@contember/engine-tenant-api 2.0.0-alpha.13 → 2.0.0-alpha.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contember/engine-tenant-api",
-  "version": "2.0.0-alpha.13",
+  "version": "2.0.0-alpha.15",
   "license": "Apache-2.0",
   "main": "./dist/production/index.js",
   "typings": "./dist/types/index.d.ts",
@@ -26,16 +26,16 @@
     "generate": "gql-gen --config graphql-tenant.codegen.yml"
   },
   "dependencies": {
-    "@contember/authorization": "2.0.0-alpha.13",
-    "@contember/config-loader": "2.0.0-alpha.13",
-    "@contember/database": "2.0.0-alpha.13",
-    "@contember/database-migrations": "2.0.0-alpha.13",
-    "@contember/dic": "2.0.0-alpha.13",
-    "@contember/graphql-utils": "2.0.0-alpha.13",
-    "@contember/logger": "2.0.0-alpha.13",
-    "@contember/schema": "2.0.0-alpha.13",
-    "@contember/schema-utils": "2.0.0-alpha.13",
-    "@contember/typesafe": "2.0.0-alpha.13",
+    "@contember/authorization": "2.0.0-alpha.15",
+    "@contember/config-loader": "2.0.0-alpha.15",
+    "@contember/database": "2.0.0-alpha.15",
+    "@contember/database-migrations": "2.0.0-alpha.15",
+    "@contember/dic": "2.0.0-alpha.15",
+    "@contember/graphql-utils": "2.0.0-alpha.15",
+    "@contember/logger": "2.0.0-alpha.15",
+    "@contember/schema": "2.0.0-alpha.15",
+    "@contember/schema-utils": "2.0.0-alpha.15",
+    "@contember/typesafe": "2.0.0-alpha.15",
     "@graphql-tools/utils": "^10.0.8",
     "graphql-tag": "^2.12.6",
     "jose": "^5.1.1",
@@ -45,7 +45,7 @@
     "otpauth": "^9.1.5"
   },
   "devDependencies": {
-    "@contember/database-tester": "2.0.0-alpha.13",
+    "@contember/database-tester": "2.0.0-alpha.15",
     "@graphql-codegen/cli": "^5.0.0",
     "@graphql-codegen/typescript": "^4.0.1",
     "@graphql-codegen/typescript-operations": "^4.0.1",

package/src/TenantContainer.ts

@@ -79,6 +79,12 @@ import { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMut
 import { TenantCredentials, TenantMigrationsRunner } from './migrations'
 import { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver'
 import { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver'
+import { ConfigurationManager } from './model/service/ConfigurationManager'
+import { ConfigurationMutationResolver } from './resolvers/mutation/configuration/ConfigurationMutationResolver'
+import { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQueryResolver'
+import { PasswordlessMutationResolver } from './resolvers/mutation/person/PasswordlessMutationResolver'
+import { PasswordlessSignInManager } