happy2 0.0.5 → 0.0.9

package/packages/happy2-server/dist/modules/auth/service.d.ts

@@ -1,6 +1,8 @@
+import { type DrizzleExecutor } from "../drizzle.js";
 import type { FastifyRequest } from "fastify";
 import type { ServerConfig } from "../config/type.js";
-import { Database, type ActiveSession, type User } from "../database.js";
+import type { ActiveSession } from "./types.js";
+import type { User } from "../user/types.js";
 import { type CloudflareAccessIdentity } from "./cloudflare-access.js";
 import { TokenService } from "./tokens.js";
 export interface AuthenticatedAccount {
@@ -14,29 +16,31 @@ export interface Authenticated extends AuthenticatedAccount {
 export interface AuthToken {
     token: string;
     expiresAt: string;
+    profileRequired: boolean;
 }
 export declare class AuthService {
     private readonly config;
-    private readonly database;
+    private readonly executor;
     private readonly tokens;
     private readonly passwordPepper;
-    constructor(config: ServerConfig, database: Database, tokens: TokenService);
+    private readonly shouldTouchAccess;
+    constructor(config: ServerConfig, executor: DrizzleExecutor, tokens: TokenService);
     /** Account authentication is reserved for account-management paths such as creating a profile. */
     authenticateAccount(request: FastifyRequest): Promise<AuthenticatedAccount | undefined>;
     /** Product routes use active Users, never bare authentication accounts. */
     authenticate(request: FastifyRequest): Promise<Authenticated | undefined>;
-    registerPassword(body: unknown, request: FastifyRequest): Promise<AuthToken | "invalid">;
+    registerPassword(body: unknown, request: FastifyRequest): Promise<AuthToken | "invalid" | "registration_closed" | "account_exists">;
     loginPassword(body: unknown, request: FastifyRequest): Promise<AuthToken | undefined>;
-    createProfile(body: unknown, request: FastifyRequest): Promise<User | "invalid" | "unauthorized">;
+    createProfile(body: unknown, request: FastifyRequest): Promise<User | "invalid" | "unauthorized" | "registration_closed">;
     updateProfile(body: unknown, request: FastifyRequest): Promise<User | "invalid" | "unauthorized">;
-    requestMagicLink(body: unknown): Promise<void>;
+    requestMagicLink(body: unknown): Promise<boolean>;
     verifyMagicLink(body: unknown, request: FastifyRequest): Promise<AuthToken | undefined>;
     startOidc(providerName: string): Promise<string | undefined>;
     completeOidc(providerName: string, query: {
         code?: string;
         state?: string;
         error?: string;
-    }, request: FastifyRequest): Promise<AuthToken | "authorization_failed" | "invalid_state">;
+    }, request: FastifyRequest): Promise<AuthToken | "authorization_failed" | "invalid_state" | "registration_closed">;
     refresh(request: FastifyRequest): Promise<AuthToken | undefined>;
     logout(request: FastifyRequest): Promise<boolean | "managed_by_cloudflare_access">;
     private issue;

package/packages/happy2-server/dist/modules/auth/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../sources/modules/auth/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,KAAK,aAAa,EAAsB,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAI7F,OAAO,EAA4B,KAAK,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAEjG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,oBAAoB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;CAC/C;AACD,MAAM,WAAW,aAAc,SAAQ,oBAAoB;IACvD,IAAI,EAAE,IAAI,CAAC;CACd;AACD,MAAM,WAAW,SAAS;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,WAAW;IAGhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJ3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,YACqB,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,QAAQ,EAClB,MAAM,EAAE,YAAY,EASxC;IAED,kGAAkG;IAC5F,mBAAmB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CA0B5F;IAED,2EAA2E;IACrE,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAO9E;IAEK,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAS7F;IACK,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAa1F;IACK,aAAa,CACf,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,cAAc,GACxB,OAAO,CAAC,IAAI,GAAG,SAAS,GAAG,cAAc,CAAC,CAK5C;IACK,aAAa,CACf,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,cAAc,GACxB,OAAO,CAAC,IAAI,GAAG,SAAS,GAAG,cAAc,CAAC,CAM5C;IAEK,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAanD;IACK,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAO5F;IAEK,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CASjE;IACK,YAAY,CACd,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EACxD,OAAO,EAAE,cAAc,GACxB,OAAO,CAAC,SAAS,GAAG,sBAAsB,GAAG,eAAe,CAAC,CAmB/D;IACK,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAcrE;IACK,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,GAAG,8BAA8B,CAAC,CAMvF;YACa,KAAK;CAWtB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../sources/modules/auth/service.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAiB,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAI5D,OAAO,EAA4B,KAAK,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAEjG,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,oBAAoB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gBAAgB,CAAC,EAAE,wBAAwB,CAAC;CAC/C;AACD,MAAM,WAAW,aAAc,SAAQ,oBAAoB;IACvD,IAAI,EAAE,IAAI,CAAC;CACd;AACD,MAAM,WAAW,SAAS;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;CAC5B;AACD,qBAAa,WAAW;IAIhB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAL3B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAyB;IAC3D,YACqB,MAAM,EAAE,YAAY,EACpB,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,YAAY,EASxC;IAED,kGAAkG;IAC5F,mBAAmB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAuC5F;IAED,2EAA2E;IACrE,YAAY,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAW9E;IACK,gBAAgB,CAClB,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,cAAc,GACxB,OAAO,CAAC,SAAS,GAAG,SAAS,GAAG,qBAAqB,GAAG,gBAAgB,CAAC,CAgB3E;IACK,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAa1F;IACK,aAAa,CACf,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,cAAc,GACxB,OAAO,CAAC,IAAI,GAAG,SAAS,GAAG,cAAc,GAAG,qBAAqB,CAAC,CAWpE;IACK,aAAa,CACf,IAAI,EAAE,OAAO,EACb,OAAO,EAAE,cAAc,GACxB,OAAO,CAAC,IAAI,GAAG,SAAS,GAAG,cAAc,CAAC,CAM5C;IACK,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CActD;IACK,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAO5F;IACK,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CASjE;IACK,YAAY,CACd,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE;QACH,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;KAClB,EACD,OAAO,EAAE,cAAc,GACxB,OAAO,CAAC,SAAS,GAAG,sBAAsB,GAAG,eAAe,GAAG,qBAAqB,CAAC,CA0BvF;IACK,OAAO,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAmBrE;IACK,MAAM,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,GAAG,8BAA8B,CAAC,CAMvF;YACa,KAAK;CAatB"}

