW,YAAY,UAAU,KAAK,+BACxC;CACJ;CACA,UAAU;;;;;;;;;;EAUR,iBAAqC,OAAO,IAAI,yBAAyB;;;;;;EAMzE,sBAA8B,OAAO,IAAI,gCAAgC,WAAW;CACtF;CACA,QAAQ;;EAEN,YAAoB,OAAO,IAAI,oBAAoB,cAAc;;EAEjE,YAAoB,OAAO,IAAI,oBAAoB,GAAG;CACxD;CACA,MAAM;;;;;AAKJ,sBAAgC,OAAO,IAAI,4BAA4B,CAAC,CAAC,EAC3E;CACA,cAAc;;EAEZ,mBACE,cACE,0BACA,OAAO,IAAI,+BAA+B,+BAA+B,CAC3E;;EAEF,aAAqB,OAAO,IAAI,2BAA2B,iBAAiB;;EAE5E,oBAAkD,OAAO,IAAI,gCAAgC;;EAE7F,WAA+C,OAAO,IAAI,uBAAuB;CACnF;CACA,eAAe;;EAEb,mBACE,cACE,2BACA,OAAO,IAAI,gCAAgC,iCAAiC,CAC9E;;EAEF,uBAA+B,OAAO,IAAI,sCAAsC,OAAO;;EAEvF,oBAAkD,OAAO,IAAI,iCAAiC;;EAE9F,WAA+C,OAAO,IAAI,wBAAwB;;EAElF,mBAA+C,OAAO,IAAI,gCAAgC;CAC5F;CACA,WAAW;;EAET,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,eAAkD,OAAO,IAAI,wBAAwB;;EAErF,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,aAA8C,OAAO,IAAI,sBAAsB;;EAE/E,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,SAAsC,OAAO,IAAI,kBAAkB;;EAEnE,SAAS,SAA2C;GAClD,MAAM,YAAY,OAAO,IAAkC,yBAAyB,CAAC,CAAC;GAGtF,OAAO,OAAO,OAAO,WAAW,IAAI,IAAI,UAAU,QAAQ;EAC5D;;EAEA,kBAA0B,OAAO,IAAI,6BAA6B,OAAO;;EAEzE,kBAAmD,OAAO,IAAI,2BAA2B;CAC3F;CACA,UAAU;;EAER,gBAAgC;GAC9B,MAAM,WAAW,OAAO,IAAgC,eAAe;GAEvE,IAAI,CAAC,UAAU,QAAQ,CAAC,SAAS,UAAU,CAAC,SAAS,QACnD,MAAM,IAAI,MACR,0GACF;GAGF,OAAO;EACT;;EAEA,eAAyB;GACvB,MAAM,EAAE,WAAW,WAAW,SAAS,SAAS;GAEhD,OAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;EACjD;;EAEA,4BACE,cACE,+BACA,OAAO,IAAI,oCAAoC,oCAAoC,CACrF;CACJ;CACA,KAAK;;EAEH,eAAuB,OAAO,IAAI,oBAAoB,KAAK;;EAE3D,kBAA0B,OAAO,IAAI,uBAAuB,OAAO;;EAEnE,mBACE,cAAc,iBAAiB,OAAO,IAAI,sBAAsB,sBAAsB,CAAC;;EAEzF,mBAA2B,OAAO,IAAI,wBAAwB,CAAC;;EAE/D,UAAU,SAAyB;GACjC,MAAM,QAAQ,OAAO,IAA4C,kBAAkB;GAEnF,OAAO,QAAQ,MAAM,IAAI,IAAI,6BAA6B;EAC5D;;EAEA,YAAmC,OAAO,IAAI,eAAe;CAC/D;CACA,cAAc;;EAEZ,cAAkC,QAAQ,uBAAuB,oBAAoB;;EAErF,eAAwB,QAAQ,wBAAwB,uBAAuB,IAAI;;EAEnF,iBAAyB,QAAQ,0BAA0B,yBAAyB,IAAI;;;;;EAKxF,mBACE,cAAc,0BAA0B,WAAW,aAAa,UAAU,CAAC;;EAE7E,gBAAyB,QAAQ,yBAAyB,wBAAwB,IAAI;;EAEtF,kBAA0B,QAAQ,2BAA2B,0BAA0B,CAAC;;EAExF,0BACE,QAAQ,mCAAmC,kCAAkC,YAAY;CAC7F;AACF"}
+{"version":3,"file":"auth-config.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth-config.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport { type Algorithm } from \"fast-jwt\";\r\nimport ms from \"ms\";\r\nimport type {\r\n  AuthNotification,\r\n  CanAuthenticate,\r\n  LogoutWithoutTokenBehavior,\r\n  OneTimeTokenUrlBuilder,\r\n  PasswordSetter,\r\n} from \"../contracts/types\";\r\nimport type {\r\n  AppleProviderConfig,\r\n  AuthProvider,\r\n  DiscordProviderConfig,\r\n  FacebookProviderConfig,\r\n  GitHubProviderConfig,\r\n  GoogleProviderConfig,\r\n  LinkedInProviderConfig,\r\n  OtpSender,\r\n  PasskeysConfig,\r\n  ProviderUserCreator,\r\n  XProviderConfig,\r\n} from \"../contracts/providers\";\r\nimport type { Auth } from \"../models/auth.model\";\r\n\r\nconst warnedLegacyKeys = new Set<string>();\r\n\r\nconst permitAuthentication: CanAuthenticate = (): boolean => true;\r\n\r\n/**\r\n * `ms` accepts anything at runtime and answers `undefined` for a string it\r\n * cannot parse (`\"30dayz\"`), a *formatted string* for a number (`2592000` ⇒\r\n * `\"43m\"`), and throws for `\"\"`. Its published types claim the far narrower\r\n * `(value: ms.StringValue) => number`, which is exactly what let an\r\n * `as ms.StringValue` cast smuggle arbitrary config text past the compiler and\r\n * hand `undefined` to the JWT signer. Declare the honest runtime signature once,\r\n * here, so every caller is forced to deal with the `undefined`.\r\n */\r\nconst parseMs = ms as unknown as (value: unknown) => number | string | undefined;\r\n\r\n/**\r\n * Turn a configured lifetime into a positive number of milliseconds, or throw\r\n * naming the key.\r\n *\r\n * A token lifetime is a security boundary, so an unusable value is a hard error\r\n * rather than a silent fallback: substituting a default would trade one\r\n * unintended lifetime for another, just as quietly — and quiet is the whole\r\n * problem. Every non-positive, non-finite or non-numeric parse is rejected:\r\n *\r\n * - `\"30dayz\"` / `\"thirty days\"` ⇒ `undefined` ⇒ a JWT signed with **no `exp`\r\n *   claim** and an `Invalid Date` written to the token row.\r\n * - `\"0d\"` ⇒ parses cleanly to `0`, which `fast-jwt` treats as falsy and also\r\n *   emits with **no `exp` claim** — it survives any guard that only rejects\r\n *   `undefined`. `\"-1h\"` signs an already-expired token.\r\n * - `2592000` (a bare number) ⇒ `ms` *formats* it as `\"43m\"`, a string, which\r\n *   then turns `Date.now() + expiresIn` into an `Invalid Date`.\r\n */\r\nfunction parseDuration(key: string, raw: unknown): number {\r\n  let parsed: number | string | undefined;\r\n\r\n  try {\r\n    parsed = parseMs(raw);\r\n  } catch {\r\n    // ms throws (rather than returning undefined) for \"\" and non-strings\r\n    parsed = undefined;\r\n  }\r\n\r\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\r\n    throw new Error(\r\n      `auth.${key}: ${JSON.stringify(raw)} is not a valid ms duration — ` +\r\n        `use a positive duration string such as \"1h\", \"7d\", or NO_EXPIRATION.`,\r\n    );\r\n  }\r\n\r\n  return parsed;\r\n}\r\n\r\n/** Email-verification token lifetime used when nothing is configured. */\r\nconst DEFAULT_VERIFICATION_EXPIRES_IN = \"24h\";\r\n\r\n/** Password-reset token lifetime used when nothing is configured. */\r\nconst DEFAULT_PASSWORD_RESET_EXPIRES_IN = \"60m\";\r\n\r\n/** Passkey challenge lifetime used when nothing is configured. */\r\nconst DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN = \"5m\";\r\n\r\n/** OTP lifetime used when nothing is configured. */\r\nconst DEFAULT_OTP_EXPIRES_IN = \"5m\";\r\n\r\n/** Access-token lifetime used when nothing is configured. */\r\nconst DEFAULT_ACCESS_TOKEN_EXPIRES_IN = \"1h\";\r\n\r\n/**\r\n * Resolve an auth setting, preferring the new `auth.accessToken.*` /\r\n * `auth.refreshToken.*` key and falling back to the deprecated `auth.jwt.*`\r\n * shape — warning once per legacy key. Returns `fallback` when neither is set.\r\n *\r\n * This is the backward-compatible shim that lets existing `auth.jwt.*` configs\r\n * keep working after the config split.\r\n */\r\nfunction resolve<T>(newKey: string, legacyKey: string, fallback?: T): T {\r\n  const fromNew = config.key(`auth.${newKey}`);\r\n\r\n  if (fromNew !== undefined && fromNew !== null) {\r\n    return fromNew as T;\r\n  }\r\n\r\n  const fromLegacy = config.key(`auth.${legacyKey}`);\r\n\r\n  if (fromLegacy !== undefined && fromLegacy !== null) {\r\n    if (!warnedLegacyKeys.has(legacyKey)) {\r\n      warnedLegacyKeys.add(legacyKey);\r\n      log.warn(\r\n        \"auth\",\r\n        \"config-deprecation\",\r\n        `auth.${legacyKey} is deprecated — use auth.${newKey}`,\r\n      );\r\n    }\r\n\r\n    return fromLegacy as T;\r\n  }\r\n\r\n  return fallback as T;\r\n}\r\n\r\n/**\r\n * Typed, backward-compatible access to auth configuration. The service and the\r\n * jwt signer read configuration exclusively through here, so the new split\r\n * config and the legacy `auth.jwt.*` shape both resolve the same way.\r\n */\r\nexport const authConfig = {\r\n  canAuthenticate: async (user: Auth): Promise<boolean> => {\r\n    const canAuthenticate = config.key<CanAuthenticate>(\r\n      \"auth.canAuthenticate\",\r\n      permitAuthentication,\r\n    );\r\n\r\n    return canAuthenticate(user);\r\n  },\r\n  accessToken: {\r\n    /** Signing secret (legacy: `auth.jwt.secret`). Throws if neither is set. */\r\n    secret: (): string => {\r\n      const secret = resolve<string | undefined>(\"accessToken.secret\", \"jwt.secret\");\r\n\r\n      if (!secret) {\r\n        throw new Error(\"auth: no JWT secret configured — set `auth.accessToken.secret`.\");\r\n      }\r\n\r\n      return secret;\r\n    },\r\n    /** Signing algorithm (legacy: `auth.jwt.algorithm`). */\r\n    algorithm: (): Algorithm => resolve(\"accessToken.algorithm\", \"jwt.algorithm\", \"HS256\"),\r\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.expiresIn`). */\r\n    expiresIn: (): string | undefined => resolve(\"accessToken.expiresIn\", \"jwt.expiresIn\"),\r\n    /**\r\n     * Lifetime in milliseconds — the only form a token issuer may use. Defaults\r\n     * to 1 hour when unset; throws naming the key when the configured value is\r\n     * not a positive `ms` duration. See {@link parseDuration}.\r\n     */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"accessToken.expiresIn\",\r\n        authConfig.accessToken.expiresIn() ?? DEFAULT_ACCESS_TOKEN_EXPIRES_IN,\r\n      ),\r\n  },\r\n  pageAuth: {\r\n    /**\r\n     * Login path a guarded PAGE route redirects a logged-out browser to.\r\n     *\r\n     * Unset (the default) ⇒ page-route auth failures keep the JSON 401 API\r\n     * contract, so existing apps see NO behavior change. Set it (e.g. \"/login\")\r\n     * to opt a browser-facing app into login-redirect UX: a logged-out human\r\n     * navigating to a guarded page lands on the login screen instead of reading\r\n     * a raw JSON error blob. Finding b9ab9804.\r\n     */\r\n    loginPath: (): string | undefined => config.key(\"auth.pageAuth.loginPath\"),\r\n    /**\r\n     * Query parameter the redirect carries the originally-requested path in, so\r\n     * the login flow can send the user back where they were headed. Defaults to\r\n     * `\"returnUrl\"`.\r\n     */\r\n    returnUrlParam: (): string => config.key(\"auth.pageAuth.returnUrlParam\", \"returnUrl\"),\r\n  },\r\n  cookie: {\r\n    /** Cookie name `setAuthCookie`/`clearAuthCookie` use. @default \"access_token\" */\r\n    name: (): string => config.key(\"auth.cookie.name\", \"access_token\"),\r\n    /** Refresh-token cookie name the session cookie helpers use. @default \"refresh_token\" */\r\n    refreshName: (): string => config.key(\"auth.cookie.refreshName\", \"refresh_token\"),\r\n    /** Cookie `Path` attribute `setAuthCookie`/`clearAuthCookie` use. @default \"/\" */\r\n    path: (): string => config.key(\"auth.cookie.path\", \"/\"),\r\n  },\r\n  csrf: {\r\n    /**\r\n     * Extra origins allowed on a cookie-authenticated unsafe-method request,\r\n     * beyond the request's own origin. @default []\r\n     */\r\n    allowedOrigins: (): string[] => config.key(\"auth.csrf.allowedOrigins\", []),\r\n  },\r\n  verification: {\r\n    /** Lifetime in ms of an email-verification token; throws naming the key when unusable. @default \"24h\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"verification.expiresIn\",\r\n        config.key(\"auth.verification.expiresIn\", DEFAULT_VERIFICATION_EXPIRES_IN),\r\n      ),\r\n    /** User attribute stamped with the verification date. @default \"emailVerifiedAt\" */\r\n    field: (): string => config.key(\"auth.verification.field\", \"emailVerifiedAt\"),\r\n    /** App notification replacing the default verification email. */\r\n    notification: (): AuthNotification | undefined => config.key(\"auth.verification.notification\"),\r\n    /** Link builder whose result is handed to the notification as `url`. */\r\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.verification.url\"),\r\n  },\r\n  passwordReset: {\r\n    /** Lifetime in ms of a password-reset token; throws naming the key when unusable. @default \"60m\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"passwordReset.expiresIn\",\r\n        config.key(\"auth.passwordReset.expiresIn\", DEFAULT_PASSWORD_RESET_EXPIRES_IN),\r\n      ),\r\n    /** User attribute `requestPasswordReset` looks the account up by. @default \"email\" */\r\n    identifierField: (): string => config.key(\"auth.passwordReset.identifierField\", \"email\"),\r\n    /** App notification replacing the default reset email. */\r\n    notification: (): AuthNotification | undefined => config.key(\"auth.passwordReset.notification\"),\r\n    /** Link builder whose result is handed to the notification as `url`. */\r\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.passwordReset.url\"),\r\n    /** App-owned password writer replacing the default. */\r\n    setPassword: (): PasswordSetter | undefined => config.key(\"auth.passwordReset.setPassword\"),\r\n  },\r\n  providers: {\r\n    /** `auth.providers.google`, when configured. */\r\n    google: (): GoogleProviderConfig | undefined => config.key(\"auth.providers.google\"),\r\n    /** `auth.providers.github`, when configured. */\r\n    github: (): GitHubProviderConfig | undefined => config.key(\"auth.providers.github\"),\r\n    /** `auth.providers.discord`, when configured. */\r\n    discord: (): DiscordProviderConfig | undefined => config.key(\"auth.providers.discord\"),\r\n    /** `auth.providers.linkedin`, when configured. */\r\n    linkedin: (): LinkedInProviderConfig | undefined => config.key(\"auth.providers.linkedin\"),\r\n    /** `auth.providers.apple`, when configured. */\r\n    apple: (): AppleProviderConfig | undefined => config.key(\"auth.providers.apple\"),\r\n    /** `auth.providers.facebook`, when configured. */\r\n    facebook: (): FacebookProviderConfig | undefined => config.key(\"auth.providers.facebook\"),\r\n    /** `auth.providers.x`, when configured. */\r\n    x: (): XProviderConfig | undefined => config.key(\"auth.providers.x\"),\r\n    /** An app-registered provider under `auth.providers.custom.<name>`. */\r\n    custom: (name: string): AuthProvider | undefined => {\r\n      const providers = config.key<Record<string, AuthProvider>>(\"auth.providers.custom\", {});\r\n\r\n      // Own keys only: `name` arrives from a URL, and \"constructor\" must not resolve to Object.\r\n      return Object.hasOwn(providers, name) ? providers[name] : undefined;\r\n    },\r\n    /** User attribute a verified provider email is matched against. @default \"email\" */\r\n    emailField: (): string => config.key(\"auth.providers.emailField\", \"email\"),\r\n    /** App-owned user creation for a first provider login. */\r\n    createUser: (): ProviderUserCreator | undefined => config.key(\"auth.providers.createUser\"),\r\n  },\r\n  passkeys: {\r\n    /** `auth.passkeys`; throws naming the keys when `rpID`, `rpName` or `origin` is missing. */\r\n    settings: (): PasskeysConfig => {\r\n      const settings = config.key<PasskeysConfig | undefined>(\"auth.passkeys\");\r\n\r\n      if (!settings?.rpID || !settings.rpName || !settings.origin) {\r\n        throw new Error(\r\n          \"@warlock.js/auth: passkeys need `auth.passkeys.rpID`, `auth.passkeys.rpName` and `auth.passkeys.origin`.\",\r\n        );\r\n      }\r\n\r\n      return settings;\r\n    },\r\n    /** Allowed ceremony origins, as a list. */\r\n    origins: (): string[] => {\r\n      const { origin } = authConfig.passkeys.settings();\r\n\r\n      return Array.isArray(origin) ? origin : [origin];\r\n    },\r\n    /** Challenge lifetime in ms; throws naming the key when unusable. @default \"5m\" */\r\n    challengeExpiresInMs: (): number =>\r\n      parseDuration(\r\n        \"passkeys.challengeExpiresIn\",\r\n        config.key(\"auth.passkeys.challengeExpiresIn\", DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN),\r\n      ),\r\n  },\r\n  otp: {\r\n    /** Notifications channel the code is sent through. @default \"sms\" */\r\n    channel: (): string => config.key(\"auth.otp.channel\", \"sms\"),\r\n    /** User attribute holding the phone number. @default \"phone\" */\r\n    phoneField: (): string => config.key(\"auth.otp.phoneField\", \"phone\"),\r\n    /** Code lifetime in ms; throws naming the key when unusable. @default \"5m\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\"otp.expiresIn\", config.key(\"auth.otp.expiresIn\", DEFAULT_OTP_EXPIRES_IN)),\r\n    /** Verify attempts before the code is invalidated. @default 5 */\r\n    maxAttempts: (): number => config.key(\"auth.otp.maxAttempts\", 5),\r\n    /** The message text for a code. */\r\n    message: (code: string): string => {\r\n      const build = config.key<((code: string) => string) | undefined>(\"auth.otp.message\");\r\n\r\n      return build ? build(code) : `Your verification code is ${code}`;\r\n    },\r\n    /** App-owned delivery replacing the notifications channel send. */\r\n    send: (): OtpSender | undefined => config.key(\"auth.otp.send\"),\r\n  },\r\n  refreshToken: {\r\n    /** Separate refresh secret (legacy: `auth.jwt.refresh.secret`); empty ⇒ fall back to the access secret. */\r\n    secret: (): string | undefined => resolve(\"refreshToken.secret\", \"jwt.refresh.secret\"),\r\n    /** Whether refresh tokens are enabled (legacy: `auth.jwt.refresh.enabled`). */\r\n    enabled: (): boolean => resolve(\"refreshToken.enabled\", \"jwt.refresh.enabled\", true),\r\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.refresh.expiresIn`). */\r\n    expiresIn: (): string => resolve(\"refreshToken.expiresIn\", \"jwt.refresh.expiresIn\", \"7d\"),\r\n    /**\r\n     * Lifetime in milliseconds — the only form a token issuer may use. Throws\r\n     * naming the key when the configured value is not a positive `ms` duration.\r\n     */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\"refreshToken.expiresIn\", authConfig.refreshToken.expiresIn()),\r\n    /** Rotate-on-use (legacy: `auth.jwt.refresh.rotation`). */\r\n    rotation: (): boolean => resolve(\"refreshToken.rotation\", \"jwt.refresh.rotation\", true),\r\n    /** Max active tokens per user (legacy: `auth.jwt.refresh.maxPerUser`). */\r\n    maxPerUser: (): number => resolve(\"refreshToken.maxPerUser\", \"jwt.refresh.maxPerUser\", 5),\r\n    /** Logout-without-token behavior (legacy: `auth.jwt.refresh.logoutWithoutToken`). */\r\n    logoutWithoutToken: (): LogoutWithoutTokenBehavior =>\r\n      resolve(\"refreshToken.logoutWithoutToken\", \"jwt.refresh.logoutWithoutToken\", \"revoke-all\"),\r\n  },\r\n};\r\n"],"mappings":";;;;;AA0BA,MAAM,mCAAmB,IAAI,IAAY;AAEzC,MAAM,6BAAuD;;;;;;;;;;AAW7D,MAAM,UAAU;;;;;;;;;;;;;;;;;;AAmBhB,SAAS,cAAc,KAAa,KAAsB;CACxD,IAAI;CAEJ,IAAI;EACF,SAAS,QAAQ,GAAG;CACtB,QAAQ;EAEN,SAAS;CACX;CAEA,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACtE,MAAM,IAAI,MACR,QAAQ,IAAI,IAAI,KAAK,UAAU,GAAG,EAAE,mGAEtC;CAGF,OAAO;AACT;;AAGA,MAAM,kCAAkC;;AAGxC,MAAM,oCAAoC;;AAG1C,MAAM,uCAAuC;;AAG7C,MAAM,yBAAyB;;AAG/B,MAAM,kCAAkC;;;;;;;;;AAUxC,SAAS,QAAW,QAAgB,WAAmB,UAAiB;CACtE,MAAM,UAAU,OAAO,IAAI,QAAQ,QAAQ;CAE3C,IAAI,YAAY,UAAa,YAAY,MACvC,OAAO;CAGT,MAAM,aAAa,OAAO,IAAI,QAAQ,WAAW;CAEjD,IAAI,eAAe,UAAa,eAAe,MAAM;EACnD,IAAI,CAAC,iBAAiB,IAAI,SAAS,GAAG;GACpC,iBAAiB,IAAI,SAAS;GAC9B,IAAI,KACF,QACA,sBACA,QAAQ,UAAU,4BAA4B,QAChD;EACF;EAEA,OAAO;CACT;CAEA,OAAO;AACT;;;;;;AAOA,MAAa,aAAa;CACxB,iBAAiB,OAAO,SAAiC;EAMvD,OALwB,OAAO,IAC7B,wBACA,oBAGmB,CAAC,CAAC,IAAI;CAC7B;CACA,aAAa;;EAEX,cAAsB;GACpB,MAAM,SAAS,QAA4B,sBAAsB,YAAY;GAE7E,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,iEAAiE;GAGnF,OAAO;EACT;;EAEA,iBAA4B,QAAQ,yBAAyB,iBAAiB,OAAO;;EAErF,iBAAqC,QAAQ,yBAAyB,eAAe;;;;;;EAMrF,mBACE,cACE,yBACA,WAAW,YAAY,UAAU,KAAK,+BACxC;CACJ;CACA,UAAU;;;;;;;;;;EAUR,iBAAqC,OAAO,IAAI,yBAAyB;;;;;;EAMzE,sBAA8B,OAAO,IAAI,gCAAgC,WAAW;CACtF;CACA,QAAQ;;EAEN,YAAoB,OAAO,IAAI,oBAAoB,cAAc;;EAEjE,mBAA2B,OAAO,IAAI,2BAA2B,eAAe;;EAEhF,YAAoB,OAAO,IAAI,oBAAoB,GAAG;CACxD;CACA,MAAM;;;;;AAKJ,sBAAgC,OAAO,IAAI,4BAA4B,CAAC,CAAC,EAC3E;CACA,cAAc;;EAEZ,mBACE,cACE,0BACA,OAAO,IAAI,+BAA+B,+BAA+B,CAC3E;;EAEF,aAAqB,OAAO,IAAI,2BAA2B,iBAAiB;;EAE5E,oBAAkD,OAAO,IAAI,gCAAgC;;EAE7F,WAA+C,OAAO,IAAI,uBAAuB;CACnF;CACA,eAAe;;EAEb,mBACE,cACE,2BACA,OAAO,IAAI,gCAAgC,iCAAiC,CAC9E;;EAEF,uBAA+B,OAAO,IAAI,sCAAsC,OAAO;;EAEvF,oBAAkD,OAAO,IAAI,iCAAiC;;EAE9F,WAA+C,OAAO,IAAI,wBAAwB;;EAElF,mBAA+C,OAAO,IAAI,gCAAgC;CAC5F;CACA,WAAW;;EAET,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,eAAkD,OAAO,IAAI,wBAAwB;;EAErF,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,aAA8C,OAAO,IAAI,sBAAsB;;EAE/E,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,SAAsC,OAAO,IAAI,kBAAkB;;EAEnE,SAAS,SAA2C;GAClD,MAAM,YAAY,OAAO,IAAkC,yBAAyB,CAAC,CAAC;GAGtF,OAAO,OAAO,OAAO,WAAW,IAAI,IAAI,UAAU,QAAQ;EAC5D;;EAEA,kBAA0B,OAAO,IAAI,6BAA6B,OAAO;;EAEzE,kBAAmD,OAAO,IAAI,2BAA2B;CAC3F;CACA,UAAU;;EAER,gBAAgC;GAC9B,MAAM,WAAW,OAAO,IAAgC,eAAe;GAEvE,IAAI,CAAC,UAAU,QAAQ,CAAC,SAAS,UAAU,CAAC,SAAS,QACnD,MAAM,IAAI,MACR,0GACF;GAGF,OAAO;EACT;;EAEA,eAAyB;GACvB,MAAM,EAAE,WAAW,WAAW,SAAS,SAAS;GAEhD,OAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;EACjD;;EAEA,4BACE,cACE,+BACA,OAAO,IAAI,oCAAoC,oCAAoC,CACrF;CACJ;CACA,KAAK;;EAEH,eAAuB,OAAO,IAAI,oBAAoB,KAAK;;EAE3D,kBAA0B,OAAO,IAAI,uBAAuB,OAAO;;EAEnE,mBACE,cAAc,iBAAiB,OAAO,IAAI,sBAAsB,sBAAsB,CAAC;;EAEzF,mBAA2B,OAAO,IAAI,wBAAwB,CAAC;;EAE/D,UAAU,SAAyB;GACjC,MAAM,QAAQ,OAAO,IAA4C,kBAAkB;GAEnF,OAAO,QAAQ,MAAM,IAAI,IAAI,6BAA6B;EAC5D;;EAEA,YAAmC,OAAO,IAAI,eAAe;CAC/D;CACA,cAAc;;EAEZ,cAAkC,QAAQ,uBAAuB,oBAAoB;;EAErF,eAAwB,QAAQ,wBAAwB,uBAAuB,IAAI;;EAEnF,iBAAyB,QAAQ,0BAA0B,yBAAyB,IAAI;;;;;EAKxF,mBACE,cAAc,0BAA0B,WAAW,aAAa,UAAU,CAAC;;EAE7E,gBAAyB,QAAQ,yBAAyB,wBAAwB,IAAI;;EAEtF,kBAA0B,QAAQ,2BAA2B,0BAA0B,CAAC;;EAExF,0BACE,QAAQ,mCAAmC,kCAAkC,YAAY;CAC7F;AACF"}

