myaidev-method 0.2.7 → 0.2.9

package/dist/server/auth/services/AuditLogService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuditLogService.js","sourceRoot":"","sources":["../../../../src/server/auth/services/AuditLogService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAkCvD,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAOhE;IACD,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CACxB,IAAI,EACJ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAErC,MAAM,GAAG,GAAG,CACV,IAAwB,EACY,EAAE,CACtC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,KAAK,CAAC,CAAC,CAAC,CACN,EAAE,CAAC,GAAG,CACJ;;;mDAGqC,EACrC;gBACE,EAAE;gBACF,IAAI,CAAC,MAAM;gBACX,IAAI,CAAC,MAAM;gBACX,IAAI,CAAC,YAAY,IAAI,IAAI;gBACzB,IAAI,CAAC,UAAU,IAAI,IAAI;gBACvB,IAAI,CAAC,SAAS,IAAI,IAAI;gBACtB,IAAI,CAAC,SAAS,IAAI,IAAI;gBACtB,IAAI,CAAC,OAAO,IAAI,IAAI;gBACpB,GAAG;aACJ,CACF,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,OAAO,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC,CAAC,CACH,CAAC"}

package/dist/server/auth/services/AuthService.d.ts

@@ -0,0 +1,27 @@
+import { Context, Effect, Layer } from "effect";
+import { AuthError, DatabaseError, Session, User, ValidationError } from "../../../shared/types.js";
+import { PasswordService } from "./PasswordService.js";
+import { TokenService } from "./TokenService.js";
+import { UserRepository } from "./UserRepository.js";
+import { SessionRepository } from "./SessionRepository.js";
+import { AuditLogService } from "./AuditLogService.js";
+import { UserManagementService } from "../../user-management/UserManagementService.js";
+export interface AuthServiceDeps {
+    readonly register: (username: string, email: string, password: string, ipAddress?: string | null, userAgent?: string | null) => Effect.Effect<User, AuthError | ValidationError | DatabaseError>;
+    readonly login: (email: string, password: string, ipAddress?: string | null, userAgent?: string | null) => Effect.Effect<{
+        user: User;
+        token: string;
+        session: Session;
+    }, AuthError | DatabaseError>;
+    readonly logout: (sessionId: string, userId: string) => Effect.Effect<void, DatabaseError>;
+    readonly verifyToken: (token: string) => Effect.Effect<{
+        user: User;
+        session: Session;
+    }, AuthError | DatabaseError>;
+}
+declare const AuthService_base: Context.TagClass<AuthService, "AuthService", AuthServiceDeps>;
+export declare class AuthService extends AuthService_base {
+    static Live: Layer.Layer<AuthService, never, PasswordService | TokenService | AuditLogService | UserRepository | SessionRepository | UserManagementService>;
+}
+export {};
+//# sourceMappingURL=AuthService.d.ts.map

package/dist/server/auth/services/AuthService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthService.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/services/AuthService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EACL,SAAS,EACT,aAAa,EACb,OAAO,EACP,IAAI,EACJ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAKvF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,EAAE,CACjB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,KACtB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,GAAG,eAAe,GAAG,aAAa,CAAC,CAAC;IACtE,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,KACtB,MAAM,CAAC,MAAM,CAChB;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAC/C,SAAS,GAAG,aAAa,CAC1B,CAAC;IACF,QAAQ,CAAC,MAAM,EAAE,CACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,CACpB,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,SAAS,GAAG,aAAa,CAAC,CAAC;CACjF;;AAED,qBAAa,WAAY,SAAQ,gBAG9B;IACD,MAAM,CAAC,IAAI,iJAsWT;CACH"}

package/dist/server/auth/services/AuthService.js

@@ -0,0 +1,246 @@
+import { Context, Effect, Layer } from "effect";
+import { AuthError, ValidationError, } from "../../../shared/types.js";
+import { PasswordService } from "./PasswordService.js";
+import { TokenService } from "./TokenService.js";
+import { UserRepository } from "./UserRepository.js";
+import { SessionRepository } from "./SessionRepository.js";
+import { AuditLogService } from "./AuditLogService.js";
+import { UserManagementService } from "../../user-management/UserManagementService.js";
+const MAX_FAILED_ATTEMPTS = 5;
+const LOCKOUT_DURATION_MS = 15 * 60 * 1000; // 15 minutes
+export class AuthService extends Context.Tag("AuthService")() {
+    static Live = Layer.effect(this, Effect.gen(function* () {
+        const passwordService = yield* PasswordService;
+        const tokenService = yield* TokenService;
+        const userRepo = yield* UserRepository;
+        const sessionRepo = yield* SessionRepository;
+        const auditLog = yield* AuditLogService;
+        const userManagement = yield* UserManagementService;
+        const sanitizeLinuxUsername = (username) => {
+            // Convert to lowercase, replace non-alphanumeric with underscore
+            let sanitized = username
+                .toLowerCase()
+                .replace(/[^a-z0-9_]/g, "_")
+                .replace(/^[0-9_]+/, "") // Cannot start with number or underscore
+                .slice(0, 32); // Max length for Linux usernames
+            // Ensure it starts with a letter
+            if (!/^[a-z]/.test(sanitized)) {
+                sanitized = "user_" + sanitized;
+            }
+            return sanitized;
+        };
+        const generateUniqueLinuxUsername = (baseUsername) => Effect.gen(function* () {
+            let linuxUsername = sanitizeLinuxUsername(baseUsername);
+            let counter = 0;
+            // Keep trying until we find a unique username
+            while (true) {
+                const existingUser = yield* userRepo.findByUsername(linuxUsername);
+                if (!existingUser) {
+                    return linuxUsername;
+                }
+                counter++;
+                const suffix = `_${counter}`;
+                const maxBase = 32 - suffix.length;
+                linuxUsername =
+                    sanitizeLinuxUsername(baseUsername).slice(0, maxBase) + suffix;
+            }
+        });
+        const validateEmail = (email) => Effect.gen(function* () {
+            const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+            if (!emailRegex.test(email)) {
+                return yield* Effect.fail(new ValidationError("email", "Invalid email format"));
+            }
+        });
+        const validateUsername = (username) => Effect.gen(function* () {
+            if (username.length < 3) {
+                return yield* Effect.fail(new ValidationError("username", "Username must be at least 3 characters long"));
+            }
+            if (username.length > 32) {
+                return yield* Effect.fail(new ValidationError("username", "Username must be at most 32 characters long"));
+            }
+            if (!/^[a-zA-Z0-9_]+$/.test(username)) {
+                return yield* Effect.fail(new ValidationError("username", "Username can only contain letters, numbers, and underscores"));
+            }
+        });
+        const isAccountLocked = (user) => {
+            if (user.failedLoginAttempts < MAX_FAILED_ATTEMPTS) {
+                return false;
+            }
+            // Check if lockout period has expired
+            const now = Date.now();
+            const lockoutExpiry = user.updatedAt + LOCKOUT_DURATION_MS;
+            return now < lockoutExpiry;
+        };
+        const register = (username, email, password, ipAddress = null, userAgent = null) => Effect.gen(function* () {
+            // Validate inputs
+            yield* validateUsername(username);
+            yield* validateEmail(email);
+            yield* passwordService.validatePasswordStrength(password);
+            // Check if user already exists
+            const existingEmail = yield* userRepo.findByEmail(email);
+            if (existingEmail) {
+                return yield* Effect.fail(new ValidationError("email", "Email already registered"));
+            }
+            const existingUsername = yield* userRepo.findByUsername(username);
+            if (existingUsername) {
+                return yield* Effect.fail(new ValidationError("username", "Username already taken"));
+            }
+            // Hash password
+            const passwordHash = yield* passwordService.hash(password);
+            // Generate unique Linux username
+            const linuxUsername = yield* generateUniqueLinuxUsername(username);
+            // Create user in database
+            const user = yield* userRepo.create({
+                username,
+                email,
+                passwordHash,
+                linuxUsername,
+            });
+            // Create Linux user with home directory and Claude config
+            // This runs in the background and doesn't block registration
+            // If it fails, user can still authenticate but won't have Linux access
+            yield* userManagement
+                .createUser({
+                username: linuxUsername,
+                email,
+                shell: "/bin/rbash", // Restricted bash for security
+                diskQuotaMB: 2048, // 2GB default quota
+            })
+                .pipe(Effect.catchAll((error) => {
+                // Log the error but don't fail registration
+                console.error(`Failed to create Linux user for ${linuxUsername}:`, error);
+                return Effect.succeed(void 0);
+            }));
+            // Log audit event
+            yield* auditLog.log({
+                userId: user.id,
+                action: "USER_REGISTERED",
+                resourceType: "user",
