@atlasauth/cli 0.12.0 → 0.14.0

package/dist/migrate/export/hanko.js

@@ -0,0 +1,605 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hankoPasswordHash = hankoPasswordHash;
+exports.exportHankoTables = exportHankoTables;
+exports.exportHankoApi = exportHankoApi;
+const tables_1 = require("./frameworks/tables");
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+/** Hanko's built-in third-party providers (`third_party.providers.<name>`); `custom_<key>` are custom OIDC providers. */
+const BUILT_IN_PROVIDERS = new Set(['apple', 'discord', 'facebook', 'github', 'google', 'linkedin', 'microsoft']);
+/** Hanko's TOTP parameters (flow_api/services/totp.go: pquerna/otp defaults, not configurable). */
+const TOTP = { digits: 6, period: 30, algorithm: 'SHA1' };
+const NO_PASSKEY_RP = 'Passkeys were left out: pass the relying-party id they were registered for (--set hanko-rp-id=<webauthn.relying_party.id>, e.g. example.com).';
+const MFA_ONLY_NOTE = (n) => `${n} WebAuthn credential(s) were Hanko security keys used only as a second factor (mfa_only). They move as passkeys bound to the same relying-party id; Atlas can also accept them as a first factor.`;
+// ── password hashes ─────────────────────────────────────────────────────────
+/**
+ * Hanko's own Firebase-scrypt import format (flow_api/services/password.go,
+ * after Supabase's): `$fbscrypt$v=1,n=<mem cost>,r=<rounds>,p=<parallelism>,ss=<salt
+ * separator>,sk=<signer key>$<salt>$<hash>`, every value standard base64.
+ */
+const FBSCRYPT = /^\$fbscrypt\$v=(\d+),n=(\d+),r=(\d+),p=(\d+)(?:,ss=([^,$]+))?(?:,sk=([^$]+))?\$([^$]+)\$(.+)$/;
+/** A Hanko `password_credentials.password` as a bundle password; null when Atlas cannot verify it. */
+function hankoPasswordHash(raw) {
+    const digest = (0, tables_1.text)(raw);
+    if (!digest)
+        return null;
+    if (/^\$2[aby]\$\d{2}\$[./A-Za-z0-9]{53}$/.test(digest))
+        return { algorithm: 'bcrypt', hash: digest };
+    const m = FBSCRYPT.exec(digest);
+    // Atlas's scrypt_firebase verifier is Firebase's own construction: version 1, p = 1.
+    if (!m || m[1] !== '1' || m[4] !== '1' || !m[6])
+        return null;
+    return {
+        algorithm: 'scrypt_firebase',
+        hash: m[8],
+        salt: m[7],
+        params: { rounds: Number(m[3]), mem_cost: Number(m[2]), salt_separator: m[5] ?? '', signer_key: m[6] },
+    };
+}
+// ── shared mapping ──────────────────────────────────────────────────────────
+/** Base64url bytes as Hanko stores them (raw URL encoding); other encodings are normalised. */
+function b64u(v) {
+    const s = (0, tables_1.text)(v);
+    if (!s)
+        return undefined;
+    return /^[A-Za-z0-9_-]+$/.test(s) ? s : (0, tables_1.base64url)(s);
+}
+const ZERO_AAGUID = '00000000-0000-0000-0000-000000000000';
+function passkey(o) {
+    const credentialId = b64u(o.id);
+    const publicKey = b64u(o.publicKey);
+    if (!credentialId || !publicKey)
+        return null;
+    const aaguid = (0, tables_1.text)(o.aaguid);
+    const count = Number(o.signCount);
+    return (0, record_set_1.compact)({
+        id: credentialId,
+        user_id: o.userId,
+        credential_id: credentialId,
+        public_key: publicKey,
+        sign_count: Number.isFinite(count) && count > 0 ? count : undefined,
+        rp_id: o.rpId,
+        transports: o.transports,
+        aaguid: aaguid && aaguid !== ZERO_AAGUID ? aaguid : undefined,
+        backed_up: o.backedUp === undefined ? undefined : (0, tables_1.bool)(o.backedUp),
+        name: (0, tables_1.text)(o.name),
+        created_at: (0, tables_1.time)(o.createdAt),
+    });
+}
+/** A metadata column / field: a JSON object (or the string Hanko stores), only when it has keys. */
+function metadata(v) {
+    return (0, record_set_1.bag)((0, record_set_1.isObj)(v) ? v : (0, tables_1.json)(v));
+}
+/** `user_custom_claims.claims` stores `{ name: { value, source } }`; the Admin API returns them flat. */
+function customClaims(v, wrapped) {
+    const o = (0, record_set_1.isObj)(v) ? v : (0, tables_1.json)(v);
+    if (!o)
+        return undefined;
+    if (!wrapped)
+        return (0, record_set_1.bag)(o);
+    const flat = {};
+    for (const [k, c] of Object.entries(o))
+        flat[k] = (0, record_set_1.isObj)(c) && 'value' in c ? c.value : c;
+    return (0, record_set_1.bag)(flat);
+}
+function privateMetadata(priv, claims) {
+    // Custom claims Hanko put in the session JWT: kept for a JWT template to add back.