package/esm/services/auth.service.d.mts

@@ -2,7 +2,7 @@ import { Auth } from "../models/auth.model.mjs";
 import { AccessToken } from "../models/access-token/access-token.model.mjs";
 import { AccessTokenOutput, AuthCredentials, ClearAuthCookieOptions, DeviceInfo, LoginResult, SetAuthCookieOptions, TokenPair } from "../contracts/types.mjs";
 import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
-import { Response } from "@warlock.js/core";
+import { Request, Response } from "@warlock.js/core";
 import { ChildModel } from "@warlock.js/cascade";
 
 //#region ../auth/src/services/auth.service.d.ts
@@ -68,7 +68,14 @@ declare class AuthService {
   renewAutomaticSession(refreshTokenString: string, expectedUserType: string, options?: {
     overlapMs?: number;
     deviceInfo?: DeviceInfo;
+    maxAgeMs?: number;
   }): Promise<TokenPair | null>;
+  /**
+   * Whether the family's first issue is older than `maxAgeMs`. The start is the
+   * family row's `created_at`, falling back to its oldest refresh token when
+   * the row carries none (an upserted legacy family).
+   */
+  private familyExceedsMaxAge;
   private automaticOverlapMs;
   private refreshIdentityMatches;
   private hasSuccessor;
@@ -102,6 +109,14 @@ declare class AuthService {
    * Never call this for a user you have not authenticated.
    */
   completeLogin<T extends Auth>(user: T, deviceInfo?: DeviceInfo): Promise<LoginResult<T>>;
+  /**
+   * Cookie login for a browser: same-origin check, credential login, then both
+   * session cookies. Unlike the default CSRF guard, the Origin/Referer check
+   * runs even when the request carries no cookies (login CSRF): a missing or
+   * cross-site Origin/Referer throws `CsrfOriginMismatchError` before any
+   * credential is looked at. Returns `null` on bad credentials.
+   */
+  loginWithSessionCookies<T extends Auth>(request: Request, response: Response, Model: ChildModel<T>, credentials: AuthCredentials, deviceInfo?: DeviceInfo): Promise<LoginResult<T> | null>;
   /** The one token-issuing tail every login method shares. */
   private finalizeLogin;
   /**
@@ -213,6 +228,26 @@ declare class AuthService {
    * authService.clearAuthCookie(response);
    */
   clearAuthCookie(response: Response, options?: ClearAuthCookieOptions): void;
+  /**
+   * Write the access and refresh cookies of a browser session. Both are
+   * `HttpOnly`, `SameSite=Lax`, `Path=/` (the refresh cookie must reach every
+   * page) and `Secure` outside development, named by `auth.cookie.name` and
+   * `auth.cookie.refreshName`. Each `Max-Age` is derived from its token's
+   * `expiresAt`, so the cookie lives exactly as long as the token.
+   *
+   * @example
+   * const { tokens } = await authService.login(User, credentials);
+   * authService.setSessionCookies(response, tokens);
+   */
+  setSessionCookies(response: Response, tokens: {
+    accessToken: AccessTokenOutput;
+    refreshToken: AccessTokenOutput;
+  }): void;
+  /**
+   * Clear both session cookies {@link setSessionCookies} wrote, on `Path=/`.
+   * Pair it with {@link logout} after the token rows are revoked.
+   */
+  clearSessionCookies(response: Response): void;
 }
 declare const authService: AuthService;
 //#endregion

package/esm/services/auth.service.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.mts","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"mappings":";;;;;;;;cAiCM,WAAA;;;;AAViD;;;cAiBzC,gBAAA;EAqBgC;;;EAAA,YAdhC,iBAAA;EA6DA;;;EAAA,YAtDA,iBAAA;EAwIG;;;EAjIR,uBAAA,CAAwB,IAAA,EAAM,IAAA,GAAO,MAAA;EA8LU;EArLzC,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EAAA,QAI5B,qBAAA;EAAA,QAMA,gBAAA;EA+LH;;;;;EArKE,mBAAA,CACX,IAAA,EAAM,IAAA,EACN,OAAA,GAAU,MAAA,oBACT,OAAA,CAAQ,iBAAA;EAAA,QAMG,iBAAA;EA0asB;;;;;;EAAA,QAjYtB,qBAAA;EAqaM;;;;EArYP,kBAAA,CACX,IAAA,EAAM,IAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,YAAA;EAAA,QAcG,cAAA;EAuXX;;;EAzUU,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EA+VpD;;;;;EA9UV,aAAA,CACX,kBAAA,UACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,SAAA;EA0YgD;;;;;EAhT9C,qBAAA,CACX,kBAAA,UACA,gBAAA,UACA,OAAA;IAAW,SAAA;IAAoB,UAAA,GAAa,UAAA;EAAA,IAC3C,OAAA,CAAQ,SAAA;EAAA,QAiGH,kBAAA;EAAA,QAMA,sBAAA;EAAA,QAWA,YAAA;EAAA,QAMA,sBAAA;EAAA,QAOM,sBAAA;EA2WsC;;;EAzUvC,cAAA,CAAe,aAAA,UAAuB,cAAA,WAAyB,OAAA;EAoXjE;;;EA7WE,YAAA,CAAa,QAAA,WAAmB,OAAA;EAqYkC;;;;EA7XlE,YAAA,WAAuB,IAAA,EAClC,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,IAAA,EAAM,eAAA,GACL,OAAA,CAAQ,CAAA;EAne0B;;;;EAmgBxB,KAAA,WAAgB,IAAA,EAC3B,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,EAAa,eAAA,EACb,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA9fM;;;;;;;;;EAihBhB,aAAA,WAAwB,IAAA,EACnC,IAAA,EAAM,CAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA7eZ;EAAA,QAofG,aAAA;EArcA;;;;;;;;;;EAgeD,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,WAAA,WAAsB,YAAA,YAAwB,OAAA;EAjYjD;;;EA8ZhB,iBAAA,CAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EA9ZgB;;;EAqa9D,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAA;EAlZ9C;;;EAyZW,kBAAA,CAAmB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EA7T1D;;;;;EAsUW,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EAnUvC;;;EAkWU,iBAAA,CAAkB,QAAA,WAAmB,OAAA;EAhP1C;;;;;;EAyTK,oBAAA,IAAwB,OAAA;EAnQxB;;;;;;;;;;EA4RA,uBAAA,IAA2B,OAAA;IACtC,YAAA,EAAc,WAAA;IACd,aAAA,EAAe,YAAA;EAAA;EAnPE;;;;;;;;EAmQN,wBAAA,IAA4B,OAAA;IACvC,YAAA;IACA,aAAA;EAAA;EA9OW;;;EAgQA,iBAAA,CAAkB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EA/PlD;;;;;EAAA,QAwQM,qBAAA;EA/PM;;;;;;;;;;;;;;;;;;;;;EA8RP,aAAA,CACL,QAAA,EAAU,QAAA,EACV,KAAA,WAAgB,iBAAA,EAChB,OAAA,GAAS,oBAAA;EAlNwB;;;;;;;;;;EA0O5B,eAAA,CAAgB,QAAA,EAAU,QAAA,EAAU,OAAA,GAAS,sBAAA;AAAA;AAAA,cAQzC,WAAA,EAAW,WAAoB"}
+{"version":3,"file":"auth.service.d.mts","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"mappings":";;;;;;;;cAmCM,WAAA;;;;AAViD;;;cAiBzC,gBAAA;EAqBgC;;;EAAA,YAdhC,iBAAA;EA6DA;;;EAAA,YAtDA,iBAAA;EAwIG;;;EAjIR,uBAAA,CAAwB,IAAA,EAAM,IAAA,GAAO,MAAA;EA8LU;EArLzC,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EAAA,QAI5B,qBAAA;EAAA,QAMA,gBAAA;EA+LH;;;;;EArKE,mBAAA,CACX,IAAA,EAAM,IAAA,EACN,OAAA,GAAU,MAAA,oBACT,OAAA,CAAQ,iBAAA;EAAA,QAMG,iBAAA;EA8csB;;;;;;EAAA,QAratB,qBAAA;EAycM;;;;EAzaP,kBAAA,CACX,IAAA,EAAM,IAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,YAAA;EAAA,QAcG,cAAA;EA2ZX;;;EA7WU,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EAmYpD;;;;;EAlXV,aAAA,CACX,kBAAA,UACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,SAAA;EA+XS;;;;;EArSP,qBAAA,CACX,kBAAA,UACA,gBAAA,UACA,OAAA;IAAW,SAAA;IAAoB,UAAA,GAAa,UAAA;IAAY,QAAA;EAAA,IACvD,OAAA,CAAQ,SAAA;EAgXgD;;;;;EAAA,QAjQ7C,mBAAA;EAAA,QAsBN,kBAAA;EAAA,QAMA,sBAAA;EAAA,QAWA,YAAA;EAAA,QAMA,sBAAA;EAAA,QAOM,sBAAA;EAqW0B;;;EAnU3B,cAAA,CAAe,aAAA,UAAuB,cAAA,WAAyB,OAAA;EAyWhC;;;EAlW/B,YAAA,CAAa,QAAA,WAAmB,OAAA;EAqaZ;;;;EA7ZpB,YAAA,WAAuB,IAAA,EAClC,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,IAAA,EAAM,eAAA,GACL,OAAA,CAAQ,CAAA;EAsc0B;;;;EAtaxB,KAAA,WAAgB,IAAA,EAC3B,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,EAAa,eAAA,EACb,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EAljBX;;;;;;;;;EAqkBC,aAAA,WAAwB,IAAA,EACnC,IAAA,EAAM,CAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA9iBT;;;;;;;EA2jBD,uBAAA,WAAkC,IAAA,EAC7C,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA,EACV,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,EAAa,eAAA,EACb,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA9hBT;EAAA,QAkjBA,aAAA;EAzeD;;;;;;;;;;EAogBA,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,WAAA,WAAsB,YAAA,YAAwB,OAAA;EArcxB;;;EAkezC,iBAAA,CAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EAjd9C;;;EAwdA,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAA;EArd7C;;;EA4dU,kBAAA,CAAmB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EAhY1D;;;;;EAyYW,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EAvYvC;;;EAsaU,iBAAA,CAAkB,QAAA,WAAmB,OAAA;EA3R1C;;;;;;EAoWK,oBAAA,IAAwB,OAAA;EA1SuC;;;;;;;;;;EAmU/D,uBAAA,IAA2B,OAAA;IACtC,YAAA,EAAc,WAAA;IACd,aAAA,EAAe,YAAA;EAAA;EAnRJ;;;;;;;;EAmSA,wBAAA,IAA4B,OAAA;IACvC,YAAA;IACA,aAAA;EAAA;EAjSqB;;;EAmTV,iBAAA,CAAkB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EA/R5C;;;;;EAAA,QAwSA,qBAAA;EAtSe;;;;;;;;;;;;;;;;;;;;;EAqUhB,aAAA,CACL,QAAA,EAAU,QAAA,EACV,KAAA,WAAgB,iBAAA,EAChB,OAAA,GAAS,oBAAA;EAtQqB;;;;;;;;;;EA8RzB,eAAA,CAAgB,QAAA,EAAU,QAAA,EAAU,OAAA,GAAS,sBAAA;EA1PJ;;;;;;;;;;;EA4QzC,iBAAA,CACL,QAAA,EAAU,QAAA,EACV,MAAA;IAAU,WAAA,EAAa,iBAAA;IAAmB,YAAA,EAAc,iBAAA;EAAA;EA7H7C;;;;EAqJN,mBAAA,CAAoB,QAAA,EAAU,QAAA;AAAA;AAAA,cAM1B,WAAA,EAAW,WAAoB"}