+                resourceId: user.id,
+                ipAddress: ipAddress ?? null,
+                userAgent: userAgent ?? null,
+            });
+            return user;
+        });
+        const login = (email, password, ipAddress = null, userAgent = null) => Effect.gen(function* () {
+            // Find user by email
+            const user = yield* userRepo.findByEmail(email);
+            if (!user) {
+                return yield* Effect.fail(new AuthError("INVALID_CREDENTIALS", "Invalid email or password"));
+            }
+            // Check if account is locked
+            if (isAccountLocked(user)) {
+                yield* auditLog.log({
+                    userId: user.id,
+                    action: "LOGIN_FAILED",
+                    resourceType: "user",
+                    resourceId: user.id,
+                    ipAddress: ipAddress ?? null,
+                    userAgent: userAgent ?? null,
+                    details: "Account locked due to too many failed attempts",
+                });
+                return yield* Effect.fail(new AuthError("ACCOUNT_LOCKED", "Account is locked due to too many failed login attempts. Please try again in 15 minutes."));
+            }
+            // Verify password
+            if (!user.passwordHash) {
+                return yield* Effect.fail(new AuthError("INVALID_CREDENTIALS", "Invalid email or password"));
+            }
+            const isPasswordValid = yield* passwordService.verify(password, user.passwordHash);
+            if (!isPasswordValid) {
+                // Increment failed login attempts
+                yield* userRepo.incrementFailedLogins(user.id);
+                yield* auditLog.log({
+                    userId: user.id,
+                    action: "LOGIN_FAILED",
+                    resourceType: "user",
+                    resourceId: user.id,
+                    ipAddress: ipAddress ?? null,
+                    userAgent: userAgent ?? null,
+                    details: "Invalid password",
+                });
+                return yield* Effect.fail(new AuthError("INVALID_CREDENTIALS", "Invalid email or password"));
+            }
+            // Reset failed login attempts on successful login
+            yield* userRepo.resetFailedLogins(user.id);
+            // Update last login time
+            const updatedUser = yield* userRepo.update(user.id, {
+                lastLoginAt: Date.now(),
+            });
+            // Generate a unique placeholder token to avoid constraint violations
+            const expiresAt = Date.now() + 7 * 24 * 60 * 60 * 1000; // 7 days
+            const placeholderToken = `placeholder_${user.id}_${Date.now()}_${Math.random()}`;
+            const placeholderHash = yield* tokenService.hashToken(placeholderToken);
+            // Create session with placeholder hash
+            const session = yield* sessionRepo.create({
+                userId: user.id,
+                tokenHash: placeholderHash,
+                ipAddress: ipAddress ?? null,
+                userAgent: userAgent ?? null,
+                expiresAt,
+            });
+            // Generate JWT token with the session ID
+            const token = yield* tokenService.generateToken({
+                sub: user.id,
+                username: user.username,
+                email: user.email,
+                jti: session.id,
+            });
+            // Update the session with the actual token hash
+            const actualTokenHash = yield* tokenService.hashToken(token);
+            const finalSession = yield* sessionRepo.updateTokenHash(session.id, actualTokenHash);
+            // Log audit event
+            yield* auditLog.log({
+                userId: user.id,
+                action: "USER_LOGIN",
+                resourceType: "session",
+                resourceId: finalSession.id,
+                ipAddress: ipAddress ?? null,
+                userAgent: userAgent ?? null,
+            });
+            return { user: updatedUser, token, session: finalSession };
+        });
+        const logout = (sessionId, userId) => Effect.gen(function* () {
+            // Revoke session
+            yield* sessionRepo.revoke(sessionId);
+            // Log audit event
+            yield* auditLog.log({
+                userId,
+                action: "USER_LOGOUT",
+                resourceType: "session",
+                resourceId: sessionId,
+                ipAddress: null,
+                userAgent: null,
+            });
+        });
+        const verifyToken = (token) => Effect.gen(function* () {
+            // Verify JWT
+            const payload = yield* tokenService.verifyToken(token);
+            // Hash token to find session
+            const tokenHash = yield* tokenService.hashToken(token);
+            const session = yield* sessionRepo.findByTokenHash(tokenHash);
+            if (!session) {
+                return yield* Effect.fail(new AuthError("INVALID_TOKEN", "Session not found"));
+            }
+            // Check if session is expired
+            if (session.expiresAt < Date.now()) {
+                return yield* Effect.fail(new AuthError("TOKEN_EXPIRED", "Session has expired"));
+            }
+            // Check if session is revoked
+            if (session.isRevoked) {
+                return yield* Effect.fail(new AuthError("SESSION_REVOKED", "Session has been revoked"));
+            }
+            // Find user
+            const user = yield* userRepo.findById(payload.sub);
+            if (!user) {
+                return yield* Effect.fail(new AuthError("USER_NOT_FOUND", "User not found"));
+            }
+            // Check if user is active
+            if (!user.isActive) {
+                return yield* Effect.fail(new AuthError("USER_INACTIVE", "User account is inactive"));
+            }
+            return { user, session };
+        });
+        return { register, login, logout, verifyToken };
+    }));
+}
+//# sourceMappingURL=AuthService.js.map