+    return (0, record_set_1.bag)({ ...(priv ?? {}), ...(claims ? { hanko_custom_claims: claims } : {}) });
+}
+/** A third-party / SAML identity. `provider` is Hanko's provider id (`google`, `custom_<key>`, or a SAML IdP's entity id). */
+function identity(o) {
+    const kind = o.saml ? 'saml' : BUILT_IN_PROVIDERS.has(o.provider) ? 'oauth' : 'oidc';
+    const verified = o.data?.email_verified;
+    return (0, record_set_1.compact)({
+        id: o.id,
+        user_id: o.userId,
+        provider: o.provider,
+        provider_user_id: o.providerUserId,
+        kind,
+        sso_connection_id: o.ssoConnectionId,
+        email: (0, record_set_1.str)(o.data?.email)?.toLowerCase() ?? o.fallbackEmail,
+        email_verified: verified === undefined ? undefined : verified === true || verified === 'true',
+        profile: (0, record_set_1.bag)(o.data),
+    });
+}
+function sortedEmails(list) {
+    // Primary first, the rest in the order Hanko had them.
+    return [...list.filter((e) => e.primary), ...list.filter((e) => !e.primary)];
+}
+/** A Hanko user with neither an email nor a username cannot be imported (nothing to sign in with). */
+const NO_IDENTIFIER = 'Hanko user without an email address or username';
+function membershipRole(slugs, set) {
+    const sorted = [...new Set(slugs)].sort();
+    if (sorted.length > 1)
+        set.warn('Some memberships carry more than one Hanko role: Atlas keeps one role per membership (the first by slug); grant the others again in Atlas.');
+    return sorted[0] ?? 'member';
+}
+// ── the database dump ───────────────────────────────────────────────────────
+/** Read a Hanko database dump (pure). */
+function exportHankoTables(tables, opts = {}) {
+    const set = new record_set_1.RecordSet();
+    const tenant = pickTenant(tables, opts.tenantId);
+    const rows = (...names) => tables.rows(...names).filter((r) => !tenant || !(0, tables_1.text)((0, tables_1.col)(r, 'tenant_id')) || (0, tables_1.text)((0, tables_1.col)(r, 'tenant_id')) === tenant);
+    const by = (list, key, value) => {
+        const out = new Map();
+        for (const r of list) {
+            const k = (0, tables_1.text)((0, tables_1.col)(r, key));
+            const v = value(r);
+            if (!k || v === undefined)
+                continue;
+            out.set(k, [...(out.get(k) ?? []), v]);
+        }
+        return out;
+    };
+    const userRows = rows('users');
+    if (!userRows.length)
+        throw new Error('No users table in the dump (expected users.json / users.ndjson / users.csv from the Hanko database).');
+    // users.id is internal; the JWT `sub` (and every Admin API id) is public_id, equal to id unless set on creation.