package/esm/services/auth.service.mjs

@@ -1,3 +1,4 @@
+import { assertCsrfOriginAllowed } from "../middleware/csrf-origin-check.mjs";
 import { AccessToken } from "../models/access-token/access-token.model.mjs";
 import "../models/access-token/index.mjs";
 import { AuthTokenFamily } from "../models/auth-token-family/auth-token-family.model.mjs";
@@ -232,6 +233,10 @@ var AuthService = class {
 				await this.revokeTokenFamily(oldToken.familyId);
 				return null;
 			}
+			if (options.maxAgeMs !== void 0 && await this.familyExceedsMaxAge(oldToken.familyId, options.maxAgeMs)) {
+				await this.revokeTokenFamily(oldToken.familyId);
+				return null;
+			}
 			const UserModel = config.key(`auth.userType.${decoded.userType}`);
 			if (!UserModel) throw new Error(`User type ${decoded.userType} is unknown type.`);
 			const user = await UserModel.find(decoded.userId);
@@ -263,6 +268,18 @@ var AuthService = class {
 			throw error;
 		});
 	}
+	/**
+	* Whether the family's first issue is older than `maxAgeMs`. The start is the
+	* family row's `created_at`, falling back to its oldest refresh token when
+	* the row carries none (an upserted legacy family).
+	*/
+	async familyExceedsMaxAge(familyId, maxAgeMs) {
+		let started = (await AuthTokenFamily.findByFamilyId(familyId))?.get("created_at");
+		if (!started) started = (await this.refreshTokenModel.query().where({ family_id: familyId }).orderBy("created_at", "asc").first())?.get("created_at");
+		const startedAt = started ? new Date(started).getTime() : NaN;
+		if (!Number.isFinite(startedAt)) return false;
+		return Date.now() - startedAt > maxAgeMs;
+	}
 	automaticOverlapMs(overlapMs) {
 		return typeof overlapMs === "number" && Number.isFinite(overlapMs) ? Math.max(0, Math.min(1e4, overlapMs)) : 5e3;
 	}
@@ -355,6 +372,24 @@ var AuthService = class {
 		await this.assertCanAuthenticate(user);
 		return this.finalizeLogin(user, deviceInfo);
 	}
+	/**
+	* Cookie login for a browser: same-origin check, credential login, then both
+	* session cookies. Unlike the default CSRF guard, the Origin/Referer check
+	* runs even when the request carries no cookies (login CSRF): a missing or
+	* cross-site Origin/Referer throws `CsrfOriginMismatchError` before any
+	* credential is looked at. Returns `null` on bad credentials.
+	*/
+	async loginWithSessionCookies(request, response, Model, credentials, deviceInfo) {
+		assertCsrfOriginAllowed(request);
+		const result = await this.login(Model, credentials, deviceInfo);
+		if (!result) return null;
+		if (result.tokens.refreshToken) this.setSessionCookies(response, {
+			accessToken: result.tokens.accessToken,
+			refreshToken: result.tokens.refreshToken
+		});
+		else this.setAuthCookie(response, result.tokens.accessToken);
+		return result;
+	}
 	/** The one token-issuing tail every login method shares. */
 	async finalizeLogin(user, deviceInfo) {
 		if (!authConfig.refreshToken.enabled()) return {
@@ -580,6 +615,38 @@ var AuthService = class {
 		const path = options.path ?? authConfig.cookie.path();
 		response.clearCookie(name, { path });
 	}
+	/**
+	* Write the access and refresh cookies of a browser session. Both are
+	* `HttpOnly`, `SameSite=Lax`, `Path=/` (the refresh cookie must reach every
+	* page) and `Secure` outside development, named by `auth.cookie.name` and
+	* `auth.cookie.refreshName`. Each `Max-Age` is derived from its token's
+	* `expiresAt`, so the cookie lives exactly as long as the token.
+	*
+	* @example
+	* const { tokens } = await authService.login(User, credentials);
+	* authService.setSessionCookies(response, tokens);
+	*/
+	setSessionCookies(response, tokens) {
+		const cookies = [[authConfig.cookie.name(), tokens.accessToken], [authConfig.cookie.refreshName(), tokens.refreshToken]];
+		for (const [name, token] of cookies) {
+			const maxAge = this.cookieMaxAgeFromToken(token);
+			response.cookie(name, token.token, {
+				raw: true,
+				httpOnly: true,
+				sameSite: "lax",
+				path: "/",
+				...maxAge !== void 0 ? { maxAge } : {}
+			});
+		}
+	}
+	/**
+	* Clear both session cookies {@link setSessionCookies} wrote, on `Path=/`.
+	* Pair it with {@link logout} after the token rows are revoked.
+	*/
+	clearSessionCookies(response) {
+		response.clearCookie(authConfig.cookie.name(), { path: "/" });
+		response.clearCookie(authConfig.cookie.refreshName(), { path: "/" });
+	}
 };
 const authService = new AuthService();
 