package/packages/happy2-server/dist/modules/auth/service.js

@@ -1,19 +1,38 @@
+import { userUpdateProfile } from "../user/userUpdateProfile.js";
+import { userTouchAccess } from "../user/userTouchAccess.js";
+import { userFindActiveByAccount } from "../user/userFindActiveByAccount.js";
+import { userCreateProfile } from "../user/userCreateProfile.js";
+import { sessionRevoke } from "./sessionRevoke.js";
+import { sessionRefresh } from "./sessionRefresh.js";
+import { sessionFindActive } from "./sessionFindActive.js";
+import { sessionCreate } from "./sessionCreate.js";
+import { oidcStateCreate } from "./oidcStateCreate.js";
+import { oidcStateConsume } from "./oidcStateConsume.js";
+import { magicLinkCreate } from "./magicLinkCreate.js";
+import { magicLinkConsume } from "./magicLinkConsume.js";
+import { accountRegisterPassword } from "./accountRegisterPassword.js";
+import { accountFindPassword } from "./accountFindPassword.js";
+import { accountFindOrCreateOidc } from "./accountFindOrCreateOidc.js";
+import { accountFindOidc } from "./accountFindOidc.js";
+import {} from "../drizzle.js";
 import { createId } from "@paralleldrive/cuid2";
-import { Database } from "../database.js";
+import { AccountExistsError, RegistrationClosedError } from "./errors.js";
 import { hashPassword, randomToken, verifyPassword } from "./crypto.js";
 import { smtpTransport } from "./email.js";
 import { bearerToken, requestMetadata } from "./metadata.js";
 import { cloudflareAccessIdentity } from "./cloudflare-access.js";
 import { authorizationUrl, exchangeCode } from "./oidc.js";
 import { TokenService } from "./tokens.js";
+import { accessTouchThrottle } from "./impl/accessTouchThrottle.js";
 export class AuthService {
     config;
-    database;
+    executor;
     tokens;
     passwordPepper;
-    constructor(config, database, tokens) {
+    shouldTouchAccess = accessTouchThrottle();
+    constructor(config, executor, tokens) {
         this.config = config;
-        this.database = database;
+        this.executor = executor;
         this.tokens = tokens;
         this.passwordPepper = config.auth.password.enabled
             ? process.env.HAPPY2_PASSWORD_PEPPER
@@ -27,9 +46,12 @@ export class AuthService {
         if (token) {
             try {
                 const claims = await this.tokens.verify(token);
-                const session = await this.database.findActiveSession(claims.sessionId);
+                const session = await sessionFindActive(this.executor, claims.sessionId);
                 return session && session.accountId === claims.accountId
-                    ? { session, accountId: claims.accountId }
+                    ? {
+                        session,
+                        accountId: claims.accountId,
+                    }
                     : undefined;
             }
             catch {
@@ -40,37 +62,62 @@ export class AuthService {
         if (!identity)
             return undefined;
         const provider = `cloudflare-access:${this.config.auth.cloudflareAccess.teamDomain}`;
-        const account = (await this.database.findOidcAccount(provider, identity.subject)) ??
-            (await this.database.findOrCreateOidcAccount(provider, identity.subject, identity.email));
+        let account = await accountFindOidc(this.executor, provider, identity.subject);
+        if (!account) {
+            try {
+                account = await accountFindOrCreateOidc(this.executor, provider, identity.subject, identity.email);
+            }
+            catch (error) {
+                if (error instanceof RegistrationClosedError)
+                    return undefined;
+                throw error;
+            }
+        }
         return account.bannedAt || account.deletedAt
             ? undefined
-            : { accountId: account.id, cloudflareAccess: identity };
+            : {
+                accountId: account.id,
+                cloudflareAccess: identity,
+            };
     }
     /** Product routes use active Users, never bare authentication accounts. */
     async authenticate(request) {
         const account = await this.authenticateAccount(request);
         if (!account)
             return undefined;
-        const user = await this.database.findActiveUserByAccount(account.accountId);
+        const user = await userFindActiveByAccount(this.executor, account.accountId);
         if (!user)
             return undefined;
-        await this.database.touchAccess(account.session?.id, user.id);
-        return { ...account, user };
+        if (this.shouldTouchAccess(account.session?.id, user.id))
+            await userTouchAccess(this.executor, account.session?.id, user.id);
+        return {
+            ...account,
+            user,
+        };
     }
     async registerPassword(body, request) {
         const accountEmail = email(body);
         const accountPassword = validatedPassword(body);
         if (!accountEmail || !accountPassword)
             return "invalid";
-        const account = await this.database.createPasswordAccount(accountEmail, await hashPassword(accountPassword, this.passwordPepper));
-        return this.issue(account.id, request);
+        try {
+            const account = await accountRegisterPassword(this.executor, accountEmail, await hashPassword(accountPassword, this.passwordPepper));
+            return this.issue(account.id, request);
+        }
+        catch (error) {
+            if (error instanceof RegistrationClosedError)
+                return "registration_closed";
+            if (error instanceof AccountExistsError)
+                return "account_exists";
+            throw error;
+        }
     }
     async loginPassword(body, request) {
         const accountEmail = email(body);
         const accountPassword = value(body, "password");
         if (!accountEmail || !accountPassword)
             return undefined;
-        const account = await this.database.findPasswordAccount(accountEmail);
+        const account = await accountFindPassword(this.executor, accountEmail);
         if (!account?.passwordHash ||
