hazo_auth 7.0.1 → 8.0.1

package/dist/lib/oauth_config.server.js

@@ -14,16 +14,9 @@ const SECTION_NAME = "hazo_auth__oauth";
  */
 export function get_oauth_config() {
     const enable_google = get_config_boolean(SECTION_NAME, "enable_google", DEFAULT_OAUTH.enable_google);
-    const enable_facebook = get_config_boolean(SECTION_NAME, "enable_facebook", false);
     const enable_email_password = get_config_boolean(SECTION_NAME, "enable_email_password", DEFAULT_OAUTH.enable_email_password);
-    // Generic key (backward compat)
     const auto_link_unverified_accounts = get_config_boolean(SECTION_NAME, "auto_link_unverified_accounts", DEFAULT_OAUTH.auto_link_unverified_accounts);
-    // Per-provider Google key (falls back to generic)
-    const auto_link_unverified_accounts_google = get_config_boolean(SECTION_NAME, "auto_link_unverified_accounts_google", auto_link_unverified_accounts);
-    // Per-provider Facebook key (defaults to false — don't auto-link Facebook unverified)
-    const auto_link_unverified_accounts_facebook = get_config_boolean(SECTION_NAME, "auto_link_unverified_accounts_facebook", false);
     const google_button_text = get_config_value(SECTION_NAME, "google_button_text", DEFAULT_OAUTH.google_button_text);
-    const facebook_button_text = get_config_value(SECTION_NAME, "facebook_button_text", "Continue with Facebook");
     const oauth_divider_text = get_config_value(SECTION_NAME, "oauth_divider_text", DEFAULT_OAUTH.oauth_divider_text);
     const sign_in_page = get_config_value(SECTION_NAME, "sign_in_page", DEFAULT_OAUTH.sign_in_page);
     const error_page = get_config_value(SECTION_NAME, "error_page", DEFAULT_OAUTH.error_page);
@@ -31,17 +24,17 @@ export function get_oauth_config() {
     const default_redirect = get_config_value(SECTION_NAME, "default_redirect", DEFAULT_OAUTH.default_redirect);
     const skip_invitation_check = get_config_boolean(SECTION_NAME, "skip_invitation_check", DEFAULT_OAUTH.skip_invitation_check);
     const no_scope_redirect = get_config_value(SECTION_NAME, "no_scope_redirect", DEFAULT_OAUTH.no_scope_redirect);
-    const facebook_client_id = process.env.HAZO_AUTH_FACEBOOK_APP_ID;
-    const facebook_client_secret = process.env.HAZO_AUTH_FACEBOOK_APP_SECRET;
+    const enable_facebook_oauth = get_config_boolean(SECTION_NAME, "enable_facebook_oauth", false);
+    const facebook_app_id = process.env.HAZO_AUTH_FACEBOOK_APP_ID ||
+        get_config_value(SECTION_NAME, "facebook_app_id", "");
+    const facebook_app_secret = process.env.HAZO_AUTH_FACEBOOK_APP_SECRET ||
+        get_config_value(SECTION_NAME, "facebook_app_secret", "");
+    const facebook_button_text = get_config_value(SECTION_NAME, "facebook_button_text", "Continue with Facebook");
     return {
         enable_google,
-        enable_facebook,
         enable_email_password,
         auto_link_unverified_accounts,
-        auto_link_unverified_accounts_google,
-        auto_link_unverified_accounts_facebook,
         google_button_text,
-        facebook_button_text,
         oauth_divider_text,
         sign_in_page,
         error_page,
@@ -49,8 +42,10 @@ export function get_oauth_config() {
         default_redirect,
         skip_invitation_check,
         no_scope_redirect,
-        facebook_client_id,
-        facebook_client_secret,
+        enable_facebook_oauth,
+        facebook_app_id,
+        facebook_app_secret,
+        facebook_button_text,
     };
 }
 /**
@@ -67,13 +62,3 @@ export function is_google_oauth_enabled() {
 export function is_email_password_enabled() {
     return get_config_boolean(SECTION_NAME, "enable_email_password", DEFAULT_OAUTH.enable_email_password);
 }
-/**
- * Helper to check if Facebook OAuth is enabled and credentials are present
- * @returns true if Facebook OAuth is enabled and env vars are set
- */
-export function is_facebook_oauth_enabled() {
-    const enabled = get_config_boolean(SECTION_NAME, "enable_facebook", false);
-    if (!enabled)
-        return false;
-    return !!(process.env.HAZO_AUTH_FACEBOOK_APP_ID && process.env.HAZO_AUTH_FACEBOOK_APP_SECRET);
-}