package/esm/services/auth.service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"sourcesContent":["import { Random } from \"@mongez/reinforcements\";\r\nimport { randomUUID } from \"node:crypto\";\r\nimport type { ChildModel } from \"@warlock.js/cascade\";\r\nimport {\r\n  config,\r\n  ForbiddenError,\r\n  hashPassword,\r\n  type Response,\r\n  verifyPassword,\r\n} from \"@warlock.js/core\";\r\nimport type {\r\n  AccessTokenOutput,\r\n  AuthCredentials,\r\n  ClearAuthCookieOptions,\r\n  DeviceInfo,\r\n  LoginResult,\r\n  SetAuthCookieOptions,\r\n  TokenPair,\r\n} from \"../contracts/types\";\r\nimport { AccessToken } from \"../models/access-token\";\r\nimport type { Auth } from \"../models/auth.model\";\r\nimport { AuthTokenFamily } from \"../models/auth-token-family\";\r\nimport { OneTimeToken } from \"../models/one-time-token\";\r\nimport { RefreshToken } from \"../models/refresh-token\";\r\nimport { authConfig } from \"./auth-config\";\r\nimport { authEvents } from \"./auth-events\";\r\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\r\nimport {\r\n  afterTokenFamilyOperation,\r\n  runTokenFamilyOperation,\r\n  TokenFamilyUnavailableError,\r\n} from \"./token-family-operation\";\r\n\r\nclass AuthService {\r\n  /**\r\n   * Resolve the active access-token model — the package default, or a subclass\r\n   * an app registered under `config.auth.accessToken.model` (e.g. to add a\r\n   * tenant column). The service never references the concrete class directly so\r\n   * an override is a pure config change.\r\n   */\r\n  private get accessTokenModel(): typeof AccessToken {\r\n    return config.key(\"auth.accessToken.model\", AccessToken);\r\n  }\r\n\r\n  /**\r\n   * Resolve the active refresh-token model (default or registered override).\r\n   */\r\n  private get refreshTokenModel(): typeof RefreshToken {\r\n    return config.key(\"auth.refreshToken.model\", RefreshToken);\r\n  }\r\n\r\n  /**\r\n   * Resolve the active one-time-token model (default or registered override).\r\n   */\r\n  private get oneTimeTokenModel(): typeof OneTimeToken {\r\n    return config.key(\"auth.oneTimeToken.model\", OneTimeToken);\r\n  }\r\n\r\n  /**\r\n   * Build the default access-token JWT payload from a user.\r\n   */\r\n  public buildAccessTokenPayload(user: Auth): Record<string, unknown> {\r\n    return {\r\n      id: user.id,\r\n      userType: user.userType,\r\n      created_at: Date.now(),\r\n    };\r\n  }\r\n\r\n  /** One policy seam keeps account-state checks identical across all auth paths. */\r\n  public async canAuthenticate(user: Auth): Promise<boolean> {\r\n    return authConfig.canAuthenticate(user);\r\n  }\r\n\r\n  private async assertCanAuthenticate(user: Auth): Promise<void> {\r\n    if (!(await this.canAuthenticate(user))) {\r\n      throw new ForbiddenError(\"This user cannot authenticate.\");\r\n    }\r\n  }\r\n\r\n  private async issueAccessToken(\r\n    user: Auth,\r\n    payload?: Record<string, unknown>,\r\n    familyId?: string,\r\n  ): Promise<AccessTokenOutput> {\r\n    const data = { ...(payload || this.buildAccessTokenPayload(user)), jti: randomUUID() };\r\n    // Validate before signing so an unusable lifetime cannot mint an immortal token.\r\n    const expiresIn = authConfig.accessToken.expiresInMs();\r\n\r\n    const token = await jwt.generate(data, { expiresIn });\r\n    const expiresAt = new Date(Date.now() + expiresIn);\r\n\r\n    if (familyId) {\r\n      await this.accessTokenModel.issue(user, token, expiresAt, familyId);\r\n    } else {\r\n      await this.accessTokenModel.issue(user, token, expiresAt);\r\n    }\r\n\r\n    return { token, expiresAt: expiresAt.toISOString() };\r\n  }\r\n\r\n  /**\r\n   * Sign + persist an access token for the user and return the token with its\r\n   * expiry. The expiry is computed locally from `expiresIn` rather than by\r\n   * re-verifying the token we just signed.\r\n   */\r\n  public async generateAccessToken(\r\n    user: Auth,\r\n    payload?: Record<string, unknown>,\r\n  ): Promise<AccessTokenOutput> {\r\n    await this.assertCanAuthenticate(user);\r\n\r\n    return this.issueAccessToken(user, payload);\r\n  }\r\n\r\n  private async issueRefreshToken(\n    user: Auth,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<RefreshToken | undefined> {\r\n    if (!authConfig.refreshToken.enabled()) return;\r\n\r\n    // Validate the lifetime first — before the per-user cap is enforced, before\r\n    // anything is signed — so a bad value can never revoke a user's oldest\r\n    // session on its way to failing.\r\n    const expiresIn = authConfig.refreshToken.expiresInMs();\r\n\r\n    const familyId = deviceInfo?.familyId || Random.string(32);\r\n\r\n    const family = await AuthTokenFamily.ensure(user, familyId);\r\n\r\n    if (family.isRevoked) {\r\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\r\n    }\r\n\r\n    const payload = {\r\n      userId: user.id,\r\n      userType: user.userType,\r\n      familyId,\r\n      jti: randomUUID(),\r\n    };\r\n\r\n    const expiresAt = new Date(Date.now() + expiresIn).toISOString();\r\n\r\n    await this.refreshTokenModel.enforceMax(user, authConfig.refreshToken.maxPerUser());\r\n\r\n    const token = await jwt.generateRefreshToken(payload, { expiresIn });\r\n\r\n    return this.refreshTokenModel.issue(user, token, { familyId, expiresAt, deviceInfo });\n  }\n\n  /**\n   * Keep issuance into an explicitly reused family in the same durable\n   * transition boundary as rotation and revocation. A new, caller-unspecified\n   * family has no concurrent session to protect and retains the lightweight\n   * issuance path.\n   */\n  private async issueInSuppliedFamily<T>(\n    user: Auth,\n    familyId: string,\n    issue: () => Promise<T>,\n  ): Promise<T> {\n    // Preserve the established error for a family that was already revoked\n    // before issuance started. The coordinator covers a revoke that races\n    // after this observation.\n    const family = await AuthTokenFamily.ensure(user, familyId);\n\n    if (family.isRevoked) {\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\n    }\n\n    try {\n      return await runTokenFamilyOperation(familyId, async () => issue());\n    } catch (error) {\n      // Do not expose a timing-dependent error shape to callers: a family\n      // revoked between ensure() and the transaction is the same unusable\n      // family condition as one found above.\n      if (error instanceof TokenFamilyUnavailableError) {\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\n      }\n\n      throw error;\n    }\n  }\n\r\n  /**\r\n   * Sign + persist a refresh token for the user (enforcing the per-user cap\r\n   * first). Resolves to `undefined` when refresh tokens are disabled in config.\r\n   */\r\n  public async createRefreshToken(\r\n    user: Auth,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<RefreshToken | undefined> {\r\n    if (!authConfig.refreshToken.enabled()) return;\n\n    await this.assertCanAuthenticate(user);\n\n    if (deviceInfo?.familyId) {\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, () =>\n        this.issueRefreshToken(user, deviceInfo),\n      );\n    }\n\n    return this.issueRefreshToken(user, deviceInfo);\n  }\r\n\r\n  private async issueTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\r\n    const refreshEnabled = authConfig.refreshToken.enabled();\r\n    const familyId = deviceInfo?.familyId || Random.string(32);\r\n\r\n    if (refreshEnabled) {\r\n      const family = await AuthTokenFamily.ensure(user, familyId);\r\n\r\n      if (family.isRevoked) {\r\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\r\n      }\r\n    }\r\n\r\n    const accessToken = await this.issueAccessToken(\r\n      user,\r\n      deviceInfo?.payload,\r\n      refreshEnabled ? familyId : undefined,\r\n    );\r\n    const refreshToken = await this.issueRefreshToken(\r\n      user,\r\n      refreshEnabled ? { ...deviceInfo, familyId } : deviceInfo,\r\n    );\r\n\r\n    const tokenPair: TokenPair = {\r\n      accessToken,\r\n      refreshToken: refreshToken\r\n        ? {\r\n            token: refreshToken.get(\"token\"),\r\n            expiresAt: refreshToken.get(\"expires_at\"),\r\n          }\r\n        : undefined,\r\n    };\r\n\r\n    afterTokenFamilyOperation(() => authEvents.emit(\"token.created\", user, tokenPair));\r\n\r\n    if (refreshToken) {\r\n      afterTokenFamilyOperation(() =>\r\n        authEvents.emit(\"session.created\", user, refreshToken, deviceInfo),\r\n      );\r\n    }\r\n\r\n    return tokenPair;\r\n  }\r\n\r\n  /**\r\n   * Issue both an access and a refresh token, emitting the creation events.\r\n   */\r\n  public async createTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    await this.assertCanAuthenticate(user);\n\n    if (authConfig.refreshToken.enabled() && deviceInfo?.familyId) {\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, () =>\n        this.issueTokenPair(user, deviceInfo),\n      );\n    }\n\n    return this.issueTokenPair(user, deviceInfo);\n  }\n\r\n  /**\r\n   * Exchange a refresh token for a new token pair, with rotation + replay\r\n   * detection. A concurrent reuse of the same token loses the atomic revoke and\r\n   * is treated as a breach — the whole family is revoked and the request fails.\r\n   */\r\n  public async refreshTokens(\r\n    refreshTokenString: string,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<TokenPair | null> {\r\n    let decoded: {\r\n      userId: number;\r\n      userType: string;\r\n      familyId: string;\r\n    } | null;\r\n\r\n    try {\r\n      decoded = await jwt.verifyRefreshToken<{\r\n        userId: number;\r\n        userType: string;\r\n        familyId: string;\r\n      }>(refreshTokenString);\r\n    } catch (error) {\r\n      if (isInvalidCredentialError(error)) return null;\r\n\r\n      throw error;\r\n    }\r\n\r\n    if (!decoded) return null;\r\n\r\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\r\n\r\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\r\n\r\n    await AuthTokenFamily.ensure(\r\n      { id: decoded.userId, userType: decoded.userType } as Auth,\r\n      presentedToken.familyId,\r\n    );\r\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\r\n      // Each serializable attempt must read the current row in its own snapshot.\r\n      const refreshToken = await this.refreshTokenModel.findByToken(refreshTokenString);\r\n      if (!refreshToken || !this.refreshIdentityMatches(refreshToken, decoded)) return null;\r\n      if (!refreshToken.isValid) {\r\n        // An already-invalid token may be a replay of a rotated credential.\r\n        if (refreshToken) {\r\n          await this.revokeTokenFamily(refreshToken.familyId);\r\n        }\r\n\r\n        return null;\r\n      }\r\n\r\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\r\n\r\n      if (!UserModel) {\r\n        throw new Error(`User type ${decoded.userType} is unknown type.`);\r\n      }\r\n\r\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\r\n\r\n      if (!user) return null;\r\n\r\n      if (!(await this.canAuthenticate(user))) return null;\r\n\r\n      const rotationEnabled = authConfig.refreshToken.rotation();\r\n\r\n      if (rotationEnabled) {\r\n        const won = await refreshToken.revokeIfActive();\r\n\r\n        if (!won) {\r\n          // A concurrent request already rotated this token.\r\n          await this.revokeTokenFamily(refreshToken.familyId);\r\n\r\n          return null;\r\n        }\r\n      } else {\r\n        await refreshToken.markAsUsed();\r\n      }\r\n\r\n      const newTokenPair = await this.issueTokenPair(user, {\r\n        ...deviceInfo,\r\n        familyId: refreshToken.familyId,\r\n      });\r\n\r\n      afterTokenFamilyOperation(() =>\r\n        authEvents.emit(\"token.refreshed\", user, newTokenPair, refreshToken),\r\n      );\r\n\r\n      return newTokenPair;\r\n    }).catch((error) => {\r\n      if (error instanceof TokenFamilyUnavailableError) return null;\r\n      throw error;\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Opt-in browser-session renewal. Unlike {@link refreshTokens}, this permits\r\n   * a short duplicate presentation to receive the exact committed successor\r\n   * pair. It is deliberately not used by the legacy/public refresh API.\r\n   */\r\n  public async renewAutomaticSession(\r\n    refreshTokenString: string,\r\n    expectedUserType: string,\r\n    options: { overlapMs?: number; deviceInfo?: DeviceInfo } = {},\r\n  ): Promise<TokenPair | null> {\r\n    let decoded: { userId: number; userType: string; familyId: string } | null;\r\n    try {\r\n      decoded = await jwt.verifyRefreshToken<{\r\n        userId: number;\r\n        userType: string;\r\n        familyId: string;\r\n      }>(refreshTokenString);\r\n    } catch (error) {\r\n      if (isInvalidCredentialError(error)) return null;\r\n      throw error;\r\n    }\r\n\r\n    if (!decoded || decoded.userType !== expectedUserType) return null;\r\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\r\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\r\n\r\n    await AuthTokenFamily.ensure(\r\n      { id: decoded.userId, userType: decoded.userType } as Auth,\r\n      presentedToken.familyId,\r\n    );\r\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\r\n      // A retry can follow another process's committed rotation. Never reuse\r\n      // a model captured before the transaction or before a failed attempt.\r\n      const oldToken = await this.refreshTokenModel.findByToken(refreshTokenString);\r\n      if (!oldToken || !this.refreshIdentityMatches(oldToken, decoded)) return null;\r\n      if (!oldToken.isValid) {\r\n        const successor = await this.readAutomaticSuccessor(oldToken, decoded, options.overlapMs);\r\n        if (successor) return successor;\r\n        if (\r\n          this.isAutomaticOverlapOpen(oldToken, options.overlapMs) &&\r\n          this.hasSuccessor(oldToken)\r\n        ) {\r\n          return null;\r\n        }\r\n        await this.revokeTokenFamily(oldToken.familyId);\r\n        return null;\r\n      }\r\n\r\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\r\n      if (!UserModel) throw new Error(`User type ${decoded.userType} is unknown type.`);\r\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\r\n      if (!user || !(await this.canAuthenticate(user))) return null;\r\n\r\n      if (!(await oldToken.revokeIfActive())) {\r\n        // A newer successor is never substituted here. A stale automatic\r\n        // response must fail quietly rather than revoke a legitimate family.\r\n        const currentToken = await this.refreshTokenModel.findByToken(refreshTokenString);\r\n        if (!currentToken) return null;\r\n        const successor = await this.readAutomaticSuccessor(\r\n          currentToken,\r\n          decoded,\r\n          options.overlapMs,\r\n        );\r\n        if (successor) return successor;\r\n        if (\r\n          this.isAutomaticOverlapOpen(currentToken, options.overlapMs) &&\r\n          this.hasSuccessor(currentToken)\r\n        )\r\n          return null;\r\n        await this.revokeTokenFamily(oldToken.familyId);\r\n        return null;\r\n      }\r\n\r\n      const pair = await this.issueTokenPair(user, {\r\n        ...options.deviceInfo,\r\n        familyId: oldToken.familyId,\r\n      });\r\n      const successorAccess = await this.accessTokenModel.findByToken(pair.accessToken.token);\r\n      const successorRefresh = pair.refreshToken\r\n        ? await this.refreshTokenModel.findByToken(pair.refreshToken.token)\r\n        : null;\r\n      if (!successorAccess || !successorRefresh) {\r\n        throw new Error(\"Automatic renewal did not persist a complete successor pair\");\r\n      }\r\n\r\n      // `revokeIfActive()` updates the database, not this hydrated instance.\r\n      // Saving that stale instance would write its old `revoked_at: null` back\r\n      // and reopen the predecessor. Update only the successor columns instead.\r\n      const linked = await this.refreshTokenModel.atomic(\r\n        { id: oldToken.id },\r\n        {\r\n          $set: {\r\n            successor_access_token_id: successorAccess.id,\r\n            successor_refresh_token_id: successorRefresh.id,\r\n          },\r\n        },\r\n      );\r\n      if (linked !== 1) throw new Error(\"Automatic renewal could not link its successor pair\");\r\n      afterTokenFamilyOperation(() => authEvents.emit(\"token.refreshed\", user, pair, oldToken));\r\n      return pair;\r\n    }).catch((error) => {\r\n      if (error instanceof TokenFamilyUnavailableError) return null;\r\n      throw error;\r\n    });\r\n  }\r\n\r\n  private automaticOverlapMs(overlapMs: number | undefined): number {\r\n    return typeof overlapMs === \"number\" && Number.isFinite(overlapMs)\r\n      ? Math.max(0, Math.min(10_000, overlapMs))\r\n      : 5000;\r\n  }\r\n\r\n  private refreshIdentityMatches(\r\n    token: RefreshToken,\r\n    decoded: { userId: string | number; userType: string; familyId: string },\r\n  ): boolean {\r\n    return (\r\n      token.familyId === decoded.familyId &&\r\n      token.get(\"user_id\") === decoded.userId &&\r\n      token.get(\"user_type\") === decoded.userType\r\n    );\r\n  }\r\n\r\n  private hasSuccessor(oldToken: RefreshToken): boolean {\r\n    return Boolean(\r\n      oldToken.get(\"successor_access_token_id\") && oldToken.get(\"successor_refresh_token_id\"),\r\n    );\r\n  }\r\n\r\n  private isAutomaticOverlapOpen(oldToken: RefreshToken, overlapMs: number | undefined): boolean {\r\n    const revokedAt = oldToken.get<Date | undefined>(\"revoked_at\");\r\n    const window = this.automaticOverlapMs(overlapMs);\r\n    const elapsed = revokedAt ? Date.now() - new Date(revokedAt).getTime() : NaN;\r\n    return window > 0 && elapsed >= 0 && elapsed <= window;\r\n  }\r\n\r\n  private async readAutomaticSuccessor(\r\n    oldToken: RefreshToken,\r\n    decoded: { userId: number; userType: string; familyId: string },\r\n    overlapMs: number | undefined,\r\n  ): Promise<TokenPair | null> {\r\n    if (!this.isAutomaticOverlapOpen(oldToken, overlapMs)) return null;\r\n    const accessId = oldToken.get<string | undefined>(\"successor_access_token_id\");\r\n    const refreshId = oldToken.get<string | undefined>(\"successor_refresh_token_id\");\r\n    if (!accessId || !refreshId) return null;\r\n    const [access, refresh] = await Promise.all([\r\n      this.accessTokenModel.find(accessId),\r\n      this.refreshTokenModel.find(refreshId),\r\n    ]);\r\n    if (!access || access.isExpired || !refresh?.isValid) return null;\r\n    if (\r\n      access.get(\"family_id\") !== decoded.familyId ||\r\n      refresh.get(\"family_id\") !== decoded.familyId ||\r\n      access.get(\"user_id\") !== decoded.userId ||\r\n      refresh.get(\"user_id\") !== decoded.userId ||\r\n      access.get(\"user_type\") !== decoded.userType ||\r\n      refresh.get(\"user_type\") !== decoded.userType\r\n    )\r\n      return null;\r\n    const accessExpiry = new Date(access.get(\"expires_at\")).getTime();\r\n    if (!Number.isFinite(accessExpiry) || accessExpiry <= Date.now()) return null;\r\n    return {\r\n      accessToken: { token: access.get(\"token\"), expiresAt: access.get(\"expires_at\") },\r\n      refreshToken: { token: refresh.get(\"token\"), expiresAt: refresh.get(\"expires_at\") },\r\n    };\r\n  }\r\n\r\n  /**\r\n   * Verify a plaintext password against a stored hash.\r\n   */\r\n  public async verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean> {\r\n    return verifyPassword(plainPassword, hashedPassword);\r\n  }\r\n\r\n  /**\r\n   * Hash a plaintext password.\r\n   */\r\n  public async hashPassword(password: string): Promise<string> {\r\n    return hashPassword(password);\r\n  }\r\n\r\n  /**\r\n   * Resolve a user by credentials, verifying the password. Returns `null` on a\r\n   * missing user or a wrong password, emitting `login.failed` either way.\r\n   */\r\n  public async attemptLogin<T extends Auth>(\r\n    Model: ChildModel<T>,\r\n    data: AuthCredentials,\r\n  ): Promise<T | null> {\r\n    const { password, ...otherData } = data;\r\n\r\n    authEvents.emit(\"login.attempt\", otherData);\r\n\r\n    const user = (await Model.first(otherData)) as T | null;\r\n\r\n    if (!user) {\r\n      authEvents.emit(\"login.failed\", otherData, \"User not found\");\r\n\r\n      return null;\r\n    }\r\n\r\n    if (!(await this.verifyPassword(password, user.string(\"password\")!))) {\r\n      authEvents.emit(\"login.failed\", otherData, \"Invalid password\");\r\n\r\n      return null;\r\n    }\r\n\r\n    if (!(await this.canAuthenticate(user))) {\r\n      authEvents.emit(\"login.failed\", otherData, \"Authentication not allowed\");\r\n\r\n      return null;\r\n    }\r\n\r\n    return user;\r\n  }\r\n\r\n  /**\r\n   * Full login flow: validate credentials, issue tokens, emit events. Returns\r\n   * the user + token pair on success, `null` on failure.\r\n   */\r\n  public async login<T extends Auth>(\r\n    Model: ChildModel<T>,\r\n    credentials: AuthCredentials,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<LoginResult<T> | null> {\r\n    const user = await this.attemptLogin(Model, credentials);\r\n\r\n    if (!user) {\r\n      return null;\r\n    }\r\n\r\n    return this.finalizeLogin(user, deviceInfo);\r\n  }\r\n\r\n  /**\r\n   * Log in a user some OTHER method already authenticated — a provider\r\n   * callback, a passkey assertion, a one-time code. Applies the\r\n   * `auth.canAuthenticate` policy (403 on refusal), then produces exactly\r\n   * what {@link login} produces: the same tokens, rows and events. Pair with\r\n   * {@link setAuthCookie} for a cookie session, as with password login.\r\n   *\r\n   * Never call this for a user you have not authenticated.\r\n   */\r\n  public async completeLogin<T extends Auth>(\r\n    user: T,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<LoginResult<T>> {\r\n    await this.assertCanAuthenticate(user);\r\n\r\n    return this.finalizeLogin(user, deviceInfo);\r\n  }\r\n\r\n  /** The one token-issuing tail every login method shares. */\r\n  private async finalizeLogin<T extends Auth>(\r\n    user: T,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<LoginResult<T>> {\r\n    if (!authConfig.refreshToken.enabled()) {\r\n      const accessToken = await this.issueAccessToken(user, deviceInfo?.payload);\r\n\r\n      return { user, tokens: { accessToken } };\r\n    }\r\n\r\n    const tokens = await this.issueTokenPair(user, deviceInfo);\r\n\r\n    authEvents.emit(\"login.success\", user, tokens, deviceInfo);\r\n\r\n    return { user, tokens };\r\n  }\r\n\r\n  /**\r\n   * Log a user out.\r\n   *\r\n   * @param accessToken - access token string to revoke (optional)\r\n   * @param refreshToken - refresh token string to revoke (optional)\r\n   *\r\n   * When no refresh token is supplied, `config.auth.refreshToken.logoutWithoutToken`\r\n   * decides the behavior: `\"revoke-all\"` (default, fail-safe) revokes every\r\n   * refresh token; `\"error\"` requires the caller to pass one.\r\n   */\r\n  public async logout(user: Auth, accessToken?: string, refreshToken?: string): Promise<void> {\r\n    if (accessToken) {\r\n      await this.removeAccessToken(user, accessToken);\r\n    }\r\n\r\n    if (refreshToken) {\r\n      const token = await this.refreshTokenModel.findForUser(user, refreshToken);\r\n\r\n      if (token) {\r\n        await this.revokeTokenFamily(token.familyId);\r\n        authEvents.emit(\"session.destroyed\", user, token);\r\n      }\r\n    } else {\r\n      const behavior = authConfig.refreshToken.logoutWithoutToken();\r\n\r\n      if (behavior === \"error\") {\r\n        throw new Error(\"Refresh token required for logout\");\r\n      }\r\n\r\n      await this.revokeAllTokens(user);\r\n      authEvents.emit(\"logout.failsafe\", user);\r\n    }\r\n\r\n    authEvents.emit(\"logout\", user);\r\n  }\r\n\r\n  /**\r\n   * Remove a specific access token belonging to the user.\r\n   */\r\n  public async removeAccessToken(user: Auth, token: string): Promise<void> {\r\n    await this.accessTokenModel.deleteForUser(user, token);\r\n  }\r\n\r\n  /**\r\n   * Remove every access token belonging to the user.\r\n   */\r\n  public async removeAllAccessTokens(user: Auth): Promise<void> {\r\n    await this.accessTokenModel.deleteAllForUser(user);\r\n  }\r\n\r\n  /**\r\n   * Remove a specific refresh token belonging to the user.