package/dist/server/auth/services/AuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/server/auth/services/AuthService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EACL,SAAS,EAIT,eAAe,GAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAC;AAEvF,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;AA4BzD,MAAM,OAAO,WAAY,SAAQ,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAGxD;IACD,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CACxB,IAAI,EACJ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QAC/C,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;QACvC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC;QAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;QACxC,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC;QAEpD,MAAM,qBAAqB,GAAG,CAAC,QAAgB,EAAU,EAAE;YACzD,iEAAiE;YACjE,IAAI,SAAS,GAAG,QAAQ;iBACrB,WAAW,EAAE;iBACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;iBAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,yCAAyC;iBACjE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iCAAiC;YAElD,iCAAiC;YACjC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9B,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;YAClC,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QAEF,MAAM,2BAA2B,GAAG,CAClC,YAAoB,EACkB,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,IAAI,aAAa,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;YACxD,IAAI,OAAO,GAAG,CAAC,CAAC;YAEhB,8CAA8C;YAC9C,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;gBACnE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,OAAO,aAAa,CAAC;gBACvB,CAAC;gBAED,OAAO,EAAE,CAAC;gBACV,MAAM,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC;gBACnC,aAAa;oBACX,qBAAqB,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC;YACnE,CAAC;QACH,CAAC,CAAC,CAAC;QAEL,MAAM,aAAa,GAAG,CAAC,KAAa,EAAwC,EAAE,CAC5E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,MAAM,UAAU,GAAG,4BAA4B,CAAC;YAChD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CAAC,OAAO,EAAE,sBAAsB,CAAC,CACrD,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEL,MAAM,gBAAgB,GAAG,CACvB,QAAgB,EACsB,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CACjB,UAAU,EACV,6CAA6C,CAC9C,CACF,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CACjB,UAAU,EACV,6CAA6C,CAC9C,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACtC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CACjB,UAAU,EACV,6DAA6D,CAC9D,CACF,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEL,MAAM,eAAe,GAAG,CAAC,IAAU,EAAW,EAAE;YAC9C,IAAI,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,sCAAsC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,GAAG,mBAAmB,CAAC;YAC3D,OAAO,GAAG,GAAG,aAAa,CAAC;QAC7B,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAgC,CAC5C,QAAQ,EACR,KAAK,EACL,QAAQ,EACR,SAAS,GAAG,IAAI,EAChB,SAAS,GAAG,IAAI,EAChB,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,kBAAkB;YAClB,KAAK,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAClC,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YAC5B,KAAK,CAAC,CAAC,eAAe,CAAC,wBAAwB,CAAC,QAAQ,CAAC,CAAC;YAE1D,+BAA+B;YAC/B,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YACzD,IAAI,aAAa,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CAAC,OAAO,EAAE,0BAA0B,CAAC,CACzD,CAAC;YACJ,CAAC;YAED,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClE,IAAI,gBAAgB,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CAAC,UAAU,EAAE,wBAAwB,CAAC,CAC1D,CAAC;YACJ,CAAC;YAED,gBAAgB;YAChB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE3D,iCAAiC;YACjC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;YAEnE,0BAA0B;YAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAClC,QAAQ;gBACR,KAAK;gBACL,YAAY;gBACZ,aAAa;aACd,CAAC,CAAC;YAEH,0DAA0D;YAC1D,6DAA6D;YAC7D,uEAAuE;YACvE,KAAK,CAAC,CAAC,cAAc;iBAClB,UAAU,CAAC;gBACV,QAAQ,EAAE,aAAa;gBACvB,KAAK;gBACL,KAAK,EAAE,YAAY,EAAE,+BAA+B;gBACpD,WAAW,EAAE,IAAI,EAAE,oBAAoB;aACxC,CAAC;iBACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE;gBACxB,4CAA4C;gBAC5C,OAAO,CAAC,KAAK,CACX,mCAAmC,aAAa,GAAG,EACnD,KAAK,CACN,CAAC;gBACF,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,CACH,CAAC;YAEJ,kBAAkB;YAClB,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,iBAAiB;gBACzB,YAAY,EAAE,MAAM;gBACpB,UAAU,EAAE,IAAI,CAAC,EAAE;gBACnB,SAAS,EAAE,SAAS,IAAI,IAAI;gBAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;aAC7B,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEL,MAAM,KAAK,GAA6B,CACtC,KAAK,EACL,QAAQ,EACR,SAAS,GAAG,IAAI,EAChB,SAAS,GAAG,IAAI,EAChB,EAAE,CACF,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,qBAAqB;YACrB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAClE,CAAC;YACJ,CAAC;YAED,6BAA6B;YAC7B,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,cAAc;oBACtB,YAAY,EAAE,MAAM;oBACpB,UAAU,EAAE,IAAI,CAAC,EAAE;oBACnB,SAAS,EAAE,SAAS,IAAI,IAAI;oBAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;oBAC5B,OAAO,EAAE,gDAAgD;iBAC1D,CAAC,CAAC;gBAEH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CACX,gBAAgB,EAChB,0FAA0F,CAC3F,CACF,CAAC;YACJ,CAAC;YAED,kBAAkB;YAClB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CACX,qBAAqB,EACrB,2BAA2B,CAC5B,CACF,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC,MAAM,CACnD,QAAQ,EACR,IAAI,CAAC,YAAY,CAClB,CAAC;YAEF,IAAI,CAAC,eAAe,EAAE,CAAC;gBACrB,kCAAkC;gBAClC,KAAK,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAE/C,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;oBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,MAAM,EAAE,cAAc;oBACtB,YAAY,EAAE,MAAM;oBACpB,UAAU,EAAE,IAAI,CAAC,EAAE;oBACnB,SAAS,EAAE,SAAS,IAAI,IAAI;oBAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;oBAC5B,OAAO,EAAE,kBAAkB;iBAC5B,CAAC,CAAC;gBAEH,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAClE,CAAC;YACJ,CAAC;YAED,kDAAkD;YAClD,KAAK,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAE3C,yBAAyB;YACzB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE;gBAClD,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;YACjE,MAAM,gBAAgB,GAAG,eAAe,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACjF,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;YAExE,uCAAuC;YACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC;gBACxC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,SAAS,IAAI,IAAI;gBAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;gBAC5B,SAAS;aACV,CAAC,CAAC;YAEH,yCAAyC;YACzC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC;gBAC9C,GAAG,EAAE,IAAI,CAAC,EAAE;gBACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,GAAG,EAAE,OAAO,CAAC,EAAE;aAChB,CAAC,CAAC;YAEH,gDAAgD;YAChD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,eAAe,CAAC,CAAC;YAErF,kBAAkB;YAClB,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAClB,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,YAAY;gBACpB,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,YAAY,CAAC,EAAE;gBAC3B,SAAS,EAAE,SAAS,IAAI,IAAI;gBAC5B,SAAS,EAAE,SAAS,IAAI,IAAI;aAC7B,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEL,MAAM,MAAM,GAA8B,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAC9D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,iBAAiB;YACjB,KAAK,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAErC,kBAAkB;YAClB,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAClB,MAAM;gBACN,MAAM,EAAE,aAAa;gBACrB,YAAY,EAAE,SAAS;gBACvB,UAAU,EAAE,SAAS;gBACrB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEL,MAAM,WAAW,GAAmC,CAAC,KAAK,EAAE,EAAE,CAC5D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,aAAa;YACb,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;YAEvD,6BAA6B;YAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YAE9D,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC,eAAe,EAAE,mBAAmB,CAAC,CACpD,CAAC;YACJ,CAAC;YAED,8BAA8B;YAC9B,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACnC,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC,eAAe,EAAE,qBAAqB,CAAC,CACtD,CAAC;YACJ,CAAC;YAED,8BAA8B;YAC9B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAC7D,CAAC;YACJ,CAAC;YAED,YAAY;YACZ,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACnD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAClD,CAAC;YACJ,CAAC;YAED,0BAA0B;YAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,SAAS,CAAC,eAAe,EAAE,0BAA0B,CAAC,CAC3D,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEL,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAClD,CAAC,CAAC,CACH,CAAC"}