package/dist/lib/register_config.server.d.ts

@@ -15,14 +15,17 @@ export type RegisterConfig = {
     returnHomePath: string;
     signInPath: string;
     signInLabel: string;
+    imageSrc: string;
+    imageAlt: string;
+    imageBackgroundColor: string;
     /** OAuth configuration */
     oauth: {
         enable_google: boolean;
-        enable_facebook: boolean;
         enable_email_password: boolean;
         google_button_text: string;
-        facebook_button_text: string;
         oauth_divider_text: string;
+        enable_facebook_oauth: boolean;
+        facebook_button_text: string;
     };
 };
 /**

package/dist/lib/register_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/register_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAUrB,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B;IAC1B,KAAK,EAAE;QACL,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC;QACzB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CAgEpD"}
+{"version":3,"file":"register_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/register_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAerB,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,0BAA0B;IAC1B,KAAK,EAAE;QACL,aAAa,EAAE,OAAO,CAAC;QACvB,qBAAqB,EAAE,OAAO,CAAC;QAC/B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,qBAAqB,EAAE,OAAO,CAAC;QAC/B,oBAAoB,EAAE,MAAM,CAAC;KAC9B,CAAC;CACH,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,CAgFpD"}

package/dist/lib/register_config.server.js

@@ -7,6 +7,10 @@ import { get_password_requirements_config } from "./password_requirements_config
 import { get_already_logged_in_config } from "./already_logged_in_config.server.js";
 import { get_user_fields_config } from "./user_fields_config.server.js";
 import { get_oauth_config } from "./oauth_config.server.js";
+// Default image path - consuming apps should either:
+// 1. Configure their own image_src in hazo_auth_config.ini
+// 2. Copy the default images from node_modules/hazo_auth/public/hazo_auth/images/ to their public folder
+const DEFAULT_REGISTER_IMAGE_PATH = "/hazo_auth/images/register_default.jpg";
 // section: helpers
 /**
  * Reads register layout configuration from hazo_auth_config.ini file
@@ -28,12 +32,16 @@ export function get_register_config() {
     // Read sign in link configuration
     const signInPath = get_config_value("hazo_auth__register_layout", "sign_in_path", "/hazo_auth/login");
     const signInLabel = get_config_value("hazo_auth__register_layout", "sign_in_label", "Sign in");
+    // Read image configuration
+    // If not set in config, falls back to default path-based image
+    // Consuming apps should copy images to public/hazo_auth/images/ or configure their own image_src
+    const imageSrc = get_config_value("hazo_auth__register_layout", "image_src", DEFAULT_REGISTER_IMAGE_PATH);
+    const imageAlt = get_config_value("hazo_auth__register_layout", "image_alt", "Modern building representing user registration");
+    const imageBackgroundColor = get_config_value("hazo_auth__register_layout", "image_background_color", "#e2e8f0");
     // Get OAuth configuration (shared with login)
     const oauthConfig = get_oauth_config();
     // For the register page, default button text to "Sign up with Google" unless overridden
     const registerGoogleButtonText = get_config_value("hazo_auth__oauth", "google_button_text_register", "Sign up with Google");
-    // For the register page, default Facebook button text to "Sign up with Facebook" unless overridden
-    const registerFacebookButtonText = get_config_value("hazo_auth__oauth", "facebook_button_text_register", "Sign up with Facebook");
     return {
         showNameField,
         passwordRequirements,
@@ -44,13 +52,16 @@ export function get_register_config() {
         returnHomePath: alreadyLoggedInConfig.returnHomePath,
         signInPath,
         signInLabel,
+        imageSrc,
+        imageAlt,
+        imageBackgroundColor,
         oauth: {
             enable_google: oauthConfig.enable_google,
-            enable_facebook: oauthConfig.enable_facebook,
             enable_email_password: oauthConfig.enable_email_password,
             google_button_text: registerGoogleButtonText,
-            facebook_button_text: registerFacebookButtonText,
             oauth_divider_text: oauthConfig.oauth_divider_text,
+            enable_facebook_oauth: oauthConfig.enable_facebook_oauth,
+            facebook_button_text: oauthConfig.facebook_button_text,
         },
     };
 }