\r\n   */\r\n  public async removeRefreshToken(user: Auth, token: string): Promise<void> {\r\n    await this.refreshTokenModel.deleteForUser(user, token);\r\n  }\r\n\r\n  /**\r\n   * Revoke every active refresh token for the user and delete their access\r\n   * tokens — \"log out of all devices\". Each durable family is first marked through its revision coordinator; an\r\n   * event fires per revoked token.\r\n   */\r\n  public async revokeAllTokens(user: Auth): Promise<void> {\r\n    // Upgrade existing installations lazily before the family scan. Include\r\n    // revoked rows: a rotation may have revoked its predecessor while its\r\n    // durable family still needs logout's marker.\r\n    const existingRows = await this.refreshTokenModel.familiesForUser(user);\r\n\r\n    for (const token of existingRows) {\r\n      await AuthTokenFamily.ensure(user, token.familyId);\r\n    }\r\n\r\n    const families = await AuthTokenFamily.activeFor(user);\r\n\r\n    for (const family of families) {\r\n      await this.revokeTokenFamily(family.get<string>(\"family_id\"));\r\n    }\r\n\r\n    // A deployment can still have rows created before the additive migration\r\n    // ran; retain the old bulk cleanup as a final conservative backstop.\r\n    const legacyTokens = await this.refreshTokenModel.revokeAllFor(user);\r\n\r\n    for (const token of legacyTokens) {\r\n      authEvents.emit(\"token.revoked\", user, token);\r\n    }\r\n    await this.removeAllAccessTokens(user);\r\n\r\n    authEvents.emit(\"logout.all\", user);\r\n  }\r\n\r\n  /**\r\n   * Revoke an entire token family — rotation breach containment.\r\n   */\r\n  public async revokeTokenFamily(familyId: string): Promise<void> {\r\n    let family = await AuthTokenFamily.findByFamilyId(familyId);\r\n\r\n    if (!family) {\r\n      const legacyToken = await this.refreshTokenModel.findInFamily(familyId);\r\n\r\n      if (!legacyToken) return;\r\n\r\n      family = await AuthTokenFamily.ensure(\r\n        {\r\n          id: legacyToken.get(\"user_id\"),\r\n          userType: legacyToken.get<string>(\"user_type\"),\r\n        } as Auth,\r\n        familyId,\r\n      );\r\n    }\r\n\r\n    const user = {\r\n      id: family.get(\"user_id\"),\r\n      userType: family.get<string>(\"user_type\"),\r\n    } as Auth;\r\n\r\n    if (family.isRevoked) {\r\n      // Logout and replay containment are idempotent. Re-run cleanup because a\r\n      // request that lost the original race may have observed stale rows.\r\n      const revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\r\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\r\n      afterTokenFamilyOperation(() =>\r\n        authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\r\n      );\r\n\r\n      return;\r\n    }\r\n\r\n    let revokedTokens: RefreshToken[];\r\n    try {\r\n      revokedTokens = await runTokenFamilyOperation(familyId, async (currentFamily) => {\r\n        const familyUser = {\r\n          id: currentFamily.get(\"user_id\"),\r\n          userType: currentFamily.get<string>(\"user_type\"),\r\n        } as Auth;\r\n        const revision = currentFamily.get<number>(\"revision\");\r\n        const revoked = await AuthTokenFamily.revoke(familyId, revision);\r\n\r\n        if (revoked !== 1) {\r\n          throw new Error(\"Token family revoke lost its revision transition\");\r\n        }\r\n\r\n        const familyTokens = await this.refreshTokenModel.revokeFamily(familyId);\r\n        await this.accessTokenModel.deleteFamilyAndLegacyForUser(familyUser, familyId);\r\n\r\n        return familyTokens;\r\n      });\r\n    } catch (error) {\r\n      if (!(error instanceof TokenFamilyUnavailableError)) throw error;\r\n\r\n      // Another request committed the revoke between the read above and its\r\n      // CAS. A second logout is successful after idempotent cleanup.\r\n      revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\r\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\r\n    }\r\n\r\n    afterTokenFamilyOperation(() =>\r\n      authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\r\n    );\r\n  }\r\n\r\n  /**\r\n   * Delete expired tokens (refresh + access) and spent one-time tokens\r\n   * (expired or consumed verification/reset/OTP/passkey rows). Emits `token.expired` per refresh\r\n   * token and `cleanup.completed` with the refresh count. Drives the\r\n   * `auth.cleanup` CLI command.\r\n   */\r\n  public async cleanupExpiredTokens(): Promise<number> {\r\n    const expiredTokens = await this.refreshTokenModel.purgeExpired();\r\n\r\n    for (const token of expiredTokens) {\r\n      authEvents.emit(\"token.expired\", token);\r\n    }\r\n\r\n    await this.accessTokenModel.purgeExpired();\r\n    await this.oneTimeTokenModel.purgeSpent();\r\n\r\n    authEvents.emit(\"cleanup.completed\", expiredTokens.length);\r\n\r\n    return expiredTokens.length;\r\n  }\r\n\r\n  /**\r\n   * Find every persisted token — access and refresh — that can never retire\r\n   * itself: an unusable `expires_at`, or a token carrying no `exp` claim.\r\n   *\r\n   * This is the remediation read for the pre-4.12.0 `expiresIn` defect (#25).\r\n   * Nothing else surfaces these rows: `auth.cleanup` selects `expires_at < now`,\r\n   * which an `Invalid Date` never satisfies, and a row whose date column is\r\n   * perfectly fine can still hold a token with no deadline in it. Read-only —\r\n   * pair with {@link purgeNeverExpiringTokens} to act on the answer.\r\n   */\r\n  public async findNeverExpiringTokens(): Promise<{\r\n    accessTokens: AccessToken[];\r\n    refreshTokens: RefreshToken[];\r\n  }> {\r\n    return {\r\n      accessTokens: await this.accessTokenModel.findNeverExpiring(),\r\n      refreshTokens: await this.refreshTokenModel.findNeverExpiring(),\r\n    };\r\n  }\r\n\r\n  /**\r\n   * Revoke every never-expiring token by deleting its row, emitting\r\n   * `token.revoked` per refresh token. Drives `warlock auth.purge-never-expiring`.\r\n   *\r\n   * Access tokens first: deleting one is immediate revocation, while a refresh\r\n   * token left in place for a moment can only mint an access token through a\r\n   * verifier that now rejects it for the missing `exp`.\r\n   */\r\n  public async purgeNeverExpiringTokens(): Promise<{\r\n    accessTokens: number;\r\n    refreshTokens: number;\r\n  }> {\r\n    const accessTokens = await this.accessTokenModel.purgeNeverExpiring();\r\n    const refreshTokens = await this.refreshTokenModel.purgeNeverExpiring();\r\n\r\n    // `token.expired` (the event `auth.cleanup` already emits for a removed\r\n    // refresh token) rather than `token.revoked`, which carries a loaded `Auth`\r\n    // this batch path has no reason to fetch a user row for.\r\n    for (const token of refreshTokens) {\r\n      authEvents.emit(\"token.expired\", token);\r\n    }\r\n\r\n    return { accessTokens: accessTokens.length, refreshTokens: refreshTokens.length };\r\n  }\r\n\r\n  /**\r\n   * Active, unexpired sessions for the user, newest first.\r\n   */\r\n  public async getActiveSessions(user: Auth): Promise<RefreshToken[]> {\r\n    return this.refreshTokenModel.activeFor(user);\r\n  }\r\n\r\n  /**\r\n   * `Max-Age` (seconds) `setAuthCookie` should apply, derived from an\r\n   * `AccessTokenOutput`'s `expiresAt` — or `undefined` for a bare token\r\n   * string (a session cookie) or an unparseable `expiresAt`.\r\n   */\r\n  private cookieMaxAgeFromToken(token: string | AccessTokenOutput): number | undefined {\r\n    if (typeof token === \"string\") return undefined;\r\n\r\n    const expiresAt = new Date(token.expiresAt).getTime();\r\n\r\n    if (Number.isNaN(expiresAt)) return undefined;\r\n\r\n    return Math.max(0, Math.round((expiresAt - Date.now()) / 1000));\r\n  }\r\n\r\n  /**\r\n   * Write the auth cookie on `response` — the write side of the `cookie:<name>`\r\n   * token source `authMiddleware([], \"cookie:<name>\")` already reads. An explicit\r\n   * app-controller call, never a side effect of {@link login}, so an existing\r\n   * bearer-only app never starts emitting `Set-Cookie` just by upgrading.\r\n   *\r\n   * Attribute flags (`HttpOnly`, `SameSite=Lax`, `Secure` outside dev) come\r\n   * from `response.cookie()`'s own `secureCookieDefaults()` floor — this\r\n   * method never overrides them, only `name`/`path`/`maxAge`. `raw: true`\r\n   * writes the token unquoted, so the same string a `cookie:<name>` source\r\n   * reads back is exactly what was issued, not a JSON-wrapped copy.\r\n   *\r\n   * @param token - the token string, or an `AccessTokenOutput` (e.g. from\r\n   *   {@link login}) whose `expiresAt` sets `Max-Age` automatically when\r\n   *   `options.maxAge` is not given. A bare string with no `options.maxAge`\r\n   *   produces a session cookie.\r\n   *\r\n   * @example\r\n   * const { user, tokens } = await authService.login(User, credentials);\r\n   * authService.setAuthCookie(response, tokens.accessToken);\r\n   */\r\n  public setAuthCookie(\r\n    response: Response,\r\n    token: string | AccessTokenOutput,\r\n    options: SetAuthCookieOptions = {},\r\n  ): void {\r\n    const name = options.name ?? authConfig.cookie.name();\r\n    const path = options.path ?? authConfig.cookie.path();\r\n    const tokenValue = typeof token === \"string\" ? token : token.token;\r\n    const maxAge = options.maxAge ?? this.cookieMaxAgeFromToken(token);\r\n\r\n    response.cookie(name, tokenValue, {\r\n      raw: true,\r\n      path,\r\n      ...(maxAge !== undefined ? { maxAge } : {}),\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Clear the auth cookie {@link setAuthCookie} wrote. An explicit\r\n   * app-controller call — pair it with {@link logout} after the token row is\r\n   * revoked. `path` must match what the cookie was set with, or the browser\r\n   * silently ignores the clear (see `response.clearCookie`'s own doc comment).\r\n   *\r\n   * @example\r\n   * await authService.logout(user, accessToken, refreshToken);\r\n   * authService.clearAuthCookie(response);\r\n   */\r\n  public clearAuthCookie(response: Response, options: ClearAuthCookieOptions = {}): void {\r\n    const name = options.name ?? authConfig.cookie.name();\r\n    const path = options.path ?? authConfig.cookie.path();\r\n\r\n    response.clearCookie(name, { path });\r\n  }\r\n}\r\n\r\nexport const authService = new AuthService();\r\n"],"mappings":";;;;;;;;;;;;;;;;;AAiCA,IAAM,cAAN,MAAkB;;;;;;;CAOhB,IAAY,mBAAuC;EACjD,OAAO,OAAO,IAAI,0BAA0B,WAAW;CACzD;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,AAAO,wBAAwB,MAAqC;EAClE,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,YAAY,KAAK,IAAI;EACvB;CACF;;CAGA,MAAa,gBAAgB,MAA8B;EACzD,OAAO,WAAW,gBAAgB,IAAI;CACxC;CAEA,MAAc,sBAAsB,MAA2B;EAC7D,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GACnC,MAAM,IAAI,eAAe,gCAAgC;CAE7D;CAEA,MAAc,iBACZ,MACA,SACA,UAC4B;EAC5B,MAAM,OAAO;GAAE,GAAI,WAAW,KAAK,wBAAwB,IAAI;GAAI,KAAK,WAAW;EAAE;EAErF,MAAM,YAAY,WAAW,YAAY,YAAY;EAErD,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM,EAAE,UAAU,CAAC;EACpD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;EAEjD,IAAI,UACF,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,WAAW,QAAQ;OAElE,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,SAAS;EAG1D,OAAO;GAAE;GAAO,WAAW,UAAU,YAAY;EAAE;CACrD;;;;;;CAOA,MAAa,oBACX,MACA,SAC4B;EAC5B,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,iBAAiB,MAAM,OAAO;CAC5C;CAEA,MAAc,kBACZ,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAKxC,MAAM,YAAY,WAAW,aAAa,YAAY;EAEtD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAIzD,KAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,MAAM,UAAU;GACd,QAAQ,KAAK;GACb,UAAU,KAAK;GACf;GACA,KAAK,WAAW;EAClB;EAEA,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,YAAY;EAE/D,MAAM,KAAK,kBAAkB,WAAW,MAAM,WAAW,aAAa,WAAW,CAAC;EAElF,MAAM,QAAQ,MAAM,IAAI,qBAAqB,SAAS,EAAE,UAAU,CAAC;EAEnE,OAAO,KAAK,kBAAkB,MAAM,MAAM,OAAO;GAAE;GAAU;GAAW;EAAW,CAAC;CACtF;;;;;;;CAQA,MAAc,sBACZ,MACA,UACA,OACY;EAMZ,KAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,IAAI;GACF,OAAO,MAAM,wBAAwB,UAAU,YAAY,MAAM,CAAC;EACpE,SAAS,OAAO;GAId,IAAI,iBAAiB,6BACnB,MAAM,IAAI,MAAM,gDAAgD;GAGlE,MAAM;EACR;CACF;;;;;CAMA,MAAa,mBACX,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAExC,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,YAAY,UACd,OAAO,KAAK,sBAAsB,MAAM,WAAW,gBACjD,KAAK,kBAAkB,MAAM,UAAU,CACzC;EAGF,OAAO,KAAK,kBAAkB,MAAM,UAAU;CAChD;CAEA,MAAc,eAAe,MAAY,YAA6C;EACpF,MAAM,iBAAiB,WAAW,aAAa,QAAQ;EACvD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAEzD,IAAI,gBAGF;QAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAClE;EAGF,MAAM,cAAc,MAAM,KAAK,iBAC7B,MACA,YAAY,SACZ,iBAAiB,WAAW,MAC9B;EACA,MAAM,eAAe,MAAM,KAAK,kBAC9B,MACA,iBAAiB;GAAE,GAAG;GAAY;EAAS,IAAI,UACjD;EAEA,MAAM,YAAuB;GAC3B;GACA,cAAc,eACV;IACE,OAAO,aAAa,IAAI,OAAO;IAC/B,WAAW,aAAa,IAAI,YAAY;GAC1C,IACA;EACN;EAEA,gCAAgC,WAAW,KAAK,iBAAiB,MAAM,SAAS,CAAC;EAEjF,IAAI,cACF,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,UAAU,CACnE;EAGF,OAAO;CACT;;;;CAKA,MAAa,gBAAgB,MAAY,YAA6C;EACpF,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,WAAW,aAAa,QAAQ,KAAK,YAAY,UACnD,OAAO,KAAK,sBAAsB,MAAM,WAAW,gBACjD,KAAK,eAAe,MAAM,UAAU,CACtC;EAGF,OAAO,KAAK,eAAe,MAAM,UAAU;CAC7C;;;;;;CAOA,MAAa,cACX,oBACA,YAC2B;EAC3B,IAAI;EAMJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAE5C,MAAM;EACR;EAEA,IAAI,CAAC,SAAS,OAAO;EAErB,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAElF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAElE,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAChF,IAAI,CAAC,gBAAgB,CAAC,KAAK,uBAAuB,cAAc,OAAO,GAAG,OAAO;GACjF,IAAI,CAAC,aAAa,SAAS;IAEzB,IAAI,cACF,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IAGpD,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAEhE,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAGlE,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GAEjD,IAAI,CAAC,MAAM,OAAO;GAElB,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAIhD,IAFwB,WAAW,aAAa,SAE9B,GAGhB;QAAI,CAAC,MAFa,aAAa,eAAe,GAEpC;KAER,MAAM,KAAK,kBAAkB,aAAa,QAAQ;KAElD,OAAO;IACT;UAEA,MAAM,aAAa,WAAW;GAGhC,MAAM,eAAe,MAAM,KAAK,eAAe,MAAM;IACnD,GAAG;IACH,UAAU,aAAa;GACzB,CAAC;GAED,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,YAAY,CACrE;GAEA,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;;;;;;CAOA,MAAa,sBACX,oBACA,kBACA,UAA2D,CAAC,GACjC;EAC3B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAC5C,MAAM;EACR;EAEA,IAAI,CAAC,WAAW,QAAQ,aAAa,kBAAkB,OAAO;EAC9D,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAClF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAGlE,MAAM,WAAW,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAC5E,IAAI,CAAC,YAAY,CAAC,KAAK,uBAAuB,UAAU,OAAO,GAAG,OAAO;GACzE,IAAI,CAAC,SAAS,SAAS;IACrB,MAAM,YAAY,MAAM,KAAK,uBAAuB,UAAU,SAAS,QAAQ,SAAS;IACxF,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,UAAU,QAAQ,SAAS,KACvD,KAAK,aAAa,QAAQ,GAE1B,OAAO;IAET,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAChF,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GACjD,IAAI,CAAC,QAAQ,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAEzD,IAAI,CAAE,MAAM,SAAS,eAAe,GAAI;IAGtC,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;IAChF,IAAI,CAAC,cAAc,OAAO;IAC1B,MAAM,YAAY,MAAM,KAAK,uBAC3B,cACA,SACA,QAAQ,SACV;IACA,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,cAAc,QAAQ,SAAS,KAC3D,KAAK,aAAa,YAAY,GAE9B,OAAO;IACT,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,OAAO,MAAM,KAAK,eAAe,MAAM;IAC3C,GAAG,QAAQ;IACX,UAAU,SAAS;GACrB,CAAC;GACD,MAAM,kBAAkB,MAAM,KAAK,iBAAiB,YAAY,KAAK,YAAY,KAAK;GACtF,MAAM,mBAAmB,KAAK,eAC1B,MAAM,KAAK,kBAAkB,YAAY,KAAK,aAAa,KAAK,IAChE;GACJ,IAAI,CAAC,mBAAmB,CAAC,kBACvB,MAAM,IAAI,MAAM,6DAA6D;GAe/E,IAAI,MATiB,KAAK,kBAAkB,OAC1C,EAAE,IAAI,SAAS,GAAG,GAClB,EACE,MAAM;IACJ,2BAA2B,gBAAgB;IAC3C,4BAA4B,iBAAiB;GAC/C,EACF,CACF,MACe,GAAG,MAAM,IAAI,MAAM,qDAAqD;GACvF,gCAAgC,WAAW,KAAK,mBAAmB,MAAM,MAAM,QAAQ,CAAC;GACxF,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;CAEA,AAAQ,mBAAmB,WAAuC;EAChE,OAAO,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,IAC7D,KAAK,IAAI,GAAG,KAAK,IAAI,KAAQ,SAAS,CAAC,IACvC;CACN;CAEA,AAAQ,uBACN,OACA,SACS;EACT,OACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,IAAI,SAAS,MAAM,QAAQ,UACjC,MAAM,IAAI,WAAW,MAAM,QAAQ;CAEvC;CAEA,AAAQ,aAAa,UAAiC;EACpD,OAAO,QACL,SAAS,IAAI,2BAA2B,KAAK,SAAS,IAAI,4BAA4B,CACxF;CACF;CAEA,AAAQ,uBAAuB,UAAwB,WAAwC;EAC7F,MAAM,YAAY,SAAS,IAAsB,YAAY;EAC7D,MAAM,SAAS,KAAK,mBAAmB,SAAS;EAChD,MAAM,UAAU,YAAY,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI;EACzE,OAAO,SAAS,KAAK,WAAW,KAAK,WAAW;CAClD;CAEA,MAAc,uBACZ,UACA,SACA,WAC2B;EAC3B,IAAI,CAAC,KAAK,uBAAuB,UAAU,SAAS,GAAG,OAAO;EAC9D,MAAM,WAAW,SAAS,IAAwB,2BAA2B;EAC7E,MAAM,YAAY,SAAS,IAAwB,4BAA4B;EAC/E,IAAI,CAAC,YAAY,CAAC,WAAW,OAAO;EACpC,MAAM,CAAC,QAAQ,WAAW,MAAM,QAAQ,IAAI,CAC1C,KAAK,iBAAiB,KAAK,QAAQ,GACnC,KAAK,kBAAkB,KAAK,SAAS,CACvC,CAAC;EACD,IAAI,CAAC,UAAU,OAAO,aAAa,CAAC,SAAS,SAAS,OAAO;EAC7D,IACE,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,YACrC,OAAO,IAAI,SAAS,MAAM,QAAQ,UAClC,QAAQ,IAAI,SAAS,MAAM,QAAQ,UACnC,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,UAErC,OAAO;EACT,MAAM,eAAe,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ;EAChE,IAAI,CAAC,OAAO,SAAS,YAAY,KAAK,gBAAgB,KAAK,IAAI,GAAG,OAAO;EACzE,OAAO;GACL,aAAa;IAAE,OAAO,OAAO,IAAI,OAAO;IAAG,WAAW,OAAO,IAAI,YAAY;GAAE;GAC/E,cAAc;IAAE,OAAO,QAAQ,IAAI,OAAO;IAAG,WAAW,QAAQ,IAAI,YAAY;GAAE;EACpF;CACF;;;;CAKA,MAAa,eAAe,eAAuB,gBAA0C;EAC3F,OAAO,eAAe,eAAe,cAAc;CACrD;;;;CAKA,MAAa,aAAa,UAAmC;EAC3D,OAAO,aAAa,QAAQ;CAC9B;;;;;CAMA,MAAa,aACX,OACA,MACmB;EACnB,MAAM,EAAE,UAAU,GAAG,cAAc;EAEnC,WAAW,KAAK,iBAAiB,SAAS;EAE1C,MAAM,OAAQ,MAAM,MAAM,MAAM,SAAS;EAEzC,IAAI,CAAC,MAAM;GACT,WAAW,KAAK,gBAAgB,WAAW,gBAAgB;GAE3D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE,GAAI;GACpE,WAAW,KAAK,gBAAgB,WAAW,kBAAkB;GAE7D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI;GACvC,WAAW,KAAK,gBAAgB,WAAW,4BAA4B;GAEvE,OAAO;EACT;EAEA,OAAO;CACT;;;;;CAMA,MAAa,MACX,OACA,aACA,YACgC;EAChC,MAAM,OAAO,MAAM,KAAK,aAAa,OAAO,WAAW;EAEvD,IAAI,CAAC,MACH,OAAO;EAGT,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;;;CAWA,MAAa,cACX,MACA,YACyB;EACzB,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;CAGA,MAAc,cACZ,MACA,YACyB;EACzB,IAAI,CAAC,WAAW,aAAa,QAAQ,GAGnC,OAAO;GAAE;GAAM,QAAQ,EAAE,mBAFC,KAAK,iBAAiB,MAAM,YAAY,OAAO,EAEpC;EAAE;EAGzC,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,UAAU;EAEzD,WAAW,KAAK,iBAAiB,MAAM,QAAQ,UAAU;EAEzD,OAAO;GAAE;GAAM;EAAO;CACxB;;;;;;;;;;;CAYA,MAAa,OAAO,MAAY,aAAsB,cAAsC;EAC1F,IAAI,aACF,MAAM,KAAK,kBAAkB,MAAM,WAAW;EAGhD,IAAI,cAAc;GAChB,MAAM,QAAQ,MAAM,KAAK,kBAAkB,YAAY,MAAM,YAAY;GAEzE,IAAI,OAAO;IACT,MAAM,KAAK,kBAAkB,MAAM,QAAQ;IAC3C,WAAW,KAAK,qBAAqB,MAAM,KAAK;GAClD;EACF,OAAO;GAGL,IAFiB,WAAW,aAAa,mBAE9B,MAAM,SACf,MAAM,IAAI,MAAM,mCAAmC;GAGrD,MAAM,KAAK,gBAAgB,IAAI;GAC/B,WAAW,KAAK,mBAAmB,IAAI;EACzC;EAEA,WAAW,KAAK,UAAU,IAAI;CAChC;;;;CAKA,MAAa,kBAAkB,MAAY,OAA8B;EACvE,MAAM,KAAK,iBAAiB,cAAc,MAAM,KAAK;CACvD;;;;CAKA,MAAa,sBAAsB,MAA2B;EAC5D,MAAM,KAAK,iBAAiB,iBAAiB,IAAI;CACnD;;;;CAKA,MAAa,mBAAmB,MAAY,OAA8B;EACxE,MAAM,KAAK,kBAAkB,cAAc,MAAM,KAAK;CACxD;;;;;;CAOA,MAAa,gBAAgB,MAA2B;EAItD,MAAM,eAAe,MAAM,KAAK,kBAAkB,gBAAgB,IAAI;EAEtE,KAAK,MAAM,SAAS,cAClB,MAAM,gBAAgB,OAAO,MAAM,MAAM,QAAQ;EAGnD,MAAM,WAAW,MAAM,gBAAgB,UAAU,IAAI;EAErD,KAAK,MAAM,UAAU,UACnB,MAAM,KAAK,kBAAkB,OAAO,IAAY,WAAW,CAAC;EAK9D,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,IAAI;EAEnE,KAAK,MAAM,SAAS,cAClB,WAAW,KAAK,iBAAiB,MAAM,KAAK;EAE9C,MAAM,KAAK,sBAAsB,IAAI;EAErC,WAAW,KAAK,cAAc,IAAI;CACpC;;;;CAKA,MAAa,kBAAkB,UAAiC;EAC9D,IAAI,SAAS,MAAM,gBAAgB,eAAe,QAAQ;EAE1D,IAAI,CAAC,QAAQ;GACX,MAAM,cAAc,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAEtE,IAAI,CAAC,aAAa;GAElB,SAAS,MAAM,gBAAgB,OAC7B;IACE,IAAI,YAAY,IAAI,SAAS;IAC7B,UAAU,YAAY,IAAY,WAAW;GAC/C,GACA,QACF;EACF;EAEA,MAAM,OAAO;GACX,IAAI,OAAO,IAAI,SAAS;GACxB,UAAU,OAAO,IAAY,WAAW;EAC1C;EAEA,IAAI,OAAO,WAAW;GAGpB,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GACxE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;GACvE,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;GAEA;EACF;EAEA,IAAI;EACJ,IAAI;GACF,gBAAgB,MAAM,wBAAwB,UAAU,OAAO,kBAAkB;IAC/E,MAAM,aAAa;KACjB,IAAI,cAAc,IAAI,SAAS;KAC/B,UAAU,cAAc,IAAY,WAAW;IACjD;IACA,MAAM,WAAW,cAAc,IAAY,UAAU;IAGrD,IAAI,MAFkB,gBAAgB,OAAO,UAAU,QAAQ,MAE/C,GACd,MAAM,IAAI,MAAM,kDAAkD;IAGpE,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IACvE,MAAM,KAAK,iBAAiB,6BAA6B,YAAY,QAAQ;IAE7E,OAAO;GACT,CAAC;EACH,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,8BAA8B,MAAM;GAI3D,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAClE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;EACzE;EAEA,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;CACF;;;;;;;CAQA,MAAa,uBAAwC;EACnD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa;EAEhE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,MAAM,KAAK,iBAAiB,aAAa;EACzC,MAAM,KAAK,kBAAkB,WAAW;EAExC,WAAW,KAAK,qBAAqB,cAAc,MAAM;EAEzD,OAAO,cAAc;CACvB;;;;;;;;;;;CAYA,MAAa,0BAGV;EACD,OAAO;GACL,cAAc,MAAM,KAAK,iBAAiB,kBAAkB;GAC5D,eAAe,MAAM,KAAK,kBAAkB,kBAAkB;EAChE;CACF;;;;;;;;;CAUA,MAAa,2BAGV;EACD,MAAM,eAAe,MAAM,KAAK,iBAAiB,mBAAmB;EACpE,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,mBAAmB;EAKtE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,OAAO;GAAE,cAAc,aAAa;GAAQ,eAAe,cAAc;EAAO;CAClF;;;;CAKA,MAAa,kBAAkB,MAAqC;EAClE,OAAO,KAAK,kBAAkB,UAAU,IAAI;CAC9C;;;;;;CAOA,AAAQ,sBAAsB,OAAuD;EACnF,IAAI,OAAO,UAAU,UAAU,OAAO;EAEtC,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ;EAEpD,IAAI,OAAO,MAAM,SAAS,GAAG,OAAO;EAEpC,OAAO,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,KAAK,IAAI,KAAK,GAAI,CAAC;CAChE;;;;;;;;;;;;;;;;;;;;;;CAuBA,AAAO,cACL,UACA,OACA,UAAgC,CAAC,GAC3B;EACN,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;EAC7D,MAAM,SAAS,QAAQ,UAAU,KAAK,sBAAsB,KAAK;EAEjE,SAAS,OAAO,MAAM,YAAY;GAChC,KAAK;GACL;GACA,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;EAC3C,CAAC;CACH;;;;;;;;;;;CAYA,AAAO,gBAAgB,UAAoB,UAAkC,CAAC,GAAS;EACrF,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EAEpD,SAAS,YAAY,MAAM,EAAE,KAAK,CAAC;CACrC;AACF;AAEA,MAAa,cAAc,IAAI,YAAY"}
