@warlock.js/auth 5.23.2 → 5.25.0

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) Hassan Zohdy
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) Hassan Zohdy
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/esm/contracts/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"sourcesContent":["import { type ChildModel } from \"@warlock.js/cascade\";\r\nimport { type Algorithm } from \"fast-jwt\";\r\nimport type { AccessToken } from \"../models/access-token\";\r\nimport type { Auth } from \"../models/auth.model\";\r\nimport type { OneTimeToken } from \"../models/one-time-token\";\r\nimport type { OtpConfig, PasskeysConfig, ProvidersConfig } from \"./providers\";\r\nimport type { RefreshToken } from \"../models/refresh-token\";\r\n\r\n/**\r\n * Symbol to indicate no expiration for tokens\r\n * Use this when you explicitly want tokens to never expire\r\n *\r\n * @example\r\n * ```typescript\r\n * // src/config/auth.ts\r\n * import { NO_EXPIRATION, type AuthConfigurations } from \"@warlock.js/auth\";\r\n *\r\n * const authConfigurations: AuthConfigurations = {\r\n *   accessToken: {\r\n *     secret: env(\"JWT_SECRET\"),\r\n *     expiresIn: NO_EXPIRATION,  // Token expires within 100 years\r\n *   },\r\n * };\r\n *\r\n * export default authConfigurations;\r\n * ```\r\n */\r\nexport const NO_EXPIRATION = \"100y\";\r\n\r\n/**\r\n * Behavior when logout is called without a refresh token\r\n * - \"revoke-all\": Revoke all refresh tokens for the user (secure default)\r\n * - \"error\": Return an error requiring the refresh token\r\n */\r\nexport type LogoutWithoutTokenBehavior = \"revoke-all\" | \"error\";\r\n\r\n/** The single request credential source an auth middleware instance accepts. */\r\nexport type TokenFrom = \"header\" | `cookie:${string}`;\r\n\r\n/** One explicitly named credential location accepted by auth middleware. */\r\nexport interface AuthCredentialDescriptor {\r\n  source: \"header\" | \"cookie\";\r\n  key?: string;\r\n}\r\n\r\n/** Cookie credential and bounded duplicate window for automatic renewal. */\r\nexport interface AuthRefreshCredentialDescriptor extends AuthCredentialDescriptor {\r\n  /** Milliseconds; the service clamps this to the 0–10 second range (default 5 seconds). */\r\n  overlapMs?: number;\r\n}\r\n\r\n/** Per-route authentication behavior for the object middleware overload. */\r\nexport interface AuthMiddlewareOptions extends Partial<AuthCredentialDescriptor> {\r\n  optional?: boolean;\r\n  /**\r\n   * Accept both a header and a cookie credential (at most one of each).\r\n   * Precedence is fixed and independent of array order: a present\r\n   * `Authorization` header wins, an invalid header rejects and never falls back\r\n   * to the cookie, and renewal plus the CSRF Origin check apply only when the\r\n   * cookie is the credential actually used. Cannot be combined with `source`.\r\n   */\r\n  sources?: AuthCredentialDescriptor[];\r\n  /** Opt-in automatic renewal credential. Cookie sources only. */\r\n  refresh?: AuthRefreshCredentialDescriptor;\r\n  redirect?: { to: string; returnUrlParam?: string };\r\n}\r\n\r\n/** Application policy that decides whether a resolved user may authenticate. */\r\nexport type CanAuthenticate = (user: Auth) => boolean | Promise<boolean>;\r\n\r\n/** Password credentials plus the application-defined identity fields. */\r\nexport type AuthCredentials = Record<string, unknown> & {\r\n  password: string;\r\n};\r\n\r\n/**\r\n * Access-token configuration.\r\n *\r\n * `secret` may also be supplied via the deprecated `jwt.secret` (resolved by a\r\n * backward-compatible shim); one of the two is required at runtime.\r\n */\r\nexport type AccessTokenConfig = {\r\n  /**\r\n   * Override the persisted access-token model — extend {@link AccessToken} to\r\n   * add columns (e.g. a tenant key) or rename them, then register the subclass\r\n   * here. Defaults to the package's `AccessToken`.\r\n   */\r\n  model?: typeof AccessToken;\r\n  /**\r\n   * Secret used to sign access tokens.\r\n   */\r\n  secret?: string;\r\n  /**\r\n   * JWT algorithm.\r\n   * @default \"HS256\"\r\n   */\r\n  algorithm?: Algorithm;\r\n  /**\r\n   * Access-token lifetime — a duration string `ms` parses to a **positive**\r\n   * number of milliseconds. A value `ms` cannot parse (`\"30dayz\"`), a\r\n   * non-positive one (`\"0d\"`), or a bare number throws naming this key on the\r\n   * first token issue: each of them would otherwise sign a token with no `exp`\r\n   * claim at all.\r\n   * @example \"1h\" or NO_EXPIRATION\r\n   * @default \"1h\"\r\n   */\r\n  expiresIn?: string;\r\n};\r\n\r\n/**\r\n * Refresh-token configuration.\r\n */\r\nexport type RefreshTokenConfig = {\r\n  /**\r\n   * Override the persisted refresh-token model — extend {@link RefreshToken}.\r\n   * Defaults to the package's `RefreshToken`.\r\n   */\r\n  model?: typeof RefreshToken;\r\n  /**\r\n   * Enable refresh tokens.\r\n   * @default true\r\n   */\r\n  enabled?: boolean;\r\n  /**\r\n   * Separate secret for refresh tokens (recommended for security). Falls back\r\n   * to the access-token secret when omitted.\r\n   */\r\n  secret?: string;\r\n  /**\r\n   * Refresh-token lifetime — a duration string `ms` parses to a **positive**\r\n   * number of milliseconds; an unusable value throws naming this key on issue\r\n   * (see {@link AccessTokenConfig.expiresIn}).\r\n   * @example \"7d\" or \"1w\"\r\n   * @default \"7d\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * Rotate the refresh token on each use (old token revoked, replay detected).\r\n   * @default true\r\n   */\r\n  rotation?: boolean;\r\n  /**\r\n   * Maximum active refresh tokens per user; the oldest are revoked past it.\r\n   * @default 5\r\n   */\r\n  maxPerUser?: number;\r\n  /**\r\n   * Behavior when logout is called without a refresh token.\r\n   * @default \"revoke-all\"\r\n   */\r\n  logoutWithoutToken?: LogoutWithoutTokenBehavior;\r\n};\r\n\r\n/**\r\n * Legacy JWT configuration shape. Still honored by the resolver shim with a\r\n * deprecation warning.\r\n *\r\n * @deprecated Use the top-level `accessToken` / `refreshToken` blocks.\r\n */\r\nexport type LegacyJwtConfig = {\r\n  secret?: string;\r\n  algorithm?: Algorithm;\r\n  expiresIn?: string;\r\n  refresh?: {\r\n    secret?: string;\r\n    enabled?: boolean;\r\n    expiresIn?: string;\r\n    rotation?: boolean;\r\n    maxPerUser?: number;\r\n    logoutWithoutToken?: LogoutWithoutTokenBehavior;\r\n  };\r\n};\r\n\r\n/**\r\n * Page-route auth-failure behavior. When a guarded PAGE route (a React-SSR page,\r\n * `route.isPage`) rejects a logged-out browser, this decides whether it redirects\r\n * to a login page instead of returning the API-style JSON 401.\r\n *\r\n * Read at runtime through `authConfig.pageAuth` (`auth.pageAuth.*`). API routes\r\n * always keep the JSON 401 contract regardless of this setting.\r\n */\r\nexport type PageAuthConfig = {\r\n  /**\r\n   * Login path a guarded page route redirects a logged-out browser to (e.g.\r\n   * `\"/login\"`). Unset ⇒ page-route auth failures keep the JSON 401, so the\r\n   * behavior is opt-in and backward-compatible.\r\n   */\r\n  loginPath?: string;\r\n  /**\r\n   * Query parameter the redirect carries the originally-requested path in, so\r\n   * the login flow can send the user back where they were headed.\r\n   * @default \"returnUrl\"\r\n   */\r\n  returnUrlParam?: string;\r\n};\r\n\r\n/**\r\n * Data every email-verification / password-reset notification receives.\r\n */\r\nexport type OneTimeTokenNotificationData = {\r\n  /** The raw token — the only place it exists; only its SHA-256 hash is stored. */\r\n  token: string;\r\n  /** When the token stops working. */\r\n  expiresAt: Date;\r\n  /** The link built by `auth.verification.url` / `auth.passwordReset.url`, when configured. */\r\n  url?: string;\r\n};\r\n\r\n/**\r\n * Anything auth can deliver a token through — a `defineNotification(...)`\r\n * result satisfies it, as does any object with a compatible `send`.\r\n */\r\nexport type AuthNotification = {\r\n  send: (to: Auth, data: OneTimeTokenNotificationData) => unknown;\r\n};\r\n\r\n/** Builds the link a token notification points at. */\r\nexport type OneTimeTokenUrlBuilder = (token: string, user: Auth) => string;\r\n\r\n/** Persists a new plaintext password for a user during a password reset. */\r\nexport type PasswordSetter = (user: Auth, plainPassword: string) => void | Promise<void>;\r\n\r\n/**\r\n * Email-verification configuration (`auth.verification`).\r\n */\r\nexport type EmailVerificationConfig = {\r\n  /**\r\n   * Token lifetime — a positive `ms` duration string.\r\n   * @default \"24h\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * User attribute stamped with the verification `Date`. Declare it in the\r\n   * user schema (e.g. `emailVerifiedAt: v.date().optional()`).\r\n   * @default \"emailVerifiedAt\"\r\n   */\r\n  field?: string;\r\n  /** Replace the default verification email. */\r\n  notification?: AuthNotification;\r\n  /** Build the verification link passed to the notification as `url`. */\r\n  url?: OneTimeTokenUrlBuilder;\r\n};\r\n\r\n/**\r\n * Password-reset configuration (`auth.passwordReset`).\r\n */\r\nexport type PasswordResetConfig = {\r\n  /**\r\n   * Token lifetime — a positive `ms` duration string.\r\n   * @default \"60m\"\r\n   */\r\n  expiresIn?: string;\r\n  /**\r\n   * User attribute `requestPasswordReset` looks the account up by.\r\n   * @default \"email\"\r\n   */\r\n  identifierField?: string;\r\n  /** Replace the default reset email. */\r\n  notification?: AuthNotification;\r\n  /** Build the reset link passed to the notification as `url`. */\r\n  url?: OneTimeTokenUrlBuilder;\r\n  /**\r\n   * Persist the new password yourself. By default auth saves a hash made by\r\n   * the same `hashPassword` login verifies against, and falls back to the\r\n   * plaintext when the model hashes on save (`useHashedPassword()`), checking\r\n   * the stored value with `verifyPassword` either way.\r\n   */\r\n  setPassword?: PasswordSetter;\r\n};\r\n\r\n/**\r\n * One-time token storage configuration (`auth.oneTimeToken`).\r\n */\r\nexport type OneTimeTokenConfig = {\r\n  /** Override the persisted model — extend {@link OneTimeToken}. */\r\n  model?: typeof OneTimeToken;\r\n};\r\n\r\nexport type AuthConfigurations = {\r\n  /**\r\n   * Define all user types — maps a user-type slug to its `Auth` model class so\r\n   * tokens and the middleware can resolve the right model.\r\n   */\r\n  userType: {\r\n    [userType: string]: ChildModel<Auth>;\r\n  };\r\n  /** Default user type used by `authMiddleware()` and options-only overloads. */\r\n  defaultUserType?: string;\r\n  /**\r\n   * Decide whether a resolved user may authenticate or receive new tokens.\r\n   * @default () => true\r\n   */\r\n  canAuthenticate?: CanAuthenticate;\r\n  /**\r\n   * Access-token configuration (secret, expiry, algorithm, model override).\r\n   */\r\n  accessToken?: AccessTokenConfig;\r\n  /**\r\n   * Refresh-token configuration (rotation, lifetime, cap, model override).\r\n   */\r\n  refreshToken?: RefreshTokenConfig;\r\n  /**\r\n   * Page-route auth-failure behavior — set `loginPath` to redirect a logged-out\r\n   * browser on a guarded PAGE route to a login page instead of the JSON 401.\r\n   * Opt-in; API routes are unaffected. Read via `authConfig.pageAuth`.\r\n   */\r\n  pageAuth?: PageAuthConfig;\r\n  /**\r\n   * Cookie auth session config — read by `authService.setAuthCookie` /\r\n   * `clearAuthCookie`. Opt-in: unset ⇒ the helpers fall back to their own\r\n   * defaults (`name: \"access_token\"`, `path: \"/\"`).\r\n   */\r\n  cookie?: CookieAuthConfig;\r\n  /**\r\n   * CSRF Origin-check config for cookie-authenticated unsafe-method requests.\r\n   */\r\n  csrf?: CsrfConfig;\r\n  /**\r\n   * Email verification — token lifetime, verified field, notification override.\r\n   */\r\n  verification?: EmailVerificationConfig;\r\n  /**\r\n   * Password reset — token lifetime, lookup field, notification and password-writer overrides.\r\n   */\r\n  passwordReset?: PasswordResetConfig;\r\n  /**\r\n   * One-time token (verification / reset) storage — model override.\r\n   */\r\n  oneTimeToken?: OneTimeTokenConfig;\r\n  /**\r\n   * Redirect login providers (`google`, `custom`) and account-linking policy.\r\n   */\r\n  providers?: ProvidersConfig;\r\n  /**\r\n   * Passkey (WebAuthn) relying-party settings. Requires `@simplewebauthn/server`.\r\n   */\r\n  passkeys?: PasskeysConfig;\r\n  /**\r\n   * Phone one-time-code login — channel, lifetime, attempts, delivery.\r\n   */\r\n  otp?: OtpConfig;\r\n  /**\r\n   * @deprecated Use `accessToken` / `refreshToken`. Read via a backward-compatible shim.\r\n   */\r\n  jwt?: LegacyJwtConfig;\r\n};\r\n\r\nexport type AccessTokenOutput = {\r\n  /**\r\n   * JWT Token\r\n   */\r\n  token: string;\r\n  /**\r\n   * Exprie time in ISO format UTC time\r\n   */\r\n  expiresAt: string;\r\n};\r\n\r\n/**\r\n * Token pair returned after login or token refresh\r\n */\r\nexport type TokenPair = {\r\n  /**\r\n   * JWT access token (short-lived)\r\n   */\r\n  accessToken: AccessTokenOutput;\r\n  /**\r\n   * JWT refresh token (long-lived)\r\n   */\r\n  refreshToken?: AccessTokenOutput;\r\n};\r\n\r\n/**\r\n * Device information for session tracking\r\n */\r\nexport type DeviceInfo = {\r\n  /**\r\n   * User agent string from request\r\n   */\r\n  userAgent?: string;\r\n  /**\r\n   * Client IP address\r\n   */\r\n  ip?: string;\r\n  /**\r\n   * Optional device identifier\r\n   */\r\n  deviceId?: string;\r\n  /**\r\n   * Token family ID (for rotation tracking)\r\n   * @internal\r\n   */\r\n  familyId?: string;\r\n  /**\r\n   * Access token payload\r\n   */\r\n  payload?: Record<string, unknown>;\r\n};\r\n\r\nexport type LoginResult<UserType extends Auth> = {\r\n  user: UserType;\r\n  tokens: TokenPair;\r\n};\r\n\r\n/**\r\n * Configuration for the cookie an app opts into via `authService.setAuthCookie`\r\n * / `clearAuthCookie` and reads back with `authMiddleware([], \"cookie:<name>\")`.\r\n * Attribute flags (`httpOnly` / `sameSite` / `secure`) are deliberately NOT\r\n * configurable here — they come from core's `secureCookieDefaults()`, the\r\n * same floor every `response.cookie()` call gets, so a cookie auth session can\r\n * never be weakened to a laxer policy than the framework default.\r\n */\r\nexport type CookieAuthConfig = {\r\n  /**\r\n   * Cookie name `setAuthCookie`/`clearAuthCookie` write and clear, and that a\r\n   * `cookie:<name>` token source must match to read it back.\r\n   * @default \"access_token\"\r\n   */\r\n  name?: string;\r\n  /**\r\n   * Cookie name the session helpers write and clear for the refresh token.\r\n   * @default \"refresh_token\"\r\n   */\r\n  refreshName?: string;\r\n  /**\r\n   * Cookie `Path` attribute.\r\n   * @default \"/\"\r\n   */\r\n  path?: string;\r\n};\r\n\r\n/**\r\n * CSRF Origin-check configuration. Read via\r\n * `authConfig.csrf.allowedOrigins()`.\r\n */\r\nexport type CsrfConfig = {\r\n  /**\r\n   * Extra origins allowed on a cookie-authenticated unsafe-method request,\r\n   * in addition to the request's own origin.\r\n   * @default []\r\n   */\r\n  allowedOrigins?: string[];\r\n};\r\n\r\n/**\r\n * Per-call overrides for {@link AuthService.setAuthCookie}. Anything omitted\r\n * falls back to `auth.cookie.*` config, then the package default. Cookie\r\n * *attribute* flags (`httpOnly`/`sameSite`/`secure`) are never settable here —\r\n * see {@link CookieAuthConfig}.\r\n */\r\nexport type SetAuthCookieOptions = {\r\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\r\n  name?: string;\r\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). */\r\n  path?: string;\r\n  /**\r\n   * `Max-Age`, in seconds. Overrides the expiry `setAuthCookie` would\r\n   * otherwise derive from an `AccessTokenOutput`'s `expiresAt`. Passing a\r\n   * bare token string with no `maxAge` produces a session cookie (cleared\r\n   * when the browser closes).\r\n   */\r\n  maxAge?: number;\r\n};\r\n\r\n/** Per-call overrides for {@link AuthService.clearAuthCookie}. */\r\nexport type ClearAuthCookieOptions = {\r\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\r\n  name?: string;\r\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). Must match the `Path` the cookie was set with. */\r\n  path?: string;\r\n};\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2BA,MAAa,gBAAgB"}
+{"version":3,"file":"types.mjs","names":[],"sources":["../../../../../../../auth/src/contracts/types.ts"],"sourcesContent":["import { type ChildModel } from \"@warlock.js/cascade\";\nimport { type Algorithm } from \"fast-jwt\";\nimport type { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport type { OneTimeToken } from \"../models/one-time-token\";\nimport type { OtpConfig, PasskeysConfig, ProvidersConfig } from \"./providers\";\nimport type { RefreshToken } from \"../models/refresh-token\";\n\n/**\n * Symbol to indicate no expiration for tokens\n * Use this when you explicitly want tokens to never expire\n *\n * @example\n * ```typescript\n * // src/config/auth.ts\n * import { NO_EXPIRATION, type AuthConfigurations } from \"@warlock.js/auth\";\n *\n * const authConfigurations: AuthConfigurations = {\n *   accessToken: {\n *     secret: env(\"JWT_SECRET\"),\n *     expiresIn: NO_EXPIRATION,  // Token expires within 100 years\n *   },\n * };\n *\n * export default authConfigurations;\n * ```\n */\nexport const NO_EXPIRATION = \"100y\";\n\n/**\n * Behavior when logout is called without a refresh token\n * - \"revoke-all\": Revoke all refresh tokens for the user (secure default)\n * - \"error\": Return an error requiring the refresh token\n */\nexport type LogoutWithoutTokenBehavior = \"revoke-all\" | \"error\";\n\n/** The single request credential source an auth middleware instance accepts. */\nexport type TokenFrom = \"header\" | `cookie:${string}`;\n\n/** One explicitly named credential location accepted by auth middleware. */\nexport interface AuthCredentialDescriptor {\n  source: \"header\" | \"cookie\";\n  key?: string;\n}\n\n/** Cookie credential and bounded duplicate window for automatic renewal. */\nexport interface AuthRefreshCredentialDescriptor extends AuthCredentialDescriptor {\n  /** Milliseconds; the service clamps this to the 0–10 second range (default 5 seconds). */\n  overlapMs?: number;\n}\n\n/** Per-route authentication behavior for the object middleware overload. */\nexport interface AuthMiddlewareOptions extends Partial<AuthCredentialDescriptor> {\n  optional?: boolean;\n  /**\n   * Accept both a header and a cookie credential (at most one of each).\n   * Precedence is fixed and independent of array order: a present\n   * `Authorization` header wins, an invalid header rejects and never falls back\n   * to the cookie, and renewal plus the CSRF Origin check apply only when the\n   * cookie is the credential actually used. Cannot be combined with `source`.\n   */\n  sources?: AuthCredentialDescriptor[];\n  /** Opt-in automatic renewal credential. Cookie sources only. */\n  refresh?: AuthRefreshCredentialDescriptor;\n  redirect?: { to: string; returnUrlParam?: string };\n}\n\n/** Application policy that decides whether a resolved user may authenticate. */\nexport type CanAuthenticate = (user: Auth) => boolean | Promise<boolean>;\n\n/** Password credentials plus the application-defined identity fields. */\nexport type AuthCredentials = Record<string, unknown> & {\n  password: string;\n};\n\n/**\n * Access-token configuration.\n *\n * `secret` may also be supplied via the deprecated `jwt.secret` (resolved by a\n * backward-compatible shim); one of the two is required at runtime.\n */\nexport type AccessTokenConfig = {\n  /**\n   * Override the persisted access-token model — extend {@link AccessToken} to\n   * add columns (e.g. a tenant key) or rename them, then register the subclass\n   * here. Defaults to the package's `AccessToken`.\n   */\n  model?: typeof AccessToken;\n  /**\n   * Secret used to sign access tokens.\n   */\n  secret?: string;\n  /**\n   * JWT algorithm.\n   * @default \"HS256\"\n   */\n  algorithm?: Algorithm;\n  /**\n   * Access-token lifetime — a duration string `ms` parses to a **positive**\n   * number of milliseconds. A value `ms` cannot parse (`\"30dayz\"`), a\n   * non-positive one (`\"0d\"`), or a bare number throws naming this key on the\n   * first token issue: each of them would otherwise sign a token with no `exp`\n   * claim at all.\n   * @example \"1h\" or NO_EXPIRATION\n   * @default \"1h\"\n   */\n  expiresIn?: string;\n};\n\n/**\n * Refresh-token configuration.\n */\nexport type RefreshTokenConfig = {\n  /**\n   * Override the persisted refresh-token model — extend {@link RefreshToken}.\n   * Defaults to the package's `RefreshToken`.\n   */\n  model?: typeof RefreshToken;\n  /**\n   * Enable refresh tokens.\n   * @default true\n   */\n  enabled?: boolean;\n  /**\n   * Separate secret for refresh tokens (recommended for security). Falls back\n   * to the access-token secret when omitted.\n   */\n  secret?: string;\n  /**\n   * Refresh-token lifetime — a duration string `ms` parses to a **positive**\n   * number of milliseconds; an unusable value throws naming this key on issue\n   * (see {@link AccessTokenConfig.expiresIn}).\n   * @example \"7d\" or \"1w\"\n   * @default \"7d\"\n   */\n  expiresIn?: string;\n  /**\n   * Rotate the refresh token on each use (old token revoked, replay detected).\n   * @default true\n   */\n  rotation?: boolean;\n  /**\n   * Maximum active refresh tokens per user; the oldest are revoked past it.\n   * @default 5\n   */\n  maxPerUser?: number;\n  /**\n   * Behavior when logout is called without a refresh token.\n   * @default \"revoke-all\"\n   */\n  logoutWithoutToken?: LogoutWithoutTokenBehavior;\n};\n\n/**\n * Legacy JWT configuration shape. Still honored by the resolver shim with a\n * deprecation warning.\n *\n * @deprecated Use the top-level `accessToken` / `refreshToken` blocks.\n */\nexport type LegacyJwtConfig = {\n  secret?: string;\n  algorithm?: Algorithm;\n  expiresIn?: string;\n  refresh?: {\n    secret?: string;\n    enabled?: boolean;\n    expiresIn?: string;\n    rotation?: boolean;\n    maxPerUser?: number;\n    logoutWithoutToken?: LogoutWithoutTokenBehavior;\n  };\n};\n\n/**\n * Page-route auth-failure behavior. When a guarded PAGE route (a React-SSR page,\n * `route.isPage`) rejects a logged-out browser, this decides whether it redirects\n * to a login page instead of returning the API-style JSON 401.\n *\n * Read at runtime through `authConfig.pageAuth` (`auth.pageAuth.*`). API routes\n * always keep the JSON 401 contract regardless of this setting.\n */\nexport type PageAuthConfig = {\n  /**\n   * Login path a guarded page route redirects a logged-out browser to (e.g.\n   * `\"/login\"`). Unset ⇒ page-route auth failures keep the JSON 401, so the\n   * behavior is opt-in and backward-compatible.\n   */\n  loginPath?: string;\n  /**\n   * Query parameter the redirect carries the originally-requested path in, so\n   * the login flow can send the user back where they were headed.\n   * @default \"returnUrl\"\n   */\n  returnUrlParam?: string;\n};\n\n/**\n * Data every email-verification / password-reset notification receives.