@xk2800/nextjs-template 0.5.3

package/dist/admin/queries.mjs

@@ -0,0 +1,143 @@
+import { parseUserAgent, lookupGeoLocation, WINDOW_MS, isOverLimit } from '../chunk-N6ECRCHY.mjs';
+import { db } from '../chunk-HYKUB3A2.mjs';
+import { users, sessions, authThrottle, deviceFingerprints } from '../chunk-ENGYO4K7.mjs';
+import '../chunk-GTPTVNY2.mjs';
+import { __spreadProps, __spreadValues } from '../chunk-YN4436PK.mjs';
+import 'server-only';
+import { sql, gte, eq, desc } from 'drizzle-orm';
+
+// lib/shared-devices.ts
+function groupSharedDevices(rows, minAccounts, limit) {
+  const byVisitor = /* @__PURE__ */ new Map();
+  for (const r of rows) {
+    let d = byVisitor.get(r.visitorId);
+    if (!d) {
+      d = {
+        visitorId: r.visitorId,
+        accountCount: 0,
+        lastSeenAt: r.firstSeenAt,
+        country: r.country,
+        city: r.city,
+        userAgent: r.userAgent,
+        accounts: []
+      };
+      byVisitor.set(r.visitorId, d);
+    }
+    d.accountCount++;
+    if (r.firstSeenAt > d.lastSeenAt) d.lastSeenAt = r.firstSeenAt;
+    d.accounts.push({
+      userId: r.userId,
+      userName: r.userName,
+      userEmail: r.userEmail,
+      banned: r.banned,
+      firstSeenAt: r.firstSeenAt
+    });
+  }
+  return [...byVisitor.values()].filter((d) => d.accountCount >= minAccounts).sort(
+    (a, b) => b.accountCount - a.accountCount || b.lastSeenAt.getTime() - a.lastSeenAt.getTime()
+  ).slice(0, limit);
+}
+
+// lib/admin-queries.ts
+async function getAdminDashboardStats() {
+  var _a, _b, _c, _d;
+  const now = /* @__PURE__ */ new Date();
+  const weekAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1e3);
+  const [totalUsersResult, newSignupsResult, activeSessionsResult, bannedResult] = await Promise.all([
+    db.select({ count: sql`cast(count(*) as integer)` }).from(users),
+    db.select({ count: sql`cast(count(*) as integer)` }).from(users).where(gte(users.createdAt, weekAgo)),
+    db.select({ count: sql`cast(count(*) as integer)` }).from(sessions).where(sql`${sessions.expiresAt} > ${now}`),
+    db.select({ count: sql`cast(count(*) as integer)` }).from(users).where(eq(users.banned, true))
+  ]);
+  return {
+    totalUsers: ((_a = totalUsersResult[0]) == null ? void 0 : _a.count) || 0,
+    newSignupsThisWeek: ((_b = newSignupsResult[0]) == null ? void 0 : _b.count) || 0,
+    activeSessions: ((_c = activeSessionsResult[0]) == null ? void 0 : _c.count) || 0,
+    bannedCount: ((_d = bannedResult[0]) == null ? void 0 : _d.count) || 0
+  };
+}
+async function getAdminStats() {
+  var _a, _b, _c;
+  const totalUsersResult = await db.select({ count: sql`cast(count(*) as integer)` }).from(users);
+  const totalUsers = ((_a = totalUsersResult[0]) == null ? void 0 : _a.count) || 0;
+  const now = /* @__PURE__ */ new Date();
+  const activeSessionsResult = await db.select({ count: sql`cast(count(*) as integer)` }).from(sessions).where(sql`${sessions.expiresAt} > ${now}`);
+  const activeSessions = ((_b = activeSessionsResult[0]) == null ? void 0 : _b.count) || 0;
+  const adminCountResult = await db.select({ count: sql`cast(count(*) as integer)` }).from(users).where(sql`${users.role} = 'admin'`);
+  const adminCount = ((_c = adminCountResult[0]) == null ? void 0 : _c.count) || 0;
+  return {
+    totalUsers,
+    activeSessions,
+    adminCount,
+    regularUsers: totalUsers - adminCount
+  };
+}
+var SUSPICIOUS_ATTEMPTS = 2;
+async function getDeviceThrottleActivity(limit = 50) {
+  const rows = await db.select().from(authThrottle).where(gte(authThrottle.count, SUSPICIOUS_ATTEMPTS)).orderBy(desc(authThrottle.lastAttemptAt)).limit(limit);
+  const now = Date.now();
+  return rows.map((r) => {
+    const device = parseUserAgent(r.userAgent);
+    const geo = lookupGeoLocation(r.ipAddress);
+    return {
+      fingerprint: r.fingerprint,
+      count: r.count,
+      windowStart: r.windowStart,
+      lastAttemptAt: r.lastAttemptAt,
+      ipAddress: r.ipAddress,
+      userAgent: r.userAgent,
+      lastEmail: r.lastEmail,
+      lastKind: r.lastKind,
+      os: device.os,
+      browser: device.browser,
+      deviceType: device.deviceType,
+      country: geo.country,
+      city: geo.city,
+      // Would this device be 429'd on its next attempt right now?