+{"version":3,"file":"auth.service.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"sourcesContent":["import { Random } from \"@mongez/reinforcements\";\r\nimport { randomUUID } from \"node:crypto\";\r\nimport type { ChildModel } from \"@warlock.js/cascade\";\r\nimport {\r\n  config,\r\n  ForbiddenError,\r\n  hashPassword,\r\n  type Request,\r\n  type Response,\r\n  verifyPassword,\r\n} from \"@warlock.js/core\";\r\nimport type {\r\n  AccessTokenOutput,\r\n  AuthCredentials,\r\n  ClearAuthCookieOptions,\r\n  DeviceInfo,\r\n  LoginResult,\r\n  SetAuthCookieOptions,\r\n  TokenPair,\r\n} from \"../contracts/types\";\r\nimport { assertCsrfOriginAllowed } from \"../middleware/csrf-origin-check\";\r\nimport { AccessToken } from \"../models/access-token\";\r\nimport type { Auth } from \"../models/auth.model\";\r\nimport { AuthTokenFamily } from \"../models/auth-token-family\";\r\nimport { OneTimeToken } from \"../models/one-time-token\";\r\nimport { RefreshToken } from \"../models/refresh-token\";\r\nimport { authConfig } from \"./auth-config\";\r\nimport { authEvents } from \"./auth-events\";\r\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\r\nimport {\r\n  afterTokenFamilyOperation,\r\n  runTokenFamilyOperation,\r\n  TokenFamilyUnavailableError,\r\n} from \"./token-family-operation\";\r\n\r\nclass AuthService {\r\n  /**\r\n   * Resolve the active access-token model — the package default, or a subclass\r\n   * an app registered under `config.auth.accessToken.model` (e.g. to add a\r\n   * tenant column). The service never references the concrete class directly so\r\n   * an override is a pure config change.\r\n   */\r\n  private get accessTokenModel(): typeof AccessToken {\r\n    return config.key(\"auth.accessToken.model\", AccessToken);\r\n  }\r\n\r\n  /**\r\n   * Resolve the active refresh-token model (default or registered override).\r\n   */\r\n  private get refreshTokenModel(): typeof RefreshToken {\r\n    return config.key(\"auth.refreshToken.model\", RefreshToken);\r\n  }\r\n\r\n  /**\r\n   * Resolve the active one-time-token model (default or registered override).\r\n   */\r\n  private get oneTimeTokenModel(): typeof OneTimeToken {\r\n    return config.key(\"auth.oneTimeToken.model\", OneTimeToken);\r\n  }\r\n\r\n  /**\r\n   * Build the default access-token JWT payload from a user.\r\n   */\r\n  public buildAccessTokenPayload(user: Auth): Record<string, unknown> {\r\n    return {\r\n      id: user.id,\r\n      userType: user.userType,\r\n      created_at: Date.now(),\r\n    };\r\n  }\r\n\r\n  /** One policy seam keeps account-state checks identical across all auth paths. */\r\n  public async canAuthenticate(user: Auth): Promise<boolean> {\r\n    return authConfig.canAuthenticate(user);\r\n  }\r\n\r\n  private async assertCanAuthenticate(user: Auth): Promise<void> {\r\n    if (!(await this.canAuthenticate(user))) {\r\n      throw new ForbiddenError(\"This user cannot authenticate.\");\r\n    }\r\n  }\r\n\r\n  private async issueAccessToken(\r\n    user: Auth,\r\n    payload?: Record<string, unknown>,\r\n    familyId?: string,\r\n  ): Promise<AccessTokenOutput> {\r\n    const data = { ...(payload || this.buildAccessTokenPayload(user)), jti: randomUUID() };\r\n    // Validate before signing so an unusable lifetime cannot mint an immortal token.\r\n    const expiresIn = authConfig.accessToken.expiresInMs();\r\n\r\n    const token = await jwt.generate(data, { expiresIn });\r\n    const expiresAt = new Date(Date.now() + expiresIn);\r\n\r\n    if (familyId) {\r\n      await this.accessTokenModel.issue(user, token, expiresAt, familyId);\r\n    } else {\r\n      await this.accessTokenModel.issue(user, token, expiresAt);\r\n    }\r\n\r\n    return { token, expiresAt: expiresAt.toISOString() };\r\n  }\r\n\r\n  /**\r\n   * Sign + persist an access token for the user and return the token with its\r\n   * expiry. The expiry is computed locally from `expiresIn` rather than by\r\n   * re-verifying the token we just signed.\r\n   */\r\n  public async generateAccessToken(\r\n    user: Auth,\r\n    payload?: Record<string, unknown>,\r\n  ): Promise<AccessTokenOutput> {\r\n    await this.assertCanAuthenticate(user);\r\n\r\n    return this.issueAccessToken(user, payload);\r\n  }\r\n\r\n  private async issueRefreshToken(\r\n    user: Auth,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<RefreshToken | undefined> {\r\n    if (!authConfig.refreshToken.enabled()) return;\r\n\r\n    // Validate the lifetime first — before the per-user cap is enforced, before\r\n    // anything is signed — so a bad value can never revoke a user's oldest\r\n    // session on its way to failing.\r\n    const expiresIn = authConfig.refreshToken.expiresInMs();\r\n\r\n    const familyId = deviceInfo?.familyId || Random.string(32);\r\n\r\n    const family = await AuthTokenFamily.ensure(user, familyId);\r\n\r\n    if (family.isRevoked) {\r\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\r\n    }\r\n\r\n    const payload = {\r\n      userId: user.id,\r\n      userType: user.userType,\r\n      familyId,\r\n      jti: randomUUID(),\r\n    };\r\n\r\n    const expiresAt = new Date(Date.now() + expiresIn).toISOString();\r\n\r\n    await this.refreshTokenModel.enforceMax(user, authConfig.refreshToken.maxPerUser());\r\n\r\n    const token = await jwt.generateRefreshToken(payload, { expiresIn });\r\n\r\n    return this.refreshTokenModel.issue(user, token, { familyId, expiresAt, deviceInfo });\r\n  }\r\n\r\n  /**\r\n   * Keep issuance into an explicitly reused family in the same durable\r\n   * transition boundary as rotation and revocation. A new, caller-unspecified\r\n   * family has no concurrent session to protect and retains the lightweight\r\n   * issuance path.\r\n   */\r\n  private async issueInSuppliedFamily<T>(\r\n    user: Auth,\r\n    familyId: string,\r\n    issue: () => Promise<T>,\r\n  ): Promise<T> {\r\n    // Preserve the established error for a family that was already revoked\r\n    // before issuance started. The coordinator covers a revoke that races\r\n    // after this observation.\r\n    const family = await AuthTokenFamily.ensure(user, familyId);\r\n\r\n    if (family.isRevoked) {\r\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\r\n    }\r\n\r\n    try {\r\n      return await runTokenFamilyOperation(familyId, async () => issue());\r\n    } catch (error) {\r\n      // Do not expose a timing-dependent error shape to callers: a family\r\n      // revoked between ensure() and the transaction is the same unusable\r\n      // family condition as one found above.\r\n      if (error instanceof TokenFamilyUnavailableError) {\r\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\r\n      }\r\n\r\n      throw error;\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Sign + persist a refresh token for the user (enforcing the per-user cap\r\n   * first). Resolves to `undefined` when refresh tokens are disabled in config.\r\n   */\r\n  public async createRefreshToken(\r\n    user: Auth,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<RefreshToken | undefined> {\r\n    if (!authConfig.refreshToken.enabled()) return;\r\n\r\n    await this.assertCanAuthenticate(user);\r\n\r\n    if (deviceInfo?.familyId) {\r\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, () =>\r\n        this.issueRefreshToken(user, deviceInfo),\r\n      );\r\n    }\r\n\r\n    return this.issueRefreshToken(user, deviceInfo);\r\n  }\r\n\r\n  private async issueTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\r\n    const refreshEnabled = authConfig.refreshToken.enabled();\r\n    const familyId = deviceInfo?.familyId || Random.string(32);\r\n\r\n    if (refreshEnabled) {\r\n      const family = await AuthTokenFamily.ensure(user, familyId);\r\n\r\n      if (family.isRevoked) {\r\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\r\n      }\r\n    }\r\n\r\n    const accessToken = await this.issueAccessToken(\r\n      user,\r\n      deviceInfo?.payload,\r\n      refreshEnabled ? familyId : undefined,\r\n    );\r\n    const refreshToken = await this.issueRefreshToken(\r\n      user,\r\n      refreshEnabled ? { ...deviceInfo, familyId } : deviceInfo,\r\n    );\r\n\r\n    const tokenPair: TokenPair = {\r\n      accessToken,\r\n      refreshToken: refreshToken\r\n        ? {\r\n            token: refreshToken.get(\"token\"),\r\n            expiresAt: refreshToken.get(\"expires_at\"),\r\n          }\r\n        : undefined,\r\n    };\r\n\r\n    afterTokenFamilyOperation(() => authEvents.emit(\"token.created\", user, tokenPair));\r\n\r\n    if (refreshToken) {\r\n      afterTokenFamilyOperation(() =>\r\n        authEvents.emit(\"session.created\", user, refreshToken, deviceInfo),\r\n      );\r\n    }\r\n\r\n    return tokenPair;\r\n  }\r\n\r\n  /**\r\n   * Issue both an access and a refresh token, emitting the creation events.\r\n   */\r\n  public async createTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\r\n    await this.assertCanAuthenticate(user);\r\n\r\n    if (authConfig.refreshToken.enabled() && deviceInfo?.familyId) {\r\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, () =>\r\n        this.issueTokenPair(user, deviceInfo),\r\n      );\r\n    }\r\n\r\n    return this.issueTokenPair(user, deviceInfo);\r\n  }\r\n\r\n  /**\r\n   * Exchange a refresh token for a new token pair, with rotation + replay\r\n   * detection. A concurrent reuse of the same token loses the atomic revoke and\r\n   * is treated as a breach — the whole family is revoked and the request fails.\r\n   */\r\n  public async refreshTokens(\r\n    refreshTokenString: string,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<TokenPair | null> {\r\n    let decoded: {\r\n      userId: number;\r\n      userType: string;\r\n      familyId: string;\r\n    } | null;\r\n\r\n    try {\r\n      decoded = await jwt.verifyRefreshToken<{\r\n        userId: number;\r\n        userType: string;\r\n        familyId: string;\r\n      }>(refreshTokenString);\r\n    } catch (error) {\r\n      if (isInvalidCredentialError(error)) return null;\r\n\r\n      throw error;\r\n    }\r\n\r\n    if (!decoded) return null;\r\n\r\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\r\n\r\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\r\n\r\n    await AuthTokenFamily.ensure(\r\n      { id: decoded.userId, userType: decoded.userType } as Auth,\r\n      presentedToken.familyId,\r\n    );\r\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\r\n      // Each serializable attempt must read the current row in its own snapshot.\r\n      const refreshToken = await this.refreshTokenModel.findByToken(refreshTokenString);\r\n      if (!refreshToken || !this.refreshIdentityMatches(refreshToken, decoded)) return null;\r\n      if (!refreshToken.isValid) {\r\n        // An already-invalid token may be a replay of a rotated credential.\r\n        if (refreshToken) {\r\n          await this.revokeTokenFamily(refreshToken.familyId);\r\n        }\r\n\r\n        return null;\r\n      }\r\n\r\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\r\n\r\n      if (!UserModel) {\r\n        throw new Error(`User type ${decoded.userType} is unknown type.`);\r\n      }\r\n\r\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\r\n\r\n      if (!user) return null;\r\n\r\n      if (!(await this.canAuthenticate(user))) return null;\r\n\r\n      const rotationEnabled = authConfig.refreshToken.rotation();\r\n\r\n      if (rotationEnabled) {\r\n        const won = await refreshToken.revokeIfActive();\r\n\r\n        if (!won) {\r\n          // A concurrent request already rotated this token.\r\n          await this.revokeTokenFamily(refreshToken.familyId);\r\n\r\n          return null;\r\n        }\r\n      } else {\r\n        await refreshToken.markAsUsed();\r\n      }\r\n\r\n      const newTokenPair = await this.issueTokenPair(user, {\r\n        ...deviceInfo,\r\n        familyId: refreshToken.familyId,\r\n      });\r\n\r\n      afterTokenFamilyOperation(() =>\r\n        authEvents.emit(\"token.refreshed\", user, newTokenPair, refreshToken),\r\n      );\r\n\r\n      return newTokenPair;\r\n    }).catch((error) => {\r\n      if (error instanceof TokenFamilyUnavailableError) return null;\r\n      throw error;\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Opt-in browser-session renewal. Unlike {@link refreshTokens}, this permits\r\n   * a short duplicate presentation to receive the exact committed successor\r\n   * pair. It is deliberately not used by the legacy/public refresh API.\r\n   */\r\n  public async renewAutomaticSession(\r\n    refreshTokenString: string,\r\n    expectedUserType: string,\r\n    options: { overlapMs?: number; deviceInfo?: DeviceInfo; maxAgeMs?: number } = {},\r\n  ): Promise<TokenPair | null> {\r\n    let decoded: { userId: number; userType: string; familyId: string } | null;\r\n    try {\r\n      decoded = await jwt.verifyRefreshToken<{\r\n        userId: number;\r\n        userType: string;\r\n        familyId: string;\r\n      }>(refreshTokenString);\r\n    } catch (error) {\r\n      if (isInvalidCredentialError(error)) return null;\r\n      throw error;\r\n    }\r\n\r\n    if (!decoded || decoded.userType !== expectedUserType) return null;\r\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\r\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\r\n\r\n    await AuthTokenFamily.ensure(\r\n      { id: decoded.userId, userType: decoded.userType } as Auth,\r\n      presentedToken.familyId,\r\n    );\r\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\r\n      // A retry can follow another process's committed rotation. Never reuse\r\n      // a model captured before the transaction or before a failed attempt.\r\n      const oldToken = await this.refreshTokenModel.findByToken(refreshTokenString);\r\n      if (!oldToken || !this.refreshIdentityMatches(oldToken, decoded)) return null;\r\n      if (!oldToken.isValid) {\r\n        const successor = await this.readAutomaticSuccessor(oldToken, decoded, options.overlapMs);\r\n        if (successor) return successor;\r\n        if (\r\n          this.isAutomaticOverlapOpen(oldToken, options.overlapMs) &&\r\n          this.hasSuccessor(oldToken)\r\n        ) {\r\n          return null;\r\n        }\r\n        await this.revokeTokenFamily(oldToken.familyId);\r\n        return null;\r\n      }\r\n\r\n      // Rotation never extends a family past `maxAgeMs` from its first issue.\r\n      if (\r\n        options.maxAgeMs !== undefined &&\r\n        (await this.familyExceedsMaxAge(oldToken.familyId, options.maxAgeMs))\r\n      ) {\r\n        await this.revokeTokenFamily(oldToken.familyId);\r\n        return null;\r\n      }\r\n\r\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\r\n      if (!UserModel) throw new Error(`User type ${decoded.userType} is unknown type.`);\r\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\r\n      if (!user || !(await this.canAuthenticate(user))) return null;\r\n\r\n      if (!(await oldToken.revokeIfActive())) {\r\n        // A newer successor is never substituted here. A stale automatic\r\n        // response must fail quietly rather than revoke a legitimate family.\r\n        const currentToken = await this.refreshTokenModel.findByToken(refreshTokenString);\r\n        if (!currentToken) return null;\r\n        const successor = await this.readAutomaticSuccessor(\r\n          currentToken,\r\n          decoded,\r\n          options.overlapMs,\r\n        );\r\n        if (successor) return successor;\r\n        if (\r\n          this.isAutomaticOverlapOpen(currentToken, options.overlapMs) &&\r\n          this.hasSuccessor(currentToken)\r\n        )\r\n          return null;\r\n        await this.revokeTokenFamily(oldToken.familyId);\r\n        return null;\r\n      }\r\n\r\n      const pair = await this.issueTokenPair(user, {\r\n        ...options.deviceInfo,\r\n        familyId: oldToken.familyId,\r\n      });\r\n      const successorAccess = await this.accessTokenModel.findByToken(pair.accessToken.token);\r\n      const successorRefresh = pair.refreshToken\r\n        ? await this.refreshTokenModel.findByToken(pair.refreshToken.token)\r\n        : null;\r\n      if (!successorAccess || !successorRefresh) {\r\n        throw new Error(\"Automatic renewal did not persist a complete successor pair\");\r\n      }\r\n\r\n      // `revokeIfActive()` updates the database, not this hydrated instance.\r\n      // Saving that stale instance would write its old `revoked_at: null` back\r\n      // and reopen the predecessor. Update only the successor columns instead.\r\n      const linked = await this.refreshTokenModel.atomic(\r\n        { id: oldToken.id },\r\n        {\r\n          $set: {\r\n            successor_access_token_id: successorAccess.id,\r\n            successor_refresh_token_id: successorRefresh.id,\r\n          },\r\n        },\r\n      );\r\n      if (linked !== 1) throw new Error(\"Automatic renewal could not link its successor pair\");\r\n      afterTokenFamilyOperation(() => authEvents.emit(\"token.refreshed\", user, pair, oldToken));\r\n      return pair;\r\n    }).catch((error) => {\r\n      if (error instanceof TokenFamilyUnavailableError) return null;\r\n      throw error;\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Whether the family's first issue is older than `maxAgeMs`. The start is the\r\n   * family row's `created_at`, falling back to its oldest refresh token when\r\n   * the row carries none (an upserted legacy family).\r\n   */\r\n  private async familyExceedsMaxAge(familyId: string, maxAgeMs: number): Promise<boolean> {\r\n    const family = await AuthTokenFamily.findByFamilyId(familyId);\r\n    let started: unknown = family?.get(\"created_at\");\r\n\r\n    if (!started) {\r\n      const oldest = await this.refreshTokenModel\r\n        .query()\r\n        .where({ family_id: familyId })\r\n        .orderBy(\"created_at\", \"asc\")\r\n        .first();\r\n\r\n      started = oldest?.get(\"created_at\");\r\n    }\r\n\r\n    const startedAt = started ? new Date(started as string | number | Date).getTime() : NaN;\r\n\r\n    // Unknown start: nothing to measure against, so the cap cannot apply.\r\n    if (!Number.isFinite(startedAt)) return false;\r\n\r\n    return Date.now() - startedAt > maxAgeMs;\r\n  }\r\n\r\n  private automaticOverlapMs(overlapMs: number | undefined): number {\r\n    return typeof overlapMs === \"number\" && Number.isFinite(overlapMs)\r\n      ? Math.max(0, Math.min(10_000, overlapMs))\r\n      : 5000;\r\n  }\r\n\r\n  private refreshIdentityMatches(\r\n    token: RefreshToken,\r\n    decoded: { userId: string | number; userType: string; familyId: string },\r\n  ): boolean {\r\n    return (\r\n      token.familyId === decoded.familyId &&\r\n      token.get(\"user_id\") === decoded.userId &&\r\n      token.get(\"user_type\") === decoded.userType\r\n    );\r\n  }\r\n\r\n  private hasSuccessor(oldToken: RefreshToken): boolean {\r\n    return Boolean(\r\n      oldToken.get(\"successor_access_token_id\") && oldToken.get(\"successor_refresh_token_id\"),\r\n    );\r\n  }\r\n\r\n  private isAutomaticOverlapOpen(oldToken: RefreshToken, overlapMs: number | undefined): boolean {\r\n    const revokedAt = oldToken.get<Date | undefined>(\"revoked_at\");\r\n    const window = this.automaticOverlapMs(overlapMs);\r\n    const elapsed = revokedAt ? Date.now() - new Date(revokedAt).getTime() : NaN;\r\n    return window > 0 && elapsed >= 0 && elapsed <= window;\r\n  }\r\n\r\n  private async readAutomaticSuccessor(\r\n    oldToken: RefreshToken,\r\n    decoded: { userId: number; userType: string; familyId: string },\r\n    overlapMs: number | undefined,\r\n  ): Promise<TokenPair | null> {\r\n    if (!this.isAutomaticOverlapOpen(oldToken, overlapMs)) return null;\r\n    const accessId = oldToken.get<string | undefined>(\"successor_access_token_id\");\r\n    const refreshId = oldToken.get<string | undefined>(\"successor_refresh_token_id\");\r\n    if (!accessId || !refreshId) return null;\r\n    const [access, refresh] = await Promise.all([\r\n      this.accessTokenModel.find(accessId),\r\n      this.refreshTokenModel.find(refreshId),\r\n    ]);\r\n    if (!access || access.isExpired || !refresh?.isValid) return null;\r\n    if (\r\n      access.get(\"family_id\") !== decoded.familyId ||\r\n      refresh.get(\"family_id\") !== decoded.familyId ||\r\n      access.get(\"user_id\") !== decoded.userId ||\r\n      refresh.get(\"user_id\") !== decoded.userId ||\r\n      access.get(\"user_type\") !== decoded.userType ||\r\n      refresh.get(\"user_type\") !== decoded.userType\r\n    )\r\n      return null;\r\n    const accessExpiry = new Date(access.get(\"expires_at\")).getTime();\r\n    if (!Number.isFinite(accessExpiry) || accessExpiry <= Date.now()) return null;\r\n    return {\r\n      accessToken: { token: access.get(\"token\"), expiresAt: access.get(\"expires_at\") },\r\n      refreshToken: { token: refresh.get(\"token\"), expiresAt: refresh.get(\"expires_at\") },\r\n    };\r\n  }\r\n\r\n  /**\r\n   * Verify a plaintext password against a stored hash.\r\n   */\r\n  public async verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean> {\r\n    return verifyPassword(plainPassword, hashedPassword);\r\n  }\r\n\r\n  /**\r\n   * Hash a plaintext password.\r\n   */\r\n  public async hashPassword(password: string): Promise<string> {\r\n    return hashPassword(password);\r\n  }\r\n\r\n  /**\r\n   * Resolve a user by credentials, verifying the password. Returns `null` on a\r\n   * missing user or a wrong password, emitting `login.failed` either way.\r\n   */\r\n  public async attemptLogin<T extends Auth>(\r\n    Model: ChildModel<T>,\r\n    data: AuthCredentials,\r\n  ): Promise<T | null> {\r\n    const { password, ...otherData } = data;\r\n\r\n    authEvents.emit(\"login.attempt\", otherData);\r\n\r\n    const user = (await Model.first(otherData)) as T | null;\r\n\r\n    if (!user) {\r\n      authEvents.emit(\"login.failed\", otherData, \"User not found\");\r\n\r\n      return null;\r\n    }\r\n\r\n    if (!(await this.verifyPassword(password, user.string(\"password\")!))) {\r\n      authEvents.emit(\"login.failed\", otherData, \"Invalid password\");\r\n\r\n      return null;\r\n    }\r\n\r\n    if (!(await this.canAuthenticate(user))) {\r\n      authEvents.emit(\"login.failed\", otherData, \"Authentication not allowed\");\r\n\r\n      return null;\r\n    }\r\n\r\n    return user;\r\n  }\r\n\r\n  /**\r\n   * Full login flow: validate credentials, issue tokens, emit events. Returns\r\n   * the user + token pair on success, `null` on failure.\r\n   */\r\n  public async login<T extends Auth>(\r\n    Model: ChildModel<T>,\r\n    credentials: AuthCredentials,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<LoginResult<T> | null> {\r\n    const user = await this.attemptLogin(Model, credentials);\r\n\r\n    if (!user) {\r\n      return null;\r\n    }\r\n\r\n    return this.finalizeLogin(user, deviceInfo);\r\n  }\r\n\r\n  /**\r\n   * Log in a user some OTHER method already authenticated — a provider\r\n   * callback, a passkey assertion, a one-time code. Applies the\r\n   * `auth.canAuthenticate` policy (403 on refusal), then produces exactly\r\n   * what {@link login} produces: the same tokens, rows and events. Pair with\r\n   * {@link setAuthCookie} for a cookie session, as with password login.\r\n   *\r\n   * Never call this for a user you have not authenticated.\r\n   */\r\n  public async completeLogin<T extends Auth>(\r\n    user: T,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<LoginResult<T>> {\r\n    await this.assertCanAuthenticate(user);\r\n\r\n    return this.finalizeLogin(user, deviceInfo);\r\n  }\r\n\r\n  /**\r\n   * Cookie login for a browser: same-origin check, credential login, then both\r\n   * session cookies. Unlike the default CSRF guard, the Origin/Referer check\r\n   * runs even when the request carries no cookies (login CSRF): a missing or\r\n   * cross-site Origin/Referer throws `CsrfOriginMismatchError` before any\r\n   * credential is looked at. Returns `null` on bad credentials.\r\n   */\r\n  public async loginWithSessionCookies<T extends Auth>(\r\n    request: Request,\r\n    response: Response,\r\n    Model: ChildModel<T>,\r\n    credentials: AuthCredentials,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<LoginResult<T> | null> {\r\n    assertCsrfOriginAllowed(request);\r\n\r\n    const result = await this.login(Model, credentials, deviceInfo);\r\n\r\n    if (!result) return null;\r\n\r\n    if (result.tokens.refreshToken) {\r\n      this.setSessionCookies(response, {\r\n        accessToken: result.tokens.accessToken,\r\n        refreshToken: result.tokens.refreshToken,\r\n      });\r\n    } else {\r\n      this.setAuthCookie(response, result.tokens.accessToken);\r\n    }\r\n\r\n    return result;\r\n  }\r\n\r\n  /** The one token-issuing tail every login method shares. */\r\n  private async finalizeLogin<T extends Auth>(\r\n    user: T,\r\n    deviceInfo?: DeviceInfo,\r\n  ): Promise<LoginResult<T>> {\r\n    if (!authConfig.refreshToken.enabled()) {\r\n      const accessToken = await this.issueAccessToken(user, deviceInfo?.payload);\r\n\r\n      return { user, tokens: { accessToken } };\r\n    }\r\n\r\n    const tokens = await this.issueTokenPair(user, deviceInfo);\r\n\r\n    authEvents.emit(\"login.success\", user, tokens, deviceInfo);\r\n\r\n    return { user, tokens };\r\n  }\r\n\r\n  /**\r\n   * Log a user out.\r\n   *\r\n   * @param accessToken - access token string to revoke (optional)\r\n   * @param refreshToken - refresh token string to revoke (optional)\r\n   *\r\n   * When no refresh token is supplied, `config.auth.refreshToken.logoutWithoutToken`\r\n   * decides the behavior: `\"revoke-all\"` (default, fail-safe) revokes every\r\n   * refresh token; `\"error\"` requires the caller to pass one.\r\n   */\r\n  public async logout(user: Auth, accessToken?: string, refreshToken?: string): Promise<void> {\r\n    if (accessToken) {\r\n      await this.removeAccessToken(user, accessToken);\r\n    }\r\n\r\n    if (refreshToken) {\r\n      const token = await this.refreshTokenModel.findForUser(user, refreshToken);\r\n\r\n      if (token) {\r\n        await this.revokeTokenFamily(token.familyId);\r\n        authEvents.emit(\"session.destroyed\", user, token);\r\n      }\r\n    } else {\r\n      const behavior = authConfig.refreshToken.logoutWithoutToken();\r\n\r\n      if (behavior === \"error\") {\r\n        throw new Error(\"Refresh token required for logout\");\r\n      }\r\n\r\n      await this.revokeAllTokens(user);\r\n      authEvents.emit(\"logout.failsafe\", user);\r\n    }\r\n\r\n    authEvents.emit(\"logout\", user);\r\n  }\r\n\r\n  /**\r\n   * Remove a specific access token belonging to the user.\r\n   */\r\n  public async removeAccessToken(user: Auth, token: string): Promise<void> {\r\n    await this.accessTokenModel.deleteForUser(user, token);\r\n  }\r\n\r\n  /**\r\n   * Remove every access token belonging to the user.\r\n   */\r\n  public async removeAllAccessTokens(user: Auth): Promise<void> {\r\n    await this.accessTokenModel.deleteAllForUser(user);\r\n  }\r\n\r\n  /**\r\n   * Remove a specific refresh token belonging to the user.\r\n   */\r\n  public async removeRefreshToken(user: Auth, token: string): Promise<void> {\r\n    await this.refreshTokenModel.deleteForUser(user, token);\r\n  }\r\n\r\n  /**\r\n   * Revoke every active refresh token for the user and delete their access\r\n   * tokens — \"log out of all devices\". Each durable family is first marked through its revision coordinator; an\r\n   * event fires per revoked token.