@camunda/ccma-api 5.14.0 → 5.16.0

package/dist/services/accounts/users.service.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/services/accounts/users.service.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport {\n  MINUTE,\n  type OrganizationRole,\n  type User,\n} from '@camunda/ccma-shared-types'\nimport type {\n  RequestBaseParams,\n  RequestBaseServiceContext,\n} from '../../types/general.types.js'\nimport { request } from '../../utils/api.js'\nimport { Cache } from '../../utils/cache.js'\nimport { HttpError } from '../../utils/errors.js'\nimport type { HibobSearchResponse } from '../hibob/hibob.service.js'\n\nconst userCache = new Cache<string, User>(5 * MINUTE)\nconst REGEX_EMAIL =\n  // eslint-disable-next-line prefer-named-capture-group, no-useless-escape\n  /^(([^<>()[\\]\\\\.,;:\\s@\"]+(\\.[^<>()[\\]\\\\.,;:\\s@\"]+)*)|(\".+\"))@((\\[[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\])|(([a-zA-Z\\-0-9]+\\.)+[a-zA-Z]{2,}))$/u\n\nexport interface SearchParams extends RequestBaseParams {\n  params: {\n    q: {\n      organization?: {\n        uuid: string\n        member: boolean\n      }\n      name?: string\n      userId?: string\n      roleId?: string\n      email?: string\n      signUpStatus?: {\n        verified: boolean\n        tokenExpired?: boolean\n      }\n      created?: {\n        after?: Date\n        before?: Date\n      }\n    }\n    onBehalfOf?: string\n  }\n}\n\nexport interface SimpleSearchParams extends RequestBaseParams {\n  params: {\n    query: string\n    type: 'by-email' | 'by-id' | 'fuzzy' | 'lucene'\n  }\n}\n\nexport interface AddUserToOrganizationRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    orgId: string\n    orgRoles: OrganizationRole[]\n    byEmail?: boolean\n  }\n}\n\nexport interface RemoveUserFromOrganizationRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    orgId: string\n    byEmail?: boolean\n  }\n}\n\nexport interface RemoveStaleOrganizationRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    orgId: string\n  }\n}\n\nexport interface UpdateUserRoleRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    roleToAdd?: string\n    roleToRemove?: string\n  }\n  headers?: {\n    'x-camunda-email'?: string\n  }\n}\n\nexport interface ChangeUserEmailRequest extends RequestBaseParams {\n  params: { userId: string; email: string }\n}\n\nexport interface ChangeUserNameRequest extends RequestBaseParams {\n  params: { userId: string; firstname: string; lastname: string }\n}\n\nexport interface UserIdRequest extends RequestBaseParams {\n  params: { userId: string }\n}\n\nexport interface DeleteMeRequest extends RequestBaseParams {\n  params: { reason: string; explanation: string }\n}\n\nexport interface SetDefaultOrgRequest extends RequestBaseParams {\n  params: { userId: string; orgId: string }\n}\n\nexport class UsersService {\n  public static async search(params: SearchParams): Promise<User[]> {\n    const queryParams = new URLSearchParams()\n    const urlParts: string[] = []\n    if (params.params.q.roleId) {\n      // API route different if roleId is present\n      // eslint-disable-next-line id-length\n      const q = {\n        roleId: params.params.q.roleId,\n        name: params.params.q.name || '',\n        email: params.params.q.email || '',\n      }\n      queryParams.append('q', JSON.stringify(q))\n      urlParts.push(...['api', 'users', `?${queryParams.toString()}`])\n    } else {\n      if (params.params.onBehalfOf) {\n        queryParams.append(\n          'onBehalfOf',\n          encodeURI(JSON.stringify(params.params.onBehalfOf)),\n        )\n      }\n      queryParams.append('q', encodeURI(JSON.stringify(params.params.q)))\n      urlParts.push(...['api', 'users', 'search', `?${queryParams.toString()}`])\n    }\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.search`,\n        url: urlParts.join(`/`),\n        normalizedUrl: `api/users/search`,\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    if (params.params.q.userId) {\n      UsersService.validateUserId(serviceContext, params.params.q.userId)\n    }\n\n    const response = await request<User[]>({\n      config: params.config,\n      base: {\n        id: 'accounts',\n      },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body!\n  }\n\n  public static async simpleSearch(\n    params: SimpleSearchParams,\n  ): Promise<{ users: User[] }> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.simpleSearch`,\n        url: `api/users/search`,\n        normalizedUrl: `api/users/search`,\n        type: 'post',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    switch (params.params.type) {\n      case 'by-email':\n        UsersService.validateEmail(serviceContext, params.params.query)\n        break\n      case 'by-id':\n        UsersService.validateUserId(serviceContext, params.params.query)\n        break\n      case 'lucene':\n        UsersService.validateLuceneQuery(serviceContext, params.params.query)\n        break\n    }\n\n    const response = await request<{ users: User[] }>({\n      config: params.config,\n      base: {\n        id: 'accounts',\n      },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      body: {\n        query: params.params.query,\n        type: params.params.type,\n      },\n      metricsDetails: serviceContext,\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body!\n  }\n\n  public static async getUserInfo(\n    params: {\n      userId: string\n      basic?: boolean\n      roles?: boolean\n    } & RequestBaseParams,\n  ): Promise<User | undefined> {\n    // `roles=true` asks the backend to enrich the user with its Auth0\n    // platform (account-level) roles, which are omitted by default.\n    const cacheKey = `${params.basic === true ? 'basic-' : ''}${\n      params.roles === true ? 'roles-' : ''\n    }${params.userId}`\n    if (!params.cacheControl?.ignoreCache) {\n      const inCache = userCache.get(cacheKey)\n      if (inCache) {\n        return inCache\n      }\n    }\n\n    const searchParams = new URLSearchParams()\n    if (params.basic === true) {\n      searchParams.append('basic', 'true')\n    }\n    if (params.roles === true) {\n      searchParams.append('roles', 'true')\n    }\n    const queryParams = searchParams.toString()\n      ? `?${searchParams.toString()}`\n      : ''\n\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.getUserInfo`,\n        url: `api/users/${params.userId}${queryParams}`,\n        normalizedUrl: `api/users/:userId`,\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    UsersService.validateUserId(serviceContext, params.userId)\n\n    const response = await request<User>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    userCache.set(cacheKey, response.body!)\n    return response.body\n  }\n\n  public static async addUserToOrganization(\n    params: AddUserToOrganizationRequest,\n  ) {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.addUserToOrganization`,\n        url: `api/users/${params.params.userId}/organization/${params.params.orgId}`,\n        normalizedUrl: `api/users/:userId/organization/:orgId`,\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        orgRoles: params.params.orgRoles,\n        byEmail: params.params.byEmail,\n      },\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async changeEmail(\n    params: ChangeUserEmailRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.changeEmail',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/email`,\n        normalizedUrl: 'api/users/:userId/email',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: { email: params.params.email },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async changeName(params: ChangeUserNameRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.changeName',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/name`,\n        normalizedUrl: 'api/users/:userId/name',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        firstname: params.params.firstname,\n        lastname: params.params.lastname,\n      },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Admin-activate a user without an email token (POST api/admin/activate). */\n  public static async activateWithoutToken(\n    params: UserIdRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.activateWithoutToken',\n        url: 'api/admin/activate',\n        normalizedUrl: 'api/admin/activate',\n        type: 'post',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: { userId: params.params.userId },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Refresh the verification token and resend the welcome mail. */\n  public static async resendWelcomeMail(params: UserIdRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.resendWelcomeMail',\n        url: 'api/admin/resend-welcome-mail',\n        normalizedUrl: 'api/admin/resend-welcome-mail',\n        type: 'post',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: { userId: params.params.userId },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async deleteUser(params: UserIdRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.deleteUser',\n        url: `api/users/${encodeURIComponent(params.params.userId)}`,\n        normalizedUrl: 'api/users/:userId',\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Delete the account of the caller (self-service `DELETE api/users/me`).\n   * The route reads the caller from the token, so it needs no `userId`.\n   *\n   * The backend reads the body field `explaination`, not `explanation`. This\n   * method keeps the misspelling only in the request body, not in its own\n   * parameter name.