+      blocked: isOverLimit(r, now),
+      // Is the counter still inside its window (attack ongoing) or has it
+      // gone quiet (last burst, awaiting reset on next attempt)?
+      windowActive: now - r.windowStart.getTime() < WINDOW_MS
+    };
+  });
+}
+async function getRecentNewDevices(limit = 20) {
+  const rows = await db.select({
+    id: deviceFingerprints.id,
+    userId: deviceFingerprints.userId,
+    userName: users.name,
+    userEmail: users.email,
+    ipAddress: deviceFingerprints.ipAddress,
+    userAgent: deviceFingerprints.userAgent,
+    country: deviceFingerprints.country,
+    city: deviceFingerprints.city,
+    createdAt: deviceFingerprints.createdAt
+  }).from(deviceFingerprints).innerJoin(users, eq(deviceFingerprints.userId, users.id)).orderBy(desc(deviceFingerprints.createdAt)).limit(limit);
+  return rows.map((r) => {
+    const device = parseUserAgent(r.userAgent);
+    return __spreadProps(__spreadValues({}, r), {
+      os: device.os,
+      browser: device.browser,
+      deviceType: device.deviceType
+    });
+  });
+}
+var MIN_SHARED_ACCOUNTS = 3;
+async function getSharedDeviceAccounts(limit = 20) {
+  const rows = await db.select({
+    visitorId: deviceFingerprints.visitorId,
+    userId: deviceFingerprints.userId,
+    userName: users.name,
+    userEmail: users.email,
+    banned: users.banned,
+    firstSeenAt: deviceFingerprints.createdAt,
+    userAgent: deviceFingerprints.userAgent,
+    country: deviceFingerprints.country,
+    city: deviceFingerprints.city
+  }).from(deviceFingerprints).innerJoin(users, eq(deviceFingerprints.userId, users.id)).orderBy(desc(deviceFingerprints.createdAt));
+  return groupSharedDevices(rows, MIN_SHARED_ACCOUNTS, limit).map((d) => __spreadValues(__spreadValues({}, d), parseUserAgent(d.userAgent)));
+}
+
+export { getAdminDashboardStats, getAdminStats, getDeviceThrottleActivity, getRecentNewDevices, getSharedDeviceAccounts };
+//# sourceMappingURL=queries.mjs.map
+//# sourceMappingURL=queries.mjs.map

package/dist/admin/queries.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../lib/shared-devices.ts","../../lib/admin-queries.ts"],"names":[],"mappings":";;;;;;;;;AAoCO,SAAS,kBAAA,CACd,IAAA,EACA,WAAA,EACA,KAAA,EACgB;AAChB,EAAA,MAAM,SAAA,uBAAgB,GAAA,EAA0B;AAEhD,EAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,IAAA,IAAI,CAAA,GAAI,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,SAAS,CAAA;AACjC,IAAA,IAAI,CAAC,CAAA,EAAG;AACN,MAAA,CAAA,GAAI;AAAA,QACF,WAAW,CAAA,CAAE,SAAA;AAAA,QACb,YAAA,EAAc,CAAA;AAAA,QACd,YAAY,CAAA,CAAE,WAAA;AAAA,QACd,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,WAAW,CAAA,CAAE,SAAA;AAAA,QACb,UAAU;AAAC,OACb;AACA,MAAA,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,SAAA,EAAW,CAAC,CAAA;AAAA,IAC9B;AACA,IAAA,CAAA,CAAE,YAAA,EAAA;AACF,IAAA,IAAI,EAAE,WAAA,GAAc,CAAA,CAAE,UAAA,EAAY,CAAA,CAAE,aAAa,CAAA,CAAE,WAAA;AACnD,IAAA,CAAA,CAAE,SAAS,IAAA,CAAK;AAAA,MACd,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,UAAU,CAAA,CAAE,QAAA;AAAA,MACZ,WAAW,CAAA,CAAE,SAAA;AAAA,MACb,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,aAAa,CAAA,CAAE;AAAA,KAChB,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,CAAC