             account.bannedAt ||
             account.deletedAt ||
@@ -83,7 +130,16 @@ export class AuthService {
         if (!account)
             return "unauthorized";
         const profile = validatedProfile(body);
-        return profile ? this.database.createProfile(account.accountId, profile) : "invalid";
+        if (!profile)
+            return "invalid";
+        try {
+            return await userCreateProfile(this.executor, account.accountId, profile);
+        }
+        catch (error) {
+            if (error instanceof RegistrationClosedError)
+                return "registration_closed";
+            throw error;
+        }
     }
     async updateProfile(body, request) {
         const current = await this.authenticate(request);
@@ -92,14 +148,15 @@ export class AuthService {
         const profile = validatedProfile(body);
         if (!profile)
             return "invalid";
-        return (await this.database.updateProfile(current.user.id, profile)) ?? "unauthorized";
+        return (await userUpdateProfile(this.executor, current.user.id, profile)) ?? "unauthorized";
     }
     async requestMagicLink(body) {
         const accountEmail = email(body);
         if (!accountEmail)
-            return;
+            return false;
         const token = randomToken();
-        await this.database.createMagicLink(accountEmail, token);
+        if (!(await magicLinkCreate(this.executor, accountEmail, token)))
+            return false;
         const link = new URL(this.config.auth.magicLink.redirectUrl);
         link.searchParams.set("token", token);
         await smtpTransport().sendMail({
@@ -108,12 +165,13 @@ export class AuthService {
             subject: "Sign in to Happy (2)",
             text: `Open this sign-in link in Happy (2). It expires in 15 minutes:\n${link}`,
         });
+        return true;
     }
     async verifyMagicLink(body, request) {
         const token = value(body, "token");
         if (!token)
             return undefined;
-        const account = await this.database.consumeMagicLink(token);
+        const account = await magicLinkConsume(this.executor, token);
         return account && !account.bannedAt && !account.deletedAt
             ? this.issue(account.id, request)
             : undefined;
@@ -126,18 +184,26 @@ export class AuthService {
         const verifier = randomToken();
         const nonce = randomToken();
         const redirectUri = `${this.config.server.publicUrl}${provider.redirectPath}`;
-        await this.database.createOidcState(state, provider.id, verifier, nonce, redirectUri);
+        await oidcStateCreate(this.executor, state, provider.id, verifier, nonce, redirectUri);
         return authorizationUrl(provider, redirectUri, state, verifier, nonce);
     }
     async completeOidc(providerName, query, request) {
         const provider = this.config.auth.oidc.get(providerName);
         if (!provider || !query.code || !query.state || query.error)
             return "authorization_failed";
-        const state = await this.database.consumeOidcState(query.state);
+        const state = await oidcStateConsume(this.executor, query.state);
         if (!state || state.provider !== provider.id)
             return "invalid_state";
         const identity = await exchangeCode(provider, query.code, state.verifier, state.redirectUri, state.nonce);
-        const account = await this.database.findOrCreateOidcAccount(provider.id, identity.subject, identity.email);
+        let account;
+        try {
+            account = await accountFindOrCreateOidc(this.executor, provider.id, identity.subject, identity.email);
+        }
+        catch (error) {
+            if (error instanceof RegistrationClosedError)
+                return "registration_closed";
+            throw error;
+        }
         if (account.bannedAt || account.deletedAt)
             return "authorization_failed";
         return this.issue(account.id, request);
@@ -146,11 +212,12 @@ export class AuthService {
         const account = await this.authenticateAccount(request);
         if (!account?.session)
             return undefined;
-        const session = await this.database.refreshSession(account.session.id, expiry(this.config), requestMetadata(request));
+        const session = await sessionRefresh(this.executor, account.session.id, expiry(this.config), requestMetadata(request));
         return session
             ? {
                 token: await this.tokens.issue(session.id, session.accountId),
                 expiresAt: session.expiresAt.toISOString(),
+                profileRequired: !(await userFindActiveByAccount(this.executor, session.accountId)),
             }
             : undefined;
     }
@@ -160,14 +227,15 @@ export class AuthService {
             return false;
         if (!account.session)
             return "managed_by_cloudflare_access";
-        await this.database.revokeSession(account.session.id, requestMetadata(request));
+        await sessionRevoke(this.executor, account.session.id, requestMetadata(request));
         return true;
     }
     async issue(accountId, request) {
-        const session = await this.database.createSession(accountId, expiry(this.config), requestMetadata(request));
+        const session = await sessionCreate(this.executor, accountId, expiry(this.config), requestMetadata(request));
         return {
             token: await this.tokens.issue(session.id, accountId),
             expiresAt: session.expiresAt.toISOString(),
+            profileRequired: !(await userFindActiveByAccount(this.executor, accountId)),
         };
     }
 }
@@ -200,7 +268,13 @@ function validatedProfile(body) {
     if (suppliedEmail && !profileEmail)
         return undefined;
     const phone = optional(value(body, "phone"), 32);
-    return { firstName, lastName, username, email: profileEmail, phone };
+    return {
+        firstName,
+        lastName,
+        username,
+        email: profileEmail,
+        phone,
+    };
 }
 function expiry(config) {
     return new Date(Date.now() + config.jwt.expiryDays * 86_400_000);

