nucleus-core-ts 0.9.730 → 0.9.731

package/dist/src/ElysiaPlugin/routes/auth/accountState.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Shared, fail-closed account-state kill-switch for EVERY token-minting auth path
+ * (password login, OAuth callback, magic-link verify, WebAuthn, refresh). A locked or
+ * deactivated account must not be able to obtain a fresh access/refresh token or session
+ * through ANY path — otherwise an admin's lock/deactivation is trivially bypassed by simply
+ * logging in again via a different mechanism. Centralized here so the invariant can't drift
+ * out of sync between handlers again.
+ *
+ * Semantics mirror the canonical refresh check (routes/auth/refresh):
+ *  - `isActive === false` → denied (admin deactivation). Absent/undefined isActive is NOT a
+ *    denial, so deployments without the column keep working (fail-open only on absence).
+ *  - `isLocked === true` AND the lock has NOT expired (`lockedUntil` null or in the future)
+ *    → denied. A past `lockedUntil` means the lock lapsed and no longer blocks.
+ *
+ * Cohort-expiry is intentionally NOT handled here: it needs a separate table lookup and is
+ * enforced per-path where cohorts apply (login/refresh).
+ */
+export interface AccountStateFields {
+    isActive?: unknown;
+    isLocked?: unknown;
+    lockedUntil?: unknown;
+}
+export type AccountStateResult = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: 'inactive' | 'locked';
+    message: string;
+};
+export declare function evaluateAccountState(user: AccountStateFields, now?: Date): AccountStateResult;

package/dist/src/ElysiaPlugin/routes/auth/accountState.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "nucleus-core-ts",
-	"version": "0.9.730",
+	"version": "0.9.731",
 	"description": "Production-ready, enterprise-grade TypeScript framework for building multi-tenant APIs",
 	"author": "Hidayet Can Özcan <hidayetcan@gmail.com>",
 	"license": "SEE LICENSE IN LICENSE",