,GAAG,SAAA,CAAU,MAAA,EAAQ,CAAA,CAC1B,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,YAAA,IAAgB,WAAW,CAAA,CAC3C,IAAA;AAAA,IACC,CAAC,CAAA,EAAG,CAAA,KACF,CAAA,CAAE,YAAA,GAAe,CAAA,CAAE,YAAA,IAAgB,CAAA,CAAE,UAAA,CAAW,OAAA,EAAQ,GAAI,CAAA,CAAE,WAAW,OAAA;AAAQ,GACrF,CACC,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA;AACnB;;;AChEA,eAAsB,sBAAA,GAAyB;AAX/C,EAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAYE,EAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,CAAK,GAAA,CAAI,OAAA,KAAY,CAAA,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA;AAEhE,EAAA,MAAM,CAAC,kBAAkB,gBAAA,EAAkB,oBAAA,EAAsB,YAAY,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,IACjG,EAAA,CAAG,OAAO,EAAE,KAAA,EAAO,gCAAwC,CAAA,CAAE,KAAK,KAAK,CAAA;AAAA,IACvE,EAAA,CACG,MAAA,CAAO,EAAE,KAAA,EAAO,gCAAwC,CAAA,CACxD,IAAA,CAAK,KAAK,EACV,KAAA,CAAM,GAAA,CAAI,KAAA,CAAM,SAAA,EAAW,OAAO,CAAC,CAAA;AAAA,IACtC,GACG,MAAA,CAAO,EAAE,KAAA,EAAO,GAAA,CAAA,yBAAA,CAAA,EAAwC,CAAA,CACxD,IAAA,CAAK,QAAQ,CAAA,CACb,MAAM,GAAA,CAAA,EAAM,QAAA,CAAS,SAAS,CAAA,GAAA,EAAM,GAAG,CAAA,CAAE,CAAA;AAAA,IAC5C,EAAA,CACG,MAAA,CAAO,EAAE,KAAA,EAAO,gCAAwC,CAAA,CACxD,IAAA,CAAK,KAAK,EACV,KAAA,CAAM,EAAA,CAAG,KAAA,CAAM,MAAA,EAAQ,IAAI,CAAC;AAAA,GAChC,CAAA;AAED,EAAA,OAAO;AAAA,IACL,UAAA,EAAA,CAAA,CAAY,EAAA,GAAA,gBAAA,CAAiB,CAAC,CAAA,KAAlB,mBAAqB,KAAA,KAAS,CAAA;AAAA,IAC1C,kBAAA,EAAA,CAAA,CAAoB,EAAA,GAAA,gBAAA,CAAiB,CAAC,CAAA,KAAlB,mBAAqB,KAAA,KAAS,CAAA;AAAA,IAClD,cAAA,EAAA,CAAA,CAAgB,EAAA,GAAA,oBAAA,CAAqB,CAAC,CAAA,KAAtB,mBAAyB,KAAA,KAAS,CAAA;AAAA,IAClD,WAAA,EAAA,CAAA,CAAa,EAAA,GAAA,YAAA,CAAa,CAAC,CAAA,KAAd,mBAAiB,KAAA,KAAS;AAAA,GACzC;AACF;AAEA,eAAsB,aAAA,GAAgB;AAvCtC,EAAA,IAAA,EAAA,EAAA,EAAA,EAAA,EAAA;AAwCE,EAAA,MAAM,gBAAA,GAAmB,MAAM,EAAA,CAC5B,MAAA,CAAO,EAAE,OAAO,GAAA,CAAA,yBAAA,CAAA,EAAwC,CAAA,CACxD,IAAA,CAAK,KAAK,CAAA;AACb,EAAA,MAAM,UAAA,GAAA,CAAA,CAAa,EAAA,GAAA,gBAAA,CAAiB,CAAC,CAAA,KAAlB,mBAAqB,KAAA,KAAS,CAAA;AAEjD,EAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,EAAA,MAAM,uBAAuB,MAAM,EAAA,CAChC,OAAO,EAAE,KAAA,EAAO,gCAAwC,CAAA,CACxD,IAAA,CAAK,QAAQ,EACb,KAAA,CAAM,GAAA,CAAA,EAAM,SAAS,SAAS,CAAA,GAAA,EAAM,GAAG,CAAA,CAAE,CAAA;AAC5C,EAAA,MAAM,cAAA,GAAA,CAAA,CAAiB,EAAA,GAAA,oBAAA,CAAqB,CAAC,CAAA,KAAtB,mBAAyB,KAAA,KAAS,CAAA;AAEzD,EAAA,MAAM,mBAAmB,MAAM,EAAA,CAC5B,MAAA,CAAO,EAAE,OAAO,GAAA,CAAA,yBAAA,CAAA,EAAwC,CAAA,CACxD,IAAA,CAAK,KAAK,CAAA,CACV,KAAA,CAAM,GAAA,CAAA,EAAM,KAAA,CAAM,IAAI,CAAA,UAAA,CAAY,CAAA;AACrC,EAAA,MAAM,UAAA,GAAA,CAAA,CAAa,EAAA,GAAA,gBAAA,CAAiB,CAAC,CAAA,KAAlB,mBAAqB,KAAA,KAAS,CAAA;AAEjD,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,cAAA;AAAA,IACA,UAAA;AAAA,IACA,cAAc,UAAA,GAAa;AAAA,GAC7B;AACF;AAKA,IAAM,mBAAA,GAAsB,CAAA;AAQ5B,eAAsB,yBAAA,CAA0B,QAAQ,EAAA,EAAI;AAC1D,EAAA,MAAM,IAAA,GAAO,MAAM,EAAA,CAChB,MAAA,GACA,IAAA,CAAK,YAAY,CAAA,CACjB,KAAA,CAAM,GAAA,CAAI,YAAA,CAAa,OAAO,mBAAmB,CAAC,EAClD,OAAA,CAAQ,IAAA,CAAK,aAAa,aAAa,CAAC,CAAA,CACxC,KAAA,CAAM,KAAK,CAAA;AAEd,EAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM;AACrB,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,CAAA,CAAE,SAAS,CAAA;AACzC,IAAA,MAAM,GAAA,GAAM,iBAAA,CAAkB,CAAA,CAAE,SAAS,CAAA;AACzC,IAAA,OAAO;AAAA,MACL,aAAa,CAAA,CAAE,WAAA;AAAA,MACf,OAAO,CAAA,CAAE,KAAA;AAAA,MACT,aAAa,CAAA,CAAE,WAAA;AAAA,MACf,eAAe,CAAA,CAAE,aAAA;AAAA,MACjB,WAAW,CAAA,CAAE,SAAA;AAAA,MACb,WAAW,CAAA,CAAE,SAAA;AAAA,MACb,WAAW,CAAA,CAAE,SAAA;AAAA,MACb,UAAU,CAAA,CAAE,QAAA;AAAA,MACZ,IAAI,MAAA,CAAO,EAAA;AAAA,MACX,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,YAAY,MAAA,CAAO,UAAA;AAAA,MACnB,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,MAAM,GAAA,CAAI,IAAA;AAAA;AAAA,MAEV,OAAA,EAAS,WAAA,CAAY,CAAA,EAAG,GAAG,CAAA;AAAA;AAAA;AAAA,MAG3B,YAAA,EAAc,GAAA,GAAM,CAAA,CAAE,WAAA,CAAY,SAAQ,GAAI;AAAA,KAChD;AAAA,EACF,CAAC,CAAA;AACH;AAQA,eAAsB,mBAAA,CAAoB,QAAQ,EAAA,EAAI;AACpD,EAAA,MAAM,IAAA,GAAO,MAAM,EAAA,CAChB,MAAA,CAAO;AAAA,IACN,IAAI,kBAAA,CAAmB,EAAA;AAAA,IACvB,QAAQ,kBAAA,CAAmB,MAAA;AAAA,IAC3B,UAAU,KAAA,CAAM,IAAA;AAAA,IAChB,WAAW,KAAA,CAAM,KAAA;AAAA,IACjB,WAAW,kBAAA,CAAmB,SAAA;AAAA,IAC9B,WAAW,kBAAA,CAAmB,SAAA;AAAA,IAC9B,SAAS,kBAAA,CAAmB,OAAA;AAAA,IAC5B,MAAM,kBAAA,CAAmB,IAAA;AAAA,IACzB,WAAW,kBAAA,CAAmB;AAAA,GAC/B,EACA,IAAA,CAAK,kBAAkB,EACvB,SAAA,CAAU,KAAA,EAAO,GAAG,kBAAA,CAAmB,MAAA,EAAQ,MAAM,EAAE,CAAC,EACxD,OAAA,CAAQ,IAAA,CAAK,mBAAmB,SAAS,CAAC,CAAA,CAC1C,KAAA,CAAM,KAAK,CAAA;AAEd,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,CAAC,CAAA,KAAM;AACrB,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,CAAA,CAAE,SAAS,CAAA;AACzC,IAAA,OAAO,iCACF,CAAA,CAAA,EADE;AAAA,MAEL,IAAI,MAAA,CAAO,EAAA;AAAA,MACX,SAAS,MAAA,CAAO,OAAA;AAAA,MAChB,YAAY,MAAA,CAAO;AAAA,KACrB,CAAA;AAAA,EACF,CAAC,CAAA;AACH;AAKA,IAAM,mBAAA,GAAsB,CAAA;AAS5B,eAAsB,uBAAA,CAAwB,QAAQ,EAAA,EAAI;AAIxD,EAAA,MAAM,IAAA,GAAO,MAAM,EAAA,CAChB,MAAA,CAAO;AAAA,IACN,WAAW,kBAAA,CAAmB,SAAA;AAAA,IAC9B,QAAQ,kBAAA,CAAmB,MAAA;AAAA,IAC3B,UAAU,KAAA,CAAM,IAAA;AAAA,IAChB,WAAW,KAAA,CAAM,KAAA;AAAA,IACjB,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,aAAa,kBAAA,CAAmB,SAAA;AAAA,IAChC,WAAW,kBAAA,CAAmB,SAAA;AAAA,IAC9B,SAAS,kBAAA,CAAmB,OAAA;AAAA,IAC5B,MAAM,kBAAA,CAAmB;AAAA,GAC1B,CAAA,CACA,IAAA,CAAK,kBAAkB,CAAA,CACvB,SAAA,CAAU,OAAO,EAAA,CAAG,kBAAA,CAAmB,MAAA,EAAQ,KAAA,CAAM,EAAE,CAAC,CAAA,CACxD,QAAQ,IAAA,CAAK,kBAAA,CAAmB,SAAS,CAAC,CAAA;AAE7C,EAAA,OAAO,kBAAA,CAAmB,IAAA,EAAM,mBAAA,EAAqB,KAAK,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAO,cAAA,CAAA,cAAA,CAAA,EAAA,EACnE,CAAA,CAAA,EACA,cAAA,CAAe,CAAA,CAAE,SAAS,CAAA,CAC7B,CAAA;AACJ","file":"queries.mjs","sourcesContent":["// Pure grouping for the admin \"Shared devices\" card — no DB, no `server-only`,\n// so it stays unit-testable. Consumed by lib/admin-queries.ts.\n\nexport type SharedDeviceAccountRow = {\n  visitorId: string\n  userId: string\n  userName: string\n  userEmail: string\n  banned: boolean\n  firstSeenAt: Date\n  userAgent: string | null\n  country: string | null\n  city: string | null\n}\n\nexport type SharedDevice = {\n  visitorId: string\n  accountCount: number\n  lastSeenAt: Date\n  country: string | null\n  city: string | null\n  userAgent: string | null\n  accounts: {\n    userId: string\n    userName: string\n    userEmail: string\n    banned: boolean\n    firstSeenAt: Date\n  }[]\n}\n\n// Collapse flat (account, device) rows into one entry per device fingerprint,\n// keep only devices reached by `minAccounts`+ accounts (the multi-account /\n// trial-abuse signal), most-accounts device first. Device context (UA/geo) is\n// taken from whichever row for that visitorId is seen first — pass rows newest\n// first if you want the most recent context.