\n */\nexport type OneTimeTokenNotificationData = {\n  /** The raw token — the only place it exists; only its SHA-256 hash is stored. */\n  token: string;\n  /** When the token stops working. */\n  expiresAt: Date;\n  /** The link built by `auth.verification.url` / `auth.passwordReset.url`, when configured. */\n  url?: string;\n};\n\n/**\n * Anything auth can deliver a token through — a `defineNotification(...)`\n * result satisfies it, as does any object with a compatible `send`.\n */\nexport type AuthNotification = {\n  send: (to: Auth, data: OneTimeTokenNotificationData) => unknown;\n};\n\n/** Builds the link a token notification points at. */\nexport type OneTimeTokenUrlBuilder = (token: string, user: Auth) => string;\n\n/** Persists a new plaintext password for a user during a password reset. */\nexport type PasswordSetter = (user: Auth, plainPassword: string) => void | Promise<void>;\n\n/**\n * Email-verification configuration (`auth.verification`).\n */\nexport type EmailVerificationConfig = {\n  /**\n   * Token lifetime — a positive `ms` duration string.\n   * @default \"24h\"\n   */\n  expiresIn?: string;\n  /**\n   * User attribute stamped with the verification `Date`. Declare it in the\n   * user schema (e.g. `emailVerifiedAt: v.date().optional()`).\n   * @default \"emailVerifiedAt\"\n   */\n  field?: string;\n  /** Replace the default verification email. */\n  notification?: AuthNotification;\n  /** Build the verification link passed to the notification as `url`. */\n  url?: OneTimeTokenUrlBuilder;\n};\n\n/**\n * Password-reset configuration (`auth.passwordReset`).\n */\nexport type PasswordResetConfig = {\n  /**\n   * Token lifetime — a positive `ms` duration string.\n   * @default \"60m\"\n   */\n  expiresIn?: string;\n  /**\n   * User attribute `requestPasswordReset` looks the account up by.\n   * @default \"email\"\n   */\n  identifierField?: string;\n  /** Replace the default reset email. */\n  notification?: AuthNotification;\n  /** Build the reset link passed to the notification as `url`. */\n  url?: OneTimeTokenUrlBuilder;\n  /**\n   * Persist the new password yourself. By default auth saves a hash made by\n   * the same `hashPassword` login verifies against, and falls back to the\n   * plaintext when the model hashes on save (`useHashedPassword()`), checking\n   * the stored value with `verifyPassword` either way.\n   */\n  setPassword?: PasswordSetter;\n};\n\n/**\n * One-time token storage configuration (`auth.oneTimeToken`).\n */\nexport type OneTimeTokenConfig = {\n  /** Override the persisted model — extend {@link OneTimeToken}. */\n  model?: typeof OneTimeToken;\n};\n\nexport type AuthConfigurations = {\n  /**\n   * Define all user types — maps a user-type slug to its `Auth` model class so\n   * tokens and the middleware can resolve the right model.\n   */\n  userType: {\n    [userType: string]: ChildModel<Auth>;\n  };\n  /** Default user type used by `authMiddleware()` and options-only overloads. */\n  defaultUserType?: string;\n  /**\n   * Decide whether a resolved user may authenticate or receive new tokens.\n   * @default () => true\n   */\n  canAuthenticate?: CanAuthenticate;\n  /**\n   * Access-token configuration (secret, expiry, algorithm, model override).\n   */\n  accessToken?: AccessTokenConfig;\n  /**\n   * Refresh-token configuration (rotation, lifetime, cap, model override).\n   */\n  refreshToken?: RefreshTokenConfig;\n  /**\n   * Page-route auth-failure behavior — set `loginPath` to redirect a logged-out\n   * browser on a guarded PAGE route to a login page instead of the JSON 401.\n   * Opt-in; API routes are unaffected. Read via `authConfig.pageAuth`.\n   */\n  pageAuth?: PageAuthConfig;\n  /**\n   * Cookie auth session config — read by `authService.setAuthCookie` /\n   * `clearAuthCookie`. Opt-in: unset ⇒ the helpers fall back to their own\n   * defaults (`name: \"access_token\"`, `path: \"/\"`).\n   */\n  cookie?: CookieAuthConfig;\n  /**\n   * CSRF Origin-check config for cookie-authenticated unsafe-method requests.\n   */\n  csrf?: CsrfConfig;\n  /**\n   * Email verification — token lifetime, verified field, notification override.\n   */\n  verification?: EmailVerificationConfig;\n  /**\n   * Password reset — token lifetime, lookup field, notification and password-writer overrides.\n   */\n  passwordReset?: PasswordResetConfig;\n  /**\n   * One-time token (verification / reset) storage — model override.\n   */\n  oneTimeToken?: OneTimeTokenConfig;\n  /**\n   * Redirect login providers (`google`, `custom`) and account-linking policy.\n   */\n  providers?: ProvidersConfig;\n  /**\n   * Passkey (WebAuthn) relying-party settings. Requires `@simplewebauthn/server`.\n   */\n  passkeys?: PasskeysConfig;\n  /**\n   * Phone one-time-code login — channel, lifetime, attempts, delivery.\n   */\n  otp?: OtpConfig;\n  /**\n   * @deprecated Use `accessToken` / `refreshToken`. Read via a backward-compatible shim.\n   */\n  jwt?: LegacyJwtConfig;\n};\n\nexport type AccessTokenOutput = {\n  /**\n   * JWT Token\n   */\n  token: string;\n  /**\n   * Exprie time in ISO format UTC time\n   */\n  expiresAt: string;\n};\n\n/**\n * Token pair returned after login or token refresh\n */\nexport type TokenPair = {\n  /**\n   * JWT access token (short-lived)\n   */\n  accessToken: AccessTokenOutput;\n  /**\n   * JWT refresh token (long-lived)\n   */\n  refreshToken?: AccessTokenOutput;\n};\n\n/**\n * Device information for session tracking\n */\nexport type DeviceInfo = {\n  /**\n   * User agent string from request\n   */\n  userAgent?: string;\n  /**\n   * Client IP address\n   */\n  ip?: string;\n  /**\n   * Optional device identifier\n   */\n  deviceId?: string;\n  /**\n   * Token family ID (for rotation tracking)\n   * @internal\n   */\n  familyId?: string;\n  /**\n   * Access token payload\n   */\n  payload?: Record<string, unknown>;\n};\n\nexport type LoginResult<UserType extends Auth> = {\n  user: UserType;\n  tokens: TokenPair;\n};\n\n/**\n * Configuration for the cookie an app opts into via `authService.setAuthCookie`\n * / `clearAuthCookie` and reads back with `authMiddleware([], \"cookie:<name>\")`.\n * Attribute flags (`httpOnly` / `sameSite` / `secure`) are deliberately NOT\n * configurable here — they come from core's `secureCookieDefaults()`, the\n * same floor every `response.cookie()` call gets, so a cookie auth session can\n * never be weakened to a laxer policy than the framework default.\n */\nexport type CookieAuthConfig = {\n  /**\n   * Cookie name `setAuthCookie`/`clearAuthCookie` write and clear, and that a\n   * `cookie:<name>` token source must match to read it back.\n   * @default \"access_token\"\n   */\n  name?: string;\n  /**\n   * Cookie name the session helpers write and clear for the refresh token.\n   * @default \"refresh_token\"\n   */\n  refreshName?: string;\n  /**\n   * Cookie `Path` attribute.\n   * @default \"/\"\n   */\n  path?: string;\n};\n\n/**\n * CSRF Origin-check configuration. Read via\n * `authConfig.csrf.allowedOrigins()`.\n */\nexport type CsrfConfig = {\n  /**\n   * Extra origins allowed on a cookie-authenticated unsafe-method request,\n   * in addition to the request's own origin.\n   * @default []\n   */\n  allowedOrigins?: string[];\n};\n\n/**\n * Per-call overrides for {@link AuthService.setAuthCookie}. Anything omitted\n * falls back to `auth.cookie.*` config, then the package default. Cookie\n * *attribute* flags (`httpOnly`/`sameSite`/`secure`) are never settable here —\n * see {@link CookieAuthConfig}.\n */\nexport type SetAuthCookieOptions = {\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\n  name?: string;\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). */\n  path?: string;\n  /**\n   * `Max-Age`, in seconds. Overrides the expiry `setAuthCookie` would\n   * otherwise derive from an `AccessTokenOutput`'s `expiresAt`. Passing a\n   * bare token string with no `maxAge` produces a session cookie (cleared\n   * when the browser closes).\n   */\n  maxAge?: number;\n};\n\n/** Per-call overrides for {@link AuthService.clearAuthCookie}. */\nexport type ClearAuthCookieOptions = {\n  /** Cookie name; defaults to `auth.cookie.name` (package default `\"access_token\"`). */\n  name?: string;\n  /** Cookie `Path`; defaults to `auth.cookie.path` (package default `\"/\"`). Must match the `Path` the cookie was set with. */\n  path?: string;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA2BA,MAAa,gBAAgB"}

package/esm/middleware/auth.middleware.mjs

@@ -72,7 +72,7 @@ function authMiddleware(userTypeOrOptions, legacyTokenFromOrOptions) {
 		const headerWins = dualHeader && Boolean(request.authorizationValue);
 		const usedTokenFrom = headerWins ? "header" : tokenFrom;
 		const usedRefresh = headerWins ? void 0 : refreshCredential;
-		if ((readCredential(request, usedTokenFrom) || usedRefresh) && requiresCsrfOriginCheck(usedTokenFrom, request.method)) try {
+		if ((readCredential(request, usedTokenFrom) || usedRefresh && readCredential(request, usedRefresh)) && requiresCsrfOriginCheck(usedTokenFrom, request.method)) try {
 			assertCsrfOriginAllowed(request);
 		} catch (error) {
 			if (!(error instanceof CsrfOriginMismatchError)) throw error;

package/esm/middleware/auth.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, type HttpContext, t, type Middleware } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport type {\r\n  AuthCredentialDescriptor,\r\n  AuthMiddlewareOptions,\r\n  TokenFrom,\r\n} from \"../contracts/types\";\r\nimport { authConfig } from \"../services/auth-config\";\r\nimport { readCredential, resolveRequestUserOutcome } from \"../services/resolve-request-user\";\r\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\r\nimport {\r\n  assertCsrfOriginAllowed,\r\n  CsrfOriginMismatchError,\r\n  requiresCsrfOriginCheck,\r\n} from \"./csrf-origin-check\";\r\nimport { localizedLoginPath } from \"./localized-login-path\";\r\n\r\n/** The 401 body shape every rejection in this middleware carries. */\r\ntype UnauthorizedPayload = { error: string; errorCode: string };\r\n\r\n/**\r\n * Reject an unauthenticated request, choosing the representation by ROUTE KIND.\r\n *\r\n * An API route always gets the JSON 401 it has always gotten. A PAGE route\r\n * (`request.route.isPage` — the React-SSR pages) instead redirects a logged-out\r\n * browser to the configured login path with a `returnUrl`, so a human\r\n * navigating to a guarded page lands on the login screen rather than reading a\r\n * raw JSON error blob — the defect in finding b9ab9804.\r\n *\r\n * The redirect is OPT-IN and backward-compatible: with no `auth.pageAuth.loginPath`\r\n * configured, even a page route falls back to the JSON 401, so an app that has\r\n * not asked for page-login UX keeps exactly its current behavior. The API 401\r\n * contract is never changed for API routes.\r\n *\r\n * `returnUrl` carries `request.url` — the relative path + query the browser was\r\n * on — never the absolute URL: a relative target cannot be turned into an\r\n * open-redirect off this app's origin.\r\n */\r\nfunction rejectUnauthorized(\r\n  { request, response }: HttpContext,\r\n  payload: UnauthorizedPayload,\r\n  redirect?: AuthMiddlewareOptions[\"redirect\"],\r\n) {\r\n  const loginPath = redirect?.to ?? authConfig.pageAuth.loginPath();\r\n  const returnUrlParam = redirect?.returnUrlParam ?? authConfig.pageAuth.returnUrlParam();\r\n\r\n  if (loginPath && request.route?.isPage) {\r\n    // Under an active `web.localeRouting` strategy, the login destination\r\n    // itself must carry the request's locale prefix — otherwise an anonymous\r\n    // `/ar/admin` bounces to the DEFAULT locale's `/login` rather than\r\n    // `/ar/login`, even though `returnUrl` below correctly points back at\r\n    // `/ar/admin`. See `./localized-login-path.ts`.\r\n    const destination = localizedLoginPath(loginPath, request.locale);\r\n    const separator = destination.includes(\"?\") ? \"&\" : \"?\";\r\n    const returnUrl = encodeURIComponent(request.url);\r\n\r\n    return response.redirect(`${destination}${separator}${returnUrlParam}=${returnUrl}`);\r\n  }\r\n\r\n  return response.unauthorized(payload);\r\n}\r\n\r\nfunction tokenFromDescriptor(descriptor: Partial<AuthCredentialDescriptor>): TokenFrom {\r\n  if (!descriptor.source || descriptor.source === \"header\") return \"header\";\r\n\r\n  if (!descriptor.key) {\r\n    throw new Error(\"authMiddleware cookie credentials require a cookie key.\");\r\n  }\r\n\r\n  return `cookie:${descriptor.key}`;\r\n}\r\n\r\nfunction resolveAllowedTypes(value: string | string[] | undefined): string[] {\r\n  if (value !== undefined) return Array.isArray(value) ? value : [value];\r\n\r\n  const configuredDefault = config.key(\"auth.defaultUserType\") as string | undefined;\r\n\r\n  if (configuredDefault) return [configuredDefault];\r\n\r\n  const userTypes = config.key(\"auth.userType\", {}) as Record<string, unknown>;\r\n  const configuredTypes = Object.keys(userTypes);\r\n\r\n  if (configuredTypes.length === 1) return configuredTypes;\r\n\r\n  throw new Error(\r\n    \"authMiddleware requires a user type when auth.defaultUserType is unset and multiple user types exist.\",\r\n  );\r\n}\r\n\r\n/**\r\n * Build a route gate. Authentication is required unless optional is explicit.\r\n *\r\n * An omitted user type selects the configured default; an explicit argument\r\n * selects which user types may pass:\r\n * - `[]` — any authenticated user (token required, type not checked).\r\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\r\n *   `userType` must be one of the listed types.\r\n *\r\n * `{ optional: true }` allows anonymous requests. All other forms reject\r\n * missing or invalid credentials with 401, or a configured page redirect.\r\n *\r\n * `tokenFrom` selects one credential source and defaults to `\"header\"`.\r\n * A single source avoids making credential precedence depend on array order.\r\n *\r\n * @example\r\n * router.get(\"/account\", authMiddleware([]), accountController);\r\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\r\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\r\n * router.get(\"/browser-account\", authMiddleware([], \"cookie:token\"), accountController);\r\n */\r\nexport function authMiddleware(): Middleware;\r\nexport function authMiddleware(options: AuthMiddlewareOptions): Middleware;\r\nexport function authMiddleware(\r\n  allowedUserType: string | string[],\r\n  options?: AuthMiddlewareOptions,\r\n): Middleware;\r\nexport function authMiddleware(\r\n  allowedUserType: string | string[],\r\n  tokenFrom?: TokenFrom,\r\n): Middleware;\r\nexport function authMiddleware(\r\n  userTypeOrOptions?: string | string[] | AuthMiddlewareOptions,\r\n  legacyTokenFromOrOptions?: TokenFrom | AuthMiddlewareOptions,\r\n): Middleware {\r\n  const options =\r\n    typeof userTypeOrOptions === \"object\" && !Array.isArray(userTypeOrOptions)\r\n      ? userTypeOrOptions\r\n      : typeof legacyTokenFromOrOptions === \"object\"\r\n        ? legacyTokenFromOrOptions\r\n        : undefined;\r\n  const selectedUserType =\r\n    typeof userTypeOrOptions === \"string\" || Array.isArray(userTypeOrOptions)\r\n      ? userTypeOrOptions\r\n      : undefined;\r\n  const allowedTypes = resolveAllowedTypes(selectedUserType);\r\n  const legacyTokenFrom =\r\n    typeof legacyTokenFromOrOptions === \"string\" ? legacyTokenFromOrOptions : undefined;\r\n  const dualSources = options?.sources?.length ? options.sources.map(tokenFromDescriptor) : undefined;\r\n\r\n  if (dualSources && options?.source) {\r\n    throw new Error(\"authMiddleware accepts either `source` or `sources`, not both.\");\r\n  }\r\n\r\n  const dualHeader = dualSources?.includes(\"header\") ?? false;\r\n  const dualCookies = dualSources?.filter(source => source !== \"header\") ?? [];\r\n\r\n  if (dualSources && (dualCookies.length > 1 || dualSources.length - dualCookies.length > 1)) {\r\n    throw new Error(\"authMiddleware `sources` accepts at most one header and one cookie.\");\r\n  }\r\n\r\n  // With dual sources the configured cookie is the base credential; the header\r\n  // is chosen per request, ahead of it.\r\n  const cookieTokenFrom: TokenFrom = dualSources\r\n    ? (dualCookies[0] ?? \"header\")\r\n    : options\r\n      ? tokenFromDescriptor(options)\r\n      : (legacyTokenFrom ?? \"header\");\r\n  const tokenFrom = cookieTokenFrom;\r\n  const refreshCredential = options?.refresh ? tokenFromDescriptor(options.refresh) : undefined;\r\n  const renewalUserType = allowedTypes.length === 1 ? allowedTypes[0] : undefined;\r\n\r\n  if (\r\n    refreshCredential &&\r\n    (tokenFrom === \"header\" || refreshCredential === \"header\" || !renewalUserType)\r\n  ) {\r\n    throw new Error(\r\n      \"authMiddleware automatic renewal requires one allowed user type and cookie access and refresh credentials.\",\r\n    );\r\n  }\r\n\r\n  const optional = options?.optional === true;\r\n\r\n  const auth: Middleware = async ({ request, response }) => {\r\n    const reject = (payload: UnauthorizedPayload) =>\r\n      rejectUnauthorized({ request, response }, payload, options?.redirect);\r\n\r\n    // A present Authorization header always wins and never falls back to the\r\n    // cookie: the credential used is the header, so no renewal and no CSRF check.\r\n    const headerWins = dualHeader && Boolean(request.authorizationValue);\r\n    const usedTokenFrom: TokenFrom = headerWins ? \"header\" : tokenFrom;\r\n    const usedRefresh = headerWins ? undefined : refreshCredential;\r\n\r\n    // Renewal can mint cookies, so a cookie-authenticated unsafe request must\r\n    // pass the same CSRF check even when its access cookie is missing.\r\n    if (\r\n      (readCredential(request, usedTokenFrom) || usedRefresh) &&\r\n      requiresCsrfOriginCheck(usedTokenFrom, request.method)\r\n    ) {\r\n      try {\r\n        assertCsrfOriginAllowed(request);\r\n      } catch (error) {\r\n        if (!(error instanceof CsrfOriginMismatchError)) throw error;\r\n\r\n        log.error(\"http\", \"auth\", error);\r\n        return response.forbidden({\r\n          error: t(\"auth.errors.csrfOriginMismatch\"),\r\n          errorCode: AuthErrorCodes.CsrfOriginMismatch,\r\n        });\r\n      }\r\n    }\r\n\r\n    const outcome = await resolveRequestUserOutcome(request, response, {\r\n      tokenFrom: usedTokenFrom,\r\n      refreshCredential: usedRefresh,\r\n      overlapMs: options?.refresh?.overlapMs,\r\n      allowedTypes,\r\n      renewalUserType,\r\n    });\r\n\r\n    if (outcome.user) {\r\n      request.locals.user = outcome.user;\r\n      return;\r\n    }\r\n\r\n    if (outcome.failure === \"forbidden\") {\r\n      return response.forbidden({\r\n        error: t(\"auth.errors.unauthorized\"),\r\n        errorCode: AuthErrorCodes.Unauthorized,\r\n      });\r\n    }\r\n\r\n    if (optional) return;\r\n\r\n    if (outcome.failure === \"missing\") {\r\n      return reject({\r\n        error: t(\"auth.errors.missingAccessToken\"),\r\n        errorCode: AuthErrorCodes.MissingAccessToken,\r\n      });\r\n    }\r\n\r\n    if (outcome.failure === \"unauthorized\") {\r\n      return reject({\r\n        error: t(\"auth.errors.unauthorized\"),\r\n        errorCode: AuthErrorCodes.Unauthorized,\r\n      });\r\n    }\r\n\r\n    return reject({\r\n      error: t(\"auth.errors.invalidAccessToken\"),\r\n      errorCode: AuthErrorCodes.InvalidAccessToken,\r\n    });\r\n  };\r\n\r\n  return auth;\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAS,mBACP,EAAE,SAAS,YACX,SACA,UACA;CACA,MAAM,YAAY,UAAU,MAAM,WAAW,SAAS,UAAU;CAChE,MAAM,iBAAiB,UAAU,kBAAkB,WAAW,SAAS,eAAe;CAEtF,IAAI,aAAa,QAAQ,OAAO,QAAQ;EAMtC,MAAM,cAAc,mBAAmB,WAAW,QAAQ,MAAM;EAChE,MAAM,YAAY,YAAY,SAAS,GAAG,IAAI,MAAM;EACpD,MAAM,YAAY,mBAAmB,QAAQ,GAAG;EAEhD,OAAO,SAAS,SAAS,GAAG,cAAc,YAAY,eAAe,GAAG,WAAW;CACrF;CAEA,OAAO,SAAS,aAAa,OAAO;AACtC;AAEA,SAAS,oBAAoB,YAA0D;CACrF,IAAI,CAAC,WAAW,UAAU,WAAW,WAAW,UAAU,OAAO;CAEjE,IAAI,CAAC,WAAW,KACd,MAAM,IAAI,MAAM,yDAAyD;CAG3E,OAAO,UAAU,WAAW;AAC9B;AAEA,SAAS,oBAAoB,OAAgD;CAC3E,IAAI,UAAU,QAAW,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;CAErE,MAAM,oBAAoB,OAAO,IAAI,sBAAsB;CAE3D,IAAI,mBAAmB,OAAO,CAAC,iBAAiB;CAEhD,MAAM,YAAY,OAAO,IAAI,iBAAiB,CAAC,CAAC;CAChD,MAAM,kBAAkB,OAAO,KAAK,SAAS;CAE7C,IAAI,gBAAgB,WAAW,GAAG,OAAO;CAEzC,MAAM,IAAI,MACR,uGACF;AACF;AAiCA,SAAgB,eACd,mBACA,0BACY;CACZ,MAAM,UACJ,OAAO,sBAAsB,YAAY,CAAC,MAAM,QAAQ,iBAAiB,IACrE,oBACA,OAAO,6BAA6B,WAClC,2BACA;CAKR,MAAM,eAAe,oBAHnB,OAAO,sBAAsB,YAAY,MAAM,QAAQ,iBAAiB,IACpE,oBACA,MACmD;CACzD,MAAM,kBACJ,OAAO,6BAA6B,WAAW,2BAA2B;CAC5E,MAAM,cAAc,SAAS,SAAS,SAAS,QAAQ,QAAQ,IAAI,mBAAmB,IAAI;CAE1F,IAAI,eAAe,SAAS,QAC1B,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAM,aAAa,aAAa,SAAS,QAAQ,KAAK;CACtD,MAAM,cAAc,aAAa,QAAO,WAAU,WAAW,QAAQ,KAAK,CAAC;CAE3E,IAAI,gBAAgB,YAAY,SAAS,KAAK,YAAY,SAAS,YAAY,SAAS,IACtF,MAAM,IAAI,MAAM,qEAAqE;CAUvF,MAAM,YAL6B,cAC9B,YAAY,MAAM,WACnB,UACE,oBAAoB,OAAO,IAC1B,mBAAmB;CAE1B,MAAM,oBAAoB,SAAS,UAAU,oBAAoB,QAAQ,OAAO,IAAI;CACpF,MAAM,kBAAkB,aAAa,WAAW,IAAI,aAAa,KAAK;CAEtE,IACE,sBACC,cAAc,YAAY,sBAAsB,YAAY,CAAC,kBAE9D,MAAM,IAAI,MACR,4GACF;CAGF,MAAM,WAAW,SAAS,aAAa;CAEvC,MAAM,OAAmB,OAAO,EAAE,SAAS,eAAe;EACxD,MAAM,UAAU,YACd,mBAAmB;GAAE;GAAS;EAAS,GAAG,SAAS,SAAS,QAAQ;EAItE,MAAM,aAAa,cAAc,QAAQ,QAAQ,kBAAkB;EACnE,MAAM,gBAA2B,aAAa,WAAW;EACzD,MAAM,cAAc,aAAa,SAAY;EAI7C,KACG,eAAe,SAAS,aAAa,KAAK,gBAC3C,wBAAwB,eAAe,QAAQ,MAAM,GAErD,IAAI;GACF,wBAAwB,OAAO;EACjC,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,0BAA0B,MAAM;GAEvD,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,OAAO,SAAS,UAAU;IACxB,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAGF,MAAM,UAAU,MAAM,0BAA0B,SAAS,UAAU;GACjE,WAAW;GACX,mBAAmB;GACnB,WAAW,SAAS,SAAS;GAC7B;GACA;EACF,CAAC;EAED,IAAI,QAAQ,MAAM;GAChB,QAAQ,OAAO,OAAO,QAAQ;GAC9B;EACF;EAEA,IAAI,QAAQ,YAAY,aACtB,OAAO,SAAS,UAAU;GACxB,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,IAAI,UAAU;EAEd,IAAI,QAAQ,YAAY,WACtB,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;EAGH,IAAI,QAAQ,YAAY,gBACtB,OAAO,OAAO;GACZ,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;CACH;CAEA,OAAO;AACT"}