package/dist/server/auth/services/PasswordService.d.ts

@@ -0,0 +1,12 @@
+import { Context, Effect, Layer } from "effect";
+import { AuthError, ValidationError } from "../../../shared/types.js";
+declare const PasswordService_base: Context.TagClass<PasswordService, "PasswordService", {
+    readonly hash: (password: string) => Effect.Effect<string, AuthError>;
+    readonly verify: (password: string, hash: string) => Effect.Effect<boolean, AuthError>;
+    readonly validatePasswordStrength: (password: string) => Effect.Effect<void, ValidationError>;
+}>;
+export declare class PasswordService extends PasswordService_base {
+    static Live: Layer.Layer<PasswordService, never, never>;
+}
+export {};
+//# sourceMappingURL=PasswordService.d.ts.map

package/dist/server/auth/services/PasswordService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordService.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/services/PasswordService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;;mBAOnD,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;qBACpD,CACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC;uCACH,CACjC,QAAQ,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC;;AAV7C,qBAAa,eAAgB,SAAQ,oBAYlC;IACD,MAAM,CAAC,IAAI,6CAgET;CACH"}

package/dist/server/auth/services/PasswordService.js

@@ -0,0 +1,31 @@
+import { Context, Effect, Layer } from "effect";
+import * as bcrypt from "bcrypt";
+import { AuthError, ValidationError } from "../../../shared/types.js";
+const SALT_ROUNDS = 12;
+export class PasswordService extends Context.Tag("PasswordService")() {
+    static Live = Layer.succeed(this, {
+        hash: (password) => Effect.tryPromise({
+            try: () => bcrypt.hash(password, SALT_ROUNDS),
+            catch: (error) => new AuthError("HASH_FAILED", "Failed to hash password", error),
+        }),
+        verify: (password, hash) => Effect.tryPromise({
+            try: () => bcrypt.compare(password, hash),
+            catch: (error) => new AuthError("VERIFY_FAILED", "Failed to verify password", error),
+        }),
+        validatePasswordStrength: (password) => Effect.gen(function* () {
+            if (password.length < 8) {
+                return yield* Effect.fail(new ValidationError("password", "Password must be at least 8 characters long"));
+            }
+            if (!/[A-Z]/.test(password)) {
+                return yield* Effect.fail(new ValidationError("password", "Password must contain at least one uppercase letter"));
+            }
+            if (!/[a-z]/.test(password)) {
+                return yield* Effect.fail(new ValidationError("password", "Password must contain at least one lowercase letter"));
+            }
+            if (!/[0-9]/.test(password)) {
+                return yield* Effect.fail(new ValidationError("password", "Password must contain at least one number"));
+            }
+        }),
+    });
+}
+//# sourceMappingURL=PasswordService.js.map

package/dist/server/auth/services/PasswordService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordService.js","sourceRoot":"","sources":["../../../../src/server/auth/services/PasswordService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEtE,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,MAAM,OAAO,eAAgB,SAAQ,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAYhE;IACD,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CACzB,IAAI,EACJ;QACE,IAAI,EAAE,CAAC,QAAgB,EAAE,EAAE,CACzB,MAAM,CAAC,UAAU,CAAC;YAChB,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;YAC7C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,SAAS,CACX,aAAa,EACb,yBAAyB,EACzB,KAAK,CACN;SACJ,CAAC;QAEJ,MAAM,EAAE,CAAC,QAAgB,EAAE,IAAY,EAAE,EAAE,CACzC,MAAM,CAAC,UAAU,CAAC;YAChB,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;YACzC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,SAAS,CACX,eAAe,EACf,2BAA2B,EAC3B,KAAK,CACN;SACJ,CAAC;QAEJ,wBAAwB,EAAE,CAAC,QAAgB,EAAE,EAAE,CAC7C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAClB,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CACjB,UAAU,EACV,6CAA6C,CAC9C,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CACjB,UAAU,EACV,qDAAqD,CACtD,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CACjB,UAAU,EACV,qDAAqD,CACtD,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,IAAI,eAAe,CACjB,UAAU,EACV,2CAA2C,CAC5C,CACF,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;KACL,CACF,CAAC"}

package/dist/server/auth/services/SessionRepository.d.ts

@@ -0,0 +1,24 @@
+import { Context, Effect, Layer } from "effect";
+import { DatabaseService } from "../../database/db.js";
+import { DatabaseError, Session } from "../../../shared/types.js";
+export interface CreateSessionData {
+    userId: string;
+    tokenHash: string;
+    ipAddress: string | null;
+    userAgent: string | null;
+    expiresAt: number;
+}
+declare const SessionRepository_base: Context.TagClass<SessionRepository, "SessionRepository", {
+    readonly create: (data: CreateSessionData) => Effect.Effect<Session, DatabaseError>;
+    readonly findById: (id: string) => Effect.Effect<Session | undefined, DatabaseError>;
+    readonly findByTokenHash: (tokenHash: string) => Effect.Effect<Session | undefined, DatabaseError>;
+    readonly updateTokenHash: (id: string, tokenHash: string) => Effect.Effect<Session, DatabaseError>;
+    readonly revoke: (id: string) => Effect.Effect<void, DatabaseError>;
+    readonly revokeAllForUser: (userId: string) => Effect.Effect<void, DatabaseError>;
+    readonly deleteExpired: () => Effect.Effect<number, DatabaseError>;
+}>;
+export declare class SessionRepository extends SessionRepository_base {
+    static Live: Layer.Layer<SessionRepository, never, DatabaseService>;
+}
+export {};
+//# sourceMappingURL=SessionRepository.d.ts.map

package/dist/server/auth/services/SessionRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionRepository.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/services/SessionRepository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAElE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;;qBAKoB,CACf,IAAI,EAAE,iBAAiB,KACpB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC;uBACvB,CACjB,EAAE,EAAE,MAAM,KACP,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,SAAS,EAAE,aAAa,CAAC;8BAC5B,CACxB,SAAS,EAAE,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,OAAO,GAAG,SAAS,EAAE,aAAa,CAAC;8BAC5B,CACxB,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,KACd,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC;qBACzB,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;+BACxC,CACzB,MAAM,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC;4BACf,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;;AApBtE,qBAAa,iBAAkB,SAAQ,sBAsBpC;IACD,MAAM,CAAC,IAAI,yDA6LT;CACH"}