\nexport function groupSharedDevices(\n  rows: SharedDeviceAccountRow[],\n  minAccounts: number,\n  limit: number,\n): SharedDevice[] {\n  const byVisitor = new Map<string, SharedDevice>()\n\n  for (const r of rows) {\n    let d = byVisitor.get(r.visitorId)\n    if (!d) {\n      d = {\n        visitorId: r.visitorId,\n        accountCount: 0,\n        lastSeenAt: r.firstSeenAt,\n        country: r.country,\n        city: r.city,\n        userAgent: r.userAgent,\n        accounts: [],\n      }\n      byVisitor.set(r.visitorId, d)\n    }\n    d.accountCount++\n    if (r.firstSeenAt > d.lastSeenAt) d.lastSeenAt = r.firstSeenAt\n    d.accounts.push({\n      userId: r.userId,\n      userName: r.userName,\n      userEmail: r.userEmail,\n      banned: r.banned,\n      firstSeenAt: r.firstSeenAt,\n    })\n  }\n\n  return [...byVisitor.values()]\n    .filter((d) => d.accountCount >= minAccounts)\n    .sort(\n      (a, b) =>\n        b.accountCount - a.accountCount || b.lastSeenAt.getTime() - a.lastSeenAt.getTime(),\n    )\n    .slice(0, limit)\n}\n","import \"server-only\"\nimport { db } from \"../server/db\"\nimport { users, sessions, authThrottle, deviceFingerprints } from \"../server/db/schema\"\nimport { sql, gte, eq, desc } from \"drizzle-orm\"\nimport { parseUserAgent, lookupGeoLocation } from \"./request-info\"\nimport { WINDOW_MS, isOverLimit } from \"./auth-throttle-limits\"\nimport { groupSharedDevices } from \"./shared-devices\"\n\n// Powers the admin panel's landing page (/dashboard/admin) — kept separate\n// from getAdminStats (the compact overview embedded in the main dashboard)\n// since the two surfaces show different metrics.\nexport async function getAdminDashboardStats() {\n  const now = new Date()\n  const weekAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000)\n\n  const [totalUsersResult, newSignupsResult, activeSessionsResult, bannedResult] = await Promise.all([\n    db.select({ count: sql<number>`cast(count(*) as integer)` }).from(users),\n    db\n      .select({ count: sql<number>`cast(count(*) as integer)` })\n      .from(users)\n      .where(gte(users.createdAt, weekAgo)),\n    db\n      .select({ count: sql<number>`cast(count(*) as integer)` })\n      .from(sessions)\n      .where(sql`${sessions.expiresAt} > ${now}`),\n    db\n      .select({ count: sql<number>`cast(count(*) as integer)` })\n      .from(users)\n      .where(eq(users.banned, true)),\n  ])\n\n  return {\n    totalUsers: totalUsersResult[0]?.count || 0,\n    newSignupsThisWeek: newSignupsResult[0]?.count || 0,\n    activeSessions: activeSessionsResult[0]?.count || 0,\n    bannedCount: bannedResult[0]?.count || 0,\n  }\n}\n\nexport async function getAdminStats() {\n  const totalUsersResult = await db\n    .select({ count: sql<number>`cast(count(*) as integer)` })\n    .from(users)\n  const totalUsers = totalUsersResult[0]?.count || 0\n\n  const now = new Date()\n  const activeSessionsResult = await db\n    .select({ count: sql<number>`cast(count(*) as integer)` })\n    .from(sessions)\n    .where(sql`${sessions.expiresAt} > ${now}`)\n  