+{"version":3,"file":"auth.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/auth.middleware.ts"],"sourcesContent":["import { config, type HttpContext, t, type Middleware } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport type {\n  AuthCredentialDescriptor,\n  AuthMiddlewareOptions,\n  TokenFrom,\n} from \"../contracts/types\";\nimport { authConfig } from \"../services/auth-config\";\nimport { readCredential, resolveRequestUserOutcome } from \"../services/resolve-request-user\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\nimport {\n  assertCsrfOriginAllowed,\n  CsrfOriginMismatchError,\n  requiresCsrfOriginCheck,\n} from \"./csrf-origin-check\";\nimport { localizedLoginPath } from \"./localized-login-path\";\n\n/** The 401 body shape every rejection in this middleware carries. */\ntype UnauthorizedPayload = { error: string; errorCode: string };\n\n/**\n * Reject an unauthenticated request, choosing the representation by ROUTE KIND.\n *\n * An API route always gets the JSON 401 it has always gotten. A PAGE route\n * (`request.route.isPage` — the React-SSR pages) instead redirects a logged-out\n * browser to the configured login path with a `returnUrl`, so a human\n * navigating to a guarded page lands on the login screen rather than reading a\n * raw JSON error blob — the defect in finding b9ab9804.\n *\n * The redirect is OPT-IN and backward-compatible: with no `auth.pageAuth.loginPath`\n * configured, even a page route falls back to the JSON 401, so an app that has\n * not asked for page-login UX keeps exactly its current behavior. The API 401\n * contract is never changed for API routes.\n *\n * `returnUrl` carries `request.url` — the relative path + query the browser was\n * on — never the absolute URL: a relative target cannot be turned into an\n * open-redirect off this app's origin.\n */\nfunction rejectUnauthorized(\n  { request, response }: HttpContext,\n  payload: UnauthorizedPayload,\n  redirect?: AuthMiddlewareOptions[\"redirect\"],\n) {\n  const loginPath = redirect?.to ?? authConfig.pageAuth.loginPath();\n  const returnUrlParam = redirect?.returnUrlParam ?? authConfig.pageAuth.returnUrlParam();\n\n  if (loginPath && request.route?.isPage) {\n    // Under an active `web.localeRouting` strategy, the login destination\n    // itself must carry the request's locale prefix — otherwise an anonymous\n    // `/ar/admin` bounces to the DEFAULT locale's `/login` rather than\n    // `/ar/login`, even though `returnUrl` below correctly points back at\n    // `/ar/admin`. See `./localized-login-path.ts`.\n    const destination = localizedLoginPath(loginPath, request.locale);\n    const separator = destination.includes(\"?\") ? \"&\" : \"?\";\n    const returnUrl = encodeURIComponent(request.url);\n\n    return response.redirect(`${destination}${separator}${returnUrlParam}=${returnUrl}`);\n  }\n\n  return response.unauthorized(payload);\n}\n\nfunction tokenFromDescriptor(descriptor: Partial<AuthCredentialDescriptor>): TokenFrom {\n  if (!descriptor.source || descriptor.source === \"header\") return \"header\";\n\n  if (!descriptor.key) {\n    throw new Error(\"authMiddleware cookie credentials require a cookie key.\");\n  }\n\n  return `cookie:${descriptor.key}`;\n}\n\nfunction resolveAllowedTypes(value: string | string[] | undefined): string[] {\n  if (value !== undefined) return Array.isArray(value) ? value : [value];\n\n  const configuredDefault = config.key(\"auth.defaultUserType\") as string | undefined;\n\n  if (configuredDefault) return [configuredDefault];\n\n  const userTypes = config.key(\"auth.userType\", {}) as Record<string, unknown>;\n  const configuredTypes = Object.keys(userTypes);\n\n  if (configuredTypes.length === 1) return configuredTypes;\n\n  throw new Error(\n    \"authMiddleware requires a user type when auth.defaultUserType is unset and multiple user types exist.\",\n  );\n}\n\n/**\n * Build a route gate. Authentication is required unless optional is explicit.\n *\n * An omitted user type selects the configured default; an explicit argument\n * selects which user types may pass:\n * - `[]` — any authenticated user (token required, type not checked).\n * - `\"admin\"` / `[\"admin\", \"staff\"]` — token required AND the user's\n *   `userType` must be one of the listed types.\n *\n * `{ optional: true }` allows anonymous requests. All other forms reject\n * missing or invalid credentials with 401, or a configured page redirect.\n *\n * `tokenFrom` selects one credential source and defaults to `\"header\"`.\n * A single source avoids making credential precedence depend on array order.\n *\n * @example\n * router.get(\"/account\", authMiddleware([]), accountController);\n * router.get(\"/admin\", authMiddleware(\"admin\"), adminController);\n * router.get(\"/back-office\", authMiddleware([\"admin\", \"staff\"]), backOfficeController);\n * router.get(\"/browser-account\", authMiddleware([], \"cookie:token\"), accountController);\n */\nexport function authMiddleware(): Middleware;\nexport function authMiddleware(options: AuthMiddlewareOptions): Middleware;\nexport function authMiddleware(\n  allowedUserType: string | string[],\n  options?: AuthMiddlewareOptions,\n): Middleware;\nexport function authMiddleware(\n  allowedUserType: string | string[],\n  tokenFrom?: TokenFrom,\n): Middleware;\nexport function authMiddleware(\n  userTypeOrOptions?: string | string[] | AuthMiddlewareOptions,\n  legacyTokenFromOrOptions?: TokenFrom | AuthMiddlewareOptions,\n): Middleware {\n  const options =\n    typeof userTypeOrOptions === \"object\" && !Array.isArray(userTypeOrOptions)\n      ? userTypeOrOptions\n      : typeof legacyTokenFromOrOptions === \"object\"\n        ? legacyTokenFromOrOptions\n        : undefined;\n  const selectedUserType =\n    typeof userTypeOrOptions === \"string\" || Array.isArray(userTypeOrOptions)\n      ? userTypeOrOptions\n      : undefined;\n  const allowedTypes = resolveAllowedTypes(selectedUserType);\n  const legacyTokenFrom =\n    typeof legacyTokenFromOrOptions === \"string\" ? legacyTokenFromOrOptions : undefined;\n  const dualSources = options?.sources?.length ? options.sources.map(tokenFromDescriptor) : undefined;\n\n  if (dualSources && options?.source) {\n    throw new Error(\"authMiddleware accepts either `source` or `sources`, not both.\");\n  }\n\n  const dualHeader = dualSources?.includes(\"header\") ?? false;\n  const dualCookies = dualSources?.filter(source => source !== \"header\") ?? [];\n\n  if (dualSources && (dualCookies.length > 1 || dualSources.length - dualCookies.length > 1)) {\n    throw new Error(\"authMiddleware `sources` accepts at most one header and one cookie.\");\n  }\n\n  // With dual sources the configured cookie is the base credential; the header\n  // is chosen per request, ahead of it.\n  const cookieTokenFrom: TokenFrom = dualSources\n    ? (dualCookies[0] ?? \"header\")\n    : options\n      ? tokenFromDescriptor(options)\n      : (legacyTokenFrom ?? \"header\");\n  const tokenFrom = cookieTokenFrom;\n  const refreshCredential = options?.refresh ? tokenFromDescriptor(options.refresh) : undefined;\n  const renewalUserType = allowedTypes.length === 1 ? allowedTypes[0] : undefined;\n\n  if (\n    refreshCredential &&\n    (tokenFrom === \"header\" || refreshCredential === \"header\" || !renewalUserType)\n  ) {\n    throw new Error(\n      \"authMiddleware automatic renewal requires one allowed user type and cookie access and refresh credentials.\",\n    );\n  }\n\n  const optional = options?.optional === true;\n\n  const auth: Middleware = async ({ request, response }) => {\n    const reject = (payload: UnauthorizedPayload) =>\n      rejectUnauthorized({ request, response }, payload, options?.redirect);\n\n    // A present Authorization header always wins and never falls back to the\n    // cookie: the credential used is the header, so no renewal and no CSRF check.\n    const headerWins = dualHeader && Boolean(request.authorizationValue);\n    const usedTokenFrom: TokenFrom = headerWins ? \"header\" : tokenFrom;\n    const usedRefresh = headerWins ? undefined : refreshCredential;\n\n    // Renewal can mint cookies, so a cookie-authenticated unsafe request must\n    // pass the same CSRF check even when its access cookie is missing.\n    if (\n      (readCredential(request, usedTokenFrom) ||\n        (usedRefresh && readCredential(request, usedRefresh))) &&\n      requiresCsrfOriginCheck(usedTokenFrom, request.method)\n    ) {\n      try {\n        assertCsrfOriginAllowed(request);\n      } catch (error) {\n        if (!(error instanceof CsrfOriginMismatchError)) throw error;\n\n        log.error(\"http\", \"auth\", error);\n        return response.forbidden({\n          error: t(\"auth.errors.csrfOriginMismatch\"),\n          errorCode: AuthErrorCodes.CsrfOriginMismatch,\n        });\n      }\n    }\n\n    const outcome = await resolveRequestUserOutcome(request, response, {\n      tokenFrom: usedTokenFrom,\n      refreshCredential: usedRefresh,\n      overlapMs: options?.refresh?.overlapMs,\n      allowedTypes,\n      renewalUserType,\n    });\n\n    if (outcome.user) {\n      request.locals.user = outcome.user;\n      return;\n    }\n\n    if (outcome.failure === \"forbidden\") {\n      return response.forbidden({\n        error: t(\"auth.errors.unauthorized\"),\n        errorCode: AuthErrorCodes.Unauthorized,\n      });\n    }\n\n    if (optional) return;\n\n    if (outcome.failure === \"missing\") {\n      return reject({\n        error: t(\"auth.errors.missingAccessToken\"),\n        errorCode: AuthErrorCodes.MissingAccessToken,\n      });\n    }\n\n    if (outcome.failure === \"unauthorized\") {\n      return reject({\n        error: t(\"auth.errors.unauthorized\"),\n        errorCode: AuthErrorCodes.Unauthorized,\n      });\n    }\n\n    return reject({\n      error: t(\"auth.errors.invalidAccessToken\"),\n      errorCode: AuthErrorCodes.InvalidAccessToken,\n    });\n  };\n\n  return auth;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAS,mBACP,EAAE,SAAS,YACX,SACA,UACA;CACA,MAAM,YAAY,UAAU,MAAM,WAAW,SAAS,UAAU;CAChE,MAAM,iBAAiB,UAAU,kBAAkB,WAAW,SAAS,eAAe;CAEtF,IAAI,aAAa,QAAQ,OAAO,QAAQ;EAMtC,MAAM,cAAc,mBAAmB,WAAW,QAAQ,MAAM;EAChE,MAAM,YAAY,YAAY,SAAS,GAAG,IAAI,MAAM;EACpD,MAAM,YAAY,mBAAmB,QAAQ,GAAG;EAEhD,OAAO,SAAS,SAAS,GAAG,cAAc,YAAY,eAAe,GAAG,WAAW;CACrF;CAEA,OAAO,SAAS,aAAa,OAAO;AACtC;AAEA,SAAS,oBAAoB,YAA0D;CACrF,IAAI,CAAC,WAAW,UAAU,WAAW,WAAW,UAAU,OAAO;CAEjE,IAAI,CAAC,WAAW,KACd,MAAM,IAAI,MAAM,yDAAyD;CAG3E,OAAO,UAAU,WAAW;AAC9B;AAEA,SAAS,oBAAoB,OAAgD;CAC3E,IAAI,UAAU,QAAW,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;CAErE,MAAM,oBAAoB,OAAO,IAAI,sBAAsB;CAE3D,IAAI,mBAAmB,OAAO,CAAC,iBAAiB;CAEhD,MAAM,YAAY,OAAO,IAAI,iBAAiB,CAAC,CAAC;CAChD,MAAM,kBAAkB,OAAO,KAAK,SAAS;CAE7C,IAAI,gBAAgB,WAAW,GAAG,OAAO;CAEzC,MAAM,IAAI,MACR,uGACF;AACF;AAiCA,SAAgB,eACd,mBACA,0BACY;CACZ,MAAM,UACJ,OAAO,sBAAsB,YAAY,CAAC,MAAM,QAAQ,iBAAiB,IACrE,oBACA,OAAO,6BAA6B,WAClC,2BACA;CAKR,MAAM,eAAe,oBAHnB,OAAO,sBAAsB,YAAY,MAAM,QAAQ,iBAAiB,IACpE,oBACA,MACmD;CACzD,MAAM,kBACJ,OAAO,6BAA6B,WAAW,2BAA2B;CAC5E,MAAM,cAAc,SAAS,SAAS,SAAS,QAAQ,QAAQ,IAAI,mBAAmB,IAAI;CAE1F,IAAI,eAAe,SAAS,QAC1B,MAAM,IAAI,MAAM,gEAAgE;CAGlF,MAAM,aAAa,aAAa,SAAS,QAAQ,KAAK;CACtD,MAAM,cAAc,aAAa,QAAO,WAAU,WAAW,QAAQ,KAAK,CAAC;CAE3E,IAAI,gBAAgB,YAAY,SAAS,KAAK,YAAY,SAAS,YAAY,SAAS,IACtF,MAAM,IAAI,MAAM,qEAAqE;CAUvF,MAAM,YAL6B,cAC9B,YAAY,MAAM,WACnB,UACE,oBAAoB,OAAO,IAC1B,mBAAmB;CAE1B,MAAM,oBAAoB,SAAS,UAAU,oBAAoB,QAAQ,OAAO,IAAI;CACpF,MAAM,kBAAkB,aAAa,WAAW,IAAI,aAAa,KAAK;CAEtE,IACE,sBACC,cAAc,YAAY,sBAAsB,YAAY,CAAC,kBAE9D,MAAM,IAAI,MACR,4GACF;CAGF,MAAM,WAAW,SAAS,aAAa;CAEvC,MAAM,OAAmB,OAAO,EAAE,SAAS,eAAe;EACxD,MAAM,UAAU,YACd,mBAAmB;GAAE;GAAS;EAAS,GAAG,SAAS,SAAS,QAAQ;EAItE,MAAM,aAAa,cAAc,QAAQ,QAAQ,kBAAkB;EACnE,MAAM,gBAA2B,aAAa,WAAW;EACzD,MAAM,cAAc,aAAa,SAAY;EAI7C,KACG,eAAe,SAAS,aAAa,KACnC,eAAe,eAAe,SAAS,WAAW,MACrD,wBAAwB,eAAe,QAAQ,MAAM,GAErD,IAAI;GACF,wBAAwB,OAAO;EACjC,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,0BAA0B,MAAM;GAEvD,IAAI,MAAM,QAAQ,QAAQ,KAAK;GAC/B,OAAO,SAAS,UAAU;IACxB,OAAO,EAAE,gCAAgC;IACzC;GACF,CAAC;EACH;EAGF,MAAM,UAAU,MAAM,0BAA0B,SAAS,UAAU;GACjE,WAAW;GACX,mBAAmB;GACnB,WAAW,SAAS,SAAS;GAC7B;GACA;EACF,CAAC;EAED,IAAI,QAAQ,MAAM;GAChB,QAAQ,OAAO,OAAO,QAAQ;GAC9B;EACF;EAEA,IAAI,QAAQ,YAAY,aACtB,OAAO,SAAS,UAAU;GACxB,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,IAAI,UAAU;EAEd,IAAI,QAAQ,YAAY,WACtB,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;EAGH,IAAI,QAAQ,YAAY,gBACtB,OAAO,OAAO;GACZ,OAAO,EAAE,0BAA0B;GACnC;EACF,CAAC;EAGH,OAAO,OAAO;GACZ,OAAO,EAAE,gCAAgC;GACzC;EACF,CAAC;CACH;CAEA,OAAO;AACT"}

package/esm/middleware/login-throttle.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"login-throttle.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/login-throttle.middleware.ts"],"sourcesContent":["import { cache } from \"@warlock.js/cache\";\r\nimport { t, type Middleware, type Request, type Response } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\r\n\r\n/**\r\n * Built-in identifier kinds the throttle knows how to extract from a request.\r\n *\r\n * - `\"email\"` tracks per-account, so an attacker can't spray one user from\r\n *   many IPs.\r\n * - `\"ip\"` tracks per-source, so an attacker can't stuff many accounts from\r\n *   one IP.\r\n *\r\n * Lockout trips when ANY tracked identifier crosses `max` — defense-in-depth.\r\n */\r\nexport type LoginThrottleIdentifier = \"email\" | \"ip\";\r\n\r\n/**\r\n * Options for {@link loginThrottleMiddleware}.\r\n *\r\n * Failure-aware by design: only counts requests whose response is non-2xx\r\n * (or whatever `isFailure` says) and resets on success, so a user who types\r\n * a wrong password three times then the right one is not penalised.\r\n *\r\n * @example\r\n * loginThrottleMiddleware({ max: 5, window: \"15m\", lockoutDuration: \"15m\" });\r\n */\r\nexport type LoginThrottleOptions = {\r\n  /**\r\n   * Failures allowed within the window before the identifier is locked.\r\n   *\r\n   * @default 5\r\n   */\r\n  max?: number;\r\n\r\n  /**\r\n   * Counting window. `ms`-format string (`\"15m\"`, `\"1h\"`) or seconds as a number.\r\n   *\r\n   * @default \"15m\"\r\n   */\r\n  window?: string | number;\r\n\r\n  /**\r\n   * Lockout duration once the threshold is tripped. `ms`-format string or seconds.\r\n   *\r\n   * @default \"15m\"\r\n   */\r\n  lockoutDuration?: string | number;\r\n\r\n  /**\r\n   * Identifiers tracked. Each is counted and locked independently.\r\n   *\r\n   * @default [\"email\", \"ip\"]\r\n   */\r\n  by?: LoginThrottleIdentifier[];\r\n\r\n  /**\r\n   * Credential field consulted when `\"email\"` is tracked. Switch to\r\n   * `\"username\"` (or any other input field) for systems that don't\r\n   * authenticate by email.\r\n   *\r\n   * @default \"email\"\r\n   */\r\n  identifierKey?: string;\r\n\r\n  /**\r\n   * Override the default error message returned with the 429 response.\r\n   */\r\n  errorMessage?: string;\r\n\r\n  /**\r\n   * Decide whether the response represents a failed login. Defaults to\r\n   * \"non-2xx is a failure\"; override if your controller signals failure\r\n   * through a 200-style body.\r\n   *\r\n   * @default (response) => !response.isOk\r\n   */\r\n  isFailure?: (response: Response) => boolean;\r\n\r\n  /**\r\n   * Compute the identifiers tracked for this request. Override to derive the\r\n   * account key from a header, a JWT subject, or any other shape that does\r\n   * not match the built-in `email` / `ip` extraction.\r\n   */\r\n  identify?: (request: Request) => string[];\r\n};\r\n\r\nconst COUNTER_PREFIX = \"auth.throttle.count.\";\r\nconst LOCK_PREFIX = \"auth.throttle.lock.\";\r\n\r\nconst counterKey = (identifier: string): string => `${COUNTER_PREFIX}${identifier}`;\r\nconst lockKey = (identifier: string): string => `${LOCK_PREFIX}${identifier}`;\r\n\r\n/**\r\n * Built-in identifier extractor — reads the configured credential field from\r\n * the request body for the per-account key, and `request.detectIp()` for the\r\n * per-source key. Untruthy values are dropped; a request that yields zero\r\n * identifiers is left untracked so the middleware no-ops for it.\r\n */\r\nfunction buildDefaultIdentifiers(\r\n  request: Request,\r\n  tracked: LoginThrottleIdentifier[],\r\n  credentialField: string,\r\n): string[] {\r\n  const identifiers: string[] = [];\r\n\r\n  if (tracked.includes(\"email\")) {\r\n    const value = request.input(credentialField);\r\n\r\n    if (typeof value === \"string\" && value.length > 0) {\r\n      identifiers.push(`email.${value.toLowerCase()}`);\r\n    }\r\n  }\r\n\r\n  if (tracked.includes(\"ip\")) {\r\n    const ip = request.detectIp();\r\n\r\n    if (ip) {\r\n      identifiers.push(`ip.${ip}`);\r\n    }\r\n  }\r\n\r\n  return identifiers;\r\n}\r\n\r\n/**\r\n * Failure-aware login throttle. Locks an identifier (account, IP, or both)\r\n * after too many failed login attempts within a window — without penalising\r\n * a user who eventually types the right password.\r\n *\r\n * Mechanism (per identifier):\r\n *\r\n * 1. **Before the controller** — reject with `429` if a lock key is set,\r\n *    skipping the DB lookup AND the bcrypt verify (this also neutralises the\r\n *    CPU-DoS angle of brute-forcing).\r\n * 2. **After the controller** — observe the outcome via `response.onSent`.\r\n *    On failure (non-2xx by default), bump a fixed-window counter; once it\r\n *    reaches `max`, set a lock key with `lockoutDuration` TTL. On success,\r\n *    clear both the counter and the lock for that identifier.\r\n *\r\n * Storage is `@warlock.js/cache` (a peer dependency of `@warlock.js/auth`,\r\n * transitively guaranteed via `@warlock.js/core`). Lockout state is shared\r\n * across replicas — correct security model, because an attacker can't bypass\r\n * by round-robin to a different pod. Every cache call is guarded so a\r\n * misconfigured driver fails open (a throttle outage must never escalate\r\n * into a full auth outage).\r\n *\r\n * @example\r\n * import { loginThrottleMiddleware } from \"@warlock.js/auth\";\r\n * import { router } from \"@warlock.js/core\";\r\n *\r\n * router.post(\"/auth/login\", loginController, {\r\n *   middleware: [loginThrottleMiddleware({ max: 5, window: \"15m\" })],\r\n * });\r\n *\r\n * @example\r\n * // Per-IP only — avoid account-lockout-as-DoS on anonymous-attack vectors\r\n * router.post(\"/auth/refresh-token\", refreshController, {\r\n *   middleware: [loginThrottleMiddleware({ by: [\"ip\"], max: 10, window: \"1m\" })],\r\n * });\r\n */\r\nexport function loginThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\r\n  const max = options.max ?? 5;\r\n  const window = options.window ?? \"15m\";\r\n  const lockoutDuration = options.lockoutDuration ?? \"15m\";\r\n  const tracked = options.by ?? [\"email\", \"ip\"];\r\n  const credentialField = options.identifierKey ?? \"email\";\r\n\r\n  return async ({ request, response }) => {\r\n    const identifiers = options.identify\r\n      ? options.identify(request)\r\n      : buildDefaultIdentifiers(request, tracked, credentialField);\r\n\r\n    if (identifiers.length === 0) return;\r\n\r\n    try {\r\n      for (const identifier of identifiers) {\r\n        const locked = await cache.get(lockKey(identifier));\r\n\r\n        if (locked) {\r\n          return response.tooManyRequests({\r\n            error: options.errorMessage ?? t(\"auth.errors.tooManyAttempts\"),\r\n            errorCode: AuthErrorCodes.TooManyAttempts,\r\n          });\r\n        }\r\n      }\r\n    } catch (error) {\r\n      // Fail open — a cache outage (driver not initialised, network blip)\r\n      // must never escalate into a full auth outage. Log and let the request\r\n      // through; the onSent recorder below is independently guarded so an\r\n      // outage there is also harmless.\r\n      log.error(\"auth\", \"login-throttle\", error);\r\n\r\n      return;\r\n    }\r\n\r\n    response.onSent(async (resolvedResponse: Response) => {\r\n      try {\r\n        const failed = options.isFailure\r\n          ? options.isFailure(resolvedResponse)\r\n          : !resolvedResponse.isOk;\r\n\r\n        if (!failed) {\r\n          for (const identifier of identifiers) {\r\n            await cache.remove(counterKey(identifier));\r\n            await cache.remove(lockKey(identifier));\r\n          }\r\n\r\n          return;\r\n        }\r\n\r\n        for (const identifier of identifiers) {\r\n          const key = counterKey(identifier);\r\n\r\n          // Open the window on the first failure: the create-only write means\r\n          // only one of several racing servers sets the TTL, and an existing\r\n          // window keeps its deadline (fixed window). The bump itself is an\r\n          // atomic increment, so concurrent failures across servers are never\r\n          // lost (redis INCRBY / pg upsert keep the window's TTL).\r\n          await cache.set(key, 0, { ttl: window, onConflict: \"create\" });\r\n          const count = await cache.increment(key);\r\n\r\n          if (count >= max) {\r\n            await cache.set(lockKey(identifier), true, { ttl: lockoutDuration });\r\n          }\r\n        }\r\n      } catch (error) {\r\n        log.error(\"auth\", \"login-throttle\", error);\r\n      }\r\n    });\r\n  };\r\n}\r\n"],"mappings":";;;;;;AAuFA,MAAM,iBAAiB;AACvB,MAAM,cAAc;AAEpB,MAAM,cAAc,eAA+B,GAAG,iBAAiB;AACvE,MAAM,WAAW,eAA+B,GAAG,cAAc;;;;;;;AAQjE,SAAS,wBACP,SACA,SACA,iBACU;CACV,MAAM,cAAwB,CAAC;CAE/B,IAAI,QAAQ,SAAS,OAAO,GAAG;EAC7B,MAAM,QAAQ,QAAQ,MAAM,eAAe;EAE3C,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAC9C,YAAY,KAAK,SAAS,MAAM,YAAY,GAAG;CAEnD;CAEA,IAAI,QAAQ,SAAS,IAAI,GAAG;EAC1B,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,IACF,YAAY,KAAK,MAAM,IAAI;CAE/B;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,wBAAwB,UAAgC,CAAC,GAAe;CACtF,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,kBAAkB,QAAQ,mBAAmB;CACnD,MAAM,UAAU,QAAQ,MAAM,CAAC,SAAS,IAAI;CAC5C,MAAM,kBAAkB,QAAQ,iBAAiB;CAEjD,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,cAAc,QAAQ,WACxB,QAAQ,SAAS,OAAO,IACxB,wBAAwB,SAAS,SAAS,eAAe;EAE7D,IAAI,YAAY,WAAW,GAAG;EAE9B,IAAI;GACF,KAAK,MAAM,cAAc,aAGvB,IAAI,MAFiB,MAAM,IAAI,QAAQ,UAAU,CAAC,GAGhD,OAAO,SAAS,gBAAgB;IAC9B,OAAO,QAAQ,gBAAgB,EAAE,6BAA6B;IAC9D;GACF,CAAC;EAGP,SAAS,OAAO;GAKd,IAAI,MAAM,QAAQ,kBAAkB,KAAK;GAEzC;EACF;EAEA,SAAS,OAAO,OAAO,qBAA+B;GACpD,IAAI;IAKF,IAAI,EAJW,QAAQ,YACnB,QAAQ,UAAU,gBAAgB,IAClC,CAAC,iBAAiB,OAET;KACX,KAAK,MAAM,cAAc,aAAa;MACpC,MAAM,MAAM,OAAO,WAAW,UAAU,CAAC;MACzC,MAAM,MAAM,OAAO,QAAQ,UAAU,CAAC;KACxC;KAEA;IACF;IAEA,KAAK,MAAM,cAAc,aAAa;KACpC,MAAM,MAAM,WAAW,UAAU;KAOjC,MAAM,MAAM,IAAI,KAAK,GAAG;MAAE,KAAK;MAAQ,YAAY;KAAS,CAAC;KAG7D,IAAI,MAFgB,MAAM,UAAU,GAAG,KAE1B,KACX,MAAM,MAAM,IAAI,QAAQ,UAAU,GAAG,MAAM,EAAE,KAAK,gBAAgB,CAAC;IAEvE;GACF,SAAS,OAAO;IACd,IAAI,MAAM,QAAQ,kBAAkB,KAAK;GAC3C;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"login-throttle.middleware.mjs","names":[],"sources":["../../../../../../../auth/src/middleware/login-throttle.middleware.ts"],"sourcesContent":["import { cache } from \"@warlock.js/cache\";\nimport { t, type Middleware, type Request, type Response } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport { AuthErrorCodes } from \"../utils/auth-error-codes\";\n\n/**\n * Built-in identifier kinds the throttle knows how to extract from a request.\n *\n * - `\"email\"` tracks per-account, so an attacker can't spray one user from\n *   many IPs.\n * - `\"ip\"` tracks per-source, so an attacker can't stuff many accounts from\n *   one IP.\n *\n * Lockout trips when ANY tracked identifier crosses `max` — defense-in-depth.\n */\nexport type LoginThrottleIdentifier = \"email\" | \"ip\";\n\n/**\n * Options for {@link loginThrottleMiddleware}.\n *\n * Failure-aware by design: only counts requests whose response is non-2xx\n * (or whatever `isFailure` says) and resets on success, so a user who types\n * a wrong password three times then the right one is not penalised.\n *\n * @example\n * loginThrottleMiddleware({ max: 5, window: \"15m\", lockoutDuration: \"15m\" });\n */\nexport type LoginThrottleOptions = {\n  /**\n   * Failures allowed within the window before the identifier is locked.\n   *\n   * @default 5\n   */\n  max?: number;\n\n  /**\n   * Counting window. `ms`-format string (`\"15m\"`, `\"1h\"`) or seconds as a number.\n   *\n   * @default \"15m\"\n   */\n  window?: string | number;\n\n  /**\n   * Lockout duration once the threshold is tripped. `ms`-format string or seconds.