+    const publicId = new Map();
+    for (const u of userRows) {
+        const id = (0, tables_1.text)((0, tables_1.col)(u, 'id'));
+        if (id)
+            publicId.set(id, (0, tables_1.text)((0, tables_1.col)(u, 'public_id')) ?? id);
+    }
+    const primaries = new Set(rows('primary_emails').map((r) => (0, tables_1.text)((0, tables_1.col)(r, 'email_id'))).filter((v) => !!v));
+    const emailRows = rows('emails');
+    const emailById = new Map();
+    for (const e of emailRows) {
+        const id = (0, tables_1.text)((0, tables_1.col)(e, 'id'));
+        const address = (0, tables_1.text)((0, tables_1.col)(e, 'address'));
+        if (id && address)
+            emailById.set(id, { address: address.toLowerCase(), userId: (0, tables_1.text)((0, tables_1.col)(e, 'user_id')) });
+    }
+    const emailsOf = by(emailRows, 'user_id', (e) => {
+        const address = (0, tables_1.text)((0, tables_1.col)(e, 'address'));
+        return address ? { email: address.toLowerCase(), verified: (0, tables_1.bool)((0, tables_1.col)(e, 'verified')), primary: primaries.has((0, tables_1.text)((0, tables_1.col)(e, 'id')) ?? '') } : undefined;
+    });
+    const usernameOf = new Map();
+    for (const r of rows('usernames')) {
+        const userId = (0, tables_1.text)((0, tables_1.col)(r, 'user_id'));
+        const username = (0, tables_1.text)((0, tables_1.col)(r, 'username'));
+        if (userId && username)
+            usernameOf.set(userId, username);
+    }
+    const passwordOf = new Map();
+    for (const r of rows('password_credentials')) {
+        const userId = (0, tables_1.text)((0, tables_1.col)(r, 'user_id'));
+        if (userId)
+            passwordOf.set(userId, (0, tables_1.col)(r, 'password'));
+    }
+    const metadataOf = new Map();
+    for (const r of rows('user_metadata')) {
+        const userId = (0, tables_1.text)((0, tables_1.col)(r, 'user_id'));
+        if (userId)
+            metadataOf.set(userId, r);
+    }
+    const claimsOf = new Map();
+    for (const r of rows('user_custom_claims')) {
+        const userId = (0, tables_1.text)((0, tables_1.col)(r, 'user_id'));
+        const claims = customClaims((0, tables_1.col)(r, 'claims'), true);
+        if (userId && claims)
+            claimsOf.set(userId, claims);
+    }
+    // ── users ──
+    const exported = new Map(); // internal id → exported (public) id
+    let unsupportedHashes = 0;
+    for (const u of userRows) {
+        const id = (0, tables_1.text)((0, tables_1.col)(u, 'id'));
+        if (!id)
+            continue;
+        const pub = publicId.get(id);
+        let emails = sortedEmails(emailsOf.get(id) ?? []);
+        // Hanko before late 2022 kept one address on the user row.
+        const legacyEmail = (0, tables_1.text)((0, tables_1.col)(u, 'email'));
+        if (!emails.length && legacyEmail)
+            emails = [{ email: legacyEmail.toLowerCase(), verified: (0, tables_1.bool)((0, tables_1.col)(u, 'verified')), primary: true }];
+        if (emails.length && !emails.some((e) => e.primary))
+            emails[0] = { ...emails[0], primary: true };
+        const username = usernameOf.get(id) ?? (0, tables_1.text)((0, tables_1.col)(u, 'username'));
+        if (!emails.length && !username) {
+            set.omit('user', NO_IDENTIFIER);
+            continue;
+        }
+        let password;
+        if (passwordOf.has(id)) {
+            password = hankoPasswordHash(passwordOf.get(id)) ?? undefined;
+            if (!password)
+                unsupportedHashes++;
+        }
+        const meta = metadataOf.get(id);
+        set.add('user', (0, record_set_1.compact)({
+            id: pub,
+            emails,
+            username,
+            first_name: (0, tables_1.text)((0, tables_1.col)(u, 'given_name')),
+            last_name: (0, tables_1.text)((0, tables_1.col)(u, 'family_name')),
+            name: (0, tables_1.text)((0, tables_1.col)(u, 'name')),
+            image_url: (0, tables_1.text)((0, tables_1.col)(u, 'picture')),
+            password,
+            public_metadata: meta ? metadata((0, tables_1.col)(meta, 'public_metadata')) : undefined,
+            private_metadata: privateMetadata(meta ? metadata((0, tables_1.col)(meta, 'private_metadata')) : undefined, claimsOf.get(id)),