package/packages/happy2-server/dist/modules/auth/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../sources/modules/auth/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,OAAO,EAAE,QAAQ,EAAqD,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAiC,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAgB3C,MAAM,OAAO,WAAW;IAGC,MAAM;IACN,QAAQ;IACR,MAAM;IAJV,cAAc,CAAqB;IACpD,YACqB,MAAoB,EACpB,QAAkB,EAClB,MAAoB;sBAFpB,MAAM;wBACN,QAAQ;sBACR,MAAM;QAEvB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;YAC9C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB;YACpC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc;YACpD,MAAM,IAAI,KAAK,CACX,oFAAoF,CACvF,CAAC;IACV,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,mBAAmB,CAAC,OAAuB;QAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC/C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACxE,OAAO,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;oBACpD,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;oBAC1C,CAAC,CAAC,SAAS,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,SAAS,CAAC;YACrB,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC5F,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,QAAQ,GAAG,qBAAqB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QACrF,MAAM,OAAO,GACT,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjE,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CACxC,QAAQ,EACR,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,KAAK,CACjB,CAAC,CAAC;QACP,OAAO,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS;YACxC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAC;IAChE,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,YAAY,CAAC,OAAuB;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5E,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAa,EAAE,OAAuB;QACzD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CACrD,YAAY,EACZ,MAAM,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,cAAe,CAAC,CAC5D,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,OAAuB;QACtD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;QACtE,IACI,CAAC,OAAO,EAAE,YAAY;YACtB,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,SAAS;YACjB,CAAC,CAAC,MAAM,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,cAAe,CAAC,CAAC;YAEpF,OAAO,SAAS,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,aAAa,CACf,IAAa,EACb,OAAuB;QAEvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,cAAc,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,CAAC;IACD,KAAK,CAAC,aAAa,CACf,IAAa,EACb,OAAuB;QAEvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,OAAO,cAAc,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,OAAO,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,cAAc,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAa;QAChC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,YAAY;YAAE,OAAO;QAC1B,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,aAAa,EAAE,CAAC,QAAQ,CAAC;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI;YAC/D,EAAE,EAAE,YAAY;YAChB,OAAO,EAAE,sBAAsB;YAC/B,IAAI,EAAE,mEAAmE,IAAI,EAAE;SAClF,CAAC,CAAC;IACP,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,OAAuB;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAC5D,OAAO,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS;YACrD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC;YACjC,CAAC,CAAC,SAAS,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,YAAoB;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC9E,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACtF,OAAO,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,CAAC,YAAY,CACd,YAAoB,EACpB,KAAwD,EACxD,OAAuB;QAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK;YAAE,OAAO,sBAAsB,CAAC;QAC3F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE;YAAE,OAAO,eAAe,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAC/B,QAAQ,EACR,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,KAAK,CACd,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CACvD,QAAQ,CAAC,EAAE,EACX,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,KAAK,CACjB,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,sBAAsB,CAAC;QACzE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAAuB;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,CAC9C,OAAO,CAAC,OAAO,CAAC,EAAE,EAClB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,eAAe,CAAC,OAAO,CAAC,CAC3B,CAAC;QACF,OAAO,OAAO;YACV,CAAC,CAAC;gBACI,KAAK,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC;gBAC7D,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;aAC7C;YACH,CAAC,CAAC,SAAS,CAAC;IACpB,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,OAAuB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,8BAA8B,CAAC;QAC5D,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC;IAChB,CAAC;IACO,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,OAAuB;QAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAC7C,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,eAAe,CAAC,OAAO,CAAC,CAC3B,CAAC;QACF,OAAO;YACH,KAAK,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC;YACrD,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;SAC7C,CAAC;IACN,CAAC;CACJ;AAED,SAAS,KAAK,CAAC,IAAa,EAAE,GAAW;IACrC,MAAM,KAAK,GAAI,IAAyB,EAAE,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AACD,SAAS,KAAK,CAAC,IAAa;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG;QAC9E,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,SAAS,CAAC;AACpB,CAAC;AACD,SAAS,iBAAiB,CAAC,IAAa;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACvC,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AACD,SAAS,QAAQ,CAAC,KAAyB,EAAE,OAAe;IACxD,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,OAAO,UAAU,IAAI,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AACD,SAAS,gBAAgB,CAAC,IAAa;IACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;IACtE,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9F,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,IAAI,aAAa,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;AACzE,CAAC;AACD,SAAS,MAAM,CAAC,MAAoB;IAChC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC;AACrE,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../sources/modules/auth/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGhD,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG1E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAiC,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAepE,MAAM,OAAO,WAAW;IAIC,MAAM;IACN,QAAQ;IACR,MAAM;IALV,cAAc,CAAqB;IACnC,iBAAiB,GAAG,mBAAmB,EAAE,CAAC;IAC3D,YACqB,MAAoB,EACpB,QAAyB,EACzB,MAAoB;sBAFpB,MAAM;wBACN,QAAQ;sBACR,MAAM;QAEvB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO;YAC9C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB;YACpC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc;YACpD,MAAM,IAAI,KAAK,CACX,oFAAoF,CACvF