\n   *\n   * @default \"15m\"\n   */\n  lockoutDuration?: string | number;\n\n  /**\n   * Identifiers tracked. Each is counted and locked independently.\n   *\n   * @default [\"email\", \"ip\"]\n   */\n  by?: LoginThrottleIdentifier[];\n\n  /**\n   * Credential field consulted when `\"email\"` is tracked. Switch to\n   * `\"username\"` (or any other input field) for systems that don't\n   * authenticate by email.\n   *\n   * @default \"email\"\n   */\n  identifierKey?: string;\n\n  /**\n   * Override the default error message returned with the 429 response.\n   */\n  errorMessage?: string;\n\n  /**\n   * Decide whether the response represents a failed login. Defaults to\n   * \"non-2xx is a failure\"; override if your controller signals failure\n   * through a 200-style body.\n   *\n   * @default (response) => !response.isOk\n   */\n  isFailure?: (response: Response) => boolean;\n\n  /**\n   * Compute the identifiers tracked for this request. Override to derive the\n   * account key from a header, a JWT subject, or any other shape that does\n   * not match the built-in `email` / `ip` extraction.\n   */\n  identify?: (request: Request) => string[];\n};\n\nconst COUNTER_PREFIX = \"auth.throttle.count.\";\nconst LOCK_PREFIX = \"auth.throttle.lock.\";\n\nconst counterKey = (identifier: string): string => `${COUNTER_PREFIX}${identifier}`;\nconst lockKey = (identifier: string): string => `${LOCK_PREFIX}${identifier}`;\n\n/**\n * Built-in identifier extractor — reads the configured credential field from\n * the request body for the per-account key, and `request.detectIp()` for the\n * per-source key. Untruthy values are dropped; a request that yields zero\n * identifiers is left untracked so the middleware no-ops for it.\n */\nfunction buildDefaultIdentifiers(\n  request: Request,\n  tracked: LoginThrottleIdentifier[],\n  credentialField: string,\n): string[] {\n  const identifiers: string[] = [];\n\n  if (tracked.includes(\"email\")) {\n    const value = request.input(credentialField);\n\n    if (typeof value === \"string\" && value.length > 0) {\n      identifiers.push(`email.${value.toLowerCase()}`);\n    }\n  }\n\n  if (tracked.includes(\"ip\")) {\n    const ip = request.detectIp();\n\n    if (ip) {\n      identifiers.push(`ip.${ip}`);\n    }\n  }\n\n  return identifiers;\n}\n\n/**\n * Failure-aware login throttle. Locks an identifier (account, IP, or both)\n * after too many failed login attempts within a window — without penalising\n * a user who eventually types the right password.\n *\n * Mechanism (per identifier):\n *\n * 1. **Before the controller** — reject with `429` if a lock key is set,\n *    skipping the DB lookup AND the bcrypt verify (this also neutralises the\n *    CPU-DoS angle of brute-forcing).\n * 2. **After the controller** — observe the outcome via `response.onSent`.\n *    On failure (non-2xx by default), bump a fixed-window counter; once it\n *    reaches `max`, set a lock key with `lockoutDuration` TTL. On success,\n *    clear both the counter and the lock for that identifier.\n *\n * Storage is `@warlock.js/cache` (a peer dependency of `@warlock.js/auth`,\n * transitively guaranteed via `@warlock.js/core`). Lockout state is shared\n * across replicas — correct security model, because an attacker can't bypass\n * by round-robin to a different pod. Every cache call is guarded so a\n * misconfigured driver fails open (a throttle outage must never escalate\n * into a full auth outage).\n *\n * @example\n * import { loginThrottleMiddleware } from \"@warlock.js/auth\";\n * import { router } from \"@warlock.js/core\";\n *\n * router.post(\"/auth/login\", loginController, {\n *   middleware: [loginThrottleMiddleware({ max: 5, window: \"15m\" })],\n * });\n *\n * @example\n * // Per-IP only — avoid account-lockout-as-DoS on anonymous-attack vectors\n * router.post(\"/auth/refresh-token\", refreshController, {\n *   middleware: [loginThrottleMiddleware({ by: [\"ip\"], max: 10, window: \"1m\" })],\n * });\n */\nexport function loginThrottleMiddleware(options: LoginThrottleOptions = {}): Middleware {\n  const max = options.max ?? 5;\n  const window = options.window ?? \"15m\";\n  const lockoutDuration = options.lockoutDuration ?? \"15m\";\n  const tracked = options.by ?? [\"email\", \"ip\"];\n  const credentialField = options.identifierKey ?? \"email\";\n\n  return async ({ request, response }) => {\n    const identifiers = options.identify\n      ? options.identify(request)\n      : buildDefaultIdentifiers(request, tracked, credentialField);\n\n    if (identifiers.length === 0) return;\n\n    try {\n      for (const identifier of identifiers) {\n        const locked = await cache.get(lockKey(identifier));\n\n        if (locked) {\n          return response.tooManyRequests({\n            error: options.errorMessage ?? t(\"auth.errors.tooManyAttempts\"),\n            errorCode: AuthErrorCodes.TooManyAttempts,\n          });\n        }\n      }\n    } catch (error) {\n      // Fail open — a cache outage (driver not initialised, network blip)\n      // must never escalate into a full auth outage. Log and let the request\n      // through; the onSent recorder below is independently guarded so an\n      // outage there is also harmless.\n      log.error(\"auth\", \"login-throttle\", error);\n\n      return;\n    }\n\n    response.onSent(async (resolvedResponse: Response) => {\n      try {\n        const failed = options.isFailure\n          ? options.isFailure(resolvedResponse)\n          : !resolvedResponse.isOk;\n\n        if (!failed) {\n          for (const identifier of identifiers) {\n            await cache.remove(counterKey(identifier));\n            await cache.remove(lockKey(identifier));\n          }\n\n          return;\n        }\n\n        for (const identifier of identifiers) {\n          const key = counterKey(identifier);\n\n          // Open the window on the first failure: the create-only write means\n          // only one of several racing servers sets the TTL, and an existing\n          // window keeps its deadline (fixed window). The bump itself is an\n          // atomic increment, so concurrent failures across servers are never\n          // lost (redis INCRBY / pg upsert keep the window's TTL).\n          await cache.set(key, 0, { ttl: window, onConflict: \"create\" });\n          const count = await cache.increment(key);\n\n          if (count >= max) {\n            await cache.set(lockKey(identifier), true, { ttl: lockoutDuration });\n          }\n        }\n      } catch (error) {\n        log.error(\"auth\", \"login-throttle\", error);\n      }\n    });\n  };\n}\n"],"mappings":";;;;;;AAuFA,MAAM,iBAAiB;AACvB,MAAM,cAAc;AAEpB,MAAM,cAAc,eAA+B,GAAG,iBAAiB;AACvE,MAAM,WAAW,eAA+B,GAAG,cAAc;;;;;;;AAQjE,SAAS,wBACP,SACA,SACA,iBACU;CACV,MAAM,cAAwB,CAAC;CAE/B,IAAI,QAAQ,SAAS,OAAO,GAAG;EAC7B,MAAM,QAAQ,QAAQ,MAAM,eAAe;EAE3C,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAC9C,YAAY,KAAK,SAAS,MAAM,YAAY,GAAG;CAEnD;CAEA,IAAI,QAAQ,SAAS,IAAI,GAAG;EAC1B,MAAM,KAAK,QAAQ,SAAS;EAE5B,IAAI,IACF,YAAY,KAAK,MAAM,IAAI;CAE/B;CAEA,OAAO;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,wBAAwB,UAAgC,CAAC,GAAe;CACtF,MAAM,MAAM,QAAQ,OAAO;CAC3B,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,kBAAkB,QAAQ,mBAAmB;CACnD,MAAM,UAAU,QAAQ,MAAM,CAAC,SAAS,IAAI;CAC5C,MAAM,kBAAkB,QAAQ,iBAAiB;CAEjD,OAAO,OAAO,EAAE,SAAS,eAAe;EACtC,MAAM,cAAc,QAAQ,WACxB,QAAQ,SAAS,OAAO,IACxB,wBAAwB,SAAS,SAAS,eAAe;EAE7D,IAAI,YAAY,WAAW,GAAG;EAE9B,IAAI;GACF,KAAK,MAAM,cAAc,aAGvB,IAAI,MAFiB,MAAM,IAAI,QAAQ,UAAU,CAAC,GAGhD,OAAO,SAAS,gBAAgB;IAC9B,OAAO,QAAQ,gBAAgB,EAAE,6BAA6B;IAC9D;GACF,CAAC;EAGP,SAAS,OAAO;GAKd,IAAI,MAAM,QAAQ,kBAAkB,KAAK;GAEzC;EACF;EAEA,SAAS,OAAO,OAAO,qBAA+B;GACpD,IAAI;IAKF,IAAI,EAJW,QAAQ,YACnB,QAAQ,UAAU,gBAAgB,IAClC,CAAC,iBAAiB,OAET;KACX,KAAK,MAAM,cAAc,aAAa;MACpC,MAAM,MAAM,OAAO,WAAW,UAAU,CAAC;MACzC,MAAM,MAAM,OAAO,QAAQ,UAAU,CAAC;KACxC;KAEA;IACF;IAEA,KAAK,MAAM,cAAc,aAAa;KACpC,MAAM,MAAM,WAAW,UAAU;KAOjC,MAAM,MAAM,IAAI,KAAK,GAAG;MAAE,KAAK;MAAQ,YAAY;KAAS,CAAC;KAG7D,IAAI,MAFgB,MAAM,UAAU,GAAG,KAE1B,KACX,MAAM,MAAM,IAAI,QAAQ,UAAU,GAAG,MAAM,EAAE,KAAK,gBAAgB,CAAC;IAEvE;GACF,SAAS,OAAO;IACd,IAAI,MAAM,QAAQ,kBAAkB,KAAK;GAC3C;EACF,CAAC;CACH;AACF"}

package/esm/models/access-token/access-token.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"access-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\r\nimport { v } from \"@warlock.js/seal\";\r\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\r\nimport type { Auth } from \"../auth.model\";\r\n\r\n/**\r\n * Seal schema for the persisted access-token record. Exported so an override\r\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\r\n * base shape.\r\n *\r\n * `last_access` and the `is_active` soft-revoke flag were removed — neither was\r\n * ever read; access tokens are revoked by deleting the row.\r\n */\r\nexport const accessTokenSchema = v.object({\r\n  token: v.string().required(),\r\n  user_id: v.scalar().required(),\r\n  user_type: v.string().required(),\r\n  /** Null for tokens issued before family tracking was introduced. */\r\n  family_id: v.string().optional(),\r\n  expires_at: v.date().required(),\r\n});\r\n\r\n/**\r\n * Persisted access-token record + the data layer for access tokens.\r\n *\r\n * **Role.** Owns access-token persistence and lookup. The middleware checks a\r\n * presented JWT against this table so deleting a row (logout) invalidates the\r\n * token immediately, before its JWT expiry. The auth service goes through the\r\n * named statics exclusively, so it never hard-codes a column name and an\r\n * override can rename/add columns by registering under\r\n * `config.auth.accessToken.model`.\r\n */\r\nexport class AccessToken extends Model {\r\n  public static table = \"access_tokens\";\r\n\r\n  public static schema = accessTokenSchema;\r\n\r\n  /**\r\n   * The raw signed JWT is a bearer credential — never serialize it. `hidden`\r\n   * only strips it from `toJSON()` / `JSON.stringify(model)` (so\r\n   * `response.json(token)` or a resource cannot leak it); `get(\"token\")`,\r\n   * `findByToken` and every query still read the column.\r\n   */\r\n  public static hidden = [\"token\"];\r\n\r\n  /**\r\n   * Permanent regardless of the data source default — Mongo's driver default\r\n   * is `\"trash\"`, which would copy live credential material (the JWT itself)\r\n   * into `access_tokensTrash` on every `destroy()` (logout, expiry purge,\r\n   * never-expiring purge). A revoked/expired access token must not survive\r\n   * anywhere.\r\n   */\r\n  public static deleteStrategy = \"permanent\" as const;\r\n\r\n  /** The user this token was issued for. */\r\n  public get userId() {\r\n    return this.get(\"user_id\");\r\n  }\r\n\r\n  /** The user-type slug this token was issued for. */\r\n  public get userType(): string {\r\n    return this.get(\"user_type\");\r\n  }\r\n\r\n  /**\r\n   * Whether the persisted expiry has passed.\r\n   *\r\n   * The middleware asks this on every request, which is what makes the row the\r\n   * authority it always looked like it was: before 4.12.0 the gate only checked\r\n   * that the row *existed*, so a row the database knew was dead still let its\r\n   * token through — the database was never asked.\r\n   *\r\n   * **Fails closed.** A missing or unparseable `expires_at` counts as expired.\r\n   * `expires_at` is `required` in the schema, so a row that cannot answer \"when\r\n   * does this die\" is malformed, and the safe reading of a malformed credential\r\n   * is that it is not one. This is deliberately stricter than a naive\r\n   * `now > expires_at`, which answers `false` for an `Invalid Date` and thereby\r\n   * grants exactly the poisoned rows an unlimited life.\r\n   */\r\n  public get isExpired(): boolean {\r\n    const expiresAt = this.get(\"expires_at\");\r\n\r\n    if (!isUsableExpiry(expiresAt)) return true;\r\n\r\n    return new Date(expiresAt).getTime() <= Date.now();\r\n  }\r\n\r\n  /**\r\n   * Whether nothing about this row can ever retire it — an unusable\r\n   * `expires_at`, or a token carrying no `exp` claim. See\r\n   * {@link isNeverExpiring}; this is the predicate `purgeNeverExpiring` selects\r\n   * on.\r\n   */\r\n  public get neverExpires(): boolean {\r\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\r\n  }\r\n\r\n  /**\r\n   * Persist a freshly-signed access token for the user.\r\n   */\r\n  public static issue(user: Auth, token: string, expiresAt: Date, familyId?: string) {\r\n    return this.create({\r\n      token,\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      family_id: familyId,\r\n      expires_at: expiresAt,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Find an access-token row by its raw token string.\r\n   */\r\n  public static findByToken(token: string): Promise<AccessToken | null> {\r\n    return this.first({ token });\r\n  }\r\n\r\n  /**\r\n   * Delete a specific token that belongs to the given user.\r\n   */\r\n  public static deleteForUser(user: Auth, token: string) {\r\n    return this.delete({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Delete every access token belonging to the user.\r\n   */\r\n  public static deleteAllForUser(user: Auth) {\r\n    return this.delete({ user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Delete every access token attached to one family, plus pre-family rows for\r\n   * the same user type. The latter is deliberately conservative during the\r\n   * additive upgrade: old access rows cannot be assigned safely to a family.\r\n   */\r\n  public static async deleteFamilyAndLegacyForUser(user: Auth, familyId: string): Promise<void> {\r\n    await this.delete({ user_id: user.id, user_type: user.userType, family_id: familyId });\r\n    await this.delete({ user_id: user.id, user_type: user.userType, family_id: null });\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every expired access-token row. Returns the number removed.\r\n   * Runs from the `auth.cleanup` CLI command (a cold batch path).\r\n   */\r\n  public static async purgeExpired(): Promise<number> {\r\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\r\n\r\n    for (const token of expiredTokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return expiredTokens.length;\r\n  }\r\n\r\n  /**\r\n   * Every row that can never retire itself — see {@link neverExpires}.\r\n   *\r\n   * **A full scan, filtered in memory, on purpose.** The defining case is a row\r\n   * whose `expires_at` is an `Invalid Date`, which no date predicate can select\r\n   * (`< now` and `> now` are both `false` for it), and the definitive case is a\r\n   * token with no `exp` claim, which lives inside the token string rather than\r\n   * in a column. Neither is expressible as a `where`, so the rows have to be\r\n   * read to be judged. This runs from a one-off remediation command, not a\r\n   * request path.\r\n   */\r\n  public static async findNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.query().get();\r\n\r\n    return tokens.filter((token: AccessToken) => token.neverExpires);\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every never-expiring row, returning the rows removed so the\r\n   * caller can report what it revoked. Deletion *is* revocation for access\r\n   * tokens — the middleware rejects a token with no row.\r\n   */\r\n  public static async purgeNeverExpiring(): Promise<AccessToken[]> {\r\n    const tokens = await this.findNeverExpiring();\r\n\r\n    for (const token of tokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,oBAAoB,EAAE,OAAO;CACxC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE/B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;;;;;;;;;;AAYD,IAAa,cAAb,cAAiC,MAAM;;eACf;;;gBAEC;;;gBAQA,CAAC,OAAO;;;wBASA;;;CAG/B,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;;;;;;CAiBA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;;CAQA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;;;CAKA,OAAc,MAAM,MAAY,OAAe,WAAiB,UAAmB;EACjF,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,WAAW;GACX,YAAY;EACd,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA4C;EACpE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,iBAAiB,MAAY;EACzC,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,GAAG,CAAC;CACzC;;;;;;CAOA,aAAoB,6BAA6B,MAAY,UAAiC;EAC5F,MAAM,KAAK,OAAO;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,WAAW;EAAS,CAAC;EACrF,MAAM,KAAK,OAAO;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,WAAW;EAAK,CAAC;CACnF;;;;;CAMA,aAAoB,eAAgC;EAClD,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO,cAAc;CACvB;;;;;;;;;;;;CAaA,aAAoB,oBAA4C;EAG9D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAuB,MAAM,YAAY;CACjE;;;;;;CAOA,aAAoB,qBAA6C;EAC/D,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}
+{"version":3,"file":"access-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/access-token/access-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\nimport type { Auth } from \"../auth.model\";\n\n/**\n * Seal schema for the persisted access-token record. Exported so an override\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\n * base shape.\n *\n * `last_access` and the `is_active` soft-revoke flag were removed — neither was\n * ever read; access tokens are revoked by deleting the row.\n */\nexport const accessTokenSchema = v.object({\n  token: v.string().required(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n  /** Null for tokens issued before family tracking was introduced. */\n  family_id: v.string().optional(),\n  expires_at: v.date().required(),\n});\n\n/**\n * Persisted access-token record + the data layer for access tokens.\n *\n * **Role.** Owns access-token persistence and lookup. The middleware checks a\n * presented JWT against this table so deleting a row (logout) invalidates the\n * token immediately, before its JWT expiry. The auth service goes through the\n * named statics exclusively, so it never hard-codes a column name and an\n * override can rename/add columns by registering under\n * `config.auth.accessToken.model`.\n */\nexport class AccessToken extends Model {\n  public static table = \"access_tokens\";\n\n  public static schema = accessTokenSchema;\n\n  /**\n   * The raw signed JWT is a bearer credential — never serialize it. `hidden`\n   * only strips it from `toJSON()` / `JSON.stringify(model)` (so\n   * `response.json(token)` or a resource cannot leak it); `get(\"token\")`,\n   * `findByToken` and every query still read the column.\n   */\n  public static hidden = [\"token\"];\n\n  /**\n   * Permanent regardless of the data source default — Mongo's driver default\n   * is `\"trash\"`, which would copy live credential material (the JWT itself)\n   * into `access_tokensTrash` on every `destroy()` (logout, expiry purge,\n   * never-expiring purge). A revoked/expired access token must not survive\n   * anywhere.\n   */\n  public static deleteStrategy = \"permanent\" as const;\n\n  /** The user this token was issued for. */\n  public get userId() {\n    return this.get(\"user_id\");\n  }\n\n  /** The user-type slug this token was issued for. */\n  public get userType(): string {\n    return this.get(\"user_type\");\n  }\n\n  /**\n   * Whether the persisted expiry has passed.\n   *\n   * The middleware asks this on every request, which is what makes the row the\n   * authority it always looked like it was: before 4.12.0 the gate only checked\n   * that the row *existed*, so a row the database knew was dead still let its\n   * token through — the database was never asked.\n   *\n   * **Fails closed.** A missing or unparseable `expires_at` counts as expired.\n   * `expires_at` is `required` in the schema, so a row that cannot answer \"when\n   * does this die\" is malformed, and the safe reading of a malformed credential\n   * is that it is not one. This is deliberately stricter than a naive\n   * `now > expires_at`, which answers `false` for an `Invalid Date` and thereby\n   * grants exactly the poisoned rows an unlimited life.\n   */\n  public get isExpired(): boolean {\n    const expiresAt = this.get(\"expires_at\");\n\n    if (!isUsableExpiry(expiresAt)) return true;\n\n    return new Date(expiresAt).getTime() <= Date.now();\n  }\n\n  /**\n   * Whether nothing about this row can ever retire it — an unusable\n   * `expires_at`, or a token carrying no `exp` claim. See\n   * {@link isNeverExpiring}; this is the predicate `purgeNeverExpiring` selects\n   * on.\n   */\n  public get neverExpires(): boolean {\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\n  }\n\n  /**\n   * Persist a freshly-signed access token for the user.\n   */\n  public static issue(user: Auth, token: string, expiresAt: Date, familyId?: string) {\n    return this.create({\n      token,\n      user_id: user.id,\n      user_type: user.userType,\n      family_id: familyId,\n      expires_at: expiresAt,\n    });\n  }\n\n  /**\n   * Find an access-token row by its raw token string.\n   */\n  public static findByToken(token: string): Promise<AccessToken | null> {\n    return this.first({ token });\n  }\n\n  /**\n   * Delete a specific token that belongs to the given user.\n   */\n  public static deleteForUser(user: Auth, token: string) {\n    return this.delete({ token, user_id: user.id });\n  }\n\n  /**\n   * Delete every access token belonging to the user.\n   */\n  public static deleteAllForUser(user: Auth) {\n    return this.delete({ user_id: user.id });\n  }\n\n  /**\n   * Delete every access token attached to one family, plus pre-family rows for\n   * the same user type. The latter is deliberately conservative during the\n   * additive upgrade: old access rows cannot be assigned safely to a family.\n   */\n  public static async deleteFamilyAndLegacyForUser(user: Auth, familyId: string): Promise<void> {\n    await this.delete({ user_id: user.id, user_type: user.userType, family_id: familyId });\n    await this.delete({ user_id: user.id, user_type: user.userType, family_id: null });\n  }\n\n  /**\n   * Hard-delete every expired access-token row. Returns the number removed.\n   * Runs from the `auth.cleanup` CLI command (a cold batch path).\n   */\n  public static async purgeExpired(): Promise<number> {\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\n\n    for (const token of expiredTokens) {\n      await token.destroy();\n    }\n\n    return expiredTokens.length;\n  }\n\n  /**\n   * Every row that can never retire itself — see {@link neverExpires}.\n   *\n   * **A full scan, filtered in memory, on purpose.** The defining case is a row\n   * whose `expires_at` is an `Invalid Date`, which no date predicate can select\n   * (`< now` and `> now` are both `false` for it), and the definitive case is a\n   * token with no `exp` claim, which lives inside the token string rather than\n   * in a column. Neither is expressible as a `where`, so the rows have to be\n   * read to be judged. This runs from a one-off remediation command, not a\n   * request path.\n   */\n  public static async findNeverExpiring(): Promise<AccessToken[]> {\n    const tokens = await this.query().get();\n\n    return tokens.filter((token: AccessToken) => token.neverExpires);\n  }\n\n  /**\n   * Hard-delete every never-expiring row, returning the rows removed so the\n   * caller can report what it revoked. Deletion *is* revocation for access\n   * tokens — the middleware rejects a token with no row.\n   */\n  public static async purgeNeverExpiring(): Promise<AccessToken[]> {\n    const tokens = await this.findNeverExpiring();\n\n    for (const token of tokens) {\n      await token.destroy();\n    }\n\n    return tokens;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAaA,MAAa,oBAAoB,EAAE,OAAO;CACxC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;;CAE/B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;;;;;;;;;;AAYD,IAAa,cAAb,cAAiC,MAAM;;eACf;;;gBAEC;;;gBAQA,CAAC,OAAO;;;wBASA;;;CAG/B,IAAW,SAAS;EAClB,OAAO,KAAK,IAAI,SAAS;CAC3B;;CAGA,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;;;;;;CAiBA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,KAAK,KAAK,IAAI;CACnD;;;;;;;CAQA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;;;CAKA,OAAc,MAAM,MAAY,OAAe,WAAiB,UAAmB;EACjF,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,WAAW;GACX,YAAY;EACd,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA4C;EACpE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,iBAAiB,MAAY;EACzC,OAAO,KAAK,OAAO,EAAE,SAAS,KAAK,GAAG,CAAC;CACzC;;;;;;CAOA,aAAoB,6BAA6B,MAAY,UAAiC;EAC5F,MAAM,KAAK,OAAO;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,WAAW;EAAS,CAAC;EACrF,MAAM,KAAK,OAAO;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,WAAW;EAAK,CAAC;CACnF;;;;;CAMA,aAAoB,eAAgC;EAClD,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO,cAAc;CACvB;;;;;;;;;;;;CAaA,aAAoB,oBAA4C;EAG9D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAuB,MAAM,YAAY;CACjE;;;;;;CAOA,aAAoB,qBAA6C;EAC/D,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}