+            unsafe_metadata: meta ? metadata((0, tables_1.col)(meta, 'unsafe_metadata')) : undefined,
+            created_at: (0, tables_1.time)((0, tables_1.col)(u, 'created_at')),
+        }), pub);
+        exported.set(id, pub);
+    }
+    if (unsupportedHashes) {
+        set.warn(`${unsupportedHashes} password hash(es) are in a format Atlas cannot verify: those users sign in once through the hanko lazy-migration preset (or reset their password).`);
+    }
+    const owner = (internal) => (internal ? exported.get(internal) : undefined);
+    // ── SAML providers (Hanko ≥ 2.x keeps them in the database; config.yaml ones are synthesised below) ──
+    const metadataByProvider = new Map();
+    for (const m of rows('saml_idp_metadata')) {
+        const pid = (0, tables_1.text)((0, tables_1.col)(m, 'provider_id'));
+        if (pid)
+            metadataByProvider.set(pid, m);
+    }
+    const connectionByDomain = new Map();
+    for (const p of rows('saml_providers')) {
+        const id = (0, tables_1.text)((0, tables_1.col)(p, 'id'));
+        const domain = (0, tables_1.text)((0, tables_1.col)(p, 'domain'))?.toLowerCase();
+        if (!id)
+            continue;
+        if (domain)
+            connectionByDomain.set(domain, id);
+        const md = metadataByProvider.get(id);
+        const attrs = (0, tables_1.json)((0, tables_1.col)(p, 'attribute_map'));
+        const mapping = {};
+        for (const [k, v] of Object.entries(attrs ?? {}))
+            if (typeof v === 'string' && v)
+                mapping[k] = v;
+        set.add('sso_connection', (0, record_set_1.compact)({
+            id,
+            name: (0, tables_1.text)((0, tables_1.col)(p, 'name')),
+            protocol: 'saml',
+            domains: domain ? [domain] : undefined,
+            enabled: (0, tables_1.col)(p, 'enabled') === undefined ? undefined : (0, tables_1.bool)((0, tables_1.col)(p, 'enabled')),
+            saml: (0, record_set_1.compact)({
+                idp_entity_id: (0, tables_1.text)((0, tables_1.col)(p, 'entity_id')) ?? (md ? (0, tables_1.text)((0, tables_1.col)(md, 'issuer')) : undefined),
+                idp_metadata_url: (0, tables_1.text)((0, tables_1.col)(p, 'metadata_url')),
+                idp_metadata_xml: md ? (0, tables_1.text)((0, tables_1.col)(md, 'raw_metadata_xml')) : undefined,
+                idp_sso_url: md ? (0, tables_1.text)((0, tables_1.col)(md, 'sso_url')) : undefined,
+                idp_certificate: md ? (0, tables_1.text)((0, tables_1.col)(md, 'certificates_pem')) : undefined,
+                attribute_mapping: Object.keys(mapping).length ? mapping : undefined,
+            }),
+        }), id);
+    }
+    // ── identities ──
+    const samlDomainOf = new Map();
+    for (const s of rows('saml_identities')) {
+        const identityId = (0, tables_1.text)((0, tables_1.col)(s, 'identity_id'));
+        const domain = (0, tables_1.text)((0, tables_1.col)(s, 'domain'))?.toLowerCase();
+        if (identityId && domain)
+            samlDomainOf.set(identityId, domain);
+    }
+    const providers = new Set();
+    let synthesized = 0;
+    for (const r of rows('identities')) {
+        // Before 2025 the columns were provider_id (the provider's user id) and provider_name.
+        const legacy = (0, tables_1.col)(r, 'provider_name') !== undefined;
+        const provider = (0, tables_1.text)((0, tables_1.col)(r, legacy ? 'provider_name' : 'provider_id'));
+        const providerUserId = (0, tables_1.text)((0, tables_1.col)(r, legacy ? 'provider_id' : 'provider_user_id'));
+        const emailId = (0, tables_1.text)((0, tables_1.col)(r, 'email_id'));
+        const user = owner((0, tables_1.text)((0, tables_1.col)(r, 'user_id')) ?? (emailId ? emailById.get(emailId)?.userId : undefined));
+        if (!provider || !providerUserId || !user) {
+            set.omit('identity', 'Identity whose user was not exported');
+            continue;
+        }
+        const id = (0, tables_1.text)((0, tables_1.col)(r, 'id'));
+        const domain = id ? samlDomainOf.get(id) : undefined;
+        let ssoConnectionId;
+        if (domain) {
+            ssoConnectionId = connectionByDomain.get(domain);
+            if (!ssoConnectionId) {
+                // A SAML provider configured in config.yaml: the connection is created from what the identity knows.