,CAAC;IACV,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,mBAAmB,CAAC,OAAuB;QAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC/C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;gBACzE,OAAO,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;oBACpD,CAAC,CAAC;wBACI,OAAO;wBACP,SAAS,EAAE,MAAM,CAAC,SAAS;qBAC9B;oBACH,CAAC,CAAC,SAAS,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,SAAS,CAAC;YACrB,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC5F,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,QAAQ,GAAG,qBAAqB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC;QACrF,IAAI,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,IAAI,CAAC;gBACD,OAAO,GAAG,MAAM,uBAAuB,CACnC,IAAI,CAAC,QAAQ,EACb,QAAQ,EACR,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,KAAK,CACjB,CAAC;YACN,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,uBAAuB;oBAAE,OAAO,SAAS,CAAC;gBAC/D,MAAM,KAAK,CAAC;YAChB,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS;YACxC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC;gBACI,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,gBAAgB,EAAE,QAAQ;aAC7B,CAAC;IACZ,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,YAAY,CAAC,OAAuB;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,OAAO;YACH,GAAG,OAAO;YACV,IAAI;SACP,CAAC;IACN,CAAC;IACD,KAAK,CAAC,gBAAgB,CAClB,IAAa,EACb,OAAuB;QAEvB,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe;YAAE,OAAO,SAAS,CAAC;QACxD,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,uBAAuB,CACzC,IAAI,CAAC,QAAQ,EACb,YAAY,EACZ,MAAM,YAAY,CAAC,eAAe,EAAE,IAAI,CAAC,cAAe,CAAC,CAC5D,CAAC;YACF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,uBAAuB;gBAAE,OAAO,qBAAqB,CAAC;YAC3E,IAAI,KAAK,YAAY,kBAAkB;gBAAE,OAAO,gBAAgB,CAAC;YACjE,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,IAAa,EAAE,OAAuB;QACtD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,IAAI,CAAC,eAAe;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACvE,IACI,CAAC,OAAO,EAAE,YAAY;YACtB,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,SAAS;YACjB,CAAC,CAAC,MAAM,cAAc,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,cAAe,CAAC,CAAC;YAEpF,OAAO,SAAS,CAAC;QACrB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,aAAa,CACf,IAAa,EACb,OAAuB;QAEvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,cAAc,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,IAAI,CAAC;YACD,OAAO,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,uBAAuB;gBAAE,OAAO,qBAAqB,CAAC;YAC3E,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;IACD,KAAK,CAAC,aAAa,CACf,IAAa,EACb,OAAuB;QAEvB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,OAAO,cAAc,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,OAAO,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,IAAI,cAAc,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,IAAa;QAChC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAY,CAAC,CAAC;QAC9D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,MAAM,aAAa,EAAE,CAAC,QAAQ,CAAC;YAC3B,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI;YAC/D,EAAE,EAAE,YAAY;YAChB,OAAO,EAAE,sBAAsB;YAC/B,IAAI,EAAE,mEAAmE,IAAI,EAAE;SAClF,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,KAAK,CAAC,eAAe,CAAC,IAAa,EAAE,OAAuB;QACxD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7D,OAAO,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS;YACrD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC;YACjC,CAAC,CAAC,SAAS,CAAC;IACpB,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,YAAoB;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC9E,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACvF,OAAO,gBAAgB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IACD,KAAK,CAAC,YAAY,CACd,YAAoB,EACpB,KAIC,EACD,OAAuB;QAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK;YAAE,OAAO,sBAAsB,CAAC;QAC3F,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE;YAAE,OAAO,eAAe,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAC/B,QAAQ,EACR,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,KAAK,CACd,CAAC;QACF,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACD,OAAO,GAAG,MAAM,uBAAuB,CACnC,IAAI,CAAC,QAAQ,EACb,QAAQ,CAAC,EAAE,EACX,QAAQ,CAAC,OAAO,EAChB,QAAQ,CAAC,KAAK,CACjB,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,KAAK,YAAY,uBAAuB;gBAAE,OAAO,qBAAqB,CAAC;YAC3E,MAAM,KAAK,CAAC;QAChB,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,sBAAsB,CAAC;QACzE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,OAAuB;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,OAAO,GAAG,MAAM,cAAc,CAChC,IAAI,CAAC,QAAQ,EACb,OAAO,CAAC,OAAO,CAAC,EAAE,EAClB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,eAAe,CAAC,OAAO,CAAC,CAC3B,CAAC;QACF,OAAO,OAAO;YACV,CAAC,CAAC;gBACI,KAAK,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC;gBAC7D,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;gBAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,uBAAuB,CAC5C,IAAI,CAAC,QAAQ,EACb,OAAO,CAAC,SAAS,CACpB,CAAC;aACL;YACH,CAAC,CAAC,SAAS,CAAC;IACpB,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,OAAuB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,OAAO,8BAA8B,CAAC;QAC5D,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC;IAChB,CAAC;IACO,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,OAAuB;QAC1D,MAAM,OAAO,GAAG,MAAM,aAAa,CAC/B,IAAI,CAAC,QAAQ,EACb,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EACnB,eAAe,CAAC,OAAO,CAAC,CAC3B,CAAC;QACF,OAAO;YACH,KAAK,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC;YACrD,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;YAC1C,eAAe,EAAE,CAAC,CAAC,MAAM,uBAAuB,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;SAC9E,CAAC;IACN,CAAC;CACJ;AACD,SAAS,KAAK,CAAC,IAAa,EAAE,GAAW;IACrC,MAAM,KAAK,GAAI,IAAyB,EAAE,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AACD,SAAS,KAAK,CAAC,IAAa;IACxB,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1D,OAAO,MAAM,IAAI,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,IAAI,GAAG;QAC9E,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,SAAS,CAAC;AACpB,CAAC;AACD,SAAS,iBAAiB,CAAC,IAAa;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACvC,OAAO,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACvF,CAAC;AACD,SAAS,QAAQ,CAAC,KAAyB,EAAE,OAAe;IACxD,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IACjC,OAAO,UAAU,IAAI,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AACD,SAAS,gBAAgB,CAAC,IAAa;IACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;IACtE,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9F,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,IAAI,aAAa,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACjD,OAAO;QACH,SAAS;QACT,QAAQ;QACR,QAAQ;QACR,KAAK,EAAE,YAAY;QACnB,KAAK;KACR,CAAC;AACN,CAAC;AACD,SAAS,MAAM,CAAC,MAAoB;IAChC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC,CAAC;AACrE,CAAC"}