package/dist/server/auth/services/SessionRepository.js

@@ -0,0 +1,101 @@
+import { Context, Effect, Layer } from "effect";
+import { randomUUID } from "node:crypto";
+import { DatabaseService } from "../../database/db.js";
+import { DatabaseError } from "../../../shared/types.js";
+export class SessionRepository extends Context.Tag("SessionRepository")() {
+    static Live = Layer.effect(this, Effect.gen(function* (_) {
+        const db = yield* _(DatabaseService);
+        const create = (data) => Effect.gen(function* (_) {
+            const id = randomUUID();
+            const now = Date.now();
+            yield* _(db.run(`INSERT INTO sessions (
+                id, user_id, token_hash, ip_address, user_agent,
+                created_at, expires_at, is_revoked, revoked_at
+              ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
+                id,
+                data.userId,
+                data.tokenHash,
+                data.ipAddress,
+                data.userAgent,
+                now,
+                data.expiresAt,
+                0, // is_revoked = false
+                null, // revoked_at = null
+            ]));
+            const session = yield* _(findById(id));
+            if (!session) {
+                return yield* _(Effect.fail(new DatabaseError("Failed to retrieve created session")));
+            }
+            return session;
+        });
+        const findById = (id) => Effect.gen(function* (_) {
+            const row = yield* _(db.get("SELECT * FROM sessions WHERE id = ?", [id]));
+            if (!row) {
+                return undefined;
+            }
+            return {
+                id: row.id,
+                userId: row.user_id,
+                tokenHash: row.token_hash,
+                ipAddress: row.ip_address,
+                userAgent: row.user_agent,
+                createdAt: row.created_at,
+                expiresAt: row.expires_at,
+                isRevoked: row.is_revoked === 1,
+                revokedAt: row.revoked_at,
+            };
+        });
+        const findByTokenHash = (tokenHash) => Effect.gen(function* (_) {
+            const row = yield* _(db.get("SELECT * FROM sessions WHERE token_hash = ?", [tokenHash]));
+            if (!row) {
+                return undefined;
+            }
+            return {
+                id: row.id,
+                userId: row.user_id,
+                tokenHash: row.token_hash,
+                ipAddress: row.ip_address,
+                userAgent: row.user_agent,
+                createdAt: row.created_at,
+                expiresAt: row.expires_at,
+                isRevoked: row.is_revoked === 1,
+                revokedAt: row.revoked_at,
+            };
+        });
+        const updateTokenHash = (id, tokenHash) => Effect.gen(function* (_) {
+            yield* _(db.run(`UPDATE sessions
+               SET token_hash = ?
+               WHERE id = ?`, [tokenHash, id]));
+            const session = yield* _(findById(id));
+            if (!session) {
+                return yield* _(Effect.fail(new DatabaseError("Failed to retrieve updated session")));
+            }
+            return session;
+        });
+        const revoke = (id) => Effect.gen(function* (_) {
+            yield* _(db.run(`UPDATE sessions
+               SET is_revoked = 1, revoked_at = ?
+               WHERE id = ?`, [Date.now(), id]));
+        });
+        const revokeAllForUser = (userId) => Effect.gen(function* (_) {
+            yield* _(db.run(`UPDATE sessions
+               SET is_revoked = 1, revoked_at = ?
+               WHERE user_id = ? AND is_revoked = 0`, [Date.now(), userId]));
+        });
+        const deleteExpired = () => Effect.gen(function* (_) {
+            const now = Date.now();
+            const result = yield* _(db.run(`DELETE FROM sessions WHERE expires_at < ?`, [now]));
+            return result.changes ?? 0;
+        });
+        return {
+            create,
+            findById,
+            findByTokenHash,
+            updateTokenHash,
+            revoke,
+            revokeAllForUser,
+            deleteExpired,
+        };
+    }));
+}
+//# sourceMappingURL=SessionRepository.js.map

package/dist/server/auth/services/SessionRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionRepository.js","sourceRoot":"","sources":["../../../../src/server/auth/services/SessionRepository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAW,MAAM,0BAA0B,CAAC;AAUlE,MAAM,OAAO,iBAAkB,SAAQ,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAsBpE;IACD,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CACxB,IAAI,EACJ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,CACb,IAAuB,EACgB,EAAE,CACzC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;YACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAEvB,KAAK,CAAC,CAAC,CAAC,CACN,EAAE,CAAC,GAAG,CACJ;;;mDAGqC,EACrC;gBACE,EAAE;gBACF,IAAI,CAAC,MAAM;gBACX,IAAI,CAAC,SAAS;gBACd,IAAI,CAAC,SAAS;gBACd,IAAI,CAAC,SAAS;gBACd,GAAG;gBACH,IAAI,CAAC,SAAS;gBACd,CAAC,EAAE,qBAAqB;gBACxB,IAAI,EAAE,oBAAoB;aAC3B,CACF,CACF,CAAC;YAEF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC,CAAC,CAAC,CACb,MAAM,CAAC,IAAI,CACT,IAAI,aAAa,CAAC,oCAAoC,CAAC,CACxD,CACF,CAAC;YACJ,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QAEL,MAAM,QAAQ,GAAG,CACf,EAAU,EACyC,EAAE,CACrD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAClB,EAAE,CAAC,GAAG,CAUH,qCAAqC,EAAE,CAAC,EAAE,CAAC,CAAC,CAChD,CAAC;YAEF,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU,KAAK,CAAC;gBAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,MAAM,eAAe,GAAG,CACtB,SAAiB,EACkC,EAAE,CACrD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAClB,EAAE,CAAC,GAAG,CAUH,6CAA6C,EAAE,CAAC,SAAS,CAAC,CAAC,CAC/D,CAAC;YAEF,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,OAAO;gBACnB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU;gBACzB,SAAS,EAAE,GAAG,CAAC,UAAU,KAAK,CAAC;gBAC/B,SAAS,EAAE,GAAG,CAAC,UAAU;aAC1B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,MAAM,eAAe,GAAG,CACtB,EAAU,EACV,SAAiB,EACsB,EAAE,CACzC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,CAAC,CAAC,CACN,EAAE,CAAC,GAAG,CACJ;;4BAEc,EACd,CAAC,SAAS,EAAE,EAAE,CAAC,CAChB,CACF,CAAC;YAEF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,KAAK,CAAC,CAAC,CAAC,CACb,MAAM,CAAC,IAAI,CACT,IAAI,aAAa,CAAC,oCAAoC,CAAC,CACxD,CACF,CAAC;YACJ,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QAEL,MAAM,MAAM,GAAG,CAAC,EAAU,EAAsC,EAAE,CAChE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,CAAC,CAAC,CACN,EAAE,CAAC,GAAG,CACJ;;4BAEc,EACd,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CACjB,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACsB,EAAE,CACtC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,CAAC,CAAC,CACN,EAAE,CAAC,GAAG,CACJ;;oDAEsC,EACtC,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CACrB,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,MAAM,aAAa,GAAG,GAAyC,EAAE,CAC/D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CACrB,EAAE,CAAC,GAAG,CACJ,2CAA2C,EAC3C,CAAC,GAAG,CAAC,CACN,CACF,CAAC;YAEF,OAAO,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QAEL,OAAO;YACL,MAAM;YACN,QAAQ;YACR,eAAe;YACf,eAAe;YACf,MAAM;YACN,gBAAgB;YAChB,aAAa;SACd,CAAC;IACJ,CAAC,CAAC,CACH,CAAC"}