package/esm/models/access-token/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/access-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\r\nimport { AccessToken } from \"./access-token.model\";\r\n\r\nexport const AccessTokenMigration = migrate(AccessToken, {\r\n  name: \"accessToken\",\r\n  up() {\r\n    // Create table\r\n    this.createTableIfNotExists();\r\n\r\n    // Primary key\r\n    this.primaryUuid();\r\n\r\n    // Token field\r\n    this.text(\"token\").unique();\r\n\r\n    // User reference (flat columns for cross-driver compatibility).\r\n    // `foreignId` matches the DataSource's default primary-key type, so the\r\n    // column stays compatible with the user model's `id` whether the app uses\r\n    // integer (the default) or uuid PKs — hardcoding uuid here 500'd every\r\n    // login on a default integer-PK app (finding 5e47bdb3).\r\n    this.foreignId(\"user_id\").index();\r\n    this.string(\"user_type\", 50).nullable();\r\n\r\n    // Expiry — enables server-side cleanup of stale access-token rows\r\n    this.timestamp(\"expires_at\").index().nullable();\r\n\r\n    // Timestamps\r\n    this.timestamps();\r\n  },\r\n  down() {\r\n    this.dropTableIfExists();\r\n  },\r\n});\r\n"],"mappings":";;;;AAGA,MAAa,uBAAuB,QAAQ,aAAa;CACvD,MAAM;CACN,KAAK;EAEH,KAAK,uBAAuB;EAG5B,KAAK,YAAY;EAGjB,KAAK,KAAK,OAAO,CAAC,CAAC,OAAO;EAO1B,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EAGtC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAG9C,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/access-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { AccessToken } from \"./access-token.model\";\n\nexport const AccessTokenMigration = migrate(AccessToken, {\n  name: \"accessToken\",\n  up() {\n    // Create table\n    this.createTableIfNotExists();\n\n    // Primary key\n    this.primaryUuid();\n\n    // Token field\n    this.text(\"token\").unique();\n\n    // User reference (flat columns for cross-driver compatibility).\n    // `foreignId` matches the DataSource's default primary-key type, so the\n    // column stays compatible with the user model's `id` whether the app uses\n    // integer (the default) or uuid PKs — hardcoding uuid here 500'd every\n    // login on a default integer-PK app (finding 5e47bdb3).\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n\n    // Expiry — enables server-side cleanup of stale access-token rows\n    this.timestamp(\"expires_at\").index().nullable();\n\n    // Timestamps\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,uBAAuB,QAAQ,aAAa;CACvD,MAAM;CACN,KAAK;EAEH,KAAK,uBAAuB;EAG5B,KAAK,YAAY;EAGjB,KAAK,KAAK,OAAO,CAAC,CAAC,OAAO;EAO1B,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EAGtC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAG9C,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/auth-token-family/auth-token-family.model.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-token-family.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/auth-token-family/auth-token-family.model.ts"],"mappings":";;;;;cAKa,qBAAA,6BAAqB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cASrB,eAAA,SAAwB,KAAA;EAAA,OACrB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAGT,SAAA;;SAKG,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,QAAA,WAAgB,OAAA,CAAA,eAAA;EAAA,OASlC,cAAA,CAAe,QAAA,WAAmB,OAAA,CAAQ,eAAA;;SAKpC,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,QAAA,WAAmB,OAAA,CAAQ,eAAA;;SAmBpD,SAAA,CAAU,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,eAAA;;AA5C/C;;;SAsDgB,eAAA,CAAgB,QAAA,UAAkB,gBAAA,WAA2B,OAAA;;SAQ7D,MAAA,CAAO,QAAA,UAAkB,gBAAA,WAA2B,OAAA;AAAA"}
+{"version":3,"file":"auth-token-family.model.d.mts","names":[],"sources":["../../../../../../../../auth/src/models/auth-token-family/auth-token-family.model.ts"],"mappings":";;;;;cAKa,qBAAA,6BAAqB,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cASrB,eAAA,SAAwB,KAAA;EAAA,OACrB,KAAA;EAAA,OAEA,MAAA,6BAAM,eAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAGT,SAAA;;SAKG,KAAA,CAAM,IAAA,EAAM,IAAA,EAAM,QAAA,WAAgB,OAAA,CAAA,eAAA;EAAA,OASlC,cAAA,CAAe,QAAA,WAAmB,OAAA,CAAQ,eAAA;;SAKpC,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,QAAA,WAAmB,OAAA,CAAQ,eAAA;;SAgCpD,SAAA,CAAU,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,eAAA;;AAzD/C;;;SAmEgB,eAAA,CAAgB,QAAA,UAAkB,gBAAA,WAA2B,OAAA;;SAQ7D,MAAA,CAAO,QAAA,UAAkB,gBAAA,WAA2B,OAAA;AAAA"}

package/esm/models/auth-token-family/auth-token-family.model.mjs

@@ -36,6 +36,11 @@ var AuthTokenFamily = class extends Model {
 	}
 	/** Add a durable row for an existing lineage through a driver-native upsert. */
 	static async ensure(user, familyId) {
+		const existing = await this.findByFamilyId(familyId);
+		if (existing) {
+			if (existing.get("user_id") !== user.id || existing.get("user_type") !== user.userType) throw new Error("Token family belongs to a different user");
+			return existing;
+		}
 		await this.atomic({ family_id: familyId }, { $setOnInsert: {
 			user_id: user.id,
 			user_type: user.userType,

package/esm/models/auth-token-family/auth-token-family.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-token-family.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/auth-token-family/auth-token-family.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { Auth } from \"../auth.model\";\n\n/** Durable revision authority for one refresh-token rotation family. */\nexport const authTokenFamilySchema = v.object({\n  family_id: v.string().required(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n  revision: v.number().default(0),\n  revoked_at: v.date().optional(),\n});\n\n/** Coordinates family-wide refresh, replay containment, and logout transitions. */\nexport class AuthTokenFamily extends Model {\n  public static table = \"auth_token_families\";\n\n  public static schema = authTokenFamilySchema;\n\n  /** Whether a family-wide revoke has made every member unusable. */\n  public get isRevoked(): boolean {\n    return Boolean(this.get(\"revoked_at\"));\n  }\n\n  /** Create the durable family record before its first token pair is issued. */\n  public static issue(user: Auth, familyId: string) {\n    return this.create({\n      family_id: familyId,\n      user_id: user.id,\n      user_type: user.userType,\n      revision: 0,\n    });\n  }\n\n  public static findByFamilyId(familyId: string): Promise<AuthTokenFamily | null> {\n    return this.first({ family_id: familyId });\n  }\n\n  /** Add a durable row for an existing lineage through a driver-native upsert. */\n  public static async ensure(user: Auth, familyId: string): Promise<AuthTokenFamily> {\n    await this.atomic(\n      { family_id: familyId },\n      { $setOnInsert: { user_id: user.id, user_type: user.userType, revision: 0 } },\n      { upsert: true },\n    );\n\n    const family = await this.findByFamilyId(familyId);\n\n    if (!family) throw new Error(\"Token family upsert did not return a family\");\n\n    if (family.get(\"user_id\") !== user.id || family.get<string>(\"user_type\") !== user.userType) {\n      throw new Error(\"Token family belongs to a different user\");\n    }\n\n    return family;\n  }\n\n  /** Every non-revoked family for a user, including a rotated refresh row. */\n  public static activeFor(user: Auth): Promise<AuthTokenFamily[]> {\n    return this.query()\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\n      .get();\n  }\n\n  /**\n   * Compare-and-set the family revision. A zero result is a concurrent family\n   * transition, never a successful no-op.\n   */\n  public static advanceRevision(familyId: string, expectedRevision: number): Promise<number> {\n    return this.atomic(\n      { family_id: familyId, revision: expectedRevision, revoked_at: null },\n      { $inc: { revision: 1 } },\n    );\n  }\n\n  /** Stamp the durable family revoke marker after a successful CAS. */\n  public static revoke(familyId: string, expectedRevision: number): Promise<number> {\n    return this.atomic(\n      { family_id: familyId, revision: expectedRevision + 1, revoked_at: null },\n      { $set: { revoked_at: new Date() } },\n    );\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,wBAAwB,EAAE,OAAO;CAC5C,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;CAC9B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;AAGD,IAAa,kBAAb,cAAqC,MAAM;;eACnB;;;gBAEC;;;CAGvB,IAAW,YAAqB;EAC9B,OAAO,QAAQ,KAAK,IAAI,YAAY,CAAC;CACvC;;CAGA,OAAc,MAAM,MAAY,UAAkB;EAChD,OAAO,KAAK,OAAO;GACjB,WAAW;GACX,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,UAAU;EACZ,CAAC;CACH;CAEA,OAAc,eAAe,UAAmD;EAC9E,OAAO,KAAK,MAAM,EAAE,WAAW,SAAS,CAAC;CAC3C;;CAGA,aAAoB,OAAO,MAAY,UAA4C;EACjF,MAAM,KAAK,OACT,EAAE,WAAW,SAAS,GACtB,EAAE,cAAc;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,UAAU;EAAE,EAAE,GAC5E,EAAE,QAAQ,KAAK,CACjB;EAEA,MAAM,SAAS,MAAM,KAAK,eAAe,QAAQ;EAEjD,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,6CAA6C;EAE1E,IAAI,OAAO,IAAI,SAAS,MAAM,KAAK,MAAM,OAAO,IAAY,WAAW,MAAM,KAAK,UAChF,MAAM,IAAI,MAAM,0CAA0C;EAG5D,OAAO;CACT;;CAGA,OAAc,UAAU,MAAwC;EAC9D,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,IAAI;CACT;;;;;CAMA,OAAc,gBAAgB,UAAkB,kBAA2C;EACzF,OAAO,KAAK,OACV;GAAE,WAAW;GAAU,UAAU;GAAkB,YAAY;EAAK,GACpE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAC1B;CACF;;CAGA,OAAc,OAAO,UAAkB,kBAA2C;EAChF,OAAO,KAAK,OACV;GAAE,WAAW;GAAU,UAAU,mBAAmB;GAAG,YAAY;EAAK,GACxE,EAAE,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,EAAE,CACrC;CACF;AACF"}
+{"version":3,"file":"auth-token-family.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/auth-token-family/auth-token-family.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { Auth } from \"../auth.model\";\n\n/** Durable revision authority for one refresh-token rotation family. */\nexport const authTokenFamilySchema = v.object({\n  family_id: v.string().required(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n  revision: v.number().default(0),\n  revoked_at: v.date().optional(),\n});\n\n/** Coordinates family-wide refresh, replay containment, and logout transitions. */\nexport class AuthTokenFamily extends Model {\n  public static table = \"auth_token_families\";\n\n  public static schema = authTokenFamilySchema;\n\n  /** Whether a family-wide revoke has made every member unusable. */\n  public get isRevoked(): boolean {\n    return Boolean(this.get(\"revoked_at\"));\n  }\n\n  /** Create the durable family record before its first token pair is issued. */\n  public static issue(user: Auth, familyId: string) {\n    return this.create({\n      family_id: familyId,\n      user_id: user.id,\n      user_type: user.userType,\n      revision: 0,\n    });\n  }\n\n  public static findByFamilyId(familyId: string): Promise<AuthTokenFamily | null> {\n    return this.first({ family_id: familyId });\n  }\n\n  /** Add a durable row for an existing lineage through a driver-native upsert. */\n  public static async ensure(user: Auth, familyId: string): Promise<AuthTokenFamily> {\n    const existing = await this.findByFamilyId(familyId);\n\n    if (existing) {\n      if (\n        existing.get(\"user_id\") !== user.id ||\n        existing.get<string>(\"user_type\") !== user.userType\n      ) {\n        throw new Error(\"Token family belongs to a different user\");\n      }\n\n      return existing;\n    }\n\n    await this.atomic(\n      { family_id: familyId },\n      { $setOnInsert: { user_id: user.id, user_type: user.userType, revision: 0 } },\n      { upsert: true },\n    );\n\n    const family = await this.findByFamilyId(familyId);\n\n    if (!family) throw new Error(\"Token family upsert did not return a family\");\n\n    if (family.get(\"user_id\") !== user.id || family.get<string>(\"user_type\") !== user.userType) {\n      throw new Error(\"Token family belongs to a different user\");\n    }\n\n    return family;\n  }\n\n  /** Every non-revoked family for a user, including a rotated refresh row. */\n  public static activeFor(user: Auth): Promise<AuthTokenFamily[]> {\n    return this.query()\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\n      .get();\n  }\n\n  /**\n   * Compare-and-set the family revision. A zero result is a concurrent family\n   * transition, never a successful no-op.\n   */\n  public static advanceRevision(familyId: string, expectedRevision: number): Promise<number> {\n    return this.atomic(\n      { family_id: familyId, revision: expectedRevision, revoked_at: null },\n      { $inc: { revision: 1 } },\n    );\n  }\n\n  /** Stamp the durable family revoke marker after a successful CAS. */\n  public static revoke(familyId: string, expectedRevision: number): Promise<number> {\n    return this.atomic(\n      { family_id: familyId, revision: expectedRevision + 1, revoked_at: null },\n      { $set: { revoked_at: new Date() } },\n    );\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,wBAAwB,EAAE,OAAO;CAC5C,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,UAAU,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC;CAC9B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;AAChC,CAAC;;AAGD,IAAa,kBAAb,cAAqC,MAAM;;eACnB;;;gBAEC;;;CAGvB,IAAW,YAAqB;EAC9B,OAAO,QAAQ,KAAK,IAAI,YAAY,CAAC;CACvC;;CAGA,OAAc,MAAM,MAAY,UAAkB;EAChD,OAAO,KAAK,OAAO;GACjB,WAAW;GACX,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,UAAU;EACZ,CAAC;CACH;CAEA,OAAc,eAAe,UAAmD;EAC9E,OAAO,KAAK,MAAM,EAAE,WAAW,SAAS,CAAC;CAC3C;;CAGA,aAAoB,OAAO,MAAY,UAA4C;EACjF,MAAM,WAAW,MAAM,KAAK,eAAe,QAAQ;EAEnD,IAAI,UAAU;GACZ,IACE,SAAS,IAAI,SAAS,MAAM,KAAK,MACjC,SAAS,IAAY,WAAW,MAAM,KAAK,UAE3C,MAAM,IAAI,MAAM,0CAA0C;GAG5D,OAAO;EACT;EAEA,MAAM,KAAK,OACT,EAAE,WAAW,SAAS,GACtB,EAAE,cAAc;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,UAAU;EAAE,EAAE,GAC5E,EAAE,QAAQ,KAAK,CACjB;EAEA,MAAM,SAAS,MAAM,KAAK,eAAe,QAAQ;EAEjD,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,6CAA6C;EAE1E,IAAI,OAAO,IAAI,SAAS,MAAM,KAAK,MAAM,OAAO,IAAY,WAAW,MAAM,KAAK,UAChF,MAAM,IAAI,MAAM,0CAA0C;EAG5D,OAAO;CACT;;CAGA,OAAc,UAAU,MAAwC;EAC9D,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,IAAI;CACT;;;;;CAMA,OAAc,gBAAgB,UAAkB,kBAA2C;EACzF,OAAO,KAAK,OACV;GAAE,WAAW;GAAU,UAAU;GAAkB,YAAY;EAAK,GACpE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAC1B;CACF;;CAGA,OAAc,OAAO,UAAkB,kBAA2C;EAChF,OAAO,KAAK,OACV;GAAE,WAAW;GAAU,UAAU,mBAAmB;GAAG,YAAY;EAAK,GACxE,EAAE,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,EAAE,CACrC;CACF;AACF"}

package/esm/models/auth.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.model.mjs","names":[],"sources":["../../../../../../../auth/src/models/auth.model.ts"],"sourcesContent":["import { type ChildModel, Model, type ModelSchema } from \"@warlock.js/cascade\";\r\nimport type { Authenticable } from \"../contracts/auth-contract\";\r\nimport type { AccessTokenOutput, DeviceInfo, TokenPair } from \"../contracts/types\";\r\nimport { authService } from \"../services\";\r\nimport type { RefreshToken } from \"./refresh-token/refresh-token.model\";\r\n\r\nexport abstract class Auth<Schema extends ModelSchema = ModelSchema>\r\n  extends Model<Schema>\r\n  implements Authenticable\r\n{\r\n  /**\r\n   * Get user type\r\n   */\r\n  public abstract get userType(): string;\r\n\r\n  /**\r\n   * Get access token payload\r\n   */\r\n  public accessTokenPayload() {\r\n    return authService.buildAccessTokenPayload(this);\r\n  }\r\n\r\n  /**\r\n   * Create both access and refresh tokens\r\n   */\r\n  public async createTokenPair(deviceInfo?: DeviceInfo): Promise<TokenPair> {\r\n    return authService.createTokenPair(this, deviceInfo);\r\n  }\r\n\r\n  /**\r\n   * Generate access token\r\n   */\r\n  public async generateAccessToken(data?: any): Promise<AccessTokenOutput> {\r\n    return authService.generateAccessToken(this, data);\r\n  }\r\n\r\n  /**\r\n   * Generate refresh token\r\n   */\r\n  public async generateRefreshToken(deviceInfo?: DeviceInfo): Promise<RefreshToken | undefined> {\r\n    return authService.createRefreshToken(this, deviceInfo);\r\n  }\r\n\r\n  /**\r\n   * Remove current access token\r\n   */\r\n  public async removeAccessToken(token: string): Promise<void> {\r\n    return authService.removeAccessToken(this, token);\r\n  }\r\n\r\n  /**\r\n   * Remove refresh token\r\n   */\r\n  public async removeRefreshToken(token: string): Promise<void> {\r\n    return authService.removeRefreshToken(this, token);\r\n  }\r\n\r\n  /**\r\n   * Remove all access tokens\r\n   */\r\n  public async removeAllAccessTokens(): Promise<void> {\r\n    return authService.removeAllAccessTokens(this);\r\n  }\r\n\r\n  /**\r\n   * Revoke all tokens (logout from all devices)\r\n   */\r\n  public async revokeAllTokens(): Promise<void> {\r\n    return authService.revokeAllTokens(this);\r\n  }\r\n\r\n  /**\r\n   * Get active sessions\r\n   */\r\n  public async activeSessions(): Promise<RefreshToken[]> {\r\n    return authService.getActiveSessions(this);\r\n  }\r\n\r\n  /**\r\n   * Attempt to login the user\r\n   */\r\n  public static async attempt(this: ChildModel<Auth>, data: any): Promise<Auth | null> {\r\n    return authService.attemptLogin(this, data);\r\n  }\r\n\r\n  /**\r\n   * Confirm password\r\n   */\r\n  public async confirmPassword(password: string): Promise<boolean> {\r\n    return authService.verifyPassword(password, this.string(\"password\")!);\r\n  }\r\n}\r\n"],"mappings":";;;;;AAMA,IAAsB,OAAtB,cACU,MAEV;;;;CASE,AAAO,qBAAqB;EAC1B,OAAO,YAAY,wBAAwB,IAAI;CACjD;;;;CAKA,MAAa,gBAAgB,YAA6C;EACxE,OAAO,YAAY,gBAAgB,MAAM,UAAU;CACrD;;;;CAKA,MAAa,oBAAoB,MAAwC;EACvE,OAAO,YAAY,oBAAoB,MAAM,IAAI;CACnD;;;;CAKA,MAAa,qBAAqB,YAA4D;EAC5F,OAAO,YAAY,mBAAmB,MAAM,UAAU;CACxD;;;;CAKA,MAAa,kBAAkB,OAA8B;EAC3D,OAAO,YAAY,kBAAkB,MAAM,KAAK;CAClD;;;;CAKA,MAAa,mBAAmB,OAA8B;EAC5D,OAAO,YAAY,mBAAmB,MAAM,KAAK;CACnD;;;;CAKA,MAAa,wBAAuC;EAClD,OAAO,YAAY,sBAAsB,IAAI;CAC/C;;;;CAKA,MAAa,kBAAiC;EAC5C,OAAO,YAAY,gBAAgB,IAAI;CACzC;;;;CAKA,MAAa,iBAA0C;EACrD,OAAO,YAAY,kBAAkB,IAAI;CAC3C;;;;CAKA,aAAoB,QAAgC,MAAiC;EACnF,OAAO,YAAY,aAAa,MAAM,IAAI;CAC5C;;;;CAKA,MAAa,gBAAgB,UAAoC;EAC/D,OAAO,YAAY,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE;CACtE;AACF"}
+{"version":3,"file":"auth.model.mjs","names":[],"sources":["../../../../../../../auth/src/models/auth.model.ts"],"sourcesContent":["import { type ChildModel, Model, type ModelSchema } from \"@warlock.js/cascade\";\nimport type { Authenticable } from \"../contracts/auth-contract\";\nimport type { AccessTokenOutput, DeviceInfo, TokenPair } from \"../contracts/types\";\nimport { authService } from \"../services\";\nimport type { RefreshToken } from \"./refresh-token/refresh-token.model\";\n\nexport abstract class Auth<Schema extends ModelSchema = ModelSchema>\n  extends Model<Schema>\n  implements Authenticable\n{\n  /**\n   * Get user type\n   */\n  public abstract get userType(): string;\n\n  /**\n   * Get access token payload\n   */\n  public accessTokenPayload() {\n    return authService.buildAccessTokenPayload(this);\n  }\n\n  /**\n   * Create both access and refresh tokens\n   */\n  public async createTokenPair(deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    return authService.createTokenPair(this, deviceInfo);\n  }\n\n  /**\n   * Generate access token\n   */\n  public async generateAccessToken(data?: any): Promise<AccessTokenOutput> {\n    return authService.generateAccessToken(this, data);\n  }\n\n  /**\n   * Generate refresh token\n   */\n  public async generateRefreshToken(deviceInfo?: DeviceInfo): Promise<RefreshToken | undefined> {\n    return authService.createRefreshToken(this, deviceInfo);\n  }\n\n  /**\n   * Remove current access token\n   */\n  public async removeAccessToken(token: string): Promise<void> {\n    return authService.removeAccessToken(this, token);\n  }\n\n  /**\n   * Remove refresh token\n   */\n  public async removeRefreshToken(token: string): Promise<void> {\n    return authService.removeRefreshToken(this, token);\n  }\n\n  /**\n   * Remove all access tokens\n   */\n  public async removeAllAccessTokens(): Promise<void> {\n    return authService.removeAllAccessTokens(this);\n  }\n\n  /**\n   * Revoke all tokens (logout from all devices)\n   */\n  public async revokeAllTokens(): Promise<void> {\n    return authService.revokeAllTokens(this);\n  }\n\n  /**\n   * Get active sessions\n   */\n  public async activeSessions(): Promise<RefreshToken[]> {\n    return authService.getActiveSessions(this);\n  }\n\n  /**\n   * Attempt to login the user\n   */\n  public static async attempt(this: ChildModel<Auth>, data: any): Promise<Auth | null> {\n    return authService.attemptLogin(this, data);\n  }\n\n  /**\n   * Confirm password\n   */\n  public async confirmPassword(password: string): Promise<boolean> {\n    return authService.verifyPassword(password, this.string(\"password\")!);\n  }\n}\n"],"mappings":";;;;;AAMA,IAAsB,OAAtB,cACU,MAEV;;;;CASE,AAAO,qBAAqB;EAC1B,OAAO,YAAY,wBAAwB,IAAI;CACjD;;;;CAKA,MAAa,gBAAgB,YAA6C;EACxE,OAAO,YAAY,gBAAgB,MAAM,UAAU;CACrD;;;;CAKA,MAAa,oBAAoB,MAAwC;EACvE,OAAO,YAAY,oBAAoB,MAAM,IAAI;CACnD;;;;CAKA,MAAa,qBAAqB,YAA4D;EAC5F,OAAO,YAAY,mBAAmB,MAAM,UAAU;CACxD;;;;CAKA,MAAa,kBAAkB,OAA8B;EAC3D,OAAO,YAAY,kBAAkB,MAAM,KAAK;CAClD;;;;CAKA,MAAa,mBAAmB,OAA8B;EAC5D,OAAO,YAAY,mBAAmB,MAAM,KAAK;CACnD;;;;CAKA,MAAa,wBAAuC;EAClD,OAAO,YAAY,sBAAsB,IAAI;CAC/C;;;;CAKA,MAAa,kBAAiC;EAC5C,OAAO,YAAY,gBAAgB,IAAI;CACzC;;;;CAKA,MAAa,iBAA0C;EACrD,OAAO,YAAY,kBAAkB,IAAI;CAC3C;;;;CAKA,aAAoB,QAAgC,MAAiC;EACnF,OAAO,YAAY,aAAa,MAAM,IAAI;CAC5C;;;;CAKA,MAAa,gBAAgB,UAAoC;EAC/D,OAAO,YAAY,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE;CACtE;AACF"}