package/dist/lib/reset_password_config.server.d.ts

@@ -16,6 +16,9 @@ export type ResetPasswordConfig = {
         require_number: boolean;
         require_special: boolean;
     };
+    imageSrc: string;
+    imageAlt: string;
+    imageBackgroundColor: string;
 };
 /**
  * Reads reset password layout configuration from hazo_auth_config.ini file

package/dist/lib/reset_password_config.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reset_password_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/reset_password_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAQrB,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;CACH,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,CAyC/D"}
+{"version":3,"file":"reset_password_config.server.d.ts","sourceRoot":"","sources":["../../src/lib/reset_password_config.server.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAarB,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE;QACpB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;CAC9B,CAAC;AAGF;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,CAgE/D"}

package/dist/lib/reset_password_config.server.js

@@ -5,6 +5,10 @@ import "server-only";
 import { get_config_value } from "./config/config_loader.server.js";
 import { get_already_logged_in_config } from "./already_logged_in_config.server.js";
 import { get_password_requirements_config } from "./password_requirements_config.server.js";
+// Default image path - consuming apps should either:
+// 1. Configure their own image_src in hazo_auth_config.ini
+// 2. Copy the default images from node_modules/hazo_auth/public/hazo_auth/images/ to their public folder
+const DEFAULT_RESET_PASSWORD_IMAGE_PATH = "/hazo_auth/images/reset_password_default.jpg";
 // section: helpers
 /**
  * Reads reset password layout configuration from hazo_auth_config.ini file
@@ -25,6 +29,12 @@ export function get_reset_password_config() {
     const forgotPasswordPath = get_config_value(section, "forgot_password_path", "/hazo_auth/forgot_password");
     // Get shared password requirements
     const passwordRequirements = get_password_requirements_config();
+    // Read image configuration
+    // If not set in config, falls back to default path-based image
+    // Consuming apps should copy images to public/hazo_auth/images/ or configure their own image_src
+    const imageSrc = get_config_value(section, "image_src", DEFAULT_RESET_PASSWORD_IMAGE_PATH);
+    const imageAlt = get_config_value(section, "image_alt", "Reset password illustration");
+    const imageBackgroundColor = get_config_value(section, "image_background_color", "#f1f5f9");
     return {
         errorMessage,
         successMessage,
@@ -36,5 +46,8 @@ export function get_reset_password_config() {
         returnHomeButtonLabel: alreadyLoggedInConfig.returnHomeButtonLabel,
         returnHomePath: alreadyLoggedInConfig.returnHomePath,
         passwordRequirements,
+        imageSrc,
+        imageAlt,
+        imageBackgroundColor,
     };
 }

package/dist/lib/services/email_template_manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email_template_manifest.d.ts","sourceRoot":"","sources":["../../../src/lib/services/email_template_manifest.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAMrB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAiB3E;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBAAsB,EAwF/D,CAAC"}
+{"version":3,"file":"email_template_manifest.d.ts","sourceRoot":"","sources":["../../../src/lib/services/email_template_manifest.ts"],"names":[],"mappings":"AAEA,OAAO,aAAa,CAAC;AAMrB,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAiB3E;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,EAAE,sBAAsB,EAuE/D,CAAC"}

package/dist/lib/services/email_template_manifest.js

@@ -92,21 +92,4 @@ export const hazo_auth_template_manifest = [
             },
         ],
     },
-    {
-        template_name: "otp_signin_code",
-        template_label: "OTP sign-in code",
-        category: SYSTEM_CATEGORY,
-        html: read_template("otp_signin_code", "html"),
-        text: read_template("otp_signin_code", "txt"),
-        variables: [
-            {
-                variable_name: "otp_code",
-                variable_description: "6-digit OTP code for email sign-in (v6.1.0+)",
-            },
-            {
-                variable_name: "expires_in_minutes",
-                variable_description: "Number of minutes until the OTP code expires",
-            },
-        ],
-    },
 ];

package/dist/lib/services/index.d.ts

@@ -18,6 +18,4 @@ export * from "./scope_service.js";
 export * from "./user_scope_service.js";
 export * from "./oauth_service.js";
 export * from "./branding_service.js";
-export { request_email_otp, verify_email_otp, generate_otp_code, hash_otp_code, verify_otp_code, } from "./otp_service.js";
-export type { RequestEmailOTPResult, VerifyEmailOTPResult } from "./otp_service";
 //# sourceMappingURL=index.d.ts.map