\r\n   */\r\n  public async revokeAllTokens(user: Auth): Promise<void> {\r\n    // Upgrade existing installations lazily before the family scan. Include\r\n    // revoked rows: a rotation may have revoked its predecessor while its\r\n    // durable family still needs logout's marker.\r\n    const existingRows = await this.refreshTokenModel.familiesForUser(user);\r\n\r\n    for (const token of existingRows) {\r\n      await AuthTokenFamily.ensure(user, token.familyId);\r\n    }\r\n\r\n    const families = await AuthTokenFamily.activeFor(user);\r\n\r\n    for (const family of families) {\r\n      await this.revokeTokenFamily(family.get<string>(\"family_id\"));\r\n    }\r\n\r\n    // A deployment can still have rows created before the additive migration\r\n    // ran; retain the old bulk cleanup as a final conservative backstop.\r\n    const legacyTokens = await this.refreshTokenModel.revokeAllFor(user);\r\n\r\n    for (const token of legacyTokens) {\r\n      authEvents.emit(\"token.revoked\", user, token);\r\n    }\r\n    await this.removeAllAccessTokens(user);\r\n\r\n    authEvents.emit(\"logout.all\", user);\r\n  }\r\n\r\n  /**\r\n   * Revoke an entire token family — rotation breach containment.\r\n   */\r\n  public async revokeTokenFamily(familyId: string): Promise<void> {\r\n    let family = await AuthTokenFamily.findByFamilyId(familyId);\r\n\r\n    if (!family) {\r\n      const legacyToken = await this.refreshTokenModel.findInFamily(familyId);\r\n\r\n      if (!legacyToken) return;\r\n\r\n      family = await AuthTokenFamily.ensure(\r\n        {\r\n          id: legacyToken.get(\"user_id\"),\r\n          userType: legacyToken.get<string>(\"user_type\"),\r\n        } as Auth,\r\n        familyId,\r\n      );\r\n    }\r\n\r\n    const user = {\r\n      id: family.get(\"user_id\"),\r\n      userType: family.get<string>(\"user_type\"),\r\n    } as Auth;\r\n\r\n    if (family.isRevoked) {\r\n      // Logout and replay containment are idempotent. Re-run cleanup because a\r\n      // request that lost the original race may have observed stale rows.\r\n      const revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\r\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\r\n      afterTokenFamilyOperation(() =>\r\n        authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\r\n      );\r\n\r\n      return;\r\n    }\r\n\r\n    let revokedTokens: RefreshToken[];\r\n    try {\r\n      revokedTokens = await runTokenFamilyOperation(familyId, async (currentFamily) => {\r\n        const familyUser = {\r\n          id: currentFamily.get(\"user_id\"),\r\n          userType: currentFamily.get<string>(\"user_type\"),\r\n        } as Auth;\r\n        const revision = currentFamily.get<number>(\"revision\");\r\n        const revoked = await AuthTokenFamily.revoke(familyId, revision);\r\n\r\n        if (revoked !== 1) {\r\n          throw new Error(\"Token family revoke lost its revision transition\");\r\n        }\r\n\r\n        const familyTokens = await this.refreshTokenModel.revokeFamily(familyId);\r\n        await this.accessTokenModel.deleteFamilyAndLegacyForUser(familyUser, familyId);\r\n\r\n        return familyTokens;\r\n      });\r\n    } catch (error) {\r\n      if (!(error instanceof TokenFamilyUnavailableError)) throw error;\r\n\r\n      // Another request committed the revoke between the read above and its\r\n      // CAS. A second logout is successful after idempotent cleanup.\r\n      revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\r\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\r\n    }\r\n\r\n    afterTokenFamilyOperation(() =>\r\n      authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\r\n    );\r\n  }\r\n\r\n  /**\r\n   * Delete expired tokens (refresh + access) and spent one-time tokens\r\n   * (expired or consumed verification/reset/OTP/passkey rows). Emits `token.expired` per refresh\r\n   * token and `cleanup.completed` with the refresh count. Drives the\r\n   * `auth.cleanup` CLI command.\r\n   */\r\n  public async cleanupExpiredTokens(): Promise<number> {\r\n    const expiredTokens = await this.refreshTokenModel.purgeExpired();\r\n\r\n    for (const token of expiredTokens) {\r\n      authEvents.emit(\"token.expired\", token);\r\n    }\r\n\r\n    await this.accessTokenModel.purgeExpired();\r\n    await this.oneTimeTokenModel.purgeSpent();\r\n\r\n    authEvents.emit(\"cleanup.completed\", expiredTokens.length);\r\n\r\n    return expiredTokens.length;\r\n  }\r\n\r\n  /**\r\n   * Find every persisted token — access and refresh — that can never retire\r\n   * itself: an unusable `expires_at`, or a token carrying no `exp` claim.\r\n   *\r\n   * This is the remediation read for the pre-4.12.0 `expiresIn` defect (#25).\r\n   * Nothing else surfaces these rows: `auth.cleanup` selects `expires_at < now`,\r\n   * which an `Invalid Date` never satisfies, and a row whose date column is\r\n   * perfectly fine can still hold a token with no deadline in it. Read-only —\r\n   * pair with {@link purgeNeverExpiringTokens} to act on the answer.\r\n   */\r\n  public async findNeverExpiringTokens(): Promise<{\r\n    accessTokens: AccessToken[];\r\n    refreshTokens: RefreshToken[];\r\n  }> {\r\n    return {\r\n      accessTokens: await this.accessTokenModel.findNeverExpiring(),\r\n      refreshTokens: await this.refreshTokenModel.findNeverExpiring(),\r\n    };\r\n  }\r\n\r\n  /**\r\n   * Revoke every never-expiring token by deleting its row, emitting\r\n   * `token.revoked` per refresh token. Drives `warlock auth.purge-never-expiring`.\r\n   *\r\n   * Access tokens first: deleting one is immediate revocation, while a refresh\r\n   * token left in place for a moment can only mint an access token through a\r\n   * verifier that now rejects it for the missing `exp`.\r\n   */\r\n  public async purgeNeverExpiringTokens(): Promise<{\r\n    accessTokens: number;\r\n    refreshTokens: number;\r\n  }> {\r\n    const accessTokens = await this.accessTokenModel.purgeNeverExpiring();\r\n    const refreshTokens = await this.refreshTokenModel.purgeNeverExpiring();\r\n\r\n    // `token.expired` (the event `auth.cleanup` already emits for a removed\r\n    // refresh token) rather than `token.revoked`, which carries a loaded `Auth`\r\n    // this batch path has no reason to fetch a user row for.\r\n    for (const token of refreshTokens) {\r\n      authEvents.emit(\"token.expired\", token);\r\n    }\r\n\r\n    return { accessTokens: accessTokens.length, refreshTokens: refreshTokens.length };\r\n  }\r\n\r\n  /**\r\n   * Active, unexpired sessions for the user, newest first.\r\n   */\r\n  public async getActiveSessions(user: Auth): Promise<RefreshToken[]> {\r\n    return this.refreshTokenModel.activeFor(user);\r\n  }\r\n\r\n  /**\r\n   * `Max-Age` (seconds) `setAuthCookie` should apply, derived from an\r\n   * `AccessTokenOutput`'s `expiresAt` — or `undefined` for a bare token\r\n   * string (a session cookie) or an unparseable `expiresAt`.\r\n   */\r\n  private cookieMaxAgeFromToken(token: string | AccessTokenOutput): number | undefined {\r\n    if (typeof token === \"string\") return undefined;\r\n\r\n    const expiresAt = new Date(token.expiresAt).getTime();\r\n\r\n    if (Number.isNaN(expiresAt)) return undefined;\r\n\r\n    return Math.max(0, Math.round((expiresAt - Date.now()) / 1000));\r\n  }\r\n\r\n  /**\r\n   * Write the auth cookie on `response` — the write side of the `cookie:<name>`\r\n   * token source `authMiddleware([], \"cookie:<name>\")` already reads. An explicit\r\n   * app-controller call, never a side effect of {@link login}, so an existing\r\n   * bearer-only app never starts emitting `Set-Cookie` just by upgrading.\r\n   *\r\n   * Attribute flags (`HttpOnly`, `SameSite=Lax`, `Secure` outside dev) come\r\n   * from `response.cookie()`'s own `secureCookieDefaults()` floor — this\r\n   * method never overrides them, only `name`/`path`/`maxAge`. `raw: true`\r\n   * writes the token unquoted, so the same string a `cookie:<name>` source\r\n   * reads back is exactly what was issued, not a JSON-wrapped copy.\r\n   *\r\n   * @param token - the token string, or an `AccessTokenOutput` (e.g. from\r\n   *   {@link login}) whose `expiresAt` sets `Max-Age` automatically when\r\n   *   `options.maxAge` is not given. A bare string with no `options.maxAge`\r\n   *   produces a session cookie.\r\n   *\r\n   * @example\r\n   * const { user, tokens } = await authService.login(User, credentials);\r\n   * authService.setAuthCookie(response, tokens.accessToken);\r\n   */\r\n  public setAuthCookie(\r\n    response: Response,\r\n    token: string | AccessTokenOutput,\r\n    options: SetAuthCookieOptions = {},\r\n  ): void {\r\n    const name = options.name ?? authConfig.cookie.name();\r\n    const path = options.path ?? authConfig.cookie.path();\r\n    const tokenValue = typeof token === \"string\" ? token : token.token;\r\n    const maxAge = options.maxAge ?? this.cookieMaxAgeFromToken(token);\r\n\r\n    response.cookie(name, tokenValue, {\r\n      raw: true,\r\n      path,\r\n      ...(maxAge !== undefined ? { maxAge } : {}),\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Clear the auth cookie {@link setAuthCookie} wrote. An explicit\r\n   * app-controller call — pair it with {@link logout} after the token row is\r\n   * revoked. `path` must match what the cookie was set with, or the browser\r\n   * silently ignores the clear (see `response.clearCookie`'s own doc comment).\r\n   *\r\n   * @example\r\n   * await authService.logout(user, accessToken, refreshToken);\r\n   * authService.clearAuthCookie(response);\r\n   */\r\n  public clearAuthCookie(response: Response, options: ClearAuthCookieOptions = {}): void {\r\n    const name = options.name ?? authConfig.cookie.name();\r\n    const path = options.path ?? authConfig.cookie.path();\r\n\r\n    response.clearCookie(name, { path });\r\n  }\r\n\r\n  /**\r\n   * Write the access and refresh cookies of a browser session. Both are\r\n   * `HttpOnly`, `SameSite=Lax`, `Path=/` (the refresh cookie must reach every\r\n   * page) and `Secure` outside development, named by `auth.cookie.name` and\r\n   * `auth.cookie.refreshName`. Each `Max-Age` is derived from its token's\r\n   * `expiresAt`, so the cookie lives exactly as long as the token.\r\n   *\r\n   * @example\r\n   * const { tokens } = await authService.login(User, credentials);\r\n   * authService.setSessionCookies(response, tokens);\r\n   */\r\n  public setSessionCookies(\r\n    response: Response,\r\n    tokens: { accessToken: AccessTokenOutput; refreshToken: AccessTokenOutput },\r\n  ): void {\r\n    const cookies = [\r\n      [authConfig.cookie.name(), tokens.accessToken],\r\n      [authConfig.cookie.refreshName(), tokens.refreshToken],\r\n    ] as const;\r\n\r\n    for (const [name, token] of cookies) {\r\n      const maxAge = this.cookieMaxAgeFromToken(token);\r\n\r\n      response.cookie(name, token.token, {\r\n        raw: true,\r\n        httpOnly: true,\r\n        sameSite: \"lax\",\r\n        path: \"/\",\r\n        ...(maxAge !== undefined ? { maxAge } : {}),\r\n      });\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Clear both session cookies {@link setSessionCookies} wrote, on `Path=/`.\r\n   * Pair it with {@link logout} after the token rows are revoked.\r\n   */\r\n  public clearSessionCookies(response: Response): void {\r\n    response.clearCookie(authConfig.cookie.name(), { path: \"/\" });\r\n    response.clearCookie(authConfig.cookie.refreshName(), { path: \"/\" });\r\n  }\r\n}\r\n\r\nexport const authService = new AuthService();\r\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmCA,IAAM,cAAN,MAAkB;;;;;;;CAOhB,IAAY,mBAAuC;EACjD,OAAO,OAAO,IAAI,0BAA0B,WAAW;CACzD;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,AAAO,wBAAwB,MAAqC;EAClE,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,YAAY,KAAK,IAAI;EACvB;CACF;;CAGA,MAAa,gBAAgB,MAA8B;EACzD,OAAO,WAAW,gBAAgB,IAAI;CACxC;CAEA,MAAc,sBAAsB,MAA2B;EAC7D,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GACnC,MAAM,IAAI,eAAe,gCAAgC;CAE7D;CAEA,MAAc,iBACZ,MACA,SACA,UAC4B;EAC5B,MAAM,OAAO;GAAE,GAAI,WAAW,KAAK,wBAAwB,IAAI;GAAI,KAAK,WAAW;EAAE;EAErF,MAAM,YAAY,WAAW,YAAY,YAAY;EAErD,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM,EAAE,UAAU,CAAC;EACpD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;EAEjD,IAAI,UACF,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,WAAW,QAAQ;OAElE,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,SAAS;EAG1D,OAAO;GAAE;GAAO,WAAW,UAAU,YAAY;EAAE;CACrD;;;;;;CAOA,MAAa,oBACX,MACA,SAC4B;EAC5B,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,iBAAiB,MAAM,OAAO;CAC5C;CAEA,MAAc,kBACZ,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAKxC,MAAM,YAAY,WAAW,aAAa,YAAY;EAEtD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAIzD,KAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,MAAM,UAAU;GACd,QAAQ,KAAK;GACb,UAAU,KAAK;GACf;GACA,KAAK,WAAW;EAClB;EAEA,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,YAAY;EAE/D,MAAM,KAAK,kBAAkB,WAAW,MAAM,WAAW,aAAa,WAAW,CAAC;EAElF,MAAM,QAAQ,MAAM,IAAI,qBAAqB,SAAS,EAAE,UAAU,CAAC;EAEnE,OAAO,KAAK,kBAAkB,MAAM,MAAM,OAAO;GAAE;GAAU;GAAW;EAAW,CAAC;CACtF;;;;;;;CAQA,MAAc,sBACZ,MACA,UACA,OACY;EAMZ,KAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,IAAI;GACF,OAAO,MAAM,wBAAwB,UAAU,YAAY,MAAM,CAAC;EACpE,SAAS,OAAO;GAId,IAAI,iBAAiB,6BACnB,MAAM,IAAI,MAAM,gDAAgD;GAGlE,MAAM;EACR;CACF;;;;;CAMA,MAAa,mBACX,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAExC,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,YAAY,UACd,OAAO,KAAK,sBAAsB,MAAM,WAAW,gBACjD,KAAK,kBAAkB,MAAM,UAAU,CACzC;EAGF,OAAO,KAAK,kBAAkB,MAAM,UAAU;CAChD;CAEA,MAAc,eAAe,MAAY,YAA6C;EACpF,MAAM,iBAAiB,WAAW,aAAa,QAAQ;EACvD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAEzD,IAAI,gBAGF;QAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAClE;EAGF,MAAM,cAAc,MAAM,KAAK,iBAC7B,MACA,YAAY,SACZ,iBAAiB,WAAW,MAC9B;EACA,MAAM,eAAe,MAAM,KAAK,kBAC9B,MACA,iBAAiB;GAAE,GAAG;GAAY;EAAS,IAAI,UACjD;EAEA,MAAM,YAAuB;GAC3B;GACA,cAAc,eACV;IACE,OAAO,aAAa,IAAI,OAAO;IAC/B,WAAW,aAAa,IAAI,YAAY;GAC1C,IACA;EACN;EAEA,gCAAgC,WAAW,KAAK,iBAAiB,MAAM,SAAS,CAAC;EAEjF,IAAI,cACF,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,UAAU,CACnE;EAGF,OAAO;CACT;;;;CAKA,MAAa,gBAAgB,MAAY,YAA6C;EACpF,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,WAAW,aAAa,QAAQ,KAAK,YAAY,UACnD,OAAO,KAAK,sBAAsB,MAAM,WAAW,gBACjD,KAAK,eAAe,MAAM,UAAU,CACtC;EAGF,OAAO,KAAK,eAAe,MAAM,UAAU;CAC7C;;;;;;CAOA,MAAa,cACX,oBACA,YAC2B;EAC3B,IAAI;EAMJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAE5C,MAAM;EACR;EAEA,IAAI,CAAC,SAAS,OAAO;EAErB,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAElF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAElE,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAChF,IAAI,CAAC,gBAAgB,CAAC,KAAK,uBAAuB,cAAc,OAAO,GAAG,OAAO;GACjF,IAAI,CAAC,aAAa,SAAS;IAEzB,IAAI,cACF,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IAGpD,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAEhE,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAGlE,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GAEjD,IAAI,CAAC,MAAM,OAAO;GAElB,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAIhD,IAFwB,WAAW,aAAa,SAE9B,GAGhB;QAAI,CAAC,MAFa,aAAa,eAAe,GAEpC;KAER,MAAM,KAAK,kBAAkB,aAAa,QAAQ;KAElD,OAAO;IACT;UAEA,MAAM,aAAa,WAAW;GAGhC,MAAM,eAAe,MAAM,KAAK,eAAe,MAAM;IACnD,GAAG;IACH,UAAU,aAAa;GACzB,CAAC;GAED,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,YAAY,CACrE;GAEA,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;;;;;;CAOA,MAAa,sBACX,oBACA,kBACA,UAA8E,CAAC,GACpD;EAC3B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAC5C,MAAM;EACR;EAEA,IAAI,CAAC,WAAW,QAAQ,aAAa,kBAAkB,OAAO;EAC9D,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAClF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAGlE,MAAM,WAAW,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAC5E,IAAI,CAAC,YAAY,CAAC,KAAK,uBAAuB,UAAU,OAAO,GAAG,OAAO;GACzE,IAAI,CAAC,SAAS,SAAS;IACrB,MAAM,YAAY,MAAM,KAAK,uBAAuB,UAAU,SAAS,QAAQ,SAAS;IACxF,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,UAAU,QAAQ,SAAS,KACvD,KAAK,aAAa,QAAQ,GAE1B,OAAO;IAET,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAGA,IACE,QAAQ,aAAa,UACpB,MAAM,KAAK,oBAAoB,SAAS,UAAU,QAAQ,QAAQ,GACnE;IACA,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAChF,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GACjD,IAAI,CAAC,QAAQ,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAEzD,IAAI,CAAE,MAAM,SAAS,eAAe,GAAI;IAGtC,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;IAChF,IAAI,CAAC,cAAc,OAAO;IAC1B,MAAM,YAAY,MAAM,KAAK,uBAC3B,cACA,SACA,QAAQ,SACV;IACA,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,cAAc,QAAQ,SAAS,KAC3D,KAAK,aAAa,YAAY,GAE9B,OAAO;IACT,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,OAAO,MAAM,KAAK,eAAe,MAAM;IAC3C,GAAG,QAAQ;IACX,UAAU,SAAS;GACrB,CAAC;GACD,MAAM,kBAAkB,MAAM,KAAK,iBAAiB,YAAY,KAAK,YAAY,KAAK;GACtF,MAAM,mBAAmB,KAAK,eAC1B,MAAM,KAAK,kBAAkB,YAAY,KAAK,aAAa,KAAK,IAChE;GACJ,IAAI,CAAC,mBAAmB,CAAC,kBACvB,MAAM,IAAI,MAAM,6DAA6D;GAe/E,IAAI,MATiB,KAAK,kBAAkB,OAC1C,EAAE,IAAI,SAAS,GAAG,GAClB,EACE,MAAM;IACJ,2BAA2B,gBAAgB;IAC3C,4BAA4B,iBAAiB;GAC/C,EACF,CACF,MACe,GAAG,MAAM,IAAI,MAAM,qDAAqD;GACvF,gCAAgC,WAAW,KAAK,mBAAmB,MAAM,MAAM,QAAQ,CAAC;GACxF,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;;;;;;CAOA,MAAc,oBAAoB,UAAkB,UAAoC;EAEtF,IAAI,WAAmB,MADF,gBAAgB,eAAe,QAAQ,EAC/B,EAAE,IAAI,YAAY;EAE/C,IAAI,CAAC,SAOH,WAAU,MANW,KAAK,kBACvB,MAAM,CAAC,CACP,MAAM,EAAE,WAAW,SAAS,CAAC,CAAC,CAC9B,QAAQ,cAAc,KAAK,CAAC,CAC5B,MAAM,EAEO,EAAE,IAAI,YAAY;EAGpC,MAAM,YAAY,UAAU,IAAI,KAAK,OAAiC,CAAC,CAAC,QAAQ,IAAI;EAGpF,IAAI,CAAC,OAAO,SAAS,SAAS,GAAG,OAAO;EAExC,OAAO,KAAK,IAAI,IAAI,YAAY;CAClC;CAEA,AAAQ,mBAAmB,WAAuC;EAChE,OAAO,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,IAC7D,KAAK,IAAI,GAAG,KAAK,IAAI,KAAQ,SAAS,CAAC,IACvC;CACN;CAEA,AAAQ,uBACN,OACA,SACS;EACT,OACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,IAAI,SAAS,MAAM,QAAQ,UACjC,MAAM,IAAI,WAAW,MAAM,QAAQ;CAEvC;CAEA,AAAQ,aAAa,UAAiC;EACpD,OAAO,QACL,SAAS,IAAI,2BAA2B,KAAK,SAAS,IAAI,4BAA4B,CACxF;CACF;CAEA,AAAQ,uBAAuB,UAAwB,WAAwC;EAC7F,MAAM,YAAY,SAAS,IAAsB,YAAY;EAC7D,MAAM,SAAS,KAAK,mBAAmB,SAAS;EAChD,MAAM,UAAU,YAAY,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI;EACzE,OAAO,SAAS,KAAK,WAAW,KAAK,WAAW;CAClD;CAEA,MAAc,uBACZ,UACA,SACA,WAC2B;EAC3B,IAAI,CAAC,KAAK,uBAAuB,UAAU,SAAS,GAAG,OAAO;EAC9D,MAAM,WAAW,SAAS,IAAwB,2BAA2B;EAC7E,MAAM,YAAY,SAAS,IAAwB,4BAA4B;EAC/E,IAAI,CAAC,YAAY,CAAC,WAAW,OAAO;EACpC,MAAM,CAAC,QAAQ,WAAW,MAAM,QAAQ,IAAI,CAC1C,KAAK,iBAAiB,KAAK,QAAQ,GACnC,KAAK,kBAAkB,KAAK,SAAS,CACvC,CAAC;EACD,IAAI,CAAC,UAAU,OAAO,aAAa,CAAC,SAAS,SAAS,OAAO;EAC7D,IACE,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,YACrC,OAAO,IAAI,SAAS,MAAM,QAAQ,UAClC,QAAQ,IAAI,SAAS,MAAM,QAAQ,UACnC,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,UAErC,OAAO;EACT,MAAM,eAAe,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ;EAChE,IAAI,CAAC,OAAO,SAAS,YAAY,KAAK,gBAAgB,KAAK,IAAI,GAAG,OAAO;EACzE,OAAO;GACL,aAAa;IAAE,OAAO,OAAO,IAAI,OAAO;IAAG,WAAW,OAAO,IAAI,YAAY;GAAE;GAC/E,cAAc;IAAE,OAAO,QAAQ,IAAI,OAAO;IAAG,WAAW,QAAQ,IAAI,YAAY;GAAE;EACpF;CACF;;;;CAKA,MAAa,eAAe,eAAuB,gBAA0C;EAC3F,OAAO,eAAe,eAAe,cAAc;CACrD;;;;CAKA,MAAa,aAAa,UAAmC;EAC3D,OAAO,aAAa,QAAQ;CAC9B;;;;;CAMA,MAAa,aACX,OACA,MACmB;EACnB,MAAM,EAAE,UAAU,GAAG,cAAc;EAEnC,WAAW,KAAK,iBAAiB,SAAS;EAE1C,MAAM,OAAQ,MAAM,MAAM,MAAM,SAAS;EAEzC,IAAI,CAAC,MAAM;GACT,WAAW,KAAK,gBAAgB,WAAW,gBAAgB;GAE3D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE,GAAI;GACpE,WAAW,KAAK,gBAAgB,WAAW,kBAAkB;GAE7D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI;GACvC,WAAW,KAAK,gBAAgB,WAAW,4BAA4B;GAEvE,OAAO;EACT;EAEA,OAAO;CACT;;;;;CAMA,MAAa,MACX,OACA,aACA,YACgC;EAChC,MAAM,OAAO,MAAM,KAAK,aAAa,OAAO,WAAW;EAEvD,IAAI,CAAC,MACH,OAAO;EAGT,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;;;CAWA,MAAa,cACX,MACA,YACyB;EACzB,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;CASA,MAAa,wBACX,SACA,UACA,OACA,aACA,YACgC;EAChC,wBAAwB,OAAO;EAE/B,MAAM,SAAS,MAAM,KAAK,MAAM,OAAO,aAAa,UAAU;EAE9D,IAAI,CAAC,QAAQ,OAAO;EAEpB,IAAI,OAAO,OAAO,cAChB,KAAK,kBAAkB,UAAU;GAC/B,aAAa,OAAO,OAAO;GAC3B,cAAc,OAAO,OAAO;EAC9B,CAAC;OAED,KAAK,cAAc,UAAU,OAAO,OAAO,WAAW;EAGxD,OAAO;CACT;;CAGA,MAAc,cACZ,MACA,YACyB;EACzB,IAAI,CAAC,WAAW,aAAa,QAAQ,GAGnC,OAAO;GAAE;GAAM,QAAQ,EAAE,mBAFC,KAAK,iBAAiB,MAAM,YAAY,OAAO,EAEpC;EAAE;EAGzC,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,UAAU;EAEzD,WAAW,KAAK,iBAAiB,MAAM,QAAQ,UAAU;EAEzD,OAAO;GAAE;GAAM;EAAO;CACxB;;;;;;;;;;;CAYA,MAAa,OAAO,MAAY,aAAsB,cAAsC;EAC1F,IAAI,aACF,MAAM,KAAK,kBAAkB,MAAM,WAAW;EAGhD,IAAI,cAAc;GAChB,MAAM,QAAQ,MAAM,KAAK,kBAAkB,YAAY,MAAM,YAAY;GAEzE,IAAI,OAAO;IACT,MAAM,KAAK,kBAAkB,MAAM,QAAQ;IAC3C,WAAW,KAAK,qBAAqB,MAAM,KAAK;GAClD;EACF,OAAO;GAGL,IAFiB,WAAW,aAAa,mBAE9B,MAAM,SACf,MAAM,IAAI,MAAM,mCAAmC;GAGrD,MAAM,KAAK,gBAAgB,IAAI;GAC/B,WAAW,KAAK,mBAAmB,IAAI;EACzC;EAEA,WAAW,KAAK,UAAU,IAAI;CAChC;;;;CAKA,MAAa,kBAAkB,MAAY,OAA8B;EACvE,MAAM,KAAK,iBAAiB,cAAc,MAAM,KAAK;CACvD;;;;CAKA,MAAa,sBAAsB,MAA2B;EAC5D,MAAM,KAAK,iBAAiB,iBAAiB,IAAI;CACnD;;;;CAKA,MAAa,mBAAmB,MAAY,OAA8B;EACxE,MAAM,KAAK,kBAAkB,cAAc,MAAM,KAAK;CACxD;;;;;;CAOA,MAAa,gBAAgB,MAA2B;EAItD,MAAM,eAAe,MAAM,KAAK,kBAAkB,gBAAgB,IAAI;EAEtE,KAAK,MAAM,SAAS,cAClB,MAAM,gBAAgB,OAAO,MAAM,MAAM,QAAQ;EAGnD,MAAM,WAAW,MAAM,gBAAgB,UAAU,IAAI;EAErD,KAAK,MAAM,UAAU,UACnB,MAAM,KAAK,kBAAkB,OAAO,IAAY,WAAW,CAAC;EAK9D,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,IAAI;EAEnE,KAAK,MAAM,SAAS,cAClB,WAAW,KAAK,iBAAiB,MAAM,KAAK;EAE9C,MAAM,KAAK,sBAAsB,IAAI;EAErC,WAAW,KAAK,cAAc,IAAI;CACpC;;;;CAKA,MAAa,kBAAkB,UAAiC;EAC9D,IAAI,SAAS,MAAM,gBAAgB,eAAe,QAAQ;EAE1D,IAAI,CAAC,QAAQ;GACX,MAAM,cAAc,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAEtE,IAAI,CAAC,aAAa;GAElB,SAAS,MAAM,gBAAgB,OAC7B;IACE,IAAI,YAAY,IAAI,SAAS;IAC7B,UAAU,YAAY,IAAY,WAAW;GAC/C,GACA,QACF;EACF;EAEA,MAAM,OAAO;GACX,IAAI,OAAO,IAAI,SAAS;GACxB,UAAU,OAAO,IAAY,WAAW;EAC1C;EAEA,IAAI,OAAO,WAAW;GAGpB,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GACxE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;GACvE,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;GAEA;EACF;EAEA,IAAI;EACJ,IAAI;GACF,gBAAgB,MAAM,wBAAwB,UAAU,OAAO,kBAAkB;IAC/E,MAAM,aAAa;KACjB,IAAI,cAAc,IAAI,SAAS;KAC/B,UAAU,cAAc,IAAY,WAAW;IACjD;IACA,MAAM,WAAW,cAAc,IAAY,UAAU;IAGrD,IAAI,MAFkB,gBAAgB,OAAO,UAAU,QAAQ,MAE/C,GACd,MAAM,IAAI,MAAM,kDAAkD;IAGpE,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IACvE,MAAM,KAAK,iBAAiB,6BAA6B,YAAY,QAAQ;IAE7E,OAAO;GACT,CAAC;EACH,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,8BAA8B,MAAM;GAI3D,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAClE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;EACzE;EAEA,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;CACF;;;;;;;CAQA,MAAa,uBAAwC;EACnD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa;EAEhE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,MAAM,KAAK,iBAAiB,aAAa;EACzC,MAAM,KAAK,kBAAkB,WAAW;EAExC,WAAW,KAAK,qBAAqB,cAAc,MAAM;EAEzD,OAAO,cAAc;CACvB;;;;;;;;;;;CAYA,MAAa,0BAGV;EACD,OAAO;GACL,cAAc,MAAM,KAAK,iBAAiB,kBAAkB;GAC5D,eAAe,MAAM,KAAK,kBAAkB,kBAAkB;EAChE;CACF;;;;;;;;;CAUA,MAAa,2BAGV;EACD,MAAM,eAAe,MAAM,KAAK,iBAAiB,mBAAmB;EACpE,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,mBAAmB;EAKtE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,OAAO;GAAE,cAAc,aAAa;GAAQ,eAAe,cAAc;EAAO;CAClF;;;;CAKA,MAAa,kBAAkB,MAAqC;EAClE,OAAO,KAAK,kBAAkB,UAAU,IAAI;CAC9C;;;;;;CAOA,AAAQ,sBAAsB,OAAuD;EACnF,IAAI,OAAO,UAAU,UAAU,OAAO;EAEtC,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ;EAEpD,IAAI,OAAO,MAAM,SAAS,GAAG,OAAO;EAEpC,OAAO,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,KAAK,IAAI,KAAK,GAAI,CAAC;CAChE;;;;;;;;;;;;;;;;;;;;;;CAuBA,AAAO,cACL,UACA,OACA,UAAgC,CAAC,GAC3B;EACN,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;EAC7D,MAAM,SAAS,QAAQ,UAAU,KAAK,sBAAsB,KAAK;EAEjE,SAAS,OAAO,MAAM,YAAY;GAChC,KAAK;GACL;GACA,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;EAC3C,CAAC;CACH;;;;;;;;;;;CAYA,AAAO,gBAAgB,UAAoB,UAAkC,CAAC,GAAS;EACrF,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EAEpD,SAAS,YAAY,MAAM,EAAE,KAAK,CAAC;CACrC;;;;;;;;;;;;CAaA,AAAO,kBACL,UACA,QACM;EACN,MAAM,UAAU,CACd,CAAC,WAAW,OAAO,KAAK,GAAG,OAAO,WAAW,GAC7C,CAAC,WAAW,OAAO,YAAY,GAAG,OAAO,YAAY,CACvD;EAEA,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS;GACnC,MAAM,SAAS,KAAK,sBAAsB,KAAK;GAE/C,SAAS,OAAO,MAAM,MAAM,OAAO;IACjC,KAAK;IACL,UAAU;IACV,UAAU;IACV,MAAM;IACN,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;GAC3C,CAAC;EACH;CACF;;;;;CAMA,AAAO,oBAAoB,UAA0B;EACnD,SAAS,YAAY,WAAW,OAAO,KAAK,GAAG,EAAE,MAAM,IAAI,CAAC;EAC5D,SAAS,YAAY,WAAW,OAAO,YAAY,GAAG,EAAE,MAAM,IAAI,CAAC;CACrE;AACF;AAEA,MAAa,cAAc,IAAI,YAAY"}