\n   */\n  public static async deleteMe(params: DeleteMeRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.deleteMe',\n        url: 'api/users/me',\n        normalizedUrl: 'api/users/me',\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        reason: params.params.reason,\n        explaination: params.params.explanation,\n      },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Auth0 brute-force blocks for a user (`GET api/users/:userId/blocks`). The\n   * entries are Auth0's block records (identifier/IP), returned opaque for the\n   * caller to render.\n   */\n  public static async getBlocks(params: UserIdRequest): Promise<unknown[]> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.getBlocks',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/blocks`,\n        normalizedUrl: 'api/users/:userId/blocks',\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request<unknown[]>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'json',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body ?? []\n  }\n\n  /** Clear a user's Auth0 blocks (`DELETE api/users/:userId/blocks`). */\n  public static async clearBlocks(params: UserIdRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.clearBlocks',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/blocks`,\n        normalizedUrl: 'api/users/:userId/blocks',\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Replace a user's Auth0 `app_metadata` (god-gated raw JSON edit). */\n  public static async updateAppMetadata(\n    params: {\n      params: { userId: string }\n      body: { appMetadata: object }\n    } & RequestBaseParams,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.updateAppMetadata',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/appmetadata`,\n        normalizedUrl: 'api/users/:userId/appmetadata',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: params.body,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Replace a user's Auth0 `user_metadata` (god-gated raw JSON edit). */\n  public static async updateUserMetadata(\n    params: {\n      params: { userId: string }\n      body: { userMetadata: object }\n    } & RequestBaseParams,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.updateUserMetadata',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/usermetadata`,\n        normalizedUrl: 'api/users/:userId/usermetadata',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: params.body,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async setDefaultOrg(\n    params: SetDefaultOrgRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.setDefaultOrg',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/organizations/${encodeURIComponent(params.params.orgId)}/default`,\n        normalizedUrl: 'api/users/:userId/organizations/:orgId/default',\n        type: 'patch',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async removeUserFromOrganization(\n    params: RemoveUserFromOrganizationRequest,\n  ) {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.removeUserFromOrganization`,\n        url: `api/users/${params.params.userId}/organization/${params.params.orgId}`,\n        normalizedUrl: `api/users/:userId/organization/:orgId`,\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        byEmail: params.params.byEmail,\n      },\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Remove a stale organization assignment from a user at Auth0. Use it when\n   * the organization has no row in the accounts database any more and only\n   * the Auth0 membership is left. The endpoint refuses an organization that\n   * still exists, thus `removeUserFromOrganization` stays the normal way.\n   */\n  public static async removeStaleOrganization(\n    params: RemoveStaleOrganizationRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.removeStaleOrganization`,\n        url: `api/users/${encodeURIComponent(params.params.userId)}/organization/${encodeURIComponent(params.params.orgId)}/stale`,\n        normalizedUrl: `api/users/:userId/organization/:orgId/stale`,\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Update a user's role by adding or removing a single role.\n   * This uses the PATCH /api/users/:userId/roles endpoint.\n   * Supports email-based auth middleware via the x-camunda-email header.\n   */\n  public static async updateUserRole(\n    params: UpdateUserRoleRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.updateUserRole`,\n        url: `api/users/${encodeURIComponent(params.params.userId)}/roles`,\n        normalizedUrl: `api/users/:userId/roles`,\n        type: 'patch',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    UsersService.validateUserId(serviceContext, params.params.userId)\n\n    if (!params.params.roleToAdd && !params.params.roleToRemove) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - either roleToAdd or roleToRemove must be specified`,\n        400,\n        `Validation Error in API Package - either roleToAdd or roleToRemove must be specified`,\n      )\n    }\n\n    const body: { roleToAdd?: string; roleToRemove?: string } = {}\n    if (params.params.roleToAdd) {\n      body.roleToAdd = params.params.roleToAdd\n    }\n    if (params.params.roleToRemove) {\n      body.roleToRemove = params.params.roleToRemove\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body,\n      headers: params.headers,\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Get all Hibob users (for bulk ghost account checks).\n   * This fetches all active Hibob employees in a single request.\n   */\n  public static async getAllHibobUsers(\n    params: RequestBaseParams,\n  ): Promise<HibobSearchResponse> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.getAllHibobUsers',\n        url: 'api/users/hibob/all',\n        normalizedUrl: 'api/users/hibob/all',\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request<HibobSearchResponse>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n\n    return response.body!\n  }\n\n  /**\n   * Get Hibob details for a specific user by their Auth0 user ID.\n   */\n  public static async getUserHibobDetails(\n    params: { userId: string } & RequestBaseParams,\n  ): Promise<HibobSearchResponse> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.getUserHibobDetails',\n        url: `api/users/${encodeURIComponent(params.userId)}/hibob`,\n        normalizedUrl: 'api/users/:userId/hibob',\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request<HibobSearchResponse>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n\n    return response.body!\n  }\n\n  private static validateUserId(\n    serviceContext: RequestBaseServiceContext,\n    userId: string,\n  ) {\n    if (!userId || !userId.includes('|')) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - missing pipe '|'`,\n        400,\n        `Validation Error in API Package - missing pipe '|'`,\n      )\n    }\n  }\n\n  private static validateEmail(\n    serviceContext: RequestBaseServiceContext,\n    email: string,\n  ) {\n    if (!email || !REGEX_EMAIL.test(email)) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - invalid email format`,\n        400,\n        `Validation Error in API Package - invalid email format`,\n      )\n    }\n  }\n\n  /**\n   * Validates a Lucene query string for Auth0 user search.\n   * Auth0 supports Lucene query syntax including:\n   * - Field queries: field:value (e.g., email:john@example.com)\n   * - Wildcards: field:*value*, field:value*\n   * - Boolean operators: AND, OR, NOT\n   * - Grouping: (field:value OR field:value)\n   * - Range queries: field:[min TO max]\n   * - Exact phrase: field:\"exact phrase\"\n   *\n   * @see https://auth0.com/docs/manage-users/user-search/user-search-query-syntax\n   */\n  private static validateLuceneQuery(\n    serviceContext: RequestBaseServiceContext,\n    query: string,\n  ) {\n    if (!query || query.trim().length === 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - empty Lucene query`,\n        400,\n        `Validation Error in API Package - empty Lucene query`,\n      )\n    }\n\n    // Basic validation: query should contain at least a field:value pattern or be a valid search term\n    // Auth0 Lucene syntax requires queries to have field:value format for structured searches\n    const trimmedQuery = query.trim()\n\n    // Check for unbalanced parentheses\n    let parenCount = 0\n    for (const char of trimmedQuery) {\n      if (char === '(') parenCount++\n      if (char === ')') parenCount--\n      if (parenCount < 0) {\n        throw new HttpError(\n          `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced parentheses in Lucene query`,\n          400,\n          `Validation Error in API Package - unbalanced parentheses in Lucene query`,\n        )\n      }\n    }\n    if (parenCount !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced parentheses in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced parentheses in Lucene query`,\n      )\n    }\n\n    // Check for unbalanced square brackets (range queries)\n    let bracketCount = 0\n    for (const char of trimmedQuery) {\n      if (char === '[') bracketCount++\n      if (char === ']') bracketCount--\n      if (bracketCount < 0) {\n        throw new HttpError(\n          `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced brackets in Lucene query`,\n          400,\n          `Validation Error in API Package - unbalanced brackets in Lucene query`,\n        )\n      }\n    }\n    if (bracketCount !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced brackets in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced brackets in Lucene query`,\n      )\n    }\n\n    // Check for unbalanced quotes\n    const quoteCount = (trimmedQuery.match(/\"/gu) || []).length\n    if (quoteCount % 2 !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced quotes in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced quotes in Lucene query`,\n      )\n    }\n\n    // Validate that query contains at least one valid field:value pattern or search term\n    // A valid Lucene query for Auth0 should have field:value syntax\n    // Use word boundary to match field:value patterns anywhere in the query\n    const hasFieldValue = /\\b\\w+:/u.test(trimmedQuery)\n    if (!hasFieldValue) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - Lucene query must contain field:value syntax (e.g., email:john@example.com)`,\n        400,\n        `Validation Error in API Package - Lucene query must contain field:value syntax (e.g., email:john@example.com)`,\n      )\n    }\n  }\n}\n"],
-  "mappings": "AAMA;AAAA,EACE;AAAA,OAGK;AAKP,SAAS,eAAe;AACxB,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAG1B,MAAM,YAAY,IAAI,MAAoB,IAAI,MAAM;AACpD,MAAM;AAAA;AAAA,EAEJ;AAAA;AAwFK,MAAM,aAAa;AAAA,EACxB,aAAoB,OAAO,QAAuC;AAChE,UAAM,cAAc,IAAI,gBAAgB;AACxC,UAAM,WAAqB,CAAC;AAC5B,QAAI,OAAO,OAAO,EAAE,QAAQ;AAG1B,YAAM,IAAI;AAAA,QACR,QAAQ,OAAO,OAAO,EAAE;AAAA,QACxB,MAAM,OAAO,OAAO,EAAE,QAAQ;AAAA,QAC9B,OAAO,OAAO,OAAO,EAAE,SAAS;AAAA,MAClC;AACA,kBAAY,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC;AACzC,eAAS,KAAK,GAAG,CAAC,OAAO,SAAS,IAAI,YAAY,SAAS,CAAC,EAAE,CAAC;AAAA,IACjE,OAAO;AACL,UAAI,OAAO,OAAO,YAAY;AAC5B,oBAAY;AAAA,UACV;AAAA,UACA,UAAU,KAAK,UAAU,OAAO,OAAO,UAAU,CAAC;AAAA,QACpD;AAAA,MACF;AACA,kBAAY,OAAO,KAAK,UAAU,KAAK,UAAU,OAAO,OAAO,CAAC,CAAC,CAAC;AAClE,eAAS,KAAK,GAAG,CAAC,OAAO,SAAS,UAAU,IAAI,YAAY,SAAS,CAAC,EAAE,CAAC;AAAA,IAC3E;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,SAAS,KAAK,GAAG;AAAA,QACtB,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,OAAO,OAAO,EAAE,QAAQ;AAC1B,mBAAa,eAAe,gBAAgB,OAAO,OAAO,EAAE,MAAM;AAAA,IACpE;AAEA,UAAM,WAAW,MAAM,QAAgB;AAAA,MACrC,QAAQ,OAAO;AAAA,MACf,MAAM;AAAA,QACJ,IAAI;AAAA,MACN;AAAA,MACA,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,aAClB,QAC4B;AAC5B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,YAAQ,OAAO,OAAO,MAAM;AAAA,MAC1B,KAAK;AACH,qBAAa,cAAc,gBAAgB,OAAO,OAAO,KAAK;AAC9D;AAAA,MACF,KAAK;AACH,qBAAa,eAAe,gBAAgB,OAAO,OAAO,KAAK;AAC/D;AAAA,MACF,KAAK;AACH,qBAAa,oBAAoB,gBAAgB,OAAO,OAAO,KAAK;AACpE;AAAA,IACJ;AAEA,UAAM,WAAW,MAAM,QAA2B;AAAA,MAChD,QAAQ,OAAO;AAAA,MACf,MAAM;AAAA,QACJ,IAAI;AAAA,MACN;AAAA,MACA,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,MAAM;AAAA,QACJ,OAAO,OAAO,OAAO;AAAA,QACrB,MAAM,OAAO,OAAO;AAAA,MACtB;AAAA,MACA,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,YAClB,QAK2B;AAG3B,UAAM,WAAW,GAAG,OAAO,UAAU,OAAO,WAAW,EAAE,GACvD,OAAO,UAAU,OAAO,WAAW,EACrC,GAAG,OAAO,MAAM;AAChB,QAAI,CAAC,OAAO,cAAc,aAAa;AACrC,YAAM,UAAU,UAAU,IAAI,QAAQ;AACtC,UAAI,SAAS;AACX,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,IAAI,gBAAgB;AACzC,QAAI,OAAO,UAAU,MAAM;AACzB,mBAAa,OAAO,SAAS,MAAM;AAAA,IACrC;AACA,QAAI,OAAO,UAAU,MAAM;AACzB,mBAAa,OAAO,SAAS,MAAM;AAAA,IACrC;AACA,UAAM,cAAc,aAAa,SAAS,IACtC,IAAI,aAAa,SAAS,CAAC,KAC3B;AAEJ,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,MAAM,GAAG,WAAW;AAAA,QAC7C,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,iBAAa,eAAe,gBAAgB,OAAO,MAAM;AAEzD,UAAM,WAAW,MAAM,QAAc;AAAA,MACnC,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,cAAU,IAAI,UAAU,SAAS,IAAK;AACtC,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,sBAClB,QACA;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,OAAO,MAAM,iBAAiB,OAAO,OAAO,KAAK;AAAA,QAC1E,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,UAAU,OAAO,OAAO;AAAA,QACxB,SAAS,OAAO,OAAO;AAAA,MACzB;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,YAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,EAAE,OAAO,OAAO,OAAO,MAAM;AAAA,MACnC,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,WAAW,QAA8C;AAC3E,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,WAAW,OAAO,OAAO;AAAA,QACzB,UAAU,OAAO,OAAO;AAAA,MAC1B;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,qBAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,EAAE,QAAQ,OAAO,OAAO,OAAO;AAAA,MACrC,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,kBAAkB,QAAsC;AAC1E,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,EAAE,QAAQ,OAAO,OAAO,OAAO;AAAA,MACrC,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,WAAW,QAAsC;AACnE,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,aAAoB,SAAS,QAAwC;AACnE,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,QAAQ,OAAO,OAAO;AAAA,QACtB,cAAc,OAAO,OAAO;AAAA,MAC9B;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAoB,UAAU,QAA2C;AACvE,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAmB;AAAA,MACxC,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS,QAAQ,CAAC;AAAA,EAC3B;AAAA;AAAA,EAGA,aAAoB,YAAY,QAAsC;AACpE,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,kBAClB,QAIe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,mBAClB,QAIe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,cAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC,kBAAkB,mBAAmB,OAAO,OAAO,KAAK,CAAC;AAAA,QACnH,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,2BAClB,QACA;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,OAAO,MAAM,iBAAiB,OAAO,OAAO,KAAK;AAAA,QAC1E,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,SAAS,OAAO,OAAO;AAAA,MACzB;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAoB,wBAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC,iBAAiB,mBAAmB,OAAO,OAAO,KAAK,CAAC;AAAA,QAClH,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAoB,eAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,iBAAa,eAAe,gBAAgB,OAAO,OAAO,MAAM;AAEhE,QAAI,CAAC,OAAO,OAAO,aAAa,CAAC,OAAO,OAAO,cAAc;AAC3D,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAsD,CAAC;AAC7D,QAAI,OAAO,OAAO,WAAW;AAC3B,WAAK,YAAY,OAAO,OAAO;AAAA,IACjC;AACA,QAAI,OAAO,OAAO,cAAc;AAC9B,WAAK,eAAe,OAAO,OAAO;AAAA,IACpC;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB;AAAA,MACA,SAAS,OAAO;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAoB,iBAClB,QAC8B;AAC9B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAA6B;AAAA,MAClD,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO,SAAS;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAKA,aAAoB,oBAClB,QAC8B;AAC9B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,MAAM,CAAC;AAAA,QACnD,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAA6B;AAAA,MAClD,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,OAAe,eACb,gBACA,QACA;AACA,QAAI,CAAC,UAAU,CAAC,OAAO,SAAS,GAAG,GAAG;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,cACb,gBACA,OACA;AACA,QAAI,CAAC,SAAS,CAAC,YAAY,KAAK,KAAK,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,OAAe,oBACb,gBACA,OACA;AACA,QAAI,CAAC,SAAS,MAAM,KAAK,EAAE,WAAW,GAAG;AACvC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAIA,UAAM,eAAe,MAAM,KAAK;AAGhC,QAAI,aAAa;AACjB,eAAW,QAAQ,cAAc;AAC/B,UAAI,SAAS,IAAK;AAClB,UAAI,SAAS,IAAK;AAClB,UAAI,aAAa,GAAG;AAClB,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,OAAO,IAAI;AAAA,UAC7B;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,eAAe,GAAG;AACpB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,QAAI,eAAe;AACnB,eAAW,QAAQ,cAAc;AAC/B,UAAI,SAAS,IAAK;AAClB,UAAI,SAAS,IAAK;AAClB,UAAI,eAAe,GAAG;AACpB,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,OAAO,IAAI;AAAA,UAC7B;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,iBAAiB,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG;AACrD,QAAI,aAAa,MAAM,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAKA,UAAM,gBAAgB,UAAU,KAAK,YAAY;AACjD,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport {\n  MINUTE,\n  type OrganizationRole,\n  type User,\n} from '@camunda/ccma-shared-types'\nimport type {\n  RequestBaseParams,\n  RequestBaseServiceContext,\n} from '../../types/general.types.js'\nimport { request } from '../../utils/api.js'\nimport { Cache } from '../../utils/cache.js'\nimport { HttpError } from '../../utils/errors.js'\nimport type { HibobSearchResponse } from '../hibob/hibob.service.js'\n\nconst userCache = new Cache<string, User>(5 * MINUTE)\nconst REGEX_EMAIL =\n  // eslint-disable-next-line prefer-named-capture-group, no-useless-escape\n  /^(([^<>()[\\]\\\\.,;:\\s@\"]+(\\.[^<>()[\\]\\\\.,;:\\s@\"]+)*)|(\".+\"))@((\\[[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\])|(([a-zA-Z\\-0-9]+\\.)+[a-zA-Z]{2,}))$/u\n\nexport interface SearchParams extends RequestBaseParams {\n  params: {\n    q: {\n      organization?: {\n        uuid: string\n        member: boolean\n      }\n      name?: string\n      userId?: string\n      roleId?: string\n      email?: string\n      signUpStatus?: {\n        verified: boolean\n        tokenExpired?: boolean\n      }\n      created?: {\n        after?: Date\n        before?: Date\n      }\n    }\n    onBehalfOf?: string\n  }\n}\n\nexport interface SimpleSearchParams extends RequestBaseParams {\n  params: {\n    query: string\n    type: 'by-email' | 'by-id' | 'fuzzy' | 'lucene'\n  }\n}\n\nexport interface AddUserToOrganizationRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    orgId: string\n    orgRoles: OrganizationRole[]\n    byEmail?: boolean\n  }\n}\n\nexport interface RemoveUserFromOrganizationRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    orgId: string\n    byEmail?: boolean\n  }\n}\n\nexport interface RemoveStaleOrganizationRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    orgId: string\n  }\n}\n\nexport interface UpdateUserRoleRequest extends RequestBaseParams {\n  params: {\n    userId: string\n    roleToAdd?: string\n    roleToRemove?: string\n  }\n  headers?: {\n    'x-camunda-email'?: string\n  }\n}\n\nexport interface ChangeUserEmailRequest extends RequestBaseParams {\n  params: { userId: string; email: string }\n}\n\nexport interface ChangeUserNameRequest extends RequestBaseParams {\n  params: { userId: string; firstname: string; lastname: string }\n}\n\nexport interface UserIdRequest extends RequestBaseParams {\n  params: { userId: string }\n}\n\n/** What accounts answers for one user of a purge. */\nexport interface PurgeUserResult {\n  userId: string\n  /** `false` when Auth0 had no such user, so nothing was deleted. */\n  deleted: boolean\n}\n\nexport interface DeleteMeRequest extends RequestBaseParams {\n  params: { reason: string; explanation: string }\n}\n\nexport interface SetDefaultOrgRequest extends RequestBaseParams {\n  params: { userId: string; orgId: string }\n}\n\nexport class UsersService {\n  public static async search(params: SearchParams): Promise<User[]> {\n    const queryParams = new URLSearchParams()\n    const urlParts: string[] = []\n    if (params.params.q.roleId) {\n      // API route different if roleId is present\n      // eslint-disable-next-line id-length\n      const q = {\n        roleId: params.params.q.roleId,\n        name: params.params.q.name || '',\n        email: params.params.q.email || '',\n      }\n      queryParams.append('q', JSON.stringify(q))\n      urlParts.push(...