package/packages/happy2-server/dist/modules/auth/sessionCreate.d.ts

@@ -0,0 +1,8 @@
+import { type ActiveSession, type RequestMetadata } from "./types.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Creates an authSessions authority row for an eligible account and records the proxy-aware request metadata for its issuance.
+ * Persisting the session and telemetry together makes later revocation authoritative and preserves where the credential originated.
+ */
+export declare function sessionCreate(executor: DrizzleExecutor, accountId: string, expiresAt: Date, metadata: RequestMetadata): Promise<ActiveSession>;
+//# sourceMappingURL=sessionCreate.d.ts.map

package/packages/happy2-server/dist/modules/auth/sessionCreate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionCreate.d.ts","sourceRoot":"","sources":["../../../sources/modules/auth/sessionCreate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAStE;;;GAGG;AACH,wBAAsB,aAAa,CAC/B,QAAQ,EAAE,eAAe,EACzB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,IAAI,EACf,QAAQ,EAAE,eAAe,GAC1B,OAAO,CAAC,aAAa,CAAC,CA4BxB"}

package/packages/happy2-server/dist/modules/auth/sessionCreate.js

@@ -0,0 +1,35 @@
+import {} from "./types.js";
+import { withTransaction } from "../drizzle.js";
+import { accounts, authSessions } from "../schema.js";
+import { and, eq, isNull } from "drizzle-orm";
+import { createId } from "@paralleldrive/cuid2";
+import { recordSessionEvent } from "./impl/recordSessionEvent.js";
+/**
+ * Creates an authSessions authority row for an eligible account and records the proxy-aware request metadata for its issuance.
+ * Persisting the session and telemetry together makes later revocation authoritative and preserves where the credential originated.
+ */
+export async function sessionCreate(executor, accountId, expiresAt, metadata) {
+    return withTransaction(executor, async (tx) => {
+        const [allowed] = await tx
+            .select({
+            id: accounts.id,
+        })
+            .from(accounts)
+            .where(and(eq(accounts.id, accountId), isNull(accounts.bannedAt), isNull(accounts.deletedAt)));
+        if (!allowed)
+            throw new Error("Account is not allowed to create sessions");
+        const session = {
+            id: createId(),
+            accountId,
+            expiresAt,
+        };
+        await tx.insert(authSessions).values({
+            id: session.id,
+            accountId,
+            expiresAt: expiresAt.toISOString(),
+        });
+        await recordSessionEvent(tx, session.id, "issued", metadata);
+        return session;
+    });
+}
+//# sourceMappingURL=sessionCreate.js.map

package/packages/happy2-server/dist/modules/auth/sessionCreate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionCreate.js","sourceRoot":"","sources":["../../../sources/modules/auth/sessionCreate.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,MAAM,YAAY,CAAC;AACtE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,QAAyB,EACzB,SAAiB,EACjB,SAAe,EACf,QAAyB;IAEzB,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC;YACJ,EAAE,EAAE,QAAQ,CAAC,EAAE;SAClB,CAAC;aACD,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CACF,GAAG,CACC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,EAC1B,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACzB,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC7B,CACJ,CAAC;QACN,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG;YACZ,EAAE,EAAE,QAAQ,EAAE;YACd,SAAS;YACT,SAAS;SACZ,CAAC;QACF,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;YACjC,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,SAAS;YACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;SACrC,CAAC,CAAC;QACH,MAAM,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7D,OAAO,OAAO,CAAC;IACnB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/auth/sessionFindActive.d.ts

@@ -0,0 +1,8 @@
+import { type ActiveSession } from "./types.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Resolves an unrevoked, unexpired authSessions row only while its account has not been banned or deleted.
+ * Rechecking durable session and account authority on every lookup prevents a valid JWT from surviving server-side revocation or account removal.
+ */
+export declare function sessionFindActive(executor: DrizzleExecutor, id: string): Promise<ActiveSession | undefined>;
+//# sourceMappingURL=sessionFindActive.d.ts.map

package/packages/happy2-server/dist/modules/auth/sessionFindActive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionFindActive.d.ts","sourceRoot":"","sources":["../../../sources/modules/auth/sessionFindActive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAKrD;;;GAGG;AACH,wBAAsB,iBAAiB,CACnC,QAAQ,EAAE,eAAe,EACzB,EAAE,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAmBpC"}