package/esm/models/refresh-token/migration.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/refresh-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\r\nimport { RefreshToken } from \"./refresh-token.model\";\r\n\r\nexport const RefreshTokenMigration = migrate(RefreshToken, {\r\n  name: \"refreshToken\",\r\n  up() {\r\n    // Create table\r\n    this.createTableIfNotExists();\r\n\r\n    // Primary key\r\n    this.primaryUuid();\r\n\r\n    // Token fields\r\n    this.text(\"token\").unique();\r\n    // `foreignId` matches the DataSource's default primary-key type so the\r\n    // column stays compatible with the user model's `id` (integer by default,\r\n    // or uuid) — hardcoding uuid here 500'd login on integer-PK apps (5e47bdb3).\r\n    this.foreignId(\"user_id\").index();\r\n    this.string(\"user_type\", 50).nullable();\r\n    this.text(\"family_id\").index().nullable();\r\n    this.timestamp(\"expires_at\").index().nullable();\r\n    this.timestamp(\"last_used_at\").nullable();\r\n    this.timestamp(\"revoked_at\").nullable();\r\n    this.json(\"device_info\").nullable();\r\n\r\n    // Composite index for the per-user active-session lookups\r\n    // (revokeAllFor / enforceMax / activeFor all filter on user_id + user_type).\r\n    this.index([\"user_id\", \"user_type\"]);\r\n\r\n    // Timestamps\r\n    this.timestamps();\r\n  },\r\n  down() {\r\n    this.dropTableIfExists();\r\n  },\r\n});\r\n"],"mappings":";;;;AAGA,MAAa,wBAAwB,QAAQ,cAAc;CACzD,MAAM;CACN,KAAK;EAEH,KAAK,uBAAuB;EAG5B,KAAK,YAAY;EAGjB,KAAK,KAAK,OAAO,CAAC,CAAC,OAAO;EAI1B,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EACtC,KAAK,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EACxC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAC9C,KAAK,UAAU,cAAc,CAAC,CAAC,SAAS;EACxC,KAAK,UAAU,YAAY,CAAC,CAAC,SAAS;EACtC,KAAK,KAAK,aAAa,CAAC,CAAC,SAAS;EAIlC,KAAK,MAAM,CAAC,WAAW,WAAW,CAAC;EAGnC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}
+{"version":3,"file":"migration.mjs","names":[],"sources":["../../../../../../../../auth/src/models/refresh-token/migration.ts"],"sourcesContent":["import { migrate } from \"@warlock.js/cascade\";\nimport { RefreshToken } from \"./refresh-token.model\";\n\nexport const RefreshTokenMigration = migrate(RefreshToken, {\n  name: \"refreshToken\",\n  up() {\n    // Create table\n    this.createTableIfNotExists();\n\n    // Primary key\n    this.primaryUuid();\n\n    // Token fields\n    this.text(\"token\").unique();\n    // `foreignId` matches the DataSource's default primary-key type so the\n    // column stays compatible with the user model's `id` (integer by default,\n    // or uuid) — hardcoding uuid here 500'd login on integer-PK apps (5e47bdb3).\n    this.foreignId(\"user_id\").index();\n    this.string(\"user_type\", 50).nullable();\n    this.text(\"family_id\").index().nullable();\n    this.timestamp(\"expires_at\").index().nullable();\n    this.timestamp(\"last_used_at\").nullable();\n    this.timestamp(\"revoked_at\").nullable();\n    this.json(\"device_info\").nullable();\n\n    // Composite index for the per-user active-session lookups\n    // (revokeAllFor / enforceMax / activeFor all filter on user_id + user_type).\n    this.index([\"user_id\", \"user_type\"]);\n\n    // Timestamps\n    this.timestamps();\n  },\n  down() {\n    this.dropTableIfExists();\n  },\n});\n"],"mappings":";;;;AAGA,MAAa,wBAAwB,QAAQ,cAAc;CACzD,MAAM;CACN,KAAK;EAEH,KAAK,uBAAuB;EAG5B,KAAK,YAAY;EAGjB,KAAK,KAAK,OAAO,CAAC,CAAC,OAAO;EAI1B,KAAK,UAAU,SAAS,CAAC,CAAC,MAAM;EAChC,KAAK,OAAO,aAAa,EAAE,CAAC,CAAC,SAAS;EACtC,KAAK,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EACxC,KAAK,UAAU,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS;EAC9C,KAAK,UAAU,cAAc,CAAC,CAAC,SAAS;EACxC,KAAK,UAAU,YAAY,CAAC,CAAC,SAAS;EACtC,KAAK,KAAK,aAAa,CAAC,CAAC,SAAS;EAIlC,KAAK,MAAM,CAAC,WAAW,WAAW,CAAC;EAGnC,KAAK,WAAW;CAClB;CACA,OAAO;EACL,KAAK,kBAAkB;CACzB;AACF,CAAC"}

package/esm/models/refresh-token/refresh-token.model.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/refresh-token/refresh-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\r\nimport { v } from \"@warlock.js/seal\";\r\nimport type { DeviceInfo } from \"../../contracts/types\";\r\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\r\nimport type { Auth } from \"../auth.model\";\r\n\r\n/**\r\n * Seal schema for the persisted refresh-token record. Exported so an override\r\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\r\n * base shape:\r\n *\r\n * @example\r\n * export class AppRefreshToken extends RefreshToken {\r\n *   public static schema = refreshTokenSchema.extend({\r\n *     organization_id: v.string().required(),\r\n *   });\r\n * }\r\n */\r\nexport const refreshTokenSchema = v.object({\r\n  token: v.string().required(),\r\n  user_id: v.scalar().required(),\r\n  user_type: v.string().required(),\r\n  family_id: v.string().required(),\r\n  expires_at: v.date().required(),\r\n  last_used_at: v.date().default(() => new Date()),\r\n  revoked_at: v.date().optional(),\r\n  /** The successor pair a bounded concurrent renewal may reuse. */\r\n  successor_access_token_id: v.string().optional(),\r\n  successor_refresh_token_id: v.string().optional(),\r\n  device_info: v.record(v.any()).optional(),\r\n});\r\n\r\n/**\r\n * Extra attributes captured when a refresh token is issued.\r\n */\r\nexport type RefreshTokenIssueOptions = {\r\n  familyId: string;\r\n  expiresAt: string;\r\n  deviceInfo?: DeviceInfo;\r\n};\r\n\r\n/**\r\n * Persisted refresh-token record + the data layer for refresh tokens.\r\n *\r\n * **Role.** Owns every refresh-token read, write, and lifecycle transition.\r\n * The auth service drives refresh-token state exclusively through this model's\r\n * named statics and instance methods, so it never hard-codes a column name —\r\n * which is what makes a snake/camel mismatch (the historical `userId` bug)\r\n * structurally impossible and lets an override rename or add columns by\r\n * extending this class and registering it under `config.auth.refreshToken.model`.\r\n */\r\nexport class RefreshToken extends Model {\r\n  public static table = \"refresh_tokens\";\r\n\r\n  public static schema = refreshTokenSchema;\r\n\r\n  /**\r\n   * The raw signed refresh JWT is a bearer credential — never serialize it.\r\n   * `hidden` only strips it from `toJSON()` / `JSON.stringify(model)` (e.g. a\r\n   * session list returned via `response.json`); `get(\"token\")`,\r\n   * `findByToken` / `findForUser` and every query still read the column.\r\n   */\r\n  public static hidden = [\"token\"];\r\n\r\n  /**\r\n   * Permanent regardless of the data source default — Mongo's driver default\r\n   * is `\"trash\"`, which would copy live credential material (the JWT itself)\r\n   * into `refresh_tokensTrash` on every `destroy()` (expiry purge,\r\n   * never-expiring purge). A purged refresh token must not survive anywhere.\r\n   */\r\n  public static deleteStrategy = \"permanent\" as const;\r\n\r\n  /** Token family this row belongs to (rotation / replay grouping). */\r\n  public get familyId(): string {\r\n    return this.get(\"family_id\");\r\n  }\r\n\r\n  /**\r\n   * Whether the token's `expires_at` is in the past.\r\n   *\r\n   * **Fails closed as of 4.12.0**: a missing or unparseable `expires_at` now\r\n   * counts as expired. It previously answered `false` for both — \"no expiry\r\n   * recorded ⇒ never expires\" — which handed an unlimited life to precisely the\r\n   * malformed rows, including the `Invalid Date` a pre-4.12.0 unparseable\r\n   * `expiresIn` could write. `expires_at` is `required` in the schema, so a row\r\n   * that cannot say when it dies is malformed, not immortal.\r\n   */\r\n  public get isExpired(): boolean {\r\n    const expiresAt = this.get(\"expires_at\");\r\n\r\n    if (!isUsableExpiry(expiresAt)) return true;\r\n\r\n    return new Date().getTime() > new Date(expiresAt).getTime();\r\n  }\r\n\r\n  /**\r\n   * Whether nothing can ever retire this row — an unusable `expires_at`, or a\r\n   * token carrying no `exp` claim. See {@link isNeverExpiring}.\r\n   */\r\n  public get neverExpires(): boolean {\r\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\r\n  }\r\n\r\n  /** Whether the token has been revoked. */\r\n  public get isRevoked(): boolean {\r\n    return !!this.get(\"revoked_at\");\r\n  }\r\n\r\n  /** Whether the token is still usable (not expired and not revoked). */\r\n  public get isValid(): boolean {\r\n    return !this.isExpired && !this.isRevoked;\r\n  }\r\n\r\n  /**\r\n   * Unconditionally stamp `revoked_at` on this token.\r\n   */\r\n  public async revoke(): Promise<this> {\r\n    return this.merge({ revoked_at: new Date() }).save();\r\n  }\r\n\r\n  /**\r\n   * Atomically revoke this token ONLY if it is still active. Resolves to `true`\r\n   * when this call performed the revoke, `false` when a concurrent request had\r\n   * already revoked it — the win/lose signal that powers rotation replay\r\n   * detection. Uses a conditional UPDATE so two concurrent rotations of the\r\n   * same token can never both succeed.\r\n   */\r\n  public async revokeIfActive(): Promise<boolean> {\r\n    const modelClass = this.constructor as typeof RefreshToken;\r\n\r\n    const revokedCount = await modelClass.atomic(\r\n      { id: this.id, revoked_at: null },\r\n      { $set: { revoked_at: new Date() } },\r\n    );\r\n\r\n    return revokedCount > 0;\r\n  }\r\n\r\n  /**\r\n   * Touch `last_used_at` without revoking — the non-rotating refresh path.\r\n   */\r\n  public async markAsUsed(): Promise<void> {\r\n    await this.merge({ last_used_at: new Date() }).save();\r\n  }\r\n\r\n  /**\r\n   * Persist a freshly-signed refresh token for the user.\r\n   */\r\n  public static issue(user: Auth, token: string, options: RefreshTokenIssueOptions) {\r\n    return this.create({\r\n      token,\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      family_id: options.familyId,\r\n      expires_at: options.expiresAt,\r\n      device_info: options.deviceInfo\r\n        ? {\r\n            userAgent: options.deviceInfo.userAgent,\r\n            ip: options.deviceInfo.ip,\r\n            deviceId: options.deviceInfo.deviceId,\r\n          }\r\n        : undefined,\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Find a refresh-token row by its raw token string.\r\n   */\r\n  public static findByToken(token: string): Promise<RefreshToken | null> {\r\n    return this.first({ token });\r\n  }\r\n\r\n  /**\r\n   * Find a refresh token scoped to a user — used by logout so a caller can only\r\n   * revoke a token that actually belongs to them.\r\n   */\r\n  public static findForUser(user: Auth, token: string): Promise<RefreshToken | null> {\r\n    return this.first({ token, user_id: user.id });\r\n  }\r\n\r\n  /** Find any member of a family, including an already-revoked legacy member. */\r\n  public static findInFamily(familyId: string): Promise<RefreshToken | null> {\r\n    return this.first({ family_id: familyId });\r\n  }\r\n\r\n  /**\r\n   * Every refresh lineage for a user, including rotated rows. Logout uses this\r\n   * to bootstrap durable family records before it starts family revocations.\r\n   */\r\n  public static familiesForUser(user: Auth): Promise<RefreshToken[]> {\r\n    return this.query().where({ user_id: user.id, user_type: user.userType }).get();\r\n  }\r\n\r\n  /**\r\n   * Delete a specific refresh token belonging to the user.\r\n   */\r\n  public static deleteForUser(user: Auth, token: string) {\r\n    return this.delete({ token, user_id: user.id });\r\n  }\r\n\r\n  /**\r\n   * Active, unexpired sessions for the user, newest first.\r\n   */\r\n  public static activeFor(user: Auth): Promise<RefreshToken[]> {\r\n    return this.query()\r\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\r\n      .where(\"expires_at\", \">\", new Date())\r\n      .orderBy(\"created_at\", \"desc\")\r\n      .get();\r\n  }\r\n\r\n  /**\r\n   * Revoke every still-active refresh token for the user, returning the rows\r\n   * that were revoked so the caller can emit a per-token event for each.\r\n   *\r\n   * Rows are fetched BEFORE they are revoked: a bulk `findAndUpdate` keyed on\r\n   * `revoked_at: null` would re-query the same predicate after the update and\r\n   * match nothing, returning an empty set.\r\n   */\r\n  public static async revokeAllFor(user: Auth): Promise<RefreshToken[]> {\r\n    const tokens = await this.query()\r\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\r\n      .get();\r\n\r\n    for (const token of tokens) {\r\n      await token.revoke();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n\r\n  /**\r\n   * Revoke every still-active token in a family (rotation breach containment),\r\n   * returning the revoked rows (fetched before revocation — see `revokeAllFor`).\r\n   */\r\n  public static async revokeFamily(familyId: string): Promise<RefreshToken[]> {\r\n    const tokens = await this.query().where({ family_id: familyId, revoked_at: null }).get();\r\n\r\n    for (const token of tokens) {\r\n      await token.revoke();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n\r\n  /**\r\n   * Revoke the oldest active tokens so at most `max - 1` remain — making room\r\n   * for the about-to-be-issued one. Bounded by `max`, so the per-row loop is\r\n   * small.\r\n   */\r\n  public static async enforceMax(user: Auth, max: number): Promise<void> {\r\n    const activeTokens = await this.query()\r\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\r\n      .orderBy(\"created_at\", \"asc\")\r\n      .get();\r\n\r\n    if (activeTokens.length < max) return;\r\n\r\n    const tokensToRevoke = activeTokens.slice(0, activeTokens.length - max + 1);\r\n\r\n    for (const token of tokensToRevoke) {\r\n      await token.revoke();\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every expired refresh token, returning the deleted rows so the\r\n   * caller can emit a per-token event. Runs from the `auth.cleanup` CLI command\r\n   * (a cold batch path).\r\n   */\r\n  public static async purgeExpired(): Promise<RefreshToken[]> {\r\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\r\n\r\n    for (const token of expiredTokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return expiredTokens;\r\n  }\r\n\r\n  /**\r\n   * Every row that can never retire itself — see {@link neverExpires}. A full\r\n   * scan filtered in memory, for the reason given on\r\n   * {@link AccessToken.findNeverExpiring}: neither an `Invalid Date` nor a\r\n   * missing `exp` claim is expressible as a `where`.\r\n   */\r\n  public static async findNeverExpiring(): Promise<RefreshToken[]> {\r\n    const tokens = await this.query().get();\r\n\r\n    return tokens.filter((token: RefreshToken) => token.neverExpires);\r\n  }\r\n\r\n  /**\r\n   * Hard-delete every never-expiring row, returning the rows removed.\r\n   *\r\n   * Deleted rather than `revoked_at`-stamped: a revoked row is still a row this\r\n   * table has to carry, and one of the two shapes being removed is a row whose\r\n   * date column cannot be compared at all — leaving it in place keeps a\r\n   * permanently unpurgeable record. Rotation replay-detection is unaffected;\r\n   * these rows can no longer be presented successfully either way.\r\n   */\r\n  public static async purgeNeverExpiring(): Promise<RefreshToken[]> {\r\n    const tokens = await this.findNeverExpiring();\r\n\r\n    for (const token of tokens) {\r\n      await token.destroy();\r\n    }\r\n\r\n    return tokens;\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;AAkBA,MAAa,qBAAqB,EAAE,OAAO;CACzC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,cAAc,EAAE,KAAK,CAAC,CAAC,8BAAc,IAAI,KAAK,CAAC;CAC/C,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;;CAE9B,2BAA2B,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/C,4BAA4B,EAAE,OAAO,CAAC,CAAC,SAAS;CAChD,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;AAC1C,CAAC;;;;;;;;;;;AAqBD,IAAa,eAAb,cAAkC,MAAM;;eAChB;;;gBAEC;;;gBAQA,CAAC,OAAO;;;wBAQA;;;CAG/B,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;CAYA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,wBAAO,IAAI,KAAK,EAAC,CAAC,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ;CAC5D;;;;;CAMA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;CAGA,IAAW,YAAqB;EAC9B,OAAO,CAAC,CAAC,KAAK,IAAI,YAAY;CAChC;;CAGA,IAAW,UAAmB;EAC5B,OAAO,CAAC,KAAK,aAAa,CAAC,KAAK;CAClC;;;;CAKA,MAAa,SAAwB;EACnC,OAAO,KAAK,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK;CACrD;;;;;;;;CASA,MAAa,iBAAmC;EAQ9C,OAAO,MAPY,KAAK,YAEc,OACpC;GAAE,IAAI,KAAK;GAAI,YAAY;EAAK,GAChC,EAAE,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,EAAE,CACrC,IAEsB;CACxB;;;;CAKA,MAAa,aAA4B;EACvC,MAAM,KAAK,MAAM,EAAE,8BAAc,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK;CACtD;;;;CAKA,OAAc,MAAM,MAAY,OAAe,SAAmC;EAChF,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,WAAW,QAAQ;GACnB,YAAY,QAAQ;GACpB,aAAa,QAAQ,aACjB;IACE,WAAW,QAAQ,WAAW;IAC9B,IAAI,QAAQ,WAAW;IACvB,UAAU,QAAQ,WAAW;GAC/B,IACA;EACN,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA6C;EACrE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;;CAMA,OAAc,YAAY,MAAY,OAA6C;EACjF,OAAO,KAAK,MAAM;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAC/C;;CAGA,OAAc,aAAa,UAAgD;EACzE,OAAO,KAAK,MAAM,EAAE,WAAW,SAAS,CAAC;CAC3C;;;;;CAMA,OAAc,gBAAgB,MAAqC;EACjE,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;EAAS,CAAC,CAAC,CAAC,IAAI;CAChF;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,UAAU,MAAqC;EAC3D,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CACpC,QAAQ,cAAc,MAAM,CAAC,CAC7B,IAAI;CACT;;;;;;;;;CAUA,aAAoB,aAAa,MAAqC;EACpE,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,CAC9B,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,IAAI;EAEP,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,OAAO;EAGrB,OAAO;CACT;;;;;CAMA,aAAoB,aAAa,UAA2C;EAC1E,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;GAAE,WAAW;GAAU,YAAY;EAAK,CAAC,CAAC,CAAC,IAAI;EAEvF,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,OAAO;EAGrB,OAAO;CACT;;;;;;CAOA,aAAoB,WAAW,MAAY,KAA4B;EACrE,MAAM,eAAe,MAAM,KAAK,MAAM,CAAC,CACpC,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,QAAQ,cAAc,KAAK,CAAC,CAC5B,IAAI;EAEP,IAAI,aAAa,SAAS,KAAK;EAE/B,MAAM,iBAAiB,aAAa,MAAM,GAAG,aAAa,SAAS,MAAM,CAAC;EAE1E,KAAK,MAAM,SAAS,gBAClB,MAAM,MAAM,OAAO;CAEvB;;;;;;CAOA,aAAoB,eAAwC;EAC1D,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;;;;;;;CAQA,aAAoB,oBAA6C;EAG/D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAwB,MAAM,YAAY;CAClE;;;;;;;;;;CAWA,aAAoB,qBAA8C;EAChE,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}
+{"version":3,"file":"refresh-token.model.mjs","names":[],"sources":["../../../../../../../../auth/src/models/refresh-token/refresh-token.model.ts"],"sourcesContent":["import { Model } from \"@warlock.js/cascade\";\nimport { v } from \"@warlock.js/seal\";\nimport type { DeviceInfo } from \"../../contracts/types\";\nimport { isNeverExpiring, isUsableExpiry } from \"../../utils/token-expiry\";\nimport type { Auth } from \"../auth.model\";\n\n/**\n * Seal schema for the persisted refresh-token record. Exported so an override\n * can spread it and add columns (e.g. a tenant key) without re-declaring the\n * base shape:\n *\n * @example\n * export class AppRefreshToken extends RefreshToken {\n *   public static schema = refreshTokenSchema.extend({\n *     organization_id: v.string().required(),\n *   });\n * }\n */\nexport const refreshTokenSchema = v.object({\n  token: v.string().required(),\n  user_id: v.scalar().required(),\n  user_type: v.string().required(),\n  family_id: v.string().required(),\n  expires_at: v.date().required(),\n  last_used_at: v.date().default(() => new Date()),\n  revoked_at: v.date().optional(),\n  /** The successor pair a bounded concurrent renewal may reuse. */\n  successor_access_token_id: v.string().optional(),\n  successor_refresh_token_id: v.string().optional(),\n  device_info: v.record(v.any()).optional(),\n});\n\n/**\n * Extra attributes captured when a refresh token is issued.\n */\nexport type RefreshTokenIssueOptions = {\n  familyId: string;\n  expiresAt: string;\n  deviceInfo?: DeviceInfo;\n};\n\n/**\n * Persisted refresh-token record + the data layer for refresh tokens.\n *\n * **Role.** Owns every refresh-token read, write, and lifecycle transition.\n * The auth service drives refresh-token state exclusively through this model's\n * named statics and instance methods, so it never hard-codes a column name —\n * which is what makes a snake/camel mismatch (the historical `userId` bug)\n * structurally impossible and lets an override rename or add columns by\n * extending this class and registering it under `config.auth.refreshToken.model`.\n */\nexport class RefreshToken extends Model {\n  public static table = \"refresh_tokens\";\n\n  public static schema = refreshTokenSchema;\n\n  /**\n   * The raw signed refresh JWT is a bearer credential — never serialize it.\n   * `hidden` only strips it from `toJSON()` / `JSON.stringify(model)` (e.g. a\n   * session list returned via `response.json`); `get(\"token\")`,\n   * `findByToken` / `findForUser` and every query still read the column.\n   */\n  public static hidden = [\"token\"];\n\n  /**\n   * Permanent regardless of the data source default — Mongo's driver default\n   * is `\"trash\"`, which would copy live credential material (the JWT itself)\n   * into `refresh_tokensTrash` on every `destroy()` (expiry purge,\n   * never-expiring purge). A purged refresh token must not survive anywhere.\n   */\n  public static deleteStrategy = \"permanent\" as const;\n\n  /** Token family this row belongs to (rotation / replay grouping). */\n  public get familyId(): string {\n    return this.get(\"family_id\");\n  }\n\n  /**\n   * Whether the token's `expires_at` is in the past.\n   *\n   * **Fails closed as of 4.12.0**: a missing or unparseable `expires_at` now\n   * counts as expired. It previously answered `false` for both — \"no expiry\n   * recorded ⇒ never expires\" — which handed an unlimited life to precisely the\n   * malformed rows, including the `Invalid Date` a pre-4.12.0 unparseable\n   * `expiresIn` could write. `expires_at` is `required` in the schema, so a row\n   * that cannot say when it dies is malformed, not immortal.\n   */\n  public get isExpired(): boolean {\n    const expiresAt = this.get(\"expires_at\");\n\n    if (!isUsableExpiry(expiresAt)) return true;\n\n    return new Date().getTime() > new Date(expiresAt).getTime();\n  }\n\n  /**\n   * Whether nothing can ever retire this row — an unusable `expires_at`, or a\n   * token carrying no `exp` claim. See {@link isNeverExpiring}.\n   */\n  public get neverExpires(): boolean {\n    return isNeverExpiring(this.get(\"token\"), this.get(\"expires_at\"));\n  }\n\n  /** Whether the token has been revoked. */\n  public get isRevoked(): boolean {\n    return !!this.get(\"revoked_at\");\n  }\n\n  /** Whether the token is still usable (not expired and not revoked). */\n  public get isValid(): boolean {\n    return !this.isExpired && !this.isRevoked;\n  }\n\n  /**\n   * Unconditionally stamp `revoked_at` on this token.\n   */\n  public async revoke(): Promise<this> {\n    return this.merge({ revoked_at: new Date() }).save();\n  }\n\n  /**\n   * Atomically revoke this token ONLY if it is still active. Resolves to `true`\n   * when this call performed the revoke, `false` when a concurrent request had\n   * already revoked it — the win/lose signal that powers rotation replay\n   * detection. Uses a conditional UPDATE so two concurrent rotations of the\n   * same token can never both succeed.