const activeSessions = activeSessionsResult[0]?.count || 0\n\n  const adminCountResult = await db\n    .select({ count: sql<number>`cast(count(*) as integer)` })\n    .from(users)\n    .where(sql`${users.role} = 'admin'`)\n  const adminCount = adminCountResult[0]?.count || 0\n\n  return {\n    totalUsers,\n    activeSessions,\n    adminCount,\n    regularUsers: totalUsers - adminCount,\n  }\n}\n\n// Rows below this are noise — a single new signup, or one login typo that\n// then succeeded (a success deletes the row, so a lingering count of 1 is\n// almost always a lone signup).\nconst SUSPICIOUS_ATTEMPTS = 2\n\nexport type DeviceThrottleRow = Awaited<ReturnType<typeof getDeviceThrottleActivity>>[number]\n\n// Powers the admin \"Device throttle\" card. One row per device fingerprint\n// that's currently accumulating failed sign-ins / sign-ups, newest first,\n// with everything an admin needs to block it at the edge (IP) or in-app\n// (fingerprint) — parsed device + geo included for context.\nexport async function getDeviceThrottleActivity(limit = 50) {\n  const rows = await db\n    .select()\n    .from(authThrottle)\n    .where(gte(authThrottle.count, SUSPICIOUS_ATTEMPTS))\n    .orderBy(desc(authThrottle.lastAttemptAt))\n    .limit(limit)\n\n  const now = Date.now()\n  return rows.map((r) => {\n    const device = parseUserAgent(r.userAgent)\n    const geo = lookupGeoLocation(r.ipAddress)\n    return {\n      fingerprint: r.fingerprint,\n      count: r.count,\n      windowStart: r.windowStart,\n      lastAttemptAt: r.lastAttemptAt,\n      ipAddress: r.ipAddress,\n      userAgent: r.userAgent,\n      lastEmail: r.lastEmail,\n      lastKind: r.lastKind,\n      os: device.os,\n      browser: device.browser,\n      deviceType: device.deviceType,\n      country: geo.country,\n      city: geo.city,\n      // Would this device be 429'd on its next attempt right now?\n      blocked: isOverLimit(r, now),\n      // Is the counter still inside its window (attack ongoing) or has it\n      // gone quiet (last burst, awaiting reset on next attempt)?\n      windowActive: now - r.windowStart.getTime() < WINDOW_MS,\n    }\n  })\n}\n\nexport type RecentNewDeviceRow = Awaited<ReturnType<typeof getRecentNewDevices>>[number]\n\n// Powers the admin \"New devices\" card. One row per (account, device) pair the\n// first time that account is seen on that device — written by\n// app/api/device-check/route.ts, newest first. The row links to the user's\n// admin detail page, where sessions can be revoked if the sign-in wasn't them.\nexport async function getRecentNewDevices(limit = 20) {\n  const rows = await db\n    .select({\n      id: deviceFingerprints.id,\n      userId: deviceFingerprints.userId,\n      userName: users.name,\n      userEmail: users.email,\n      ipAddress: deviceFingerprints.ipAddress,\n      userAgent: deviceFingerprints.userAgent,\n      country: deviceFingerprints.country,\n      city: deviceFingerprints.city,\n      createdAt: deviceFingerprints.createdAt,\n    })\n    .from(deviceFingerprints)\n    .innerJoin(users, eq(deviceFingerprints.userId, users.id))\n    .orderBy(desc(deviceFingerprints.createdAt))\n    .limit(limit)\n\n  return rows.map((r) => {\n    const device = parseUserAgent(r.userAgent)\n    return {\n      ...r,\n      os: device.os,\n      browser: device.browser,\n      deviceType: device.deviceType,\n    }\n  })\n}\n\n// A device fingerprint (FingerprintJS visitorId) is normally 1:1 with an\n// account, or 1:few (personal + work login on one laptop). One visitorId behind\n// this many accounts is the multi-account / trial-abuse smell.