['api', 'users', `?${queryParams.toString()}`])\n    } else {\n      if (params.params.onBehalfOf) {\n        queryParams.append(\n          'onBehalfOf',\n          encodeURI(JSON.stringify(params.params.onBehalfOf)),\n        )\n      }\n      queryParams.append('q', encodeURI(JSON.stringify(params.params.q)))\n      urlParts.push(...['api', 'users', 'search', `?${queryParams.toString()}`])\n    }\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.search`,\n        url: urlParts.join(`/`),\n        normalizedUrl: `api/users/search`,\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    if (params.params.q.userId) {\n      UsersService.validateUserId(serviceContext, params.params.q.userId)\n    }\n\n    const response = await request<User[]>({\n      config: params.config,\n      base: {\n        id: 'accounts',\n      },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body!\n  }\n\n  public static async simpleSearch(\n    params: SimpleSearchParams,\n  ): Promise<{ users: User[] }> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.simpleSearch`,\n        url: `api/users/search`,\n        normalizedUrl: `api/users/search`,\n        type: 'post',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    switch (params.params.type) {\n      case 'by-email':\n        UsersService.validateEmail(serviceContext, params.params.query)\n        break\n      case 'by-id':\n        UsersService.validateUserId(serviceContext, params.params.query)\n        break\n      case 'lucene':\n        UsersService.validateLuceneQuery(serviceContext, params.params.query)\n        break\n    }\n\n    const response = await request<{ users: User[] }>({\n      config: params.config,\n      base: {\n        id: 'accounts',\n      },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      body: {\n        query: params.params.query,\n        type: params.params.type,\n      },\n      metricsDetails: serviceContext,\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body!\n  }\n\n  public static async getUserInfo(\n    params: {\n      userId: string\n      basic?: boolean\n      roles?: boolean\n    } & RequestBaseParams,\n  ): Promise<User | undefined> {\n    // `roles=true` asks the backend to enrich the user with its Auth0\n    // platform (account-level) roles, which are omitted by default.\n    const cacheKey = `${params.basic === true ? 'basic-' : ''}${\n      params.roles === true ? 'roles-' : ''\n    }${params.userId}`\n    if (!params.cacheControl?.ignoreCache) {\n      const inCache = userCache.get(cacheKey)\n      if (inCache) {\n        return inCache\n      }\n    }\n\n    const searchParams = new URLSearchParams()\n    if (params.basic === true) {\n      searchParams.append('basic', 'true')\n    }\n    if (params.roles === true) {\n      searchParams.append('roles', 'true')\n    }\n    const queryParams = searchParams.toString()\n      ? `?${searchParams.toString()}`\n      : ''\n\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.getUserInfo`,\n        url: `api/users/${params.userId}${queryParams}`,\n        normalizedUrl: `api/users/:userId`,\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    UsersService.validateUserId(serviceContext, params.userId)\n\n    const response = await request<User>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    userCache.set(cacheKey, response.body!)\n    return response.body\n  }\n\n  public static async addUserToOrganization(\n    params: AddUserToOrganizationRequest,\n  ) {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.addUserToOrganization`,\n        url: `api/users/${params.params.userId}/organization/${params.params.orgId}`,\n        normalizedUrl: `api/users/:userId/organization/:orgId`,\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        orgRoles: params.params.orgRoles,\n        byEmail: params.params.byEmail,\n      },\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async changeEmail(\n    params: ChangeUserEmailRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.changeEmail',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/email`,\n        normalizedUrl: 'api/users/:userId/email',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: { email: params.params.email },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async changeName(params: ChangeUserNameRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.changeName',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/name`,\n        normalizedUrl: 'api/users/:userId/name',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        firstname: params.params.firstname,\n        lastname: params.params.lastname,\n      },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Admin-activate a user without an email token (POST api/admin/activate). */\n  public static async activateWithoutToken(\n    params: UserIdRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.activateWithoutToken',\n        url: 'api/admin/activate',\n        normalizedUrl: 'api/admin/activate',\n        type: 'post',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: { userId: params.params.userId },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Refresh the verification token and resend the welcome mail. */\n  public static async resendWelcomeMail(params: UserIdRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.resendWelcomeMail',\n        url: 'api/admin/resend-welcome-mail',\n        normalizedUrl: 'api/admin/resend-welcome-mail',\n        type: 'post',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: { userId: params.params.userId },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async deleteUser(params: UserIdRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.deleteUser',\n        url: `api/users/${encodeURIComponent(params.params.userId)}`,\n        normalizedUrl: 'api/users/:userId',\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Deletes one user of a God Mode purge (`DELETE api/users/:userId/purge`).\n   * The route needs `admin.god.purgeUsers` and `admin.deleteUser`. A purge\n   * screen calls this for each user, and never `deleteUser`.\n   */\n  public static async purgeUser(\n    params: UserIdRequest,\n  ): Promise<PurgeUserResult> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.purgeUser',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/purge`,\n        normalizedUrl: 'api/users/:userId/purge',\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request<PurgeUserResult>({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'json',\n    })\n    if (!response.ok || response.body === undefined) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body\n  }\n\n  /**\n   * Delete the account of the caller (self-service `DELETE api/users/me`).\n   * The route reads the caller from the token, so it needs no `userId`.\n   *\n   * The backend reads the body field `explaination`, not `explanation`. This\n   * method keeps the misspelling only in the request body, not in its own\n   * parameter name.\n   */\n  public static async deleteMe(params: DeleteMeRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.deleteMe',\n        url: 'api/users/me',\n        normalizedUrl: 'api/users/me',\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        reason: params.params.reason,\n        explaination: params.params.explanation,\n      },\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Auth0 brute-force blocks for a user (`GET api/users/:userId/blocks`). The\n   * entries are Auth0's block records (identifier/IP), returned opaque for the\n   * caller to render.