\n   */\n  public async revokeIfActive(): Promise<boolean> {\n    const modelClass = this.constructor as typeof RefreshToken;\n\n    const revokedCount = await modelClass.atomic(\n      { id: this.id, revoked_at: null },\n      { $set: { revoked_at: new Date() } },\n    );\n\n    return revokedCount > 0;\n  }\n\n  /**\n   * Touch `last_used_at` without revoking — the non-rotating refresh path.\n   */\n  public async markAsUsed(): Promise<void> {\n    await this.merge({ last_used_at: new Date() }).save();\n  }\n\n  /**\n   * Persist a freshly-signed refresh token for the user.\n   */\n  public static issue(user: Auth, token: string, options: RefreshTokenIssueOptions) {\n    return this.create({\n      token,\n      user_id: user.id,\n      user_type: user.userType,\n      family_id: options.familyId,\n      expires_at: options.expiresAt,\n      device_info: options.deviceInfo\n        ? {\n            userAgent: options.deviceInfo.userAgent,\n            ip: options.deviceInfo.ip,\n            deviceId: options.deviceInfo.deviceId,\n          }\n        : undefined,\n    });\n  }\n\n  /**\n   * Find a refresh-token row by its raw token string.\n   */\n  public static findByToken(token: string): Promise<RefreshToken | null> {\n    return this.first({ token });\n  }\n\n  /**\n   * Find a refresh token scoped to a user — used by logout so a caller can only\n   * revoke a token that actually belongs to them.\n   */\n  public static findForUser(user: Auth, token: string): Promise<RefreshToken | null> {\n    return this.first({ token, user_id: user.id });\n  }\n\n  /** Find any member of a family, including an already-revoked legacy member. */\n  public static findInFamily(familyId: string): Promise<RefreshToken | null> {\n    return this.first({ family_id: familyId });\n  }\n\n  /**\n   * Every refresh lineage for a user, including rotated rows. Logout uses this\n   * to bootstrap durable family records before it starts family revocations.\n   */\n  public static familiesForUser(user: Auth): Promise<RefreshToken[]> {\n    return this.query().where({ user_id: user.id, user_type: user.userType }).get();\n  }\n\n  /**\n   * Delete a specific refresh token belonging to the user.\n   */\n  public static deleteForUser(user: Auth, token: string) {\n    return this.delete({ token, user_id: user.id });\n  }\n\n  /**\n   * Active, unexpired sessions for the user, newest first.\n   */\n  public static activeFor(user: Auth): Promise<RefreshToken[]> {\n    return this.query()\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\n      .where(\"expires_at\", \">\", new Date())\n      .orderBy(\"created_at\", \"desc\")\n      .get();\n  }\n\n  /**\n   * Revoke every still-active refresh token for the user, returning the rows\n   * that were revoked so the caller can emit a per-token event for each.\n   *\n   * Rows are fetched BEFORE they are revoked: a bulk `findAndUpdate` keyed on\n   * `revoked_at: null` would re-query the same predicate after the update and\n   * match nothing, returning an empty set.\n   */\n  public static async revokeAllFor(user: Auth): Promise<RefreshToken[]> {\n    const tokens = await this.query()\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\n      .get();\n\n    for (const token of tokens) {\n      await token.revoke();\n    }\n\n    return tokens;\n  }\n\n  /**\n   * Revoke every still-active token in a family (rotation breach containment),\n   * returning the revoked rows (fetched before revocation — see `revokeAllFor`).\n   */\n  public static async revokeFamily(familyId: string): Promise<RefreshToken[]> {\n    const tokens = await this.query().where({ family_id: familyId, revoked_at: null }).get();\n\n    for (const token of tokens) {\n      await token.revoke();\n    }\n\n    return tokens;\n  }\n\n  /**\n   * Revoke the oldest active tokens so at most `max - 1` remain — making room\n   * for the about-to-be-issued one. Bounded by `max`, so the per-row loop is\n   * small.\n   */\n  public static async enforceMax(user: Auth, max: number): Promise<void> {\n    const activeTokens = await this.query()\n      .where({ user_id: user.id, user_type: user.userType, revoked_at: null })\n      .orderBy(\"created_at\", \"asc\")\n      .get();\n\n    if (activeTokens.length < max) return;\n\n    const tokensToRevoke = activeTokens.slice(0, activeTokens.length - max + 1);\n\n    for (const token of tokensToRevoke) {\n      await token.revoke();\n    }\n  }\n\n  /**\n   * Hard-delete every expired refresh token, returning the deleted rows so the\n   * caller can emit a per-token event. Runs from the `auth.cleanup` CLI command\n   * (a cold batch path).\n   */\n  public static async purgeExpired(): Promise<RefreshToken[]> {\n    const expiredTokens = await this.query().where(\"expires_at\", \"<\", new Date()).get();\n\n    for (const token of expiredTokens) {\n      await token.destroy();\n    }\n\n    return expiredTokens;\n  }\n\n  /**\n   * Every row that can never retire itself — see {@link neverExpires}. A full\n   * scan filtered in memory, for the reason given on\n   * {@link AccessToken.findNeverExpiring}: neither an `Invalid Date` nor a\n   * missing `exp` claim is expressible as a `where`.\n   */\n  public static async findNeverExpiring(): Promise<RefreshToken[]> {\n    const tokens = await this.query().get();\n\n    return tokens.filter((token: RefreshToken) => token.neverExpires);\n  }\n\n  /**\n   * Hard-delete every never-expiring row, returning the rows removed.\n   *\n   * Deleted rather than `revoked_at`-stamped: a revoked row is still a row this\n   * table has to carry, and one of the two shapes being removed is a row whose\n   * date column cannot be compared at all — leaving it in place keeps a\n   * permanently unpurgeable record. Rotation replay-detection is unaffected;\n   * these rows can no longer be presented successfully either way.\n   */\n  public static async purgeNeverExpiring(): Promise<RefreshToken[]> {\n    const tokens = await this.findNeverExpiring();\n\n    for (const token of tokens) {\n      await token.destroy();\n    }\n\n    return tokens;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAkBA,MAAa,qBAAqB,EAAE,OAAO;CACzC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS;CAC3B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/B,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;CAC9B,cAAc,EAAE,KAAK,CAAC,CAAC,8BAAc,IAAI,KAAK,CAAC;CAC/C,YAAY,EAAE,KAAK,CAAC,CAAC,SAAS;;CAE9B,2BAA2B,EAAE,OAAO,CAAC,CAAC,SAAS;CAC/C,4BAA4B,EAAE,OAAO,CAAC,CAAC,SAAS;CAChD,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;AAC1C,CAAC;;;;;;;;;;;AAqBD,IAAa,eAAb,cAAkC,MAAM;;eAChB;;;gBAEC;;;gBAQA,CAAC,OAAO;;;wBAQA;;;CAG/B,IAAW,WAAmB;EAC5B,OAAO,KAAK,IAAI,WAAW;CAC7B;;;;;;;;;;;CAYA,IAAW,YAAqB;EAC9B,MAAM,YAAY,KAAK,IAAI,YAAY;EAEvC,IAAI,CAAC,eAAe,SAAS,GAAG,OAAO;EAEvC,wBAAO,IAAI,KAAK,EAAC,CAAC,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ;CAC5D;;;;;CAMA,IAAW,eAAwB;EACjC,OAAO,gBAAgB,KAAK,IAAI,OAAO,GAAG,KAAK,IAAI,YAAY,CAAC;CAClE;;CAGA,IAAW,YAAqB;EAC9B,OAAO,CAAC,CAAC,KAAK,IAAI,YAAY;CAChC;;CAGA,IAAW,UAAmB;EAC5B,OAAO,CAAC,KAAK,aAAa,CAAC,KAAK;CAClC;;;;CAKA,MAAa,SAAwB;EACnC,OAAO,KAAK,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK;CACrD;;;;;;;;CASA,MAAa,iBAAmC;EAQ9C,OAAO,MAPY,KAAK,YAEc,OACpC;GAAE,IAAI,KAAK;GAAI,YAAY;EAAK,GAChC,EAAE,MAAM,EAAE,4BAAY,IAAI,KAAK,EAAE,EAAE,CACrC,IAEsB;CACxB;;;;CAKA,MAAa,aAA4B;EACvC,MAAM,KAAK,MAAM,EAAE,8BAAc,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK;CACtD;;;;CAKA,OAAc,MAAM,MAAY,OAAe,SAAmC;EAChF,OAAO,KAAK,OAAO;GACjB;GACA,SAAS,KAAK;GACd,WAAW,KAAK;GAChB,WAAW,QAAQ;GACnB,YAAY,QAAQ;GACpB,aAAa,QAAQ,aACjB;IACE,WAAW,QAAQ,WAAW;IAC9B,IAAI,QAAQ,WAAW;IACvB,UAAU,QAAQ,WAAW;GAC/B,IACA;EACN,CAAC;CACH;;;;CAKA,OAAc,YAAY,OAA6C;EACrE,OAAO,KAAK,MAAM,EAAE,MAAM,CAAC;CAC7B;;;;;CAMA,OAAc,YAAY,MAAY,OAA6C;EACjF,OAAO,KAAK,MAAM;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAC/C;;CAGA,OAAc,aAAa,UAAgD;EACzE,OAAO,KAAK,MAAM,EAAE,WAAW,SAAS,CAAC;CAC3C;;;;;CAMA,OAAc,gBAAgB,MAAqC;EACjE,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;EAAS,CAAC,CAAC,CAAC,IAAI;CAChF;;;;CAKA,OAAc,cAAc,MAAY,OAAe;EACrD,OAAO,KAAK,OAAO;GAAE;GAAO,SAAS,KAAK;EAAG,CAAC;CAChD;;;;CAKA,OAAc,UAAU,MAAqC;EAC3D,OAAO,KAAK,MAAM,CAAC,CAChB,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CACpC,QAAQ,cAAc,MAAM,CAAC,CAC7B,IAAI;CACT;;;;;;;;;CAUA,aAAoB,aAAa,MAAqC;EACpE,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,CAC9B,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,IAAI;EAEP,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,OAAO;EAGrB,OAAO;CACT;;;;;CAMA,aAAoB,aAAa,UAA2C;EAC1E,MAAM,SAAS,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM;GAAE,WAAW;GAAU,YAAY;EAAK,CAAC,CAAC,CAAC,IAAI;EAEvF,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,OAAO;EAGrB,OAAO;CACT;;;;;;CAOA,aAAoB,WAAW,MAAY,KAA4B;EACrE,MAAM,eAAe,MAAM,KAAK,MAAM,CAAC,CACpC,MAAM;GAAE,SAAS,KAAK;GAAI,WAAW,KAAK;GAAU,YAAY;EAAK,CAAC,CAAC,CACvE,QAAQ,cAAc,KAAK,CAAC,CAC5B,IAAI;EAEP,IAAI,aAAa,SAAS,KAAK;EAE/B,MAAM,iBAAiB,aAAa,MAAM,GAAG,aAAa,SAAS,MAAM,CAAC;EAE1E,KAAK,MAAM,SAAS,gBAClB,MAAM,MAAM,OAAO;CAEvB;;;;;;CAOA,aAAoB,eAAwC;EAC1D,MAAM,gBAAgB,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,cAAc,qBAAK,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI;EAElF,KAAK,MAAM,SAAS,eAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;;;;;;;CAQA,aAAoB,oBAA6C;EAG/D,QAAO,MAFc,KAAK,MAAM,CAAC,CAAC,IAAI,EAEzB,CAAC,QAAQ,UAAwB,MAAM,YAAY;CAClE;;;;;;;;;;CAWA,aAAoB,qBAA8C;EAChE,MAAM,SAAS,MAAM,KAAK,kBAAkB;EAE5C,KAAK,MAAM,SAAS,QAClB,MAAM,MAAM,QAAQ;EAGtB,OAAO;CACT;AACF"}

package/esm/services/auth-config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth-config.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport { type Algorithm } from \"fast-jwt\";\r\nimport ms from \"ms\";\r\nimport type {\r\n  AuthNotification,\r\n  CanAuthenticate,\r\n  LogoutWithoutTokenBehavior,\r\n  OneTimeTokenUrlBuilder,\r\n  PasswordSetter,\r\n} from \"../contracts/types\";\r\nimport type {\r\n  AppleProviderConfig,\r\n  AuthProvider,\r\n  DiscordProviderConfig,\r\n  FacebookProviderConfig,\r\n  GitHubProviderConfig,\r\n  GoogleProviderConfig,\r\n  LinkedInProviderConfig,\r\n  OtpSender,\r\n  PasskeysConfig,\r\n  ProviderUserCreator,\r\n  XProviderConfig,\r\n} from \"../contracts/providers\";\r\nimport type { Auth } from \"../models/auth.model\";\r\n\r\nconst warnedLegacyKeys = new Set<string>();\r\n\r\nconst permitAuthentication: CanAuthenticate = (): boolean => true;\r\n\r\n/**\r\n * `ms` accepts anything at runtime and answers `undefined` for a string it\r\n * cannot parse (`\"30dayz\"`), a *formatted string* for a number (`2592000` ⇒\r\n * `\"43m\"`), and throws for `\"\"`. Its published types claim the far narrower\r\n * `(value: ms.StringValue) => number`, which is exactly what let an\r\n * `as ms.StringValue` cast smuggle arbitrary config text past the compiler and\r\n * hand `undefined` to the JWT signer. Declare the honest runtime signature once,\r\n * here, so every caller is forced to deal with the `undefined`.\r\n */\r\nconst parseMs = ms as unknown as (value: unknown) => number | string | undefined;\r\n\r\n/**\r\n * Turn a configured lifetime into a positive number of milliseconds, or throw\r\n * naming the key.\r\n *\r\n * A token lifetime is a security boundary, so an unusable value is a hard error\r\n * rather than a silent fallback: substituting a default would trade one\r\n * unintended lifetime for another, just as quietly — and quiet is the whole\r\n * problem. Every non-positive, non-finite or non-numeric parse is rejected:\r\n *\r\n * - `\"30dayz\"` / `\"thirty days\"` ⇒ `undefined` ⇒ a JWT signed with **no `exp`\r\n *   claim** and an `Invalid Date` written to the token row.\r\n * - `\"0d\"` ⇒ parses cleanly to `0`, which `fast-jwt` treats as falsy and also\r\n *   emits with **no `exp` claim** — it survives any guard that only rejects\r\n *   `undefined`. `\"-1h\"` signs an already-expired token.\r\n * - `2592000` (a bare number) ⇒ `ms` *formats* it as `\"43m\"`, a string, which\r\n *   then turns `Date.now() + expiresIn` into an `Invalid Date`.\r\n */\r\nfunction parseDuration(key: string, raw: unknown): number {\r\n  let parsed: number | string | undefined;\r\n\r\n  try {\r\n    parsed = parseMs(raw);\r\n  } catch {\r\n    // ms throws (rather than returning undefined) for \"\" and non-strings\r\n    parsed = undefined;\r\n  }\r\n\r\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\r\n    throw new Error(\r\n      `auth.${key}: ${JSON.stringify(raw)} is not a valid ms duration — ` +\r\n        `use a positive duration string such as \"1h\", \"7d\", or NO_EXPIRATION.`,\r\n    );\r\n  }\r\n\r\n  return parsed;\r\n}\r\n\r\n/** Email-verification token lifetime used when nothing is configured. */\r\nconst DEFAULT_VERIFICATION_EXPIRES_IN = \"24h\";\r\n\r\n/** Password-reset token lifetime used when nothing is configured. */\r\nconst DEFAULT_PASSWORD_RESET_EXPIRES_IN = \"60m\";\r\n\r\n/** Passkey challenge lifetime used when nothing is configured. */\r\nconst DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN = \"5m\";\r\n\r\n/** OTP lifetime used when nothing is configured. */\r\nconst DEFAULT_OTP_EXPIRES_IN = \"5m\";\r\n\r\n/** Access-token lifetime used when nothing is configured. */\r\nconst DEFAULT_ACCESS_TOKEN_EXPIRES_IN = \"1h\";\r\n\r\n/**\r\n * Resolve an auth setting, preferring the new `auth.accessToken.*` /\r\n * `auth.refreshToken.*` key and falling back to the deprecated `auth.jwt.*`\r\n * shape — warning once per legacy key. Returns `fallback` when neither is set.\r\n *\r\n * This is the backward-compatible shim that lets existing `auth.jwt.*` configs\r\n * keep working after the config split.\r\n */\r\nfunction resolve<T>(newKey: string, legacyKey: string, fallback?: T): T {\r\n  const fromNew = config.key(`auth.${newKey}`);\r\n\r\n  if (fromNew !== undefined && fromNew !== null) {\r\n    return fromNew as T;\r\n  }\r\n\r\n  const fromLegacy = config.key(`auth.${legacyKey}`);\r\n\r\n  if (fromLegacy !== undefined && fromLegacy !== null) {\r\n    if (!warnedLegacyKeys.has(legacyKey)) {\r\n      warnedLegacyKeys.add(legacyKey);\r\n      log.warn(\r\n        \"auth\",\r\n        \"config-deprecation\",\r\n        `auth.${legacyKey} is deprecated — use auth.${newKey}`,\r\n      );\r\n    }\r\n\r\n    return fromLegacy as T;\r\n  }\r\n\r\n  return fallback as T;\r\n}\r\n\r\n/**\r\n * Typed, backward-compatible access to auth configuration. The service and the\r\n * jwt signer read configuration exclusively through here, so the new split\r\n * config and the legacy `auth.jwt.*` shape both resolve the same way.\r\n */\r\nexport const authConfig = {\r\n  canAuthenticate: async (user: Auth): Promise<boolean> => {\r\n    const canAuthenticate = config.key<CanAuthenticate>(\r\n      \"auth.canAuthenticate\",\r\n      permitAuthentication,\r\n    );\r\n\r\n    return canAuthenticate(user);\r\n  },\r\n  accessToken: {\r\n    /** Signing secret (legacy: `auth.jwt.secret`). Throws if neither is set. */\r\n    secret: (): string => {\r\n      const secret = resolve<string | undefined>(\"accessToken.secret\", \"jwt.secret\");\r\n\r\n      if (!secret) {\r\n        throw new Error(\"auth: no JWT secret configured — set `auth.accessToken.secret`.\");\r\n      }\r\n\r\n      return secret;\r\n    },\r\n    /** Signing algorithm (legacy: `auth.jwt.algorithm`). */\r\n    algorithm: (): Algorithm => resolve(\"accessToken.algorithm\", \"jwt.algorithm\", \"HS256\"),\r\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.expiresIn`). */\r\n    expiresIn: (): string | undefined => resolve(\"accessToken.expiresIn\", \"jwt.expiresIn\"),\r\n    /**\r\n     * Lifetime in milliseconds — the only form a token issuer may use. Defaults\r\n     * to 1 hour when unset; throws naming the key when the configured value is\r\n     * not a positive `ms` duration. See {@link parseDuration}.\r\n     */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"accessToken.expiresIn\",\r\n        authConfig.accessToken.expiresIn() ?? DEFAULT_ACCESS_TOKEN_EXPIRES_IN,\r\n      ),\r\n  },\r\n  pageAuth: {\r\n    /**\r\n     * Login path a guarded PAGE route redirects a logged-out browser to.\r\n     *\r\n     * Unset (the default) ⇒ page-route auth failures keep the JSON 401 API\r\n     * contract, so existing apps see NO behavior change. Set it (e.g. \"/login\")\r\n     * to opt a browser-facing app into login-redirect UX: a logged-out human\r\n     * navigating to a guarded page lands on the login screen instead of reading\r\n     * a raw JSON error blob. Finding b9ab9804.\r\n     */\r\n    loginPath: (): string | undefined => config.key(\"auth.pageAuth.loginPath\"),\r\n    /**\r\n     * Query parameter the redirect carries the originally-requested path in, so\r\n     * the login flow can send the user back where they were headed. Defaults to\r\n     * `\"returnUrl\"`.\r\n     */\r\n    returnUrlParam: (): string => config.key(\"auth.pageAuth.returnUrlParam\", \"returnUrl\"),\r\n  },\r\n  cookie: {\r\n    /** Cookie name `setAuthCookie`/`clearAuthCookie` use. @default \"access_token\" */\r\n    name: (): string => config.key(\"auth.cookie.name\", \"access_token\"),\r\n    /** Refresh-token cookie name the session cookie helpers use. @default \"refresh_token\" */\r\n    refreshName: (): string => config.key(\"auth.cookie.refreshName\", \"refresh_token\"),\r\n    /** Cookie `Path` attribute `setAuthCookie`/`clearAuthCookie` use. @default \"/\" */\r\n    path: (): string => config.key(\"auth.cookie.path\", \"/\"),\r\n  },\r\n  csrf: {\r\n    /**\r\n     * Extra origins allowed on a cookie-authenticated unsafe-method request,\r\n     * beyond the request's own origin. @default []\r\n     */\r\n    allowedOrigins: (): string[] => config.key(\"auth.csrf.allowedOrigins\", []),\r\n  },\r\n  verification: {\r\n    /** Lifetime in ms of an email-verification token; throws naming the key when unusable. @default \"24h\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"verification.expiresIn\",\r\n        config.key(\"auth.verification.expiresIn\", DEFAULT_VERIFICATION_EXPIRES_IN),\r\n      ),\r\n    /** User attribute stamped with the verification date. @default \"emailVerifiedAt\" */\r\n    field: (): string => config.key(\"auth.verification.field\", \"emailVerifiedAt\"),\r\n    /** App notification replacing the default verification email. */\r\n    notification: (): AuthNotification | undefined => config.key(\"auth.verification.notification\"),\r\n    /** Link builder whose result is handed to the notification as `url`. */\r\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.verification.url\"),\r\n  },\r\n  passwordReset: {\r\n    /** Lifetime in ms of a password-reset token; throws naming the key when unusable. @default \"60m\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\r\n        \"passwordReset.expiresIn\",\r\n        config.key(\"auth.passwordReset.expiresIn\", DEFAULT_PASSWORD_RESET_EXPIRES_IN),\r\n      ),\r\n    /** User attribute `requestPasswordReset` looks the account up by. @default \"email\" */\r\n    identifierField: (): string => config.key(\"auth.passwordReset.identifierField\", \"email\"),\r\n    /** App notification replacing the default reset email. */\r\n    notification: (): AuthNotification | undefined => config.key(\"auth.passwordReset.notification\"),\r\n    /** Link builder whose result is handed to the notification as `url`. */\r\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.passwordReset.url\"),\r\n    /** App-owned password writer replacing the default. */\r\n    setPassword: (): PasswordSetter | undefined => config.key(\"auth.passwordReset.setPassword\"),\r\n  },\r\n  providers: {\r\n    /** `auth.providers.google`, when configured. */\r\n    google: (): GoogleProviderConfig | undefined => config.key(\"auth.providers.google\"),\r\n    /** `auth.providers.github`, when configured. */\r\n    github: (): GitHubProviderConfig | undefined => config.key(\"auth.providers.github\"),\r\n    /** `auth.providers.discord`, when configured. */\r\n    discord: (): DiscordProviderConfig | undefined => config.key(\"auth.providers.discord\"),\r\n    /** `auth.providers.linkedin`, when configured. */\r\n    linkedin: (): LinkedInProviderConfig | undefined => config.key(\"auth.providers.linkedin\"),\r\n    /** `auth.providers.apple`, when configured. */\r\n    apple: (): AppleProviderConfig | undefined => config.key(\"auth.providers.apple\"),\r\n    /** `auth.providers.facebook`, when configured. */\r\n    facebook: (): FacebookProviderConfig | undefined => config.key(\"auth.providers.facebook\"),\r\n    /** `auth.providers.x`, when configured. */\r\n    x: (): XProviderConfig | undefined => config.key(\"auth.providers.x\"),\r\n    /** An app-registered provider under `auth.providers.custom.<name>`. */\r\n    custom: (name: string): AuthProvider | undefined => {\r\n      const providers = config.key<Record<string, AuthProvider>>(\"auth.providers.custom\", {});\r\n\r\n      // Own keys only: `name` arrives from a URL, and \"constructor\" must not resolve to Object.\r\n      return Object.hasOwn(providers, name) ? providers[name] : undefined;\r\n    },\r\n    /** User attribute a verified provider email is matched against. @default \"email\" */\r\n    emailField: (): string => config.key(\"auth.providers.emailField\", \"email\"),\r\n    /** App-owned user creation for a first provider login. */\r\n    createUser: (): ProviderUserCreator | undefined => config.key(\"auth.providers.createUser\"),\r\n  },\r\n  passkeys: {\r\n    /** `auth.passkeys`; throws naming the keys when `rpID`, `rpName` or `origin` is missing. */\r\n    settings: (): PasskeysConfig => {\r\n      const settings = config.key<PasskeysConfig | undefined>(\"auth.passkeys\");\r\n\r\n      if (!settings?.rpID || !settings.rpName || !settings.origin) {\r\n        throw new Error(\r\n          \"@warlock.js/auth: passkeys need `auth.passkeys.rpID`, `auth.passkeys.rpName` and `auth.passkeys.origin`.\",\r\n        );\r\n      }\r\n\r\n      return settings;\r\n    },\r\n    /** Allowed ceremony origins, as a list. */\r\n    origins: (): string[] => {\r\n      const { origin } = authConfig.passkeys.settings();\r\n\r\n      return Array.isArray(origin) ? origin : [origin];\r\n    },\r\n    /** Challenge lifetime in ms; throws naming the key when unusable. @default \"5m\" */\r\n    challengeExpiresInMs: (): number =>\r\n      parseDuration(\r\n        \"passkeys.challengeExpiresIn\",\r\n        config.key(\"auth.passkeys.challengeExpiresIn\", DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN),\r\n      ),\r\n  },\r\n  otp: {\r\n    /** Notifications channel the code is sent through. @default \"sms\" */\r\n    channel: (): string => config.key(\"auth.otp.channel\", \"sms\"),\r\n    /** User attribute holding the phone number. @default \"phone\" */\r\n    phoneField: (): string => config.key(\"auth.otp.phoneField\", \"phone\"),\r\n    /** Code lifetime in ms; throws naming the key when unusable. @default \"5m\" */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\"otp.expiresIn\", config.key(\"auth.otp.expiresIn\", DEFAULT_OTP_EXPIRES_IN)),\r\n    /** Verify attempts before the code is invalidated. @default 5 */\r\n    maxAttempts: (): number => config.key(\"auth.otp.maxAttempts\", 5),\r\n    /** The message text for a code. */\r\n    message: (code: string): string => {\r\n      const build = config.key<((code: string) => string) | undefined>(\"auth.otp.message\");\r\n\r\n      return build ? build(code) : `Your verification code is ${code}`;\r\n    },\r\n    /** App-owned delivery replacing the notifications channel send. */\r\n    send: (): OtpSender | undefined => config.key(\"auth.otp.send\"),\r\n  },\r\n  refreshToken: {\r\n    /** Separate refresh secret (legacy: `auth.jwt.refresh.secret`); empty ⇒ fall back to the access secret. */\r\n    secret: (): string | undefined => resolve(\"refreshToken.secret\", \"jwt.refresh.secret\"),\r\n    /** Whether refresh tokens are enabled (legacy: `auth.jwt.refresh.enabled`). */\r\n    enabled: (): boolean => resolve(\"refreshToken.enabled\", \"jwt.refresh.enabled\", true),\r\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.refresh.expiresIn`). */\r\n    expiresIn: (): string => resolve(\"refreshToken.expiresIn\", \"jwt.refresh.expiresIn\", \"7d\"),\r\n    /**\r\n     * Lifetime in milliseconds — the only form a token issuer may use. Throws\r\n     * naming the key when the configured value is not a positive `ms` duration.