package/packages/happy2-server/dist/modules/auth/sessionFindActive.js

@@ -0,0 +1,22 @@
+import {} from "./types.js";
+import {} from "../drizzle.js";
+import { accounts, authSessions } from "../schema.js";
+import { and, eq, gt, isNull } from "drizzle-orm";
+import { asSession } from "./impl/asSession.js";
+/**
+ * Resolves an unrevoked, unexpired authSessions row only while its account has not been banned or deleted.
+ * Rechecking durable session and account authority on every lookup prevents a valid JWT from surviving server-side revocation or account removal.
+ */
+export async function sessionFindActive(executor, id) {
+    const [row] = await executor
+        .select({
+        id: authSessions.id,
+        accountId: authSessions.accountId,
+        expiresAt: authSessions.expiresAt,
+    })
+        .from(authSessions)
+        .innerJoin(accounts, eq(accounts.id, authSessions.accountId))
+        .where(and(eq(authSessions.id, id), isNull(authSessions.revokedAt), gt(authSessions.expiresAt, new Date().toISOString()), isNull(accounts.bannedAt), isNull(accounts.deletedAt)));
+    return row ? asSession(row) : undefined;
+}
+//# sourceMappingURL=sessionFindActive.js.map

package/packages/happy2-server/dist/modules/auth/sessionFindActive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionFindActive.js","sourceRoot":"","sources":["../../../sources/modules/auth/sessionFindActive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,MAAM,YAAY,CAAC;AAChD,OAAO,EAAwB,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACnC,QAAyB,EACzB,EAAU;IAEV,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ;SACvB,MAAM,CAAC;QACJ,EAAE,EAAE,YAAY,CAAC,EAAE;QACnB,SAAS,EAAE,YAAY,CAAC,SAAS;QACjC,SAAS,EAAE,YAAY,CAAC,SAAS;KACpC,CAAC;SACD,IAAI,CAAC,YAAY,CAAC;SAClB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;SAC5D,KAAK,CACF,GAAG,CACC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EACvB,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAC9B,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EACpD,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACzB,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC7B,CACJ,CAAC;IACN,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5C,CAAC"}

package/packages/happy2-server/dist/modules/auth/sessionRefresh.d.ts

@@ -0,0 +1,8 @@
+import { type ActiveSession, type RequestMetadata } from "./types.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Extends the expiry and last-seen timestamp of an unrevoked authSessions row whose account remains eligible, then records refresh telemetry.
+ * The transaction keeps the sliding-expiry update and its security event together; it deliberately does not rotate or replace the session identifier.
+ */
+export declare function sessionRefresh(executor: DrizzleExecutor, id: string, expiresAt: Date, metadata: RequestMetadata): Promise<ActiveSession | undefined>;
+//# sourceMappingURL=sessionRefresh.d.ts.map

package/packages/happy2-server/dist/modules/auth/sessionRefresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRefresh.d.ts","sourceRoot":"","sources":["../../../sources/modules/auth/sessionRefresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AAQtE;;;GAGG;AACH,wBAAsB,cAAc,CAChC,QAAQ,EAAE,eAAe,EACzB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,IAAI,EACf,QAAQ,EAAE,eAAe,GAC1B,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAqCpC"}

package/packages/happy2-server/dist/modules/auth/sessionRefresh.js

@@ -0,0 +1,37 @@
+import {} from "./types.js";
+import { withTransaction } from "../drizzle.js";
+import { accounts, authSessions } from "../schema.js";
+import { and, eq, gt, isNull, sql } from "drizzle-orm";
+import { asSession } from "./impl/asSession.js";
+import { recordSessionEvent } from "./impl/recordSessionEvent.js";
+/**
+ * Extends the expiry and last-seen timestamp of an unrevoked authSessions row whose account remains eligible, then records refresh telemetry.
+ * The transaction keeps the sliding-expiry update and its security event together; it deliberately does not rotate or replace the session identifier.
+ */
+export async function sessionRefresh(executor, id, expiresAt, metadata) {
+    return withTransaction(executor, async (tx) => {
+        const activeAccount = tx
+            .select({
+            id: accounts.id,
+        })
+            .from(accounts)
+            .where(and(eq(accounts.id, authSessions.accountId), isNull(accounts.bannedAt), isNull(accounts.deletedAt)));
+        const [session] = await tx
+            .update(authSessions)
+            .set({
+            expiresAt: expiresAt.toISOString(),
+            lastSeenAt: sql `CURRENT_TIMESTAMP`,
+        })
+            .where(and(eq(authSessions.id, id), isNull(authSessions.revokedAt), gt(authSessions.expiresAt, new Date().toISOString()), sql `exists ${activeAccount}`))
+            .returning({
+            id: authSessions.id,
+            accountId: authSessions.accountId,
+            expiresAt: authSessions.expiresAt,
+        });
+        if (!session)
+            return undefined;
+        await recordSessionEvent(tx, id, "refreshed", metadata);
+        return asSession(session);
+    });
+}
+//# sourceMappingURL=sessionRefresh.js.map

package/packages/happy2-server/dist/modules/auth/sessionRefresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRefresh.js","sourceRoot":"","sources":["../../../sources/modules/auth/sessionRefresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4C,MAAM,YAAY,CAAC;AACtE,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,QAAyB,EACzB,EAAU,EACV,SAAe,EACf,QAAyB;IAEzB,OAAO,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1C,MAAM,aAAa,GAAG,EAAE;aACnB,MAAM,CAAC;YACJ,EAAE,EAAE,QAAQ,CAAC,EAAE;SAClB,CAAC;aACD,IAAI,CAAC,QAAQ,CAAC;aACd,KAAK,CACF,GAAG,CACC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,YAAY,CAAC,SAAS,CAAC,EACvC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACzB,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC7B,CACJ,CAAC;QACN,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC;YACD,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;YAClC,UAAU,EAAE,GAAG,CAAA,mBAAmB;SACrC,CAAC;aACD,KAAK,CACF,GAAG,CACC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EACvB,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAC9B,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EACpD,GAAG,CAAA,UAAU,aAAa,EAAE,CAC/B,CACJ;aACA,SAAS,CAAC;YACP,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,SAAS,EAAE,YAAY,CAAC,SAAS;SACpC,CAAC,CAAC;QACP,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACxD,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/auth/sessionRevoke.d.ts