package/dist/lib/services/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/services/index.ts"],"names":[],"mappings":"AAEA,cAAc,iBAAiB,CAAC;AAChC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/services/index.ts"],"names":[],"mappings":"AAEA,cAAc,iBAAiB,CAAC;AAChC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,iBAAiB,CAAC;AAChC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0BAA0B,CAAC;AACzC,cAAc,kCAAkC,CAAC;AACjD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,wBAAwB,CAAC;AACvC,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC"}

package/dist/lib/services/index.js

@@ -20,4 +20,3 @@ export * from "./scope_service.js";
 export * from "./user_scope_service.js";
 export * from "./oauth_service.js";
 export * from "./branding_service.js";
-export { request_email_otp, verify_email_otp, generate_otp_code, hash_otp_code, verify_otp_code, } from "./otp_service.js";

package/dist/lib/services/oauth_service.d.ts

@@ -11,6 +11,14 @@ export type GoogleOAuthData = {
     /** Whether Google has verified this email */
     email_verified: boolean;
 };
+export type FacebookOAuthData = {
+    facebook_id: string;
+    email: string;
+    name?: string;
+    profile_picture_url?: string;
+    /** Facebook does not always verify emails — only link when hazo user is verified */
+    email_verified: boolean;
+};
 export type OAuthLoginResult = {
     success: boolean;
     user_id?: string;
@@ -24,16 +32,6 @@ export type OAuthLoginResult = {
     name?: string;
     error?: string;
 };
-export type FacebookOAuthData = {
-    /** Facebook's unique user ID */
-    facebook_id: string;
-    /** User's email address from Facebook (may be null if user denied email permission) */
-    email: string | null;
-    /** User's full name from Facebook profile */
-    name?: string;
-    /** User's profile picture URL from Facebook */
-    profile_picture_url?: string;
-};
 export type LinkGoogleResult = {
     success: boolean;
     error?: string;
@@ -56,19 +54,10 @@ export type AuthProvidersResult = {
  */
 export declare function handle_google_oauth_login(adapter: HazoConnectAdapter, data: GoogleOAuthData): Promise<OAuthLoginResult>;
 /**
- * Handles Facebook OAuth login/registration flow
- * 1. Check if user exists with facebook_id -> login
- * 2. Check if user exists with email -> link Facebook account (respects auto_link_unverified)
- * 3. Create new user with Facebook data (email_verified always false — never trust Facebook)
- *
- * @param adapter - The hazo_connect adapter instance
- * @param data - Facebook OAuth user data
- * @param opts - Options (auto_link_unverified: whether to link unverified accounts)
- * @returns OAuth login result with user_id and status flags
+ * Handles Facebook OAuth login: find-by-facebook_id → find-by-email+link → create new.
+ * Mirrors handle_google_oauth_login exactly. Uses auto_link_unverified_accounts gate.
  */
-export declare function handle_facebook_oauth_login(adapter: HazoConnectAdapter, data: FacebookOAuthData, opts?: {
-    auto_link_unverified?: boolean;
-}): Promise<OAuthLoginResult>;
+export declare function handle_facebook_oauth_login(adapter: HazoConnectAdapter, data: FacebookOAuthData): Promise<OAuthLoginResult>;
 /**
  * Links a Google account to an existing user
  * @param adapter - The hazo_connect adapter instance

package/dist/lib/services/oauth_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/oauth_service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AASvD,MAAM,MAAM,eAAe,GAAG;IAC5B,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6CAA6C;IAC7C,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAE9B,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAiL3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,iBAAiB,EACvB,IAAI,CAAC,EAAE;IAAE,oBAAoB,CAAC,EAAE,OAAO,CAAA;CAAE,GACxC,OAAO,CAAC,gBAAgB,CAAC,CAwK3B;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAgE3B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CA2C9B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA0D/C"}
+{"version":3,"file":"oauth_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/oauth_service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AASvD,MAAM,MAAM,eAAe,GAAG;IAC5B,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,6CAA6C;IAC7C,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,oFAAoF;IACpF,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uDAAuD;IACvD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sBAAsB;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF;;;;;;;;;GASG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,gBAAgB,CAAC,CAiL3B;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CA6H3B;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CAgE3B;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,kBAAkB,EAC3B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CA2C9B;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,kBAAkB,EAC3B,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA0D/C"}