\n   */\n  public static async getBlocks(params: UserIdRequest): Promise<unknown[]> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.getBlocks',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/blocks`,\n        normalizedUrl: 'api/users/:userId/blocks',\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request<unknown[]>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'json',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n    return response.body ?? []\n  }\n\n  /** Clear a user's Auth0 blocks (`DELETE api/users/:userId/blocks`). */\n  public static async clearBlocks(params: UserIdRequest): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.clearBlocks',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/blocks`,\n        normalizedUrl: 'api/users/:userId/blocks',\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Replace a user's Auth0 `app_metadata` (god-gated raw JSON edit). */\n  public static async updateAppMetadata(\n    params: {\n      params: { userId: string }\n      body: { appMetadata: object }\n    } & RequestBaseParams,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.updateAppMetadata',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/appmetadata`,\n        normalizedUrl: 'api/users/:userId/appmetadata',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: params.body,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /** Replace a user's Auth0 `user_metadata` (god-gated raw JSON edit). */\n  public static async updateUserMetadata(\n    params: {\n      params: { userId: string }\n      body: { userMetadata: object }\n    } & RequestBaseParams,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.updateUserMetadata',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/usermetadata`,\n        normalizedUrl: 'api/users/:userId/usermetadata',\n        type: 'put',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: params.body,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async setDefaultOrg(\n    params: SetDefaultOrgRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.setDefaultOrg',\n        url: `api/users/${encodeURIComponent(params.params.userId)}/organizations/${encodeURIComponent(params.params.orgId)}/default`,\n        normalizedUrl: 'api/users/:userId/organizations/:orgId/default',\n        type: 'patch',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: { name: 'accounts', type: 'internal' },\n    }\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'none',\n    })\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  public static async removeUserFromOrganization(\n    params: RemoveUserFromOrganizationRequest,\n  ) {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.removeUserFromOrganization`,\n        url: `api/users/${params.params.userId}/organization/${params.params.orgId}`,\n        normalizedUrl: `api/users/:userId/organization/:orgId`,\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body: {\n        byEmail: params.params.byEmail,\n      },\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Remove a stale organization assignment from a user at Auth0. Use it when\n   * the organization has no row in the accounts database any more and only\n   * the Auth0 membership is left. The endpoint refuses an organization that\n   * still exists, thus `removeUserFromOrganization` stays the normal way.\n   */\n  public static async removeStaleOrganization(\n    params: RemoveStaleOrganizationRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.removeStaleOrganization`,\n        url: `api/users/${encodeURIComponent(params.params.userId)}/organization/${encodeURIComponent(params.params.orgId)}/stale`,\n        normalizedUrl: `api/users/:userId/organization/:orgId/stale`,\n        type: 'delete',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Update a user's role by adding or removing a single role.\n   * This uses the PATCH /api/users/:userId/roles endpoint.\n   * Supports email-based auth middleware via the x-camunda-email header.\n   */\n  public static async updateUserRole(\n    params: UpdateUserRoleRequest,\n  ): Promise<void> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: `UsersService.updateUserRole`,\n        url: `api/users/${encodeURIComponent(params.params.userId)}/roles`,\n        normalizedUrl: `api/users/:userId/roles`,\n        type: 'patch',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    // Validation\n    UsersService.validateUserId(serviceContext, params.params.userId)\n\n    if (!params.params.roleToAdd && !params.params.roleToRemove) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - either roleToAdd or roleToRemove must be specified`,\n        400,\n        `Validation Error in API Package - either roleToAdd or roleToRemove must be specified`,\n      )\n    }\n\n    const body: { roleToAdd?: string; roleToRemove?: string } = {}\n    if (params.params.roleToAdd) {\n      body.roleToAdd = params.params.roleToAdd\n    }\n    if (params.params.roleToRemove) {\n      body.roleToRemove = params.params.roleToRemove\n    }\n\n    const response = await request({\n      config: params.config,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n      body,\n      headers: params.headers,\n      responseType: 'none',\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n  }\n\n  /**\n   * Get all Hibob users (for bulk ghost account checks).\n   * This fetches all active Hibob employees in a single request.\n   */\n  public static async getAllHibobUsers(\n    params: RequestBaseParams,\n  ): Promise<HibobSearchResponse> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.getAllHibobUsers',\n        url: 'api/users/hibob/all',\n        normalizedUrl: 'api/users/hibob/all',\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request<HibobSearchResponse>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n\n    return response.body!\n  }\n\n  /**\n   * Get Hibob details for a specific user by their Auth0 user ID.\n   */\n  public static async getUserHibobDetails(\n    params: { userId: string } & RequestBaseParams,\n  ): Promise<HibobSearchResponse> {\n    const serviceContext: RequestBaseServiceContext = {\n      method: {\n        name: 'UsersService.getUserHibobDetails',\n        url: `api/users/${encodeURIComponent(params.userId)}/hibob`,\n        normalizedUrl: 'api/users/:userId/hibob',\n        type: 'get',\n      },\n      source: params.config.metrics?.source || 'unset',\n      target: {\n        name: 'accounts',\n        type: 'internal',\n      },\n    }\n\n    const response = await request<HibobSearchResponse>({\n      ...params,\n      base: { id: 'accounts' },\n      url: serviceContext.method.url,\n      method: serviceContext.method.type,\n      metricsDetails: serviceContext,\n    })\n\n    if (!response.ok) {\n      throw new HttpError(\n        `${serviceContext.method.name}: ${response.status} ${response.statusText}`,\n        response.status,\n        response.statusText,\n      )\n    }\n\n    return response.body!\n  }\n\n  private static validateUserId(\n    serviceContext: RequestBaseServiceContext,\n    userId: string,\n  ) {\n    if (!userId || !userId.includes('|')) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - missing pipe '|'`,\n        400,\n        `Validation Error in API Package - missing pipe '|'`,\n      )\n    }\n  }\n\n  private static validateEmail(\n    serviceContext: RequestBaseServiceContext,\n    email: string,\n  ) {\n    if (!email || !REGEX_EMAIL.test(email)) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - invalid email format`,\n        400,\n        `Validation Error in API Package - invalid email format`,\n      )\n    }\n  }\n\n  /**\n   * Validates a Lucene query string for Auth0 user search.\n   * Auth0 supports Lucene query syntax including:\n   * - Field queries: field:value (e.g., email:john@example.com)\n   * - Wildcards: field:*value*, field:value*\n   * - Boolean operators: AND, OR, NOT\n   * - Grouping: (field:value OR field:value)\n   * - Range queries: field:[min TO max]\n   * - Exact phrase: field:\"exact phrase\"\n   *\n   * @see https://auth0.com/docs/manage-users/user-search/user-search-query-syntax\n   */\n  private static validateLuceneQuery(\n    serviceContext: RequestBaseServiceContext,\n    query: string,\n  ) {\n    if (!query || query.trim().length === 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - empty Lucene query`,\n        400,\n        `Validation Error in API Package - empty Lucene query`,\n      )\n    }\n\n    // Basic validation: query should contain at least a field:value pattern or be a valid search term\n    // Auth0 Lucene syntax requires queries to have field:value format for structured searches\n    const trimmedQuery = query.trim()\n\n    // Check for unbalanced parentheses\n    let parenCount = 0\n    for (const char of trimmedQuery) {\n      if (char === '(') parenCount++\n      if (char === ')') parenCount--\n      if (parenCount < 0) {\n        throw new HttpError(\n          `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced parentheses in Lucene query`,\n          400,\n          `Validation Error in API Package - unbalanced parentheses in Lucene query`,\n        )\n      }\n    }\n    if (parenCount !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced parentheses in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced parentheses in Lucene query`,\n      )\n    }\n\n    // Check for unbalanced square brackets (range queries)\n    let bracketCount = 0\n    for (const char of trimmedQuery) {\n      if (char === '[') bracketCount++\n      if (char === ']') bracketCount--\n      if (bracketCount < 0) {\n        throw new HttpError(\n          `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced brackets in Lucene query`,\n          400,\n          `Validation Error in API Package - unbalanced brackets in Lucene query`,\n        )\n      }\n    }\n    if (bracketCount !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced brackets in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced brackets in Lucene query`,\n      )\n    }\n\n    // Check for unbalanced quotes\n    const quoteCount = (trimmedQuery.match(/\"/gu) || []).length\n    if (quoteCount % 2 !== 0) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - unbalanced quotes in Lucene query`,\n        400,\n        `Validation Error in API Package - unbalanced quotes in Lucene query`,\n      )\n    }\n\n    // Validate that query contains at least one valid field:value pattern or search term\n    // A valid Lucene query for Auth0 should have field:value syntax\n    // Use word boundary to match field:value patterns anywhere in the query\n    const hasFieldValue = /\\b\\w+:/u.test(trimmedQuery)\n    if (!hasFieldValue) {\n      throw new HttpError(\n        `${serviceContext.method.name}: 400 - Validation Error in API Package - Lucene query must contain field:value syntax (e.g., email:john@example.com)`,\n        400,\n        `Validation Error in API Package - Lucene query must contain field:value syntax (e.g., email:john@example.com)`,\n      )\n    }\n  }\n}\n"],