@@ -0,0 +1,8 @@
+import { type DrizzleExecutor } from "../drizzle.js";
+import { type RequestMetadata } from "./types.js";
+/**
+ * Marks the selected authSessions row revoked and records the request context that terminated its authority.
+ * Keeping revocation durable makes every server instance reject the otherwise long-lived JWT immediately on its next authenticated request.
+ */
+export declare function sessionRevoke(executor: DrizzleExecutor, id: string, metadata: RequestMetadata): Promise<void>;
+//# sourceMappingURL=sessionRevoke.d.ts.map

package/packages/happy2-server/dist/modules/auth/sessionRevoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRevoke.d.ts","sourceRoot":"","sources":["../../../sources/modules/auth/sessionRevoke.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,eAAe,EAAmB,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAMlD;;;GAGG;AACH,wBAAsB,aAAa,CAC/B,QAAQ,EAAE,eAAe,EACzB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,eAAe,GAC1B,OAAO,CAAC,IAAI,CAAC,CAaf"}

package/packages/happy2-server/dist/modules/auth/sessionRevoke.js

@@ -0,0 +1,25 @@
+import { withTransaction } from "../drizzle.js";
+import {} from "./types.js";
+import { and, eq, isNull, sql } from "drizzle-orm";
+import { authSessions } from "../schema.js";
+import { recordSessionEvent } from "./impl/recordSessionEvent.js";
+/**
+ * Marks the selected authSessions row revoked and records the request context that terminated its authority.
+ * Keeping revocation durable makes every server instance reject the otherwise long-lived JWT immediately on its next authenticated request.
+ */
+export async function sessionRevoke(executor, id, metadata) {
+    await withTransaction(executor, async (tx) => {
+        const [session] = await tx
+            .update(authSessions)
+            .set({
+            revokedAt: sql `CURRENT_TIMESTAMP`,
+        })
+            .where(and(eq(authSessions.id, id), isNull(authSessions.revokedAt)))
+            .returning({
+            id: authSessions.id,
+        });
+        if (session)
+            await recordSessionEvent(tx, id, "revoked", metadata);
+    });
+}
+//# sourceMappingURL=sessionRevoke.js.map

package/packages/happy2-server/dist/modules/auth/sessionRevoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionRevoke.js","sourceRoot":"","sources":["../../../sources/modules/auth/sessionRevoke.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,eAAe,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAwB,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,QAAyB,EACzB,EAAU,EACV,QAAyB;IAEzB,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;QACzC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC;YACD,SAAS,EAAE,GAAG,CAAA,mBAAmB;SACpC,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;aACnE,SAAS,CAAC;YACP,EAAE,EAAE,YAAY,CAAC,EAAE;SACtB,CAAC,CAAC;QACP,IAAI,OAAO;YAAE,MAAM,kBAAkB,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACP,CAAC"}

package/packages/happy2-server/dist/modules/auth/types.d.ts

@@ -0,0 +1,22 @@
+export interface RequestMetadata {
+    ip?: string;
+    forwardedFor?: string[];
+    location?: Record<string, string>;
+    device?: string;
+    appVersion?: string;
+    userAgent?: string;
+}
+export interface ActiveSession {
+    id: string;
+    accountId: string;
+    expiresAt: Date;
+}
+export interface Account {
+    id: string;
+    email: string;
+    passwordHash: string | null;
+    active: boolean;
+    bannedAt?: string;
+    deletedAt?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/packages/happy2-server/dist/modules/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../sources/modules/auth/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC5B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED,MAAM,WAAW,OAAO;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/packages/happy2-server/dist/modules/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/packages/happy2-server/dist/modules/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../sources/modules/auth/types.ts"],"names":[],"mappings":""}

package/packages/happy2-server/dist/modules/automation/automationCreate.d.ts

@@ -0,0 +1,24 @@
+import { type AutomationSummary } from "./impl/automationSummary.js";
+import { type MutationHint } from "../chat/types.js";
+import { type DrizzleExecutor } from "../drizzle.js";
+/**
+ * Persists an administrator-validated automations definition with its trigger, action payload, and initial scheduling state.
+ * Publishing the definition with audit and sync evidence ensures runners never execute an automation clients cannot attribute or inspect.
+ */
+export declare function automationCreate(executor: DrizzleExecutor, input: {
+    actorUserId: string;
+    name: string;
+    chatId?: string;
+    botId?: string;
+    triggerType: "schedule" | "event" | "webhook";
+    triggerConfig: Record<string, unknown>;
+    actionType: "send_message" | "call_webhook" | "moderate";
+    actionConfig: Record<string, unknown>;
+    timezone?: string;
+    nextRunAt?: string;
+}): Promise<{
+    automation: AutomationSummary;
+    hint: MutationHint;
+    webhookToken?: string;
+}>;
+//# sourceMappingURL=automationCreate.d.ts.map