package/dist/server/auth/services/TokenService.d.ts

@@ -0,0 +1,12 @@
+import { Context, Effect, Layer } from "effect";
+import { AuthError, JWTPayload } from "../../../shared/types.js";
+declare const TokenService_base: Context.TagClass<TokenService, "TokenService", {
+    readonly generateToken: (payload: Omit<JWTPayload, "iat" | "exp">) => Effect.Effect<string, AuthError>;
+    readonly verifyToken: (token: string) => Effect.Effect<JWTPayload, AuthError>;
+    readonly hashToken: (token: string) => Effect.Effect<string, never>;
+}>;
+export declare class TokenService extends TokenService_base {
+    static Live: Layer.Layer<TokenService, AuthError, never>;
+}
+export {};
+//# sourceMappingURL=TokenService.d.ts.map

package/dist/server/auth/services/TokenService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenService.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/services/TokenService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAGhD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;;4BAUrC,CACtB,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,KAAK,CAAC,KACrC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;0BACf,CACpB,KAAK,EAAE,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC;wBACrB,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;;AATvE,qBAAa,YAAa,SAAQ,iBAW/B;IACD,MAAM,CAAC,IAAI,8CAsJT;CACH"}

package/dist/server/auth/services/TokenService.js

@@ -0,0 +1,86 @@
+import { Context, Effect, Layer } from "effect";
+import * as jose from "jose";
+import { createHash } from "node:crypto";
+import { AuthError } from "../../../shared/types.js";
+const TOKEN_EXPIRY_DAYS = 7;
+const ALGORITHM = "RS256";
+let keyPair = null;
+export class TokenService extends Context.Tag("TokenService")() {
+    static Live = Layer.effect(this, Effect.gen(function* (_) {
+        // Generate key pair if not already generated
+        if (!keyPair) {
+            const { publicKey, privateKey } = yield* _(Effect.tryPromise({
+                try: () => jose.generateKeyPair(ALGORITHM),
+                catch: (error) => new AuthError("KEY_GENERATION_FAILED", "Failed to generate RSA key pair", error),
+            }));
+            keyPair = { publicKey, privateKey };
+        }
+        const generateToken = (payload) => Effect.gen(function* (_) {
+            const currentKeyPair = keyPair;
+            if (!currentKeyPair) {
+                return yield* _(Effect.fail(new AuthError("KEY_NOT_INITIALIZED", "Key pair not initialized")));
+            }
+            const now = Math.floor(Date.now() / 1000);
+            // Type assertion needed for index signature compatibility
+            const sub = payload["sub"];
+            const username = payload["username"];
+            const email = payload["email"];
+            const jti = payload["jti"];
+            if (typeof sub !== "string" ||
+                typeof username !== "string" ||
+                typeof email !== "string" ||
+                typeof jti !== "string") {
+                return yield* _(Effect.fail(new AuthError("INVALID_PAYLOAD", "Payload contains invalid field types")));
+            }
+            const fullPayload = {
+                sub,
+                username,
+                email,
+                jti,
+                iat: now,
+                exp: now + TOKEN_EXPIRY_DAYS * 24 * 60 * 60,
+            };
+            return yield* _(Effect.tryPromise({
+                try: () => new jose.SignJWT(fullPayload)
+                    .setProtectedHeader({ alg: ALGORITHM })
+                    .setIssuedAt(fullPayload.iat)
+                    .setExpirationTime(fullPayload.exp)
+                    .sign(currentKeyPair.privateKey),
+                catch: (error) => new AuthError("TOKEN_GENERATION_FAILED", "Failed to generate JWT token", error),
+            }));
+        });
+        const verifyToken = (token) => Effect.gen(function* (_) {
+            const currentKeyPair = keyPair;
+            if (!currentKeyPair) {
+                return yield* _(Effect.fail(new AuthError("KEY_NOT_INITIALIZED", "Key pair not initialized")));
+            }
+            const result = yield* _(Effect.tryPromise({
+                try: () => jose.jwtVerify(token, currentKeyPair.publicKey),
+                catch: (error) => new AuthError("TOKEN_VERIFICATION_FAILED", "Invalid or expired token", error),
+            }));
+            const payload = result.payload;
+            // Validate payload structure using bracket notation for index signature properties
+            if (typeof payload.sub !== "string" ||
+                typeof payload["username"] !== "string" ||
+                typeof payload["email"] !== "string" ||
+                typeof payload.iat !== "number" ||
+                typeof payload.exp !== "number" ||
+                typeof payload.jti !== "string") {
+                return yield* _(Effect.fail(new AuthError("INVALID_TOKEN_PAYLOAD", "Token payload is missing required fields")));
+            }
+            return {
+                sub: payload.sub,
+                username: payload["username"],
+                email: payload["email"],
+                iat: payload.iat,
+                exp: payload.exp,
+                jti: payload.jti,
+            };
+        });
+        const hashToken = (token) => Effect.sync(() => {
+            return createHash("sha256").update(token).digest("hex");
+        });
+        return { generateToken, verifyToken, hashToken };
+    }));
+}
+//# sourceMappingURL=TokenService.js.map