+  "mappings": "AAMA;AAAA,EACE;AAAA,OAGK;AAKP,SAAS,eAAe;AACxB,SAAS,aAAa;AACtB,SAAS,iBAAiB;AAG1B,MAAM,YAAY,IAAI,MAAoB,IAAI,MAAM;AACpD,MAAM;AAAA;AAAA,EAEJ;AAAA;AA+FK,MAAM,aAAa;AAAA,EACxB,aAAoB,OAAO,QAAuC;AAChE,UAAM,cAAc,IAAI,gBAAgB;AACxC,UAAM,WAAqB,CAAC;AAC5B,QAAI,OAAO,OAAO,EAAE,QAAQ;AAG1B,YAAM,IAAI;AAAA,QACR,QAAQ,OAAO,OAAO,EAAE;AAAA,QACxB,MAAM,OAAO,OAAO,EAAE,QAAQ;AAAA,QAC9B,OAAO,OAAO,OAAO,EAAE,SAAS;AAAA,MAClC;AACA,kBAAY,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC;AACzC,eAAS,KAAK,GAAG,CAAC,OAAO,SAAS,IAAI,YAAY,SAAS,CAAC,EAAE,CAAC;AAAA,IACjE,OAAO;AACL,UAAI,OAAO,OAAO,YAAY;AAC5B,oBAAY;AAAA,UACV;AAAA,UACA,UAAU,KAAK,UAAU,OAAO,OAAO,UAAU,CAAC;AAAA,QACpD;AAAA,MACF;AACA,kBAAY,OAAO,KAAK,UAAU,KAAK,UAAU,OAAO,OAAO,CAAC,CAAC,CAAC;AAClE,eAAS,KAAK,GAAG,CAAC,OAAO,SAAS,UAAU,IAAI,YAAY,SAAS,CAAC,EAAE,CAAC;AAAA,IAC3E;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,SAAS,KAAK,GAAG;AAAA,QACtB,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,OAAO,OAAO,EAAE,QAAQ;AAC1B,mBAAa,eAAe,gBAAgB,OAAO,OAAO,EAAE,MAAM;AAAA,IACpE;AAEA,UAAM,WAAW,MAAM,QAAgB;AAAA,MACrC,QAAQ,OAAO;AAAA,MACf,MAAM;AAAA,QACJ,IAAI;AAAA,MACN;AAAA,MACA,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,aAClB,QAC4B;AAC5B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,YAAQ,OAAO,OAAO,MAAM;AAAA,MAC1B,KAAK;AACH,qBAAa,cAAc,gBAAgB,OAAO,OAAO,KAAK;AAC9D;AAAA,MACF,KAAK;AACH,qBAAa,eAAe,gBAAgB,OAAO,OAAO,KAAK;AAC/D;AAAA,MACF,KAAK;AACH,qBAAa,oBAAoB,gBAAgB,OAAO,OAAO,KAAK;AACpE;AAAA,IACJ;AAEA,UAAM,WAAW,MAAM,QAA2B;AAAA,MAChD,QAAQ,OAAO;AAAA,MACf,MAAM;AAAA,QACJ,IAAI;AAAA,MACN;AAAA,MACA,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,MAAM;AAAA,QACJ,OAAO,OAAO,OAAO;AAAA,QACrB,MAAM,OAAO,OAAO;AAAA,MACtB;AAAA,MACA,gBAAgB;AAAA,IAClB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,YAClB,QAK2B;AAG3B,UAAM,WAAW,GAAG,OAAO,UAAU,OAAO,WAAW,EAAE,GACvD,OAAO,UAAU,OAAO,WAAW,EACrC,GAAG,OAAO,MAAM;AAChB,QAAI,CAAC,OAAO,cAAc,aAAa;AACrC,YAAM,UAAU,UAAU,IAAI,QAAQ;AACtC,UAAI,SAAS;AACX,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,eAAe,IAAI,gBAAgB;AACzC,QAAI,OAAO,UAAU,MAAM;AACzB,mBAAa,OAAO,SAAS,MAAM;AAAA,IACrC;AACA,QAAI,OAAO,UAAU,MAAM;AACzB,mBAAa,OAAO,SAAS,MAAM;AAAA,IACrC;AACA,UAAM,cAAc,aAAa,SAAS,IACtC,IAAI,aAAa,SAAS,CAAC,KAC3B;AAEJ,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,MAAM,GAAG,WAAW;AAAA,QAC7C,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,iBAAa,eAAe,gBAAgB,OAAO,MAAM;AAEzD,UAAM,WAAW,MAAM,QAAc;AAAA,MACnC,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,cAAU,IAAI,UAAU,SAAS,IAAK;AACtC,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,aAAoB,sBAClB,QACA;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,OAAO,MAAM,iBAAiB,OAAO,OAAO,KAAK;AAAA,QAC1E,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,UAAU,OAAO,OAAO;AAAA,QACxB,SAAS,OAAO,OAAO;AAAA,MACzB;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,YAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,EAAE,OAAO,OAAO,OAAO,MAAM;AAAA,MACnC,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,WAAW,QAA8C;AAC3E,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,WAAW,OAAO,OAAO;AAAA,QACzB,UAAU,OAAO,OAAO;AAAA,MAC1B;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,qBAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,EAAE,QAAQ,OAAO,OAAO,OAAO;AAAA,MACrC,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,kBAAkB,QAAsC;AAC1E,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,EAAE,QAAQ,OAAO,OAAO,OAAO;AAAA,MACrC,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,WAAW,QAAsC;AACnE,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAoB,UAClB,QAC0B;AAC1B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAyB;AAAA,MAC9C,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,MAAM,SAAS,SAAS,QAAW;AAC/C,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,aAAoB,SAAS,QAAwC;AACnE,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,QAAQ,OAAO,OAAO;AAAA,QACtB,cAAc,OAAO,OAAO;AAAA,MAC9B;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAoB,UAAU,QAA2C;AACvE,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAmB;AAAA,MACxC,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AACA,WAAO,SAAS,QAAQ,CAAC;AAAA,EAC3B;AAAA;AAAA,EAGA,aAAoB,YAAY,QAAsC;AACpE,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,kBAClB,QAIe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,mBAClB,QAIe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,cAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC,kBAAkB,mBAAmB,OAAO,OAAO,KAAK,CAAC;AAAA,QACnH,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,IAC/C;AACA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA,EAEA,aAAoB,2BAClB,QACA;AACA,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,OAAO,OAAO,MAAM,iBAAiB,OAAO,OAAO,KAAK;AAAA,QAC1E,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,MAAM;AAAA,QACJ,SAAS,OAAO,OAAO;AAAA,MACzB;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,aAAoB,wBAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC,iBAAiB,mBAAmB,OAAO,OAAO,KAAK,CAAC;AAAA,QAClH,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,aAAoB,eAClB,QACe;AACf,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1D,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAGA,iBAAa,eAAe,gBAAgB,OAAO,OAAO,MAAM;AAEhE,QAAI,CAAC,OAAO,OAAO,aAAa,CAAC,OAAO,OAAO,cAAc;AAC3D,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,UAAM,OAAsD,CAAC;AAC7D,QAAI,OAAO,OAAO,WAAW;AAC3B,WAAK,YAAY,OAAO,OAAO;AAAA,IACjC;AACA,QAAI,OAAO,OAAO,cAAc;AAC9B,WAAK,eAAe,OAAO,OAAO;AAAA,IACpC;AAEA,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B,QAAQ,OAAO;AAAA,MACf,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,MAChB;AAAA,MACA,SAAS,OAAO;AAAA,MAChB,cAAc;AAAA,IAChB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAoB,iBAClB,QAC8B;AAC9B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK;AAAA,QACL,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAA6B;AAAA,MAClD,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO,SAAS;AAAA,EAClB;AAAA;AAAA;AAAA;AAAA,EAKA,aAAoB,oBAClB,QAC8B;AAC9B,UAAM,iBAA4C;AAAA,MAChD,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,KAAK,aAAa,mBAAmB,OAAO,MAAM,CAAC;AAAA,QACnD,eAAe;AAAA,QACf,MAAM;AAAA,MACR;AAAA,MACA,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,MACzC,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,WAAW,MAAM,QAA6B;AAAA,MAClD,GAAG;AAAA,MACH,MAAM,EAAE,IAAI,WAAW;AAAA,MACvB,KAAK,eAAe,OAAO;AAAA,MAC3B,QAAQ,eAAe,OAAO;AAAA,MAC9B,gBAAgB;AAAA,IAClB,CAAC;AAED,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,QACxE,SAAS;AAAA,QACT,SAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO,SAAS;AAAA,EAClB;AAAA,EAEA,OAAe,eACb,gBACA,QACA;AACA,QAAI,CAAC,UAAU,CAAC,OAAO,SAAS,GAAG,GAAG;AACpC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,OAAe,cACb,gBACA,OACA;AACA,QAAI,CAAC,SAAS,CAAC,YAAY,KAAK,KAAK,GAAG;AACtC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,OAAe,oBACb,gBACA,OACA;AACA,QAAI,CAAC,SAAS,MAAM,KAAK,EAAE,WAAW,GAAG;AACvC,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAIA,UAAM,eAAe,MAAM,KAAK;AAGhC,QAAI,aAAa;AACjB,eAAW,QAAQ,cAAc;AAC/B,UAAI,SAAS,IAAK;AAClB,UAAI,SAAS,IAAK;AAClB,UAAI,aAAa,GAAG;AAClB,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,OAAO,IAAI;AAAA,UAC7B;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,eAAe,GAAG;AACpB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,QAAI,eAAe;AACnB,eAAW,QAAQ,cAAc;AAC/B,UAAI,SAAS,IAAK;AAClB,UAAI,SAAS,IAAK;AAClB,UAAI,eAAe,GAAG;AACpB,cAAM,IAAI;AAAA,UACR,GAAG,eAAe,OAAO,IAAI;AAAA,UAC7B;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AACA,QAAI,iBAAiB,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,cAAc,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG;AACrD,QAAI,aAAa,MAAM,GAAG;AACxB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAKA,UAAM,gBAAgB,UAAU,KAAK,YAAY;AACjD,QAAI,CAAC,eAAe;AAClB,YAAM,IAAI;AAAA,QACR,GAAG,eAAe,OAAO,IAAI;AAAA,QAC7B;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/services/control/control.agent-tokens.service.d.ts

@@ -0,0 +1,66 @@
+import type { AgentStatusResponse, AgentToken, AgentTokenAdmin, AgentTokenCreated, AgentTokenExpiryDays, AgentTokenStatus, AgentVerifyResponse } from '@camunda/ccma-shared-types';
+import type { RequestBaseParams } from '../../types/general.types.js';
+export interface CreateAgentTokenRequest extends RequestBaseParams {
+    params: {
+        name: string;
+        expiresInDays: AgentTokenExpiryDays;
+    };
+}
+export interface ListAllAgentTokensRequest extends RequestBaseParams {
+    params?: {
+        status?: Exclude<AgentTokenStatus, 'inactive'>;
+    };
+}
+export interface AgentTokenUuidRequest extends RequestBaseParams {
+    params: {
+        uuid: string;
+    };
+}
+export interface VerifyAgentClientRequest extends RequestBaseParams {
+    params: {
+        clientId: string;
+        clientSecret: string;
+    };
+}
+export declare class ControlAgentTokensService {
+    /**
+     * Creates an agent token of the caller. The answer is the only place that
+     * holds the secret. 404 while the flag `control.agentTokens` is off.