\nconst MIN_SHARED_ACCOUNTS = 3\n\nexport type SharedDeviceRow = Awaited<ReturnType<typeof getSharedDeviceAccounts>>[number]\n\n// Powers the admin \"Shared devices\" card. One row per device fingerprint that\n// MIN_SHARED_ACCOUNTS+ distinct accounts have signed in from, most-shared first,\n// each with its full account list so an admin can open and ban them. The\n// device_fingerprint unique (userId, visitorId) constraint means a plain row\n// count per visitorId already IS the distinct-account count.\nexport async function getSharedDeviceAccounts(limit = 20) {\n  // ponytail: pulls the whole device_fingerprint table each call and groups in\n  // JS — fine for a template. If this table gets large, add an index on\n  // visitorId and push the \"N+ accounts\" filter into a HAVING subquery.\n  const rows = await db\n    .select({\n      visitorId: deviceFingerprints.visitorId,\n      userId: deviceFingerprints.userId,\n      userName: users.name,\n      userEmail: users.email,\n      banned: users.banned,\n      firstSeenAt: deviceFingerprints.createdAt,\n      userAgent: deviceFingerprints.userAgent,\n      country: deviceFingerprints.country,\n      city: deviceFingerprints.city,\n    })\n    .from(deviceFingerprints)\n    .innerJoin(users, eq(deviceFingerprints.userId, users.id))\n    .orderBy(desc(deviceFingerprints.createdAt))\n\n  return groupSharedDevices(rows, MIN_SHARED_ACCOUNTS, limit).map((d) => ({\n    ...d,\n    ...parseUserAgent(d.userAgent),\n  }))\n}\n"]}

package/dist/auth/helpers.d.mts

@@ -0,0 +1,111 @@
+/**
+ * Get current session (server-side only)
+ * Returns session data or null if not authenticated
+ *
+ * Wrapped in React's cache() so the layout and page (both of which call
+ * requireAuth per request) share one auth.api.getSession call instead of two.
+ */
+declare const getCurrentSession: () => Promise<{
+    session: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined | undefined;
+        userAgent?: string | null | undefined | undefined;
+        impersonatedBy?: string | null | undefined;
+    };
+    user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined | undefined;
+        role: string | null | undefined;
+        banned: boolean | null | undefined;
+        banExpires?: Date | null | undefined;
+        banReason?: string | null | undefined;
+        twoFactorEnabled: boolean | null | undefined;
+    };
+} | null>;
+/**
+ * Require authentication - redirect to login if not authenticated
+ * Use in server components/layouts that need protection
+ *
+ * Wrapped in cache() so the layout, page, and any admin layout that all call
+ * requireAuth per request share one banned-status DB lookup instead of several.