package/dist/server/auth/services/TokenService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TokenService.js","sourceRoot":"","sources":["../../../../src/server/auth/services/TokenService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAc,MAAM,0BAA0B,CAAC;AAEjE,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,SAAS,GAAG,OAAO,CAAC;AAE1B,IAAI,OAAO,GAAiE,IAAI,CAAC;AAEjF,MAAM,OAAO,YAAa,SAAQ,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAW1D;IACD,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CACxB,IAAI,EACJ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrB,6CAA6C;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CACxC,MAAM,CAAC,UAAU,CAAC;gBAChB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;gBAC1C,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,SAAS,CACX,uBAAuB,EACvB,iCAAiC,EACjC,KAAK,CACN;aACJ,CAAC,CACH,CAAC;YACF,OAAO,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;QACtC,CAAC;QAED,MAAM,aAAa,GAAG,CACpB,OAAwC,EACN,EAAE,CACpC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,MAAM,cAAc,GAAG,OAAO,CAAC;YAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,CAAC,CAAC,CACb,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CACX,qBAAqB,EACrB,0BAA0B,CAC3B,CACF,CACF,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YAE1C,0DAA0D;YAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YACrC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAE3B,IACE,OAAO,GAAG,KAAK,QAAQ;gBACvB,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,OAAO,KAAK,KAAK,QAAQ;gBACzB,OAAO,GAAG,KAAK,QAAQ,EACvB,CAAC;gBACD,OAAO,KAAK,CAAC,CAAC,CAAC,CACb,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CACX,iBAAiB,EACjB,sCAAsC,CACvC,CACF,CACF,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAe;gBAC9B,GAAG;gBACH,QAAQ;gBACR,KAAK;gBACL,GAAG;gBACH,GAAG,EAAE,GAAG;gBACR,GAAG,EAAE,GAAG,GAAG,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;aAC5C,CAAC;YAEF,OAAO,KAAK,CAAC,CAAC,CAAC,CACb,MAAM,CAAC,UAAU,CAAC;gBAChB,GAAG,EAAE,GAAG,EAAE,CACR,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;qBAC1B,kBAAkB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;qBACtC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC;qBAC5B,iBAAiB,CAAC,WAAW,CAAC,GAAG,CAAC;qBAClC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;gBACpC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,SAAS,CACX,yBAAyB,EACzB,8BAA8B,EAC9B,KAAK,CACN;aACJ,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,MAAM,WAAW,GAAG,CAAC,KAAa,EAAwC,EAAE,CAC1E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrB,MAAM,cAAc,GAAG,OAAO,CAAC;YAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,KAAK,CAAC,CAAC,CAAC,CACb,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CACX,qBAAqB,EACrB,0BAA0B,CAC3B,CACF,CACF,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CACrB,MAAM,CAAC,UAAU,CAAC;gBAChB,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,SAAS,CAAC;gBAC1D,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,SAAS,CACX,2BAA2B,EAC3B,0BAA0B,EAC1B,KAAK,CACN;aACJ,CAAC,CACH,CAAC;YAEF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAE/B,mFAAmF;YACnF,IACE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAC/B,OAAO,OAAO,CAAC,UAAU,CAAC,KAAK,QAAQ;gBACvC,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,QAAQ;gBACpC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;gBAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAC/B,CAAC;gBACD,OAAO,KAAK,CAAC,CAAC,CAAC,CACb,MAAM,CAAC,IAAI,CACT,IAAI,SAAS,CACX,uBAAuB,EACvB,0CAA0C,CAC3C,CACF,CACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC;gBAC7B,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC;gBACvB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,MAAM,SAAS,GAAG,CAAC,KAAa,EAAgC,EAAE,CAChE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE;YACf,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QAEL,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IACnD,CAAC,CAAC,CACH,CAAC"}

package/dist/server/auth/services/UserRepository.d.ts

@@ -0,0 +1,23 @@
+import { Context, Effect, Layer } from "effect";
+import { DatabaseService } from "../../database/db.js";
+import { DatabaseError, User } from "../../../shared/types.js";
+export interface CreateUserData {
+    username: string;
+    email: string;
+    passwordHash: string | null;
+    linuxUsername: string;
+}
+declare const UserRepository_base: Context.TagClass<UserRepository, "UserRepository", {
+    readonly create: (data: CreateUserData) => Effect.Effect<User, DatabaseError>;
+    readonly findById: (id: string) => Effect.Effect<User | undefined, DatabaseError>;
+    readonly findByEmail: (email: string) => Effect.Effect<User | undefined, DatabaseError>;
+    readonly findByUsername: (username: string) => Effect.Effect<User | undefined, DatabaseError>;
+    readonly update: (id: string, data: Partial<User>) => Effect.Effect<User, DatabaseError>;
+    readonly incrementFailedLogins: (id: string) => Effect.Effect<void, DatabaseError>;
+    readonly resetFailedLogins: (id: string) => Effect.Effect<void, DatabaseError>;
+}>;
+export declare class UserRepository extends UserRepository_base {
+    static Live: Layer.Layer<UserRepository, never, DatabaseService>;
+}
+export {};
+//# sourceMappingURL=UserRepository.d.ts.map