+     */
+    static create(params: CreateAgentTokenRequest): Promise<AgentTokenCreated>;
+    /** The tokens that the caller created, newest first. */
+    static listOwn(params: RequestBaseParams): Promise<{
+        items: AgentToken[];
+    }>;
+    /**
+     * The newest 500 tokens of the stage that match `status`. Needs
+     * `agentTokens.admin`.
+     */
+    static listAll(params: ListAllAgentTokensRequest): Promise<{
+        items: AgentTokenAdmin[];
+    }>;
+    /** A new secret for an own, active token. 404 while the flag is off. */
+    static rotate(params: AgentTokenUuidRequest): Promise<AgentTokenCreated>;
+    /** Revokes an own token, or any token with `agentTokens.admin`. */
+    static revoke(params: AgentTokenUuidRequest): Promise<void>;
+}
+export declare class ControlAgentClientsInternalService {
+    /**
+     * Checks the credentials of an agent client. It needs no token: do not
+     * set `config.auth`. A 401 means that the credentials are not valid, for
+     * any reason, and it does not count as an error in the metrics.
+     *
+     * A 429 is NOT tried again. token-issuer calls this inside a token request,
+     * and `request` would otherwise wait and try up to 8 times.
+     */
+    static verify(params: VerifyAgentClientRequest): Promise<AgentVerifyResponse>;
+    /**
+     * Whether an agent client is active, and its read permissions. It needs a
+     * machine token for `camunda-cloud-audience` that holds `ctas`. An unknown
+     * uuid answers `active: false`.
+     *
+     * A 429 is NOT tried again, for the reason of `verify`: the caller holds
+     * an agent request open, and it has a deadline of its own.
+     */
+    static status(params: AgentTokenUuidRequest): Promise<AgentStatusResponse>;
+}

package/dist/services/control/control.agent-tokens.service.js

@@ -0,0 +1,134 @@
+import { request } from "../../utils/api.js";
+import { HttpError } from "../../utils/errors.js";
+const BASE = { id: "control" };
+async function send(params, name, url, normalizedUrl, method, body, retry) {
+  const serviceContext = {
+    method: { name, url, normalizedUrl, type: method },
+    source: params.config.metrics?.source || "unset",
+    target: { name: "control", type: "internal" }
+  };
+  const response = await request({
+    ...params,
+    config: params.config,
+    base: BASE,
+    url,
+    method,
+    metricsDetails: serviceContext,
+    body,
+    retry
+  });
+  if (!response.ok) {
+    throw new HttpError(
+      `${name}: ${response.status} ${response.statusText}`,
+      response.status,
+      response.statusText
+    );
+  }
+  return response.body;
+}
+class ControlAgentTokensService {
+  /**
+   * Creates an agent token of the caller. The answer is the only place that
+   * holds the secret. 404 while the flag `control.agentTokens` is off.
+   */
+  static async create(params) {
+    return send(
+      params,
+      "ControlAgentTokensService.create",
+      "api/agent-tokens",
+      "api/agent-tokens",
+      "post",
+      params.params
+    );
+  }
+  /** The tokens that the caller created, newest first. */
+  static async listOwn(params) {
+    return send(
+      params,
+      "ControlAgentTokensService.listOwn",
+      "api/agent-tokens",
+      "api/agent-tokens",
+      "get"
+    );
+  }
+  /**
+   * The newest 500 tokens of the stage that match `status`. Needs
+   * `agentTokens.admin`.
+   */
+  static async listAll(params) {
+    const status = params.params?.status;
+    const query = status ? `?status=${encodeURIComponent(status)}` : "";
+    return send(
+      params,
+      "ControlAgentTokensService.listAll",
+      `api/agent-tokens/all${query}`,
+      "api/agent-tokens/all",
+      "get"
+    );
+  }
+  /** A new secret for an own, active token. 404 while the flag is off. */
+  static async rotate(params) {
+    return send(
+      params,
+      "ControlAgentTokensService.rotate",
+      `api/agent-tokens/${encodeURIComponent(params.params.uuid)}/rotate`,
+      "api/agent-tokens/:uuid/rotate",
+      "post"
+    );
+  }
+  /** Revokes an own token, or any token with `agentTokens.admin`. */
+  static async revoke(params) {
+    await send(
+      params,
+      "ControlAgentTokensService.revoke",
+      `api/agent-tokens/${encodeURIComponent(params.params.uuid)}`,
+      "api/agent-tokens/:uuid",
+      "delete"
+    );
+  }
+}
+class ControlAgentClientsInternalService {
+  /**
+   * Checks the credentials of an agent client. It needs no token: do not
+   * set `config.auth`. A 401 means that the credentials are not valid, for
+   * any reason, and it does not count as an error in the metrics.
+   *
+   * A 429 is NOT tried again. token-issuer calls this inside a token request,
+   * and `request` would otherwise wait and try up to 8 times.
+   */
+  static async verify(params) {
+    return send(
+      params,
+      "ControlAgentClientsInternalService.verify",
+      "internal/agent-clients/verify",
+      "internal/agent-clients/verify",
+      "post",
+      params.params,
+      { attempts: 1, remaining: 0 }
+    );
+  }
+  /**
+   * Whether an agent client is active, and its read permissions. It needs a
+   * machine token for `camunda-cloud-audience` that holds `ctas`. An unknown
+   * uuid answers `active: false`.
+   *
+   * A 429 is NOT tried again, for the reason of `verify`: the caller holds
+   * an agent request open, and it has a deadline of its own.