\r\n     */\r\n    expiresInMs: (): number =>\r\n      parseDuration(\"refreshToken.expiresIn\", authConfig.refreshToken.expiresIn()),\r\n    /** Rotate-on-use (legacy: `auth.jwt.refresh.rotation`). */\r\n    rotation: (): boolean => resolve(\"refreshToken.rotation\", \"jwt.refresh.rotation\", true),\r\n    /** Max active tokens per user (legacy: `auth.jwt.refresh.maxPerUser`). */\r\n    maxPerUser: (): number => resolve(\"refreshToken.maxPerUser\", \"jwt.refresh.maxPerUser\", 5),\r\n    /** Logout-without-token behavior (legacy: `auth.jwt.refresh.logoutWithoutToken`). */\r\n    logoutWithoutToken: (): LogoutWithoutTokenBehavior =>\r\n      resolve(\"refreshToken.logoutWithoutToken\", \"jwt.refresh.logoutWithoutToken\", \"revoke-all\"),\r\n  },\r\n};\r\n"],"mappings":";;;;;AA0BA,MAAM,mCAAmB,IAAI,IAAY;AAEzC,MAAM,6BAAuD;;;;;;;;;;AAW7D,MAAM,UAAU;;;;;;;;;;;;;;;;;;AAmBhB,SAAS,cAAc,KAAa,KAAsB;CACxD,IAAI;CAEJ,IAAI;EACF,SAAS,QAAQ,GAAG;CACtB,QAAQ;EAEN,SAAS;CACX;CAEA,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACtE,MAAM,IAAI,MACR,QAAQ,IAAI,IAAI,KAAK,UAAU,GAAG,EAAE,mGAEtC;CAGF,OAAO;AACT;;AAGA,MAAM,kCAAkC;;AAGxC,MAAM,oCAAoC;;AAG1C,MAAM,uCAAuC;;AAG7C,MAAM,yBAAyB;;AAG/B,MAAM,kCAAkC;;;;;;;;;AAUxC,SAAS,QAAW,QAAgB,WAAmB,UAAiB;CACtE,MAAM,UAAU,OAAO,IAAI,QAAQ,QAAQ;CAE3C,IAAI,YAAY,UAAa,YAAY,MACvC,OAAO;CAGT,MAAM,aAAa,OAAO,IAAI,QAAQ,WAAW;CAEjD,IAAI,eAAe,UAAa,eAAe,MAAM;EACnD,IAAI,CAAC,iBAAiB,IAAI,SAAS,GAAG;GACpC,iBAAiB,IAAI,SAAS;GAC9B,IAAI,KACF,QACA,sBACA,QAAQ,UAAU,4BAA4B,QAChD;EACF;EAEA,OAAO;CACT;CAEA,OAAO;AACT;;;;;;AAOA,MAAa,aAAa;CACxB,iBAAiB,OAAO,SAAiC;EAMvD,OALwB,OAAO,IAC7B,wBACA,oBAGmB,CAAC,CAAC,IAAI;CAC7B;CACA,aAAa;;EAEX,cAAsB;GACpB,MAAM,SAAS,QAA4B,sBAAsB,YAAY;GAE7E,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,iEAAiE;GAGnF,OAAO;EACT;;EAEA,iBAA4B,QAAQ,yBAAyB,iBAAiB,OAAO;;EAErF,iBAAqC,QAAQ,yBAAyB,eAAe;;;;;;EAMrF,mBACE,cACE,yBACA,WAAW,YAAY,UAAU,KAAK,+BACxC;CACJ;CACA,UAAU;;;;;;;;;;EAUR,iBAAqC,OAAO,IAAI,yBAAyB;;;;;;EAMzE,sBAA8B,OAAO,IAAI,gCAAgC,WAAW;CACtF;CACA,QAAQ;;EAEN,YAAoB,OAAO,IAAI,oBAAoB,cAAc;;EAEjE,mBAA2B,OAAO,IAAI,2BAA2B,eAAe;;EAEhF,YAAoB,OAAO,IAAI,oBAAoB,GAAG;CACxD;CACA,MAAM;;;;;AAKJ,sBAAgC,OAAO,IAAI,4BAA4B,CAAC,CAAC,EAC3E;CACA,cAAc;;EAEZ,mBACE,cACE,0BACA,OAAO,IAAI,+BAA+B,+BAA+B,CAC3E;;EAEF,aAAqB,OAAO,IAAI,2BAA2B,iBAAiB;;EAE5E,oBAAkD,OAAO,IAAI,gCAAgC;;EAE7F,WAA+C,OAAO,IAAI,uBAAuB;CACnF;CACA,eAAe;;EAEb,mBACE,cACE,2BACA,OAAO,IAAI,gCAAgC,iCAAiC,CAC9E;;EAEF,uBAA+B,OAAO,IAAI,sCAAsC,OAAO;;EAEvF,oBAAkD,OAAO,IAAI,iCAAiC;;EAE9F,WAA+C,OAAO,IAAI,wBAAwB;;EAElF,mBAA+C,OAAO,IAAI,gCAAgC;CAC5F;CACA,WAAW;;EAET,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,eAAkD,OAAO,IAAI,wBAAwB;;EAErF,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,aAA8C,OAAO,IAAI,sBAAsB;;EAE/E,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,SAAsC,OAAO,IAAI,kBAAkB;;EAEnE,SAAS,SAA2C;GAClD,MAAM,YAAY,OAAO,IAAkC,yBAAyB,CAAC,CAAC;GAGtF,OAAO,OAAO,OAAO,WAAW,IAAI,IAAI,UAAU,QAAQ;EAC5D;;EAEA,kBAA0B,OAAO,IAAI,6BAA6B,OAAO;;EAEzE,kBAAmD,OAAO,IAAI,2BAA2B;CAC3F;CACA,UAAU;;EAER,gBAAgC;GAC9B,MAAM,WAAW,OAAO,IAAgC,eAAe;GAEvE,IAAI,CAAC,UAAU,QAAQ,CAAC,SAAS,UAAU,CAAC,SAAS,QACnD,MAAM,IAAI,MACR,0GACF;GAGF,OAAO;EACT;;EAEA,eAAyB;GACvB,MAAM,EAAE,WAAW,WAAW,SAAS,SAAS;GAEhD,OAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;EACjD;;EAEA,4BACE,cACE,+BACA,OAAO,IAAI,oCAAoC,oCAAoC,CACrF;CACJ;CACA,KAAK;;EAEH,eAAuB,OAAO,IAAI,oBAAoB,KAAK;;EAE3D,kBAA0B,OAAO,IAAI,uBAAuB,OAAO;;EAEnE,mBACE,cAAc,iBAAiB,OAAO,IAAI,sBAAsB,sBAAsB,CAAC;;EAEzF,mBAA2B,OAAO,IAAI,wBAAwB,CAAC;;EAE/D,UAAU,SAAyB;GACjC,MAAM,QAAQ,OAAO,IAA4C,kBAAkB;GAEnF,OAAO,QAAQ,MAAM,IAAI,IAAI,6BAA6B;EAC5D;;EAEA,YAAmC,OAAO,IAAI,eAAe;CAC/D;CACA,cAAc;;EAEZ,cAAkC,QAAQ,uBAAuB,oBAAoB;;EAErF,eAAwB,QAAQ,wBAAwB,uBAAuB,IAAI;;EAEnF,iBAAyB,QAAQ,0BAA0B,yBAAyB,IAAI;;;;;EAKxF,mBACE,cAAc,0BAA0B,WAAW,aAAa,UAAU,CAAC;;EAE7E,gBAAyB,QAAQ,yBAAyB,wBAAwB,IAAI;;EAEtF,kBAA0B,QAAQ,2BAA2B,0BAA0B,CAAC;;EAExF,0BACE,QAAQ,mCAAmC,kCAAkC,YAAY;CAC7F;AACF"}
+{"version":3,"file":"auth-config.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth-config.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\nimport { log } from \"@warlock.js/logger\";\nimport { type Algorithm } from \"fast-jwt\";\nimport ms from \"ms\";\nimport type {\n  AuthNotification,\n  CanAuthenticate,\n  LogoutWithoutTokenBehavior,\n  OneTimeTokenUrlBuilder,\n  PasswordSetter,\n} from \"../contracts/types\";\nimport type {\n  AppleProviderConfig,\n  AuthProvider,\n  DiscordProviderConfig,\n  FacebookProviderConfig,\n  GitHubProviderConfig,\n  GoogleProviderConfig,\n  LinkedInProviderConfig,\n  OtpSender,\n  PasskeysConfig,\n  ProviderUserCreator,\n  XProviderConfig,\n} from \"../contracts/providers\";\nimport type { Auth } from \"../models/auth.model\";\n\nconst warnedLegacyKeys = new Set<string>();\n\nconst permitAuthentication: CanAuthenticate = (): boolean => true;\n\n/**\n * `ms` accepts anything at runtime and answers `undefined` for a string it\n * cannot parse (`\"30dayz\"`), a *formatted string* for a number (`2592000` ⇒\n * `\"43m\"`), and throws for `\"\"`. Its published types claim the far narrower\n * `(value: ms.StringValue) => number`, which is exactly what let an\n * `as ms.StringValue` cast smuggle arbitrary config text past the compiler and\n * hand `undefined` to the JWT signer. Declare the honest runtime signature once,\n * here, so every caller is forced to deal with the `undefined`.\n */\nconst parseMs = ms as unknown as (value: unknown) => number | string | undefined;\n\n/**\n * Turn a configured lifetime into a positive number of milliseconds, or throw\n * naming the key.\n *\n * A token lifetime is a security boundary, so an unusable value is a hard error\n * rather than a silent fallback: substituting a default would trade one\n * unintended lifetime for another, just as quietly — and quiet is the whole\n * problem. Every non-positive, non-finite or non-numeric parse is rejected:\n *\n * - `\"30dayz\"` / `\"thirty days\"` ⇒ `undefined` ⇒ a JWT signed with **no `exp`\n *   claim** and an `Invalid Date` written to the token row.\n * - `\"0d\"` ⇒ parses cleanly to `0`, which `fast-jwt` treats as falsy and also\n *   emits with **no `exp` claim** — it survives any guard that only rejects\n *   `undefined`. `\"-1h\"` signs an already-expired token.\n * - `2592000` (a bare number) ⇒ `ms` *formats* it as `\"43m\"`, a string, which\n *   then turns `Date.now() + expiresIn` into an `Invalid Date`.\n */\nfunction parseDuration(key: string, raw: unknown): number {\n  let parsed: number | string | undefined;\n\n  try {\n    parsed = parseMs(raw);\n  } catch {\n    // ms throws (rather than returning undefined) for \"\" and non-strings\n    parsed = undefined;\n  }\n\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(\n      `auth.${key}: ${JSON.stringify(raw)} is not a valid ms duration — ` +\n        `use a positive duration string such as \"1h\", \"7d\", or NO_EXPIRATION.`,\n    );\n  }\n\n  return parsed;\n}\n\n/** Email-verification token lifetime used when nothing is configured. */\nconst DEFAULT_VERIFICATION_EXPIRES_IN = \"24h\";\n\n/** Password-reset token lifetime used when nothing is configured. */\nconst DEFAULT_PASSWORD_RESET_EXPIRES_IN = \"60m\";\n\n/** Passkey challenge lifetime used when nothing is configured. */\nconst DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN = \"5m\";\n\n/** OTP lifetime used when nothing is configured. */\nconst DEFAULT_OTP_EXPIRES_IN = \"5m\";\n\n/** Access-token lifetime used when nothing is configured. */\nconst DEFAULT_ACCESS_TOKEN_EXPIRES_IN = \"1h\";\n\n/**\n * Resolve an auth setting, preferring the new `auth.accessToken.*` /\n * `auth.refreshToken.*` key and falling back to the deprecated `auth.jwt.*`\n * shape — warning once per legacy key. Returns `fallback` when neither is set.\n *\n * This is the backward-compatible shim that lets existing `auth.jwt.*` configs\n * keep working after the config split.\n */\nfunction resolve<T>(newKey: string, legacyKey: string, fallback?: T): T {\n  const fromNew = config.key(`auth.${newKey}`);\n\n  if (fromNew !== undefined && fromNew !== null) {\n    return fromNew as T;\n  }\n\n  const fromLegacy = config.key(`auth.${legacyKey}`);\n\n  if (fromLegacy !== undefined && fromLegacy !== null) {\n    if (!warnedLegacyKeys.has(legacyKey)) {\n      warnedLegacyKeys.add(legacyKey);\n      log.warn(\n        \"auth\",\n        \"config-deprecation\",\n        `auth.${legacyKey} is deprecated — use auth.${newKey}`,\n      );\n    }\n\n    return fromLegacy as T;\n  }\n\n  return fallback as T;\n}\n\n/**\n * Typed, backward-compatible access to auth configuration. The service and the\n * jwt signer read configuration exclusively through here, so the new split\n * config and the legacy `auth.jwt.*` shape both resolve the same way.\n */\nexport const authConfig = {\n  canAuthenticate: async (user: Auth): Promise<boolean> => {\n    const canAuthenticate = config.key<CanAuthenticate>(\n      \"auth.canAuthenticate\",\n      permitAuthentication,\n    );\n\n    return canAuthenticate(user);\n  },\n  accessToken: {\n    /** Signing secret (legacy: `auth.jwt.secret`). Throws if neither is set. */\n    secret: (): string => {\n      const secret = resolve<string | undefined>(\"accessToken.secret\", \"jwt.secret\");\n\n      if (!secret) {\n        throw new Error(\"auth: no JWT secret configured — set `auth.accessToken.secret`.\");\n      }\n\n      return secret;\n    },\n    /** Signing algorithm (legacy: `auth.jwt.algorithm`). */\n    algorithm: (): Algorithm => resolve(\"accessToken.algorithm\", \"jwt.algorithm\", \"HS256\"),\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.expiresIn`). */\n    expiresIn: (): string | undefined => resolve(\"accessToken.expiresIn\", \"jwt.expiresIn\"),\n    /**\n     * Lifetime in milliseconds — the only form a token issuer may use. Defaults\n     * to 1 hour when unset; throws naming the key when the configured value is\n     * not a positive `ms` duration. See {@link parseDuration}.\n     */\n    expiresInMs: (): number =>\n      parseDuration(\n        \"accessToken.expiresIn\",\n        authConfig.accessToken.expiresIn() ?? DEFAULT_ACCESS_TOKEN_EXPIRES_IN,\n      ),\n  },\n  pageAuth: {\n    /**\n     * Login path a guarded PAGE route redirects a logged-out browser to.\n     *\n     * Unset (the default) ⇒ page-route auth failures keep the JSON 401 API\n     * contract, so existing apps see NO behavior change. Set it (e.g. \"/login\")\n     * to opt a browser-facing app into login-redirect UX: a logged-out human\n     * navigating to a guarded page lands on the login screen instead of reading\n     * a raw JSON error blob. Finding b9ab9804.\n     */\n    loginPath: (): string | undefined => config.key(\"auth.pageAuth.loginPath\"),\n    /**\n     * Query parameter the redirect carries the originally-requested path in, so\n     * the login flow can send the user back where they were headed. Defaults to\n     * `\"returnUrl\"`.\n     */\n    returnUrlParam: (): string => config.key(\"auth.pageAuth.returnUrlParam\", \"returnUrl\"),\n  },\n  cookie: {\n    /** Cookie name `setAuthCookie`/`clearAuthCookie` use. @default \"access_token\" */\n    name: (): string => config.key(\"auth.cookie.name\", \"access_token\"),\n    /** Refresh-token cookie name the session cookie helpers use. @default \"refresh_token\" */\n    refreshName: (): string => config.key(\"auth.cookie.refreshName\", \"refresh_token\"),\n    /** Cookie `Path` attribute `setAuthCookie`/`clearAuthCookie` use. @default \"/\" */\n    path: (): string => config.key(\"auth.cookie.path\", \"/\"),\n  },\n  csrf: {\n    /**\n     * Extra origins allowed on a cookie-authenticated unsafe-method request,\n     * beyond the request's own origin. @default []\n     */\n    allowedOrigins: (): string[] => config.key(\"auth.csrf.allowedOrigins\", []),\n  },\n  verification: {\n    /** Lifetime in ms of an email-verification token; throws naming the key when unusable. @default \"24h\" */\n    expiresInMs: (): number =>\n      parseDuration(\n        \"verification.expiresIn\",\n        config.key(\"auth.verification.expiresIn\", DEFAULT_VERIFICATION_EXPIRES_IN),\n      ),\n    /** User attribute stamped with the verification date. @default \"emailVerifiedAt\" */\n    field: (): string => config.key(\"auth.verification.field\", \"emailVerifiedAt\"),\n    /** App notification replacing the default verification email. */\n    notification: (): AuthNotification | undefined => config.key(\"auth.verification.notification\"),\n    /** Link builder whose result is handed to the notification as `url`. */\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.verification.url\"),\n  },\n  passwordReset: {\n    /** Lifetime in ms of a password-reset token; throws naming the key when unusable. @default \"60m\" */\n    expiresInMs: (): number =>\n      parseDuration(\n        \"passwordReset.expiresIn\",\n        config.key(\"auth.passwordReset.expiresIn\", DEFAULT_PASSWORD_RESET_EXPIRES_IN),\n      ),\n    /** User attribute `requestPasswordReset` looks the account up by. @default \"email\" */\n    identifierField: (): string => config.key(\"auth.passwordReset.identifierField\", \"email\"),\n    /** App notification replacing the default reset email. */\n    notification: (): AuthNotification | undefined => config.key(\"auth.passwordReset.notification\"),\n    /** Link builder whose result is handed to the notification as `url`. */\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.passwordReset.url\"),\n    /** App-owned password writer replacing the default. */\n    setPassword: (): PasswordSetter | undefined => config.key(\"auth.passwordReset.setPassword\"),\n  },\n  providers: {\n    /** `auth.providers.google`, when configured. */\n    google: (): GoogleProviderConfig | undefined => config.key(\"auth.providers.google\"),\n    /** `auth.providers.github`, when configured. */\n    github: (): GitHubProviderConfig | undefined => config.key(\"auth.providers.github\"),\n    /** `auth.providers.discord`, when configured. */\n    discord: (): DiscordProviderConfig | undefined => config.key(\"auth.providers.discord\"),\n    /** `auth.providers.linkedin`, when configured. */\n    linkedin: (): LinkedInProviderConfig | undefined => config.key(\"auth.providers.linkedin\"),\n    /** `auth.providers.apple`, when configured. */\n    apple: (): AppleProviderConfig | undefined => config.key(\"auth.providers.apple\"),\n    /** `auth.providers.facebook`, when configured. */\n    facebook: (): FacebookProviderConfig | undefined => config.key(\"auth.providers.facebook\"),\n    /** `auth.providers.x`, when configured. */\n    x: (): XProviderConfig | undefined => config.key(\"auth.providers.x\"),\n    /** An app-registered provider under `auth.providers.custom.<name>`. */\n    custom: (name: string): AuthProvider | undefined => {\n      const providers = config.key<Record<string, AuthProvider>>(\"auth.providers.custom\", {});\n\n      // Own keys only: `name` arrives from a URL, and \"constructor\" must not resolve to Object.\n      return Object.hasOwn(providers, name) ? providers[name] : undefined;\n    },\n    /** User attribute a verified provider email is matched against. @default \"email\" */\n    emailField: (): string => config.key(\"auth.providers.emailField\", \"email\"),\n    /** App-owned user creation for a first provider login. */\n    createUser: (): ProviderUserCreator | undefined => config.key(\"auth.providers.createUser\"),\n  },\n  passkeys: {\n    /** `auth.passkeys`; throws naming the keys when `rpID`, `rpName` or `origin` is missing. */\n    settings: (): PasskeysConfig => {\n      const settings = config.key<PasskeysConfig | undefined>(\"auth.passkeys\");\n\n      if (!settings?.rpID || !settings.rpName || !settings.origin) {\n        throw new Error(\n          \"@warlock.js/auth: passkeys need `auth.passkeys.rpID`, `auth.passkeys.rpName` and `auth.passkeys.origin`.\",\n        );\n      }\n\n      return settings;\n    },\n    /** Allowed ceremony origins, as a list. */\n    origins: (): string[] => {\n      const { origin } = authConfig.passkeys.settings();\n\n      return Array.isArray(origin) ? origin : [origin];\n    },\n    /** Challenge lifetime in ms; throws naming the key when unusable. @default \"5m\" */\n    challengeExpiresInMs: (): number =>\n      parseDuration(\n        \"passkeys.challengeExpiresIn\",\n        config.key(\"auth.passkeys.challengeExpiresIn\", DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN),\n      ),\n  },\n  otp: {\n    /** Notifications channel the code is sent through. @default \"sms\" */\n    channel: (): string => config.key(\"auth.otp.channel\", \"sms\"),\n    /** User attribute holding the phone number. @default \"phone\" */\n    phoneField: (): string => config.key(\"auth.otp.phoneField\", \"phone\"),\n    /** Code lifetime in ms; throws naming the key when unusable. @default \"5m\" */\n    expiresInMs: (): number =>\n      parseDuration(\"otp.expiresIn\", config.key(\"auth.otp.expiresIn\", DEFAULT_OTP_EXPIRES_IN)),\n    /** Verify attempts before the code is invalidated. @default 5 */\n    maxAttempts: (): number => config.key(\"auth.otp.maxAttempts\", 5),\n    /** The message text for a code. */\n    message: (code: string): string => {\n      const build = config.key<((code: string) => string) | undefined>(\"auth.otp.message\");\n\n      return build ? build(code) : `Your verification code is ${code}`;\n    },\n    /** App-owned delivery replacing the notifications channel send. */\n    send: (): OtpSender | undefined => config.key(\"auth.otp.send\"),\n  },\n  refreshToken: {\n    /** Separate refresh secret (legacy: `auth.jwt.refresh.secret`); empty ⇒ fall back to the access secret. */\n    secret: (): string | undefined => resolve(\"refreshToken.secret\", \"jwt.refresh.secret\"),\n    /** Whether refresh tokens are enabled (legacy: `auth.jwt.refresh.enabled`). */\n    enabled: (): boolean => resolve(\"refreshToken.enabled\", \"jwt.refresh.enabled\", true),\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.refresh.expiresIn`). */\n    expiresIn: (): string => resolve(\"refreshToken.expiresIn\", \"jwt.refresh.expiresIn\", \"7d\"),\n    /**\n     * Lifetime in milliseconds — the only form a token issuer may use. Throws\n     * naming the key when the configured value is not a positive `ms` duration.\n     */\n    expiresInMs: (): number =>\n      parseDuration(\"refreshToken.expiresIn\", authConfig.refreshToken.expiresIn()),\n    /** Rotate-on-use (legacy: `auth.jwt.refresh.rotation`). */\n    rotation: (): boolean => resolve(\"refreshToken.rotation\", \"jwt.refresh.rotation\", true),\n    /** Max active tokens per user (legacy: `auth.jwt.refresh.maxPerUser`). */\n    maxPerUser: (): number => resolve(\"refreshToken.maxPerUser\", \"jwt.refresh.maxPerUser\", 5),\n    /** Logout-without-token behavior (legacy: `auth.jwt.refresh.logoutWithoutToken`). */\n    logoutWithoutToken: (): LogoutWithoutTokenBehavior =>\n      resolve(\"refreshToken.logoutWithoutToken\", \"jwt.refresh.logoutWithoutToken\", \"revoke-all\"),\n  },\n};\n"],"mappings":";;;;;AA0BA,MAAM,mCAAmB,IAAI,IAAY;AAEzC,MAAM,6BAAuD;;;;;;;;;;AAW7D,MAAM,UAAU;;;;;;;;;;;;;;;;;;AAmBhB,SAAS,cAAc,KAAa,KAAsB;CACxD,IAAI;CAEJ,IAAI;EACF,SAAS,QAAQ,GAAG;CACtB,QAAQ;EAEN,SAAS;CACX;CAEA,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACtE,MAAM,IAAI,MACR,QAAQ,IAAI,IAAI,KAAK,UAAU,GAAG,EAAE,mGAEtC;CAGF,OAAO;AACT;;AAGA,MAAM,kCAAkC;;AAGxC,MAAM,oCAAoC;;AAG1C,MAAM,uCAAuC;;AAG7C,MAAM,yBAAyB;;AAG/B,MAAM,kCAAkC;;;;;;;;;AAUxC,SAAS,QAAW,QAAgB,WAAmB,UAAiB;CACtE,MAAM,UAAU,OAAO,IAAI,QAAQ,QAAQ;CAE3C,IAAI,YAAY,UAAa,YAAY,MACvC,OAAO;CAGT,MAAM,aAAa,OAAO,IAAI,QAAQ,WAAW;CAEjD,IAAI,eAAe,UAAa,eAAe,MAAM;EACnD,IAAI,CAAC,iBAAiB,IAAI,SAAS,GAAG;GACpC,iBAAiB,IAAI,SAAS;GAC9B,IAAI,KACF,QACA,sBACA,QAAQ,UAAU,4BAA4B,QAChD;EACF;EAEA,OAAO;CACT;CAEA,OAAO;AACT;;;;;;AAOA,MAAa,aAAa;CACxB,iBAAiB,OAAO,SAAiC;EAMvD,OALwB,OAAO,IAC7B,wBACA,oBAGmB,CAAC,CAAC,IAAI;CAC7B;CACA,aAAa;;EAEX,cAAsB;GACpB,MAAM,SAAS,QAA4B,sBAAsB,YAAY;GAE7E,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,iEAAiE;GAGnF,OAAO;EACT;;EAEA,iBAA4B,QAAQ,yBAAyB,iBAAiB,OAAO;;EAErF,iBAAqC,QAAQ,yBAAyB,eAAe;;;;;;EAMrF,mBACE,cACE,yBACA,WAAW,YAAY,UAAU,KAAK,+BACxC;CACJ;CACA,UAAU;;;;;;;;;;EAUR,iBAAqC,OAAO,IAAI,yBAAyB;;;;;;EAMzE,sBAA8B,OAAO,IAAI,gCAAgC,WAAW;CACtF;CACA,QAAQ;;EAEN,YAAoB,OAAO,IAAI,oBAAoB,cAAc;;EAEjE,mBAA2B,OAAO,IAAI,2BAA2B,eAAe;;EAEhF,YAAoB,OAAO,IAAI,oBAAoB,GAAG;CACxD;CACA,MAAM;;;;;AAKJ,sBAAgC,OAAO,IAAI,4BAA4B,CAAC,CAAC,EAC3E;CACA,cAAc;;EAEZ,mBACE,cACE,0BACA,OAAO,IAAI,+BAA+B,+BAA+B,CAC3E;;EAEF,aAAqB,OAAO,IAAI,2BAA2B,iBAAiB;;EAE5E,oBAAkD,OAAO,IAAI,gCAAgC;;EAE7F,WAA+C,OAAO,IAAI,uBAAuB;CACnF;CACA,eAAe;;EAEb,mBACE,cACE,2BACA,OAAO,IAAI,gCAAgC,iCAAiC,CAC9E;;EAEF,uBAA+B,OAAO,IAAI,sCAAsC,OAAO;;EAEvF,oBAAkD,OAAO,IAAI,iCAAiC;;EAE9F,WAA+C,OAAO,IAAI,wBAAwB;;EAElF,mBAA+C,OAAO,IAAI,gCAAgC;CAC5F;CACA,WAAW;;EAET,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,eAAkD,OAAO,IAAI,wBAAwB;;EAErF,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,aAA8C,OAAO,IAAI,sBAAsB;;EAE/E,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,SAAsC,OAAO,IAAI,kBAAkB;;EAEnE,SAAS,SAA2C;GAClD,MAAM,YAAY,OAAO,IAAkC,yBAAyB,CAAC,CAAC;GAGtF,OAAO,OAAO,OAAO,WAAW,IAAI,IAAI,UAAU,QAAQ;EAC5D;;EAEA,kBAA0B,OAAO,IAAI,6BAA6B,OAAO;;EAEzE,kBAAmD,OAAO,IAAI,2BAA2B;CAC3F;CACA,UAAU;;EAER,gBAAgC;GAC9B,MAAM,WAAW,OAAO,IAAgC,eAAe;GAEvE,IAAI,CAAC,UAAU,QAAQ,CAAC,SAAS,UAAU,CAAC,SAAS,QACnD,MAAM,IAAI,MACR,0GACF;GAGF,OAAO;EACT;;EAEA,eAAyB;GACvB,MAAM,EAAE,WAAW,WAAW,SAAS,SAAS;GAEhD,OAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;EACjD;;EAEA,4BACE,cACE,+BACA,OAAO,IAAI,oCAAoC,oCAAoC,CACrF;CACJ;CACA,KAAK;;EAEH,eAAuB,OAAO,IAAI,oBAAoB,KAAK;;EAE3D,kBAA0B,OAAO,IAAI,uBAAuB,OAAO;;EAEnE,mBACE,cAAc,iBAAiB,OAAO,IAAI,sBAAsB,sBAAsB,CAAC;;EAEzF,mBAA2B,OAAO,IAAI,wBAAwB,CAAC;;EAE/D,UAAU,SAAyB;GACjC,MAAM,QAAQ,OAAO,IAA4C,kBAAkB;GAEnF,OAAO,QAAQ,MAAM,IAAI,IAAI,6BAA6B;EAC5D;;EAEA,YAAmC,OAAO,IAAI,eAAe;CAC/D;CACA,cAAc;;EAEZ,cAAkC,QAAQ,uBAAuB,oBAAoB;;EAErF,eAAwB,QAAQ,wBAAwB,uBAAuB,IAAI;;EAEnF,iBAAyB,QAAQ,0BAA0B,yBAAyB,IAAI;;;;;EAKxF,mBACE,cAAc,0BAA0B,WAAW,aAAa,UAAU,CAAC;;EAE7E,gBAAyB,QAAQ,yBAAyB,wBAAwB,IAAI;;EAEtF,kBAA0B,QAAQ,2BAA2B,0BAA0B,CAAC;;EAExF,0BACE,QAAQ,mCAAmC,kCAAkC,YAAY;CAC7F;AACF"}