+                ssoConnectionId = `saml:${domain}`;
+                connectionByDomain.set(domain, ssoConnectionId);
+                set.add('sso_connection', { id: ssoConnectionId, name: domain, protocol: 'saml', domains: [domain], saml: { idp_entity_id: provider } }, ssoConnectionId);
+                synthesized++;
+            }
+        }
+        else {
+            providers.add(provider);
+        }
+        set.add('identity', identity({
+            id,
+            userId: user,
+            provider,
+            providerUserId,
+            data: (0, tables_1.json)((0, tables_1.col)(r, 'data')),
+            ssoConnectionId,
+            saml: Boolean(domain),
+            fallbackEmail: emailId ? emailById.get(emailId)?.address : undefined,
+        }), `${provider}\u0000${providerUserId}`);
+    }
+    if (synthesized) {
+        set.warn(`${synthesized} SAML connection(s) come from config.yaml (saml.identity_providers) and were created from their users' identities: add each IdP's metadata URL in Atlas (atlas migrate hanko config lists them).`);
+    }
+    // ── TOTP ──
+    for (const r of rows('otp_secrets')) {
+        const user = owner((0, tables_1.text)((0, tables_1.col)(r, 'user_id')));
+        const secret = (0, tables_1.text)((0, tables_1.col)(r, 'secret'))?.replace(/=+$/, '').toUpperCase();
+        if (!user || !secret)
+            continue;
+        set.add('mfa_factor', (0, record_set_1.compact)({ id: (0, tables_1.text)((0, tables_1.col)(r, 'id')), user_id: user, type: 'totp', secret_base32: secret, ...TOTP, verified: true, created_at: (0, tables_1.time)((0, tables_1.col)(r, 'created_at')) }));
+    }
+    // ── passkeys and security keys ──
+    const transports = by(rows('webauthn_credential_transports'), 'webauthn_credential_id', (t) => (0, tables_1.text)((0, tables_1.col)(t, 'name')));
+    const credentials = rows('webauthn_credentials').filter((c) => owner((0, tables_1.text)((0, tables_1.col)(c, 'user_id'))));
+    if (credentials.length && !opts.rpId) {
+        set.omit('passkey', 'No relying-party id given (--set hanko-rp-id)', credentials.length);
+        set.warn(NO_PASSKEY_RP);
+    }
+    else if (opts.rpId) {
+        let mfaOnly = 0;
+        for (const c of credentials) {
+            const record = passkey({
+                id: (0, tables_1.col)(c, 'id'),
+                userId: owner((0, tables_1.text)((0, tables_1.col)(c, 'user_id'))),
+                publicKey: (0, tables_1.col)(c, 'public_key'),
+                rpId: opts.rpId,
+                signCount: (0, tables_1.col)(c, 'sign_count'),
+                aaguid: (0, tables_1.col)(c, 'aaguid'),
+                backedUp: (0, tables_1.col)(c, 'backup_state'),
+                name: (0, tables_1.col)(c, 'name'),
+                transports: transports.get((0, tables_1.text)((0, tables_1.col)(c, 'id')) ?? '') ?? [],
+                createdAt: (0, tables_1.col)(c, 'created_at'),
+            });
+            if (!record) {
+                set.omit('passkey', 'WebAuthn credential without an id or public key');
+                continue;
+            }
+            if ((0, tables_1.bool)((0, tables_1.col)(c, 'mfa_only')))
+                mfaOnly++;
+            set.add('passkey', record, record.credential_id);
+        }
+        if (mfaOnly)
+            set.warn(MFA_ONLY_NOTE(mfaOnly));
+    }
+    // ── organizations, roles, memberships ──
+    for (const o of rows('organizations')) {
+        const id = (0, tables_1.text)((0, tables_1.col)(o, 'id'));
+        const name = (0, tables_1.text)((0, tables_1.col)(o, 'name'));
+        if (id && name)