package/dist/lib/services/oauth_service.js

@@ -168,33 +168,23 @@ export async function handle_google_oauth_login(adapter, data) {
     }
 }
 /**
- * Handles Facebook OAuth login/registration flow
- * 1. Check if user exists with facebook_id -> login
- * 2. Check if user exists with email -> link Facebook account (respects auto_link_unverified)
- * 3. Create new user with Facebook data (email_verified always false — never trust Facebook)
- *
- * @param adapter - The hazo_connect adapter instance
- * @param data - Facebook OAuth user data
- * @param opts - Options (auto_link_unverified: whether to link unverified accounts)
- * @returns OAuth login result with user_id and status flags
+ * Handles Facebook OAuth login: find-by-facebook_id → find-by-email+link → create new.
+ * Mirrors handle_google_oauth_login exactly. Uses auto_link_unverified_accounts gate.
  */
-export async function handle_facebook_oauth_login(adapter, data, opts) {
+export async function handle_facebook_oauth_login(adapter, data) {
     const logger = create_app_logger();
     try {
-        const { facebook_id, email, name, profile_picture_url } = data;
+        const { facebook_id, email, name, profile_picture_url, email_verified } = data;
+        const oauth_config = get_oauth_config();
         const users_service = createCrudService(adapter, "hazo_users");
         const now = new Date().toISOString();
-        // Step 1: Check if user exists with this facebook_id
-        const users_by_facebook_id = await users_service.findBy({ facebook_id });
-        if (Array.isArray(users_by_facebook_id) && users_by_facebook_id.length > 0) {
-            const user = users_by_facebook_id[0];
-            await users_service.updateById(user.id, {
-                last_logon: now,
-                changed_at: now,
-            });
-            logger.info("oauth_service_facebook_login_existing_facebook_user", {
+        // Step 1: existing user with this facebook_id
+        const users_by_fb_id = await users_service.findBy({ facebook_id });
+        if (Array.isArray(users_by_fb_id) && users_by_fb_id.length > 0) {
+            const user = users_by_fb_id[0];
+            await users_service.updateById(user.id, { last_logon: now, changed_at: now });
+            logger.info("oauth_service_facebook_login_existing_fb_user", {
                 filename: "oauth_service.ts",
-                line_number: get_line_number(),
                 user_id: user.id,
                 email: user.email_address,
             });
@@ -207,91 +197,76 @@ export async function handle_facebook_oauth_login(adapter, data, opts) {
                 name: user.name,
             };
         }
-        // Step 2: Check if user exists with this email
-        if (email) {
-            const users_by_email = await users_service.findBy({ email_address: email });
-            if (Array.isArray(users_by_email) && users_by_email.length > 0) {
-                const user = users_by_email[0];
-                const user_email_verified = user.email_verified;
-                if (!user_email_verified) {
-                    if (!(opts === null || opts === void 0 ? void 0 : opts.auto_link_unverified)) {
-                        return {
-                            success: false,
-                            error: "link_blocked_unverified",
-                        };
-                    }
-                    // auto_link_unverified=true: link but do NOT change email_verified status
-                }
-                // Link Facebook account to existing user
-                const current_auth_providers = user.auth_providers || "email";
-                const new_auth_providers = current_auth_providers.includes("facebook")
-                    ? current_auth_providers
-                    : `${current_auth_providers},facebook`;
-                const update_data = {
-                    facebook_id,
-                    auth_providers: new_auth_providers,
-                    last_logon: now,
-                    changed_at: now,
-                };
-                // Update name if not set and Facebook provides one
-                if (!user.name && name) {
-                    update_data.name = name;
-                }
-                // Update profile picture if not set and Facebook provides one
-                if (!user.profile_picture_url && profile_picture_url) {
-                    update_data.profile_picture_url = profile_picture_url;
-                    update_data.profile_source = "custom";
-                }
-                await users_service.updateById(user.id, update_data);
-                logger.info("oauth_service_facebook_linked_to_existing", {
-                    filename: "oauth_service.ts",
-                    line_number: get_line_number(),
-                    user_id: user.id,
-                    email,
-                    was_unverified: !user_email_verified,
-                });
+        // Step 2: existing user with matching email