+ */
+declare const requireAuth: () => Promise<{
+    session: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined | undefined;
+        userAgent?: string | null | undefined | undefined;
+        impersonatedBy?: string | null | undefined;
+    };
+    user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined | undefined;
+        role: string | null | undefined;
+        banned: boolean | null | undefined;
+        banExpires?: Date | null | undefined;
+        banReason?: string | null | undefined;
+        twoFactorEnabled: boolean | null | undefined;
+    };
+}>;
+/**
+ * Check if user has specific role
+ */
+declare function hasRole(userRole: string | null | undefined, requiredRole: 'user' | 'admin'): boolean;
+/**
+ * Require specific role - throw error if user doesn't have it
+ */
+declare function requireRole(requiredRole: 'user' | 'admin'): Promise<{
+    session: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined | undefined;
+        userAgent?: string | null | undefined | undefined;
+        impersonatedBy?: string | null | undefined;
+    };
+    user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined | undefined;
+        role: string | null | undefined;
+        banned: boolean | null | undefined;
+        banExpires?: Date | null | undefined;
+        banReason?: string | null | undefined;
+        twoFactorEnabled: boolean | null | undefined;
+    };
+}>;
+/**
+ * Normalize a callbackUrl query param to a same-origin path before it's ever
+ * passed to redirect() or an auth form's callbackURL. Guards against open
+ * redirects (e.g. /login?callbackUrl=https://evil.com) — anything that
+ * doesn't resolve to this app's own origin falls back to /dashboard.
+ */
+declare function normalizeCallbackUrl(value?: string | string[]): string;
+
+export { getCurrentSession, hasRole, normalizeCallbackUrl, requireAuth, requireRole };

package/dist/auth/helpers.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Get current session (server-side only)
+ * Returns session data or null if not authenticated
+ *
+ * Wrapped in React's cache() so the layout and page (both of which call
+ * requireAuth per request) share one auth.api.getSession call instead of two.
+ */
+declare const getCurrentSession: () => Promise<{
+    session: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined | undefined;
+        userAgent?: string | null | undefined | undefined;
+        impersonatedBy?: string | null | undefined;
+    };
+    user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined | undefined;
+        role: string | null | undefined;
+        banned: boolean | null | undefined;
+        banExpires?: Date | null | undefined;
+        banReason?: string | null | undefined;
+        twoFactorEnabled: boolean | null | undefined;
+    };
+} | null>;
+/**
+ * Require authentication - redirect to login if not authenticated
+ * Use in server components/layouts that need protection
+ *
+ * Wrapped in cache() so the layout, page, and any admin layout that all call
+ * requireAuth per request share one banned-status DB lookup instead of several.
+ */
+declare const requireAuth: () => Promise<{
+    session: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined | undefined;
+        userAgent?: string | null | undefined | undefined;
+        impersonatedBy?: string | null | undefined;
+    };
+    user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined | undefined;
+        role: string | null | undefined;
+        banned: boolean | null | undefined;
+        banExpires?: Date | null | undefined;
+        banReason?: string | null | undefined;
+        twoFactorEnabled: boolean | null | undefined;
+    };
+}>;
+/**
+ * Check if user has specific role
+ */
+declare function hasRole(userRole: string | null | undefined, requiredRole: 'user' | 'admin'): boolean;
+/**
+ * Require specific role - throw error if user doesn't have it
+ */
+declare function requireRole(requiredRole: 'user' | 'admin'): Promise<{
+    session: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        userId: string;
+        expiresAt: Date;
+        token: string;
+        ipAddress?: string | null | undefined | undefined;
+        userAgent?: string | null | undefined | undefined;
+        impersonatedBy?: string | null | undefined;
+    };
+    user: {
+        id: string;
+        createdAt: Date;
+        updatedAt: Date;
+        email: string;
+        emailVerified: boolean;
+        name: string;
+        image?: string | null | undefined | undefined;
+        role: string | null | undefined;
+        banned: boolean | null | undefined;
+        banExpires?: Date | null | undefined;
+        banReason?: string | null | undefined;
+        twoFactorEnabled: boolean | null | undefined;
+    };
+}>;
+/**
+ * Normalize a callbackUrl query param to a same-origin path before it's ever
+ * passed to redirect() or an auth form's callbackURL. Guards against open
+ * redirects (e.g. /login?callbackUrl=https://evil.com) — anything that
+ * doesn't resolve to this app's own origin falls back to /dashboard.
+ */
+declare function normalizeCallbackUrl(value?: string | string[]): string;
+
+export { getCurrentSession, hasRole, normalizeCallbackUrl, requireAuth, requireRole };