+            set.add('organization', (0, record_set_1.compact)({ id, name, created_at: (0, tables_1.time)((0, tables_1.col)(o, 'created_at')) }), id);
+    }
+    const roleSlug = new Map();
+    for (const r of rows('roles')) {
+        const id = (0, tables_1.text)((0, tables_1.col)(r, 'id'));
+        const slug = (0, tables_1.text)((0, tables_1.col)(r, 'slug'));
+        if (!id || !slug)
+            continue;
+        roleSlug.set(id, slug);
+        set.add('role', (0, record_set_1.compact)({ key: slug, name: (0, tables_1.text)((0, tables_1.col)(r, 'name')), scope: 'organization' }), slug);
+    }
+    const bindings = new Map();
+    for (const b of rows('role_bindings')) {
+        const slug = roleSlug.get((0, tables_1.text)((0, tables_1.col)(b, 'role_id')) ?? '');
+        const key = `${(0, tables_1.text)((0, tables_1.col)(b, 'user_id'))}\u0000${(0, tables_1.text)((0, tables_1.col)(b, 'organization_id'))}`;
+        if (slug)
+            bindings.set(key, [...(bindings.get(key) ?? []), slug]);
+    }
+    for (const m of rows('organization_memberships')) {
+        const internal = (0, tables_1.text)((0, tables_1.col)(m, 'user_id'));
+        const user = owner(internal);
+        const org = (0, tables_1.text)((0, tables_1.col)(m, 'organization_id'));
+        if (!user || !org) {
+            set.omit('membership', 'Membership whose user was not exported');
+            continue;
+        }
+        set.add('membership', (0, record_set_1.compact)({ id: (0, tables_1.text)((0, tables_1.col)(m, 'id')), organization_id: org, user_id: user, role: membershipRole(bindings.get(`${internal}\u0000${org}`) ?? [], set), created_at: (0, tables_1.time)((0, tables_1.col)(m, 'created_at')) }), `${org}\u0000${user}`);
+    }
+    // ── what does not move ──
+    const now = Date.now();
+    const live = rows('sessions').filter((s) => {
+        const exp = (0, tables_1.timeMs)((0, tables_1.col)(s, 'expires_at'));
+        return exp === undefined || exp > now;
+    }).length;
+    if (live)
+        set.omit('session', 'Hanko sessions are JWTs the bridge accepts as they are (hanko preset)', live);
+    const webhooks = rows('webhooks').length;
+    if (webhooks)
+        set.warn(`${webhooks} Hanko webhook(s) in the database: recreate them as Atlas webhooks (the event names differ).`);
+    set.manifest = (0, record_set_1.compact)({
+        origin: tenant ? `Hanko database dump (tenant ${tenant})` : 'Hanko database dump',
+        rpId: opts.rpId,
+        providers: [...providers].sort(),
+        settings: (0, record_set_1.compact)({ hanko_tenant_id: tenant, totp: { ...TOTP } }),
+    });
+    return set;
+}
+/** The tenant to export: the one given, the only one in the dump, or an error naming them. */
+function pickTenant(tables, given) {
+    if (given)
+        return given;
+    const tenants = new Set(tables.rows('users').map((u) => (0, tables_1.text)((0, tables_1.col)(u, 'tenant_id'))).filter((t) => !!t));
+    if (tenants.size > 1) {
+        throw new Error(`The dump holds users of ${tenants.size} Hanko tenants (${[...tenants].sort().join(', ')}): export one at a time with --set hanko-tenant-id=<tenant id>.`);
+    }
+    return undefined;
+}
+// ── the Admin API ───────────────────────────────────────────────────────────
+/** Every page of a Hanko admin listing (`?page=&per_page=`; Link / X-Total-Count headers). Null when the endpoint does not exist. */
+async function pages(http, path, size, optional) {
+    const out = [];
+    for (let page = 1;; page++) {
+        let res;
+        try {
+            res = await http.get(`${path}?page=${page}&per_page=${size}`);
+        }
+        catch (err) {
+            // Older Hanko versions have no organizations / roles.