+        const users_by_email = await users_service.findBy({ email_address: email });
+        if (Array.isArray(users_by_email) && users_by_email.length > 0) {
+            const user = users_by_email[0];
+            const user_email_verified = user.email_verified;
+            if (!user_email_verified && !oauth_config.auto_link_unverified_accounts) {
                 return {
-                    success: true,
-                    user_id: user.id,
-                    is_new_user: false,
-                    was_linked: true,
-                    email: user.email_address,
-                    name: update_data.name || user.name,
+                    success: false,
+                    error: "An account with this email exists but is not verified. Please verify your email first.",
                 };
             }
+            const current_auth_providers = user.auth_providers || "email";
+            const new_auth_providers = current_auth_providers.includes("facebook")
+                ? current_auth_providers
+                : `${current_auth_providers},facebook`;
+            const update_data = {
+                facebook_id,
+                auth_providers: new_auth_providers,
+                last_logon: now,
+                changed_at: now,
+            };
+            if (!user_email_verified && email_verified) {
+                update_data.email_verified = true;
+            }
+            if (!user.name && name)
+                update_data.name = name;
+            if (!user.profile_picture_url && profile_picture_url) {
+                update_data.profile_picture_url = profile_picture_url;
+                update_data.profile_source = "custom";
+            }
+            await users_service.updateById(user.id, update_data);
+            logger.info("oauth_service_facebook_linked_to_existing", {
+                filename: "oauth_service.ts",
+                user_id: user.id,
+                email,
+                was_unverified: !user_email_verified,
+            });
+            return {
+                success: true,
+                user_id: user.id,
+                is_new_user: false,
+                was_linked: true,
+                email: user.email_address,
+                name: user.name,
+            };
         }
-        // Step 3: Create new user with Facebook data
+        // Step 3: create new user
         const user_id = randomUUID();
         const insert_data = {
             id: user_id,
             email_address: email,
-            password_hash: "", // Empty string for Facebook-only users
-            email_verified: false, // Never trust Facebook's email_verified claim
-            status: "ACTIVE",
-            login_attempts: 0,
             facebook_id,
             auth_providers: "facebook",
+            email_verified: email_verified,
+            last_logon: now,
             created_at: now,
             changed_at: now,
-            last_logon: now,
         };
-        if (name) {
+        if (name)
             insert_data.name = name;
-        }
         if (profile_picture_url) {
             insert_data.profile_picture_url = profile_picture_url;
             insert_data.profile_source = "custom";
         }
-        const inserted_users = await users_service.insert(insert_data);
-        if (!Array.isArray(inserted_users) || inserted_users.length === 0) {
-            return {
-                success: false,
-                error: "Failed to create user account",
-            };
+        const inserted = await users_service.insert(insert_data);
+        if (!Array.isArray(inserted) || inserted.length === 0) {
+            return { success: false, error: "Failed to create user account" };
         }
         logger.info("oauth_service_facebook_new_user_created", {
             filename: "oauth_service.ts",
-            line_number: get_line_number(),
             user_id,
             email,
         });
@@ -300,7 +275,7 @@ export async function handle_facebook_oauth_login(adapter, data, opts) {
             user_id,
             is_new_user: true,
             was_linked: false,
-            email: email !== null && email !== void 0 ? email : undefined,
+            email,
             name,
         };
     }
@@ -309,17 +284,9 @@ export async function handle_facebook_oauth_login(adapter, data, opts) {
             logToConsole: true,
             logToLogger: true,
             logger,
-            context: {
-                filename: "oauth_service.ts",
-                line_number: get_line_number(),
-                email: data.email,
-                operation: "handle_facebook_oauth_login",
-            },
+            context: { filename: "oauth_service.ts", email: data.email, operation: "handle_facebook_oauth_login" },
         });
-        return {
-            success: false,
-            error: user_friendly_error,
-        };
+        return { success: false, error: user_friendly_error };
     }
 }
 /**