+   */
+  static async status(params) {
+    return send(
+      params,
+      "ControlAgentClientsInternalService.status",
+      `internal/agent-clients/${encodeURIComponent(params.params.uuid)}/status`,
+      "internal/agent-clients/:uuid/status",
+      "get",
+      void 0,
+      { attempts: 1, remaining: 0 }
+    );
+  }
+}
+export {
+  ControlAgentClientsInternalService,
+  ControlAgentTokensService
+};
+//# sourceMappingURL=control.agent-tokens.service.js.map

package/dist/services/control/control.agent-tokens.service.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/services/control/control.agent-tokens.service.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport type {\n  AgentStatusResponse,\n  AgentToken,\n  AgentTokenAdmin,\n  AgentTokenCreated,\n  AgentTokenExpiryDays,\n  AgentTokenStatus,\n  AgentVerifyResponse,\n} from '@camunda/ccma-shared-types'\nimport type {\n  RequestBaseMethodType,\n  RequestBaseParams,\n} from '../../types/general.types.js'\nimport { request } from '../../utils/api.js'\nimport { HttpError } from '../../utils/errors.js'\n\n/**\n * The agent tokens of ccmacli in control-backend.\n *\n * `ControlAgentTokensService` is for a Camundi, with the user token of\n * control-frontend. `ControlAgentClientsInternalService` is for the machine\n * callers: token-issuer verifies credentials, and console-backend and\n * accounts-backend read the status of a client.\n */\n\nconst BASE = { id: 'control' } as const\n\nexport interface CreateAgentTokenRequest extends RequestBaseParams {\n  params: { name: string; expiresInDays: AgentTokenExpiryDays }\n}\n\nexport interface ListAllAgentTokensRequest extends RequestBaseParams {\n  params?: { status?: Exclude<AgentTokenStatus, 'inactive'> }\n}\n\nexport interface AgentTokenUuidRequest extends RequestBaseParams {\n  params: { uuid: string }\n}\n\nexport interface VerifyAgentClientRequest extends RequestBaseParams {\n  params: { clientId: string; clientSecret: string }\n}\n\nasync function send<TResponse>(\n  params: RequestBaseParams,\n  name: string,\n  url: string,\n  normalizedUrl: string,\n  method: RequestBaseMethodType,\n  body?: object,\n  retry?: { attempts: number; remaining: number },\n): Promise<TResponse> {\n  const serviceContext = {\n    method: { name, url, normalizedUrl, type: method },\n    source: params.config.metrics?.source || 'unset',\n    target: { name: 'control', type: 'internal' as const },\n  }\n  const response = await request<TResponse>({\n    ...params,\n    config: params.config,\n    base: BASE,\n    url,\n    method,\n    metricsDetails: serviceContext,\n    body,\n    retry,\n  })\n  if (!response.ok) {\n    throw new HttpError(\n      `${name}: ${response.status} ${response.statusText}`,\n      response.status,\n      response.statusText,\n    )\n  }\n  // `revoke` answers 204 with no body, and its caller reads nothing.\n  return response.body as TResponse\n}\n\nexport class ControlAgentTokensService {\n  /**\n   * Creates an agent token of the caller. The answer is the only place that\n   * holds the secret. 404 while the flag `control.agentTokens` is off.\n   */\n  public static async create(\n    params: CreateAgentTokenRequest,\n  ): Promise<AgentTokenCreated> {\n    return send<AgentTokenCreated>(\n      params,\n      'ControlAgentTokensService.create',\n      'api/agent-tokens',\n      'api/agent-tokens',\n      'post',\n      params.params,\n    )\n  }\n\n  /** The tokens that the caller created, newest first. */\n  public static async listOwn(\n    params: RequestBaseParams,\n  ): Promise<{ items: AgentToken[] }> {\n    return send<{ items: AgentToken[] }>(\n      params,\n      'ControlAgentTokensService.listOwn',\n      'api/agent-tokens',\n      'api/agent-tokens',\n      'get',\n    )\n  }\n\n  /**\n   * The newest 500 tokens of the stage that match `status`. Needs\n   * `agentTokens.admin`.\n   */\n  public static async listAll(\n    params: ListAllAgentTokensRequest,\n  ): Promise<{ items: AgentTokenAdmin[] }> {\n    const status = params.params?.status\n    const query = status ? `?status=${encodeURIComponent(status)}` : ''\n    return send<{ items: AgentTokenAdmin[] }>(\n      params,\n      'ControlAgentTokensService.listAll',\n      `api/agent-tokens/all${query}`,\n      'api/agent-tokens/all',\n      'get',\n    )\n  }\n\n  /** A new secret for an own, active token. 404 while the flag is off. */\n  public static async rotate(\n    params: AgentTokenUuidRequest,\n  ): Promise<AgentTokenCreated> {\n    return send<AgentTokenCreated>(\n      params,\n      'ControlAgentTokensService.rotate',\n      `api/agent-tokens/${encodeURIComponent(params.params.uuid)}/rotate`,\n      'api/agent-tokens/:uuid/rotate',\n      'post',\n    )\n  }\n\n  /** Revokes an own token, or any token with `agentTokens.admin`. */\n  public static async revoke(params: AgentTokenUuidRequest): Promise<void> {\n    await send<undefined>(\n      params,\n      'ControlAgentTokensService.revoke',\n      `api/agent-tokens/${encodeURIComponent(params.params.uuid)}`,\n      'api/agent-tokens/:uuid',\n      'delete',\n    )\n  }\n}\n\nexport class ControlAgentClientsInternalService {\n  /**\n   * Checks the credentials of an agent client. It needs no token: do not\n   * set `config.auth`. A 401 means that the credentials are not valid, for\n   * any reason, and it does not count as an error in the metrics.\n   *\n   * A 429 is NOT tried again. token-issuer calls this inside a token request,\n   * and `request` would otherwise wait and try up to 8 times.\n   */\n  public static async verify(\n    params: VerifyAgentClientRequest,\n  ): Promise<AgentVerifyResponse> {\n    return send<AgentVerifyResponse>(\n      params,\n      'ControlAgentClientsInternalService.verify',\n      'internal/agent-clients/verify',\n      'internal/agent-clients/verify',\n      'post',\n      params.params,\n      { attempts: 1, remaining: 0 },\n    )\n  }\n\n  /**\n   * Whether an agent client is active, and its read permissions. It needs a\n   * machine token for `camunda-cloud-audience` that holds `ctas`. An unknown\n   * uuid answers `active: false`.\n   *\n   * A 429 is NOT tried again, for the reason of `verify`: the caller holds\n   * an agent request open, and it has a deadline of its own.\n   */\n  public static async status(\n    params: AgentTokenUuidRequest,\n  ): Promise<AgentStatusResponse> {\n    return send<AgentStatusResponse>(\n      params,\n      'ControlAgentClientsInternalService.status',\n      `internal/agent-clients/${encodeURIComponent(params.params.uuid)}/status`,\n      'internal/agent-clients/:uuid/status',\n      'get',\n      undefined,\n      { attempts: 1, remaining: 0 },\n    )\n  }\n}\n"],
+  "mappings": "AAmBA,SAAS,eAAe;AACxB,SAAS,iBAAiB;AAW1B,MAAM,OAAO,EAAE,IAAI,UAAU;AAkB7B,eAAe,KACb,QACA,MACA,KACA,eACA,QACA,MACA,OACoB;AACpB,QAAM,iBAAiB;AAAA,IACrB,QAAQ,EAAE,MAAM,KAAK,eAAe,MAAM,OAAO;AAAA,IACjD,QAAQ,OAAO,OAAO,SAAS,UAAU;AAAA,IACzC,QAAQ,EAAE,MAAM,WAAW,MAAM,WAAoB;AAAA,EACvD;AACA,QAAM,WAAW,MAAM,QAAmB;AAAA,IACxC,GAAG;AAAA,IACH,QAAQ,OAAO;AAAA,IACf,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,EACF,CAAC;AACD,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI;AAAA,MACR,GAAG,IAAI,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU;AAAA,MAClD,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF;AAEA,SAAO,SAAS;AAClB;AAEO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrC,aAAoB,OAClB,QAC4B;AAC5B,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,QAClB,QACkC;AAClC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAoB,QAClB,QACuC;AACvC,UAAM,SAAS,OAAO,QAAQ;AAC9B,UAAM,QAAQ,SAAS,WAAW,mBAAmB,MAAM,CAAC,KAAK;AACjE,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,uBAAuB,KAAK;AAAA,MAC5B;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,OAClB,QAC4B;AAC5B,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,oBAAoB,mBAAmB,OAAO,OAAO,IAAI,CAAC;AAAA,MAC1D;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA;AAAA,EAGA,aAAoB,OAAO,QAA8C;AACvE,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,oBAAoB,mBAAmB,OAAO,OAAO,IAAI,CAAC;AAAA,MAC1D;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEO,MAAM,mCAAmC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS9C,aAAoB,OAClB,QAC8B;AAC9B,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO;AAAA,MACP,EAAE,UAAU,GAAG,WAAW,EAAE;AAAA,IAC9B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,aAAoB,OAClB,QAC8B;AAC9B,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,0BAA0B,mBAAmB,OAAO,OAAO,IAAI,CAAC;AAAA,MAChE;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE,UAAU,GAAG,WAAW,EAAE;AAAA,IAC9B;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/services/control/control.agent-tokens.service.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/utils/api.js

@@ -449,6 +449,11 @@ async function request(payload) {
             );
           }
           break;
+        case "control":
+          if (payload.metricsDetails.method.name === "ControlAgentClientsInternalService.verify") {
+            noErrorStatusCodes.push(401);
+          }
+          break;
       }
       if (noErrorStatusCodes.includes(response.status)) {
         type2 = "success";