+            if (optional && err instanceof vendor_http_1.VendorApiError && err.status === 404)
+                return null;
+            throw err;
+        }
+        const list = (0, record_set_1.objs)(res.body);
+        out.push(...list);
+        const total = Number(res.headers.get('x-total-count'));
+        if (list.length < size || (Number.isFinite(total) && total > 0 && out.length >= total))
+            return out;
+    }
+}
+/** Read a Hanko project through the Admin API. */
+async function exportHankoApi(o) {
+    const set = new record_set_1.RecordSet();
+    const progress = o.onProgress ?? (() => undefined);
+    const size = Math.min(Math.max(o.pageSize ?? 100, 1), 1000);
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'Hanko',
+        baseUrl: o.adminUrl,
+        headers: o.apiKey ? { authorization: `Bearer ${o.apiKey}` } : {},
+        fetchImpl: o.fetchImpl,
+        sleep: o.sleep,
+    });
+    progress('organizations');
+    for (const org of (await pages(http, '/organizations', size, true)) ?? []) {
+        const id = (0, record_set_1.str)(org.id);
+        const name = (0, record_set_1.str)(org.name);
+        if (id && name)
+            set.add('organization', (0, record_set_1.compact)({ id, name, created_at: (0, record_set_1.str)(org.created_at) }), id);
+    }
+    progress('roles');
+    for (const role of (await pages(http, '/roles', size, true)) ?? []) {
+        const slug = (0, record_set_1.str)(role.slug);
+        if (slug)
+            set.add('role', (0, record_set_1.compact)({ key: slug, name: (0, record_set_1.str)(role.name), scope: 'organization' }), slug);
+    }
+    progress('users');
+    const listed = (await pages(http, '/users', size, false)) ?? [];
+    const providers = new Set();
+    let withPassword = 0;
+    let withTotp = 0;
+    let mfaOnly = 0;
+    let credentialsWithoutRp = 0;
+    for (const [i, item] of listed.entries()) {
+        const id = (0, record_set_1.str)(item.id);
+        if (!id)
+            continue;
+        if (i > 0 && i % 100 === 0)
+            progress(`users (${i}/${listed.length})`);
+        // The listing has emails, passkeys and username; identities, metadata and names need the user itself.
+        let u = item;
+        try {
+            const { body } = await http.get(`/users/${encodeURIComponent(id)}`);
+            if ((0, record_set_1.isObj)(body))
+                u = { ...item, ...body };
+        }
+        catch (err) {
+            if (!(err instanceof vendor_http_1.VendorApiError && err.status === 404))
+                throw err;
+        }
+        const emailById = new Map();
+        const emails = sortedEmails((0, record_set_1.objs)(u.emails).flatMap((e) => {
+            const address = (0, record_set_1.str)(e.address)?.toLowerCase();
+            if (!address)
+                return [];
+            if ((0, record_set_1.str)(e.id))
+                emailById.set((0, record_set_1.str)(e.id), address);
+            return [{ email: address, verified: e.is_verified === true, primary: e.is_primary === true }];
+        }));
+        const named = u.username;
+        const username = (0, record_set_1.isObj)(named) ? (0, record_set_1.str)(named.username) : (0, record_set_1.str)(named);
+        if (!emails.length && !username) {
+            set.omit('user', NO_IDENTIFIER);
+            continue;
+        }
+        if ((0, record_set_1.isObj)(u.password))
+            withPassword++;
+        if ((0, record_set_1.isObj)(u.otp))
+            withTotp++;
+        const meta = (0, record_set_1.isObj)(u.metadata) ? u.metadata : {};
+        set.add('user', (0, record_set_1.compact)({
+            id,
+            emails,
+            username,
+            first_name: (0, record_set_1.str)(u.given_name),
+            last_name: (0, record_set_1.str)(u.family_name),
+            name: (0, record_set_1.str)(u.name),
+            image_url: (0, record_set_1.str)(u.picture),
+            public_metadata: metadata(meta.public_metadata),
+            private_metadata: privateMetadata(metadata(meta.private_metadata), customClaims(u.custom_claims, false)),
+            unsafe_metadata: metadata(meta.unsafe_metadata),
+            created_at: (0, record_set_1.str)(u.created_at),
+        }), id);
+        // The admin DTO names them the other way round: provider_id is the provider's user id, provider_name the provider.