package/dist/lib/services/otp_service.d.ts

@@ -36,7 +36,7 @@ export type VerifyEmailOTPResult = {
     session_token: string;
 } | {
     ok: false;
-    error: "invalid_or_expired";
+    error: "invalid_or_expired" | "expired";
 };
 export declare function verify_email_otp(args: {
     email: string;

package/dist/lib/services/otp_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otp_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/otp_service.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAUrB;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjE;AAED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMtF;AAID,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC;AAItE;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8GjC;AAID,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAE/C,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAsHhC"}
+{"version":3,"file":"otp_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/otp_service.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,CAAC;AAUrB;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAG1C;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEjE;AAED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMtF;AAID,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,cAAc,CAAC;IAAC,mBAAmB,EAAE,MAAM,CAAA;CAAE,CAAC;AAItE;;;;;;;;;;;GAWG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAmHjC;AAID,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,GAAG,SAAS,CAAA;CAAE,CAAC;AAE3D,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAsHhC"}

package/dist/lib/services/otp_service.js

@@ -111,6 +111,11 @@ export async function request_email_otp(args) {
         expires_at,
         attempt_count: 0,
         requester_ip: ip,
+        // Explicitly pass created_at in JS ISO format ("2024-01-01T00:00:00.000Z") rather
+        // than relying on SQLite's DEFAULT (datetime('now') = "2024-01-01 00:00:00").
+        // The space-separated SQLite format compares as less-than the T-separated JS ISO
+        // threshold used in rate-limit WHERE clauses, causing the counter to always read 0.
+        created_at: new Date().toISOString(),
     });
     // 7. Dispatch email — fire-and-forget; errors are logged but do not surface to caller
     try {
@@ -155,7 +160,7 @@ export async function verify_email_otp(args) {
     // 2. Check expiry
     const expires_at_ms = Date.parse(String(row.expires_at));
     if (Number.isNaN(expires_at_ms) || expires_at_ms < Date.now()) {
-        return { ok: false, error: "invalid_or_expired" };
+        return { ok: false, error: "expired" };
     }
     // 3. argon2 verify
     const is_valid = await verify_otp_code(String(row.otp_hash), code);

package/dist/lib/services/registration_service.d.ts

@@ -4,6 +4,11 @@ export type RegistrationData = {
     password: string;
     name?: string;
     url_on_logon?: string;
+    legal_accepted?: Record<string, {
+        hash: string;
+    }>;
+    ip?: string | null;
+    user_agent?: string | null;
 };
 export type RegistrationResult = {
     success: boolean;

package/dist/lib/services/registration_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registration_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/registration_service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAkBvD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAwJ7B"}
+{"version":3,"file":"registration_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/registration_service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAmBvD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAGF;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAmK7B"}

package/dist/lib/services/registration_service.js

@@ -10,6 +10,7 @@ import { send_template_email } from "./email_service.js";
 import { sanitize_error_for_user } from "../utils/error_sanitizer.js";
 import { get_line_number } from "../utils/api_route_helpers.js";
 import { is_user_types_enabled, get_default_user_type, } from "../user_types_config.server.js";
+import { write_legal_acceptance } from "../legal/legal_docs_service.js";
 // section: helpers
 /**
  * Registers a new user in the database using hazo_connect
@@ -18,6 +19,7 @@ import { is_user_types_enabled, get_default_user_type, } from "../user_types_con
  * @returns Registration result with success status and user_id or error
  */
 export async function register_user(adapter, data) {
+    var _a, _b;
     try {
         const { email, password, name, url_on_logon } = data;
         // Create CRUD service for hazo_users table
@@ -130,6 +132,10 @@ export async function register_user(adapter, data) {
                 });
             }
         }
+        // Write legal acceptance records if provided
+        if (data.legal_accepted && Object.keys(data.legal_accepted).length > 0) {
+            await write_legal_acceptance(adapter, user_id, data.legal_accepted, (_a = data.ip) !== null && _a !== void 0 ? _a : null, (_b = data.user_agent) !== null && _b !== void 0 ? _b : null);
+        }
         return {
             success: true,
             user_id,

package/dist/lib/services/session_token_service.d.ts

@@ -16,8 +16,6 @@ export type ValidateSessionTokenResult = {
  * Token includes user_id, email, issued at time, and expiration
  * @param user_id - User ID
  * @param email - User email address
- * @param managed_by_user_id - Optional: ID of the managing user (for impersonation)
- * @param ttl_seconds - Optional: token lifetime in seconds (default: 30 days). Use 604800 for 7-day OTP sessions.
  * @returns JWT token string
  */
 export declare function create_session_token(user_id: string, email: string, managed_by_user_id?: string, ttl_seconds?: number): Promise<string>;

package/dist/lib/services/session_token_service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session_token_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/session_token_service.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAuCF;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,kBAAkB,CAAC,EAAE,MAAM,EAC3B,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,CAAC,CAkDrC"}
+{"version":3,"file":"session_token_service.d.ts","sourceRoot":"","sources":["../../../src/lib/services/session_token_service.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,CAAC;AAuCF;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,kBAAkB,CAAC,EAAE,MAAM,EAC3B,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,MAAM,CAAC,CA4CjB;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,CAAC,CAkDrC"}