package/esm/services/index.d.mts

@@ -5,4 +5,5 @@ import { generateJWTSecret } from "./generate-jwt-secret.mjs";
 import { TokenType, TokenTypeError, isInvalidCredentialError, jwt } from "./jwt.mjs";
 import { isEmailVerified, sendEmailVerification, verifyEmail } from "./email-verification.mjs";
 import { IssuedOneTimeToken, consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel } from "./one-time-tokens.mjs";
-import { requestPasswordReset, resetPassword } from "./password-reset.mjs";
+import { requestPasswordReset, resetPassword } from "./password-reset.mjs";
+import { RequestUserFailure, RequestUserOutcome, ResolveRequestUserOptions, readCredential, resolveRequestUser, resolveRequestUserOutcome } from "./resolve-request-user.mjs";

package/esm/services/index.mjs

@@ -2,6 +2,7 @@ import { authEvents } from "./auth-events.mjs";
 import { TokenTypeError, isInvalidCredentialError, jwt } from "./jwt.mjs";
 import { authService } from "./auth.service.mjs";
 import { generateJWTSecret } from "./generate-jwt-secret.mjs";
+import { readCredential, resolveRequestUser, resolveRequestUserOutcome } from "./resolve-request-user.mjs";
 import { currentUser } from "./current-user.mjs";
 import { consumeOneTimeToken, hashOneTimeToken, issueOneTimeToken, oneTimeTokenModel } from "./one-time-tokens.mjs";
 import { isEmailVerified, sendEmailVerification, verifyEmail } from "./email-verification.mjs";

package/esm/services/jwt.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.mts","names":[],"sources":["../../../../../../../auth/src/services/jwt.ts"],"mappings":";;;;;;AAmBA;;;;AAAqB;AAoCrB;KApCY,SAAA;;;AAoC2C;AAevD;;iBAfgB,wBAAA,CAAyB,KAAc;;;;;;;;;;cAe1C,cAAA,SAAuB,KAAA;EAAA,SACzB,IAAA,GAAI,cAAA,CAAA,gBAAA;cAED,QAAA,EAAU,SAAA,EAAW,MAAA;AAAA;AAAA,cA+CtB,GAAA;EA/CoC;AA+CjD;;;;IAMgB,GAAA;IAAA,SAAA;IAAA,GAAA;EAAA,IAKT,aAAA;IAAkB,GAAA;EAAA,IACpB,OAAA;EAAA;;;;;sBAaW,KAAA;IACC,GAAA;IAAA,UAAA;IAAA,cAAA;IAAA,GAAA;EAAA,IAMV,eAAA;IAAoB,GAAA;EAAA,IACtB,OAAA,CAAQ,CAAA;EAmBG;;;;IAAA,GAAA;IAAA,SAAA;IAAA,SAAA;IAAA,GAAA;EAAA,IAMT,aAAA;IAAkB,GAAA;EAAA,IACpB,OAAA;EASY;;;kCADW,KAAA;IACX,GAAA;IAAA,UAAA;IAAA,cAAA;IAAA,GAAA;EAAA,IAMV,eAAA;IAAoB,GAAA;EAAA,IACtB,OAAA,CAAQ,CAAA;AAAA"}
+{"version":3,"file":"jwt.d.mts","names":[],"sources":["../../../../../../../auth/src/services/jwt.ts"],"mappings":";;;;;;AAoBA;;;;AAAqB;AAoCrB;KApCY,SAAA;;;AAoC2C;AAevD;;iBAfgB,wBAAA,CAAyB,KAAc;;;;;;;;;;cAe1C,cAAA,SAAuB,KAAA;EAAA,SACzB,IAAA,GAAI,cAAA,CAAA,gBAAA;cAED,QAAA,EAAU,SAAA,EAAW,MAAA;AAAA;AAAA,cA+CtB,GAAA;EA/CoC;AA+CjD;;;;IAMgB,GAAA;IAAA,SAAA;IAAA,GAAA;EAAA,IAKT,aAAA;IAAkB,GAAA;EAAA,IACpB,OAAA;EAAA;;;;;sBAaW,KAAA;IACC,GAAA;IAAA,UAAA;IAAA,cAAA;IAAA,GAAA;EAAA,IAMV,eAAA;IAAoB,GAAA;EAAA,IACtB,OAAA,CAAQ,CAAA;EAmBG;;;;IAAA,GAAA;IAAA,SAAA;IAAA,SAAA;IAAA,GAAA;EAAA,IAMT,aAAA;IAAkB,GAAA;EAAA,IACpB,OAAA;EASY;;;kCADW,KAAA;IACX,GAAA;IAAA,UAAA;IAAA,cAAA;IAAA,GAAA;EAAA,IAMV,eAAA;IAAoB,GAAA;EAAA,IACtB,OAAA,CAAQ,CAAA;AAAA"}

package/esm/services/jwt.mjs

@@ -1,5 +1,6 @@
-import { authConfig } from "./auth-config.mjs";
 import { AuthErrorCodes } from "../utils/auth-error-codes.mjs";
+import { authConfig } from "./auth-config.mjs";
+import { randomUUID } from "node:crypto";
 import { createSigner, createVerifier } from "fast-jwt";
 
 //#region ../auth/src/services/jwt.ts
@@ -101,6 +102,7 @@ const jwt = {
 			...options,
 			algorithm
 		})({
+			jti: randomUUID(),
 			...payload,
 			tokenType: ACCESS_TOKEN_TYPE
 		});
@@ -130,6 +132,7 @@ const jwt = {
 			algorithm,
 			...options
 		})({
+			jti: randomUUID(),
 			...payload,
 			tokenType: REFRESH_TOKEN_TYPE
 		});