+        for (const ident of (0, record_set_1.objs)(u.identities)) {
+            const provider = (0, record_set_1.str)(ident.provider_name);
+            const providerUserId = (0, record_set_1.str)(ident.provider_id);
+            if (!provider || !providerUserId)
+                continue;
+            const saml = /^(https?:\/\/|urn:)/i.test(provider);
+            if (!saml)
+                providers.add(provider);
+            set.add('identity', identity({ id: (0, record_set_1.str)(ident.id), userId: id, provider, providerUserId, saml, fallbackEmail: emailById.get((0, record_set_1.str)(ident.email_id) ?? '') }), `${provider}\u0000${providerUserId}`);
+        }
+        for (const c of (0, record_set_1.objs)(u.webauthn_credentials)) {
+            if (!o.rpId) {
+                credentialsWithoutRp++;
+                continue;
+            }
+            const record = passkey({
+                id: c.id,
+                userId: id,
+                publicKey: c.public_key,
+                rpId: o.rpId,
+                aaguid: c.aaguid,
+                backedUp: c.backup_state,
+                name: c.name,
+                transports: (0, record_set_1.strs)(c.transports),
+                createdAt: c.created_at,
+            });
+            if (!record) {
+                set.omit('passkey', 'WebAuthn credential without an id or public key');
+                continue;
+            }
+            if (c.mfa_only === true)
+                mfaOnly++;
+            set.add('passkey', record, record.credential_id);
+        }
+        for (const org of (0, record_set_1.objs)(u.organizations)) {
+            const orgId = (0, record_set_1.str)(org.id);
+            if (!orgId)
+                continue;
+            if ((0, record_set_1.str)(org.name))
+                set.add('organization', { id: orgId, name: (0, record_set_1.str)(org.name) }, orgId);
+            const roles = (0, record_set_1.objs)(org.roles);
+            for (const r of roles)
+                if ((0, record_set_1.str)(r.slug))
+                    set.add('role', (0, record_set_1.compact)({ key: (0, record_set_1.str)(r.slug), name: (0, record_set_1.str)(r.name), scope: 'organization' }), (0, record_set_1.str)(r.slug));
+            set.add('membership', { organization_id: orgId, user_id: id, role: membershipRole(roles.map((r) => (0, record_set_1.str)(r.slug)).filter((s) => !!s), set) }, `${orgId}\u0000${id}`);
+        }
+    }
+    if (withPassword) {
+        set.warn(`${withPassword} user(s) have a Hanko password: the Admin API never returns password hashes, so these move by lazy migration (preset hanko) on each user's first Atlas sign-in — or export from the database instead.`);
+    }
+    if (withTotp)
+        set.warn(`${withTotp} user(s) use TOTP: the Admin API never returns TOTP secrets, so they enrol an authenticator again in Atlas (a database dump carries the secrets).`);
+    if (credentialsWithoutRp) {
+        set.omit('passkey', 'No relying-party id given (--set hanko-rp-id)', credentialsWithoutRp);
+        set.warn(NO_PASSKEY_RP);
+    }
+    if (mfaOnly)
+        set.warn(MFA_ONLY_NOTE(mfaOnly));
+    if (o.apiUrl) {
+        progress('signing keys');
+        const pub = new vendor_http_1.VendorHttp({ vendor: 'Hanko', baseUrl: o.apiUrl, fetchImpl: o.fetchImpl, sleep: o.sleep });
+        try {
+            const { body } = await pub.get('/.well-known/jwks.json');
+            for (const jwk of (0, record_set_1.objs)((0, record_set_1.isObj)(body) ? body.keys : undefined)) {
+                const kid = (0, record_set_1.str)(jwk.kid);
+                if (kid && jwk.d === undefined)
+                    set.add('jwks', { kid, jwk }, kid);
+            }
+        }
+        catch (err) {
+            if (!(err instanceof vendor_http_1.VendorApiError))
+                throw err;
+            set.warn(`Could not read Hanko's signing keys (${err.message}); the bridge fetches them itself.`);
+        }
+    }
+    set.manifest = (0, record_set_1.compact)({ origin: `Hanko Admin API ${o.adminUrl.replace(/^https?:\/\//, '').replace(/\/+$/, '')}`, rpId: o.rpId, providers: [...providers].sort(), settings: { totp: { ...TOTP } } });
+    return set;
+}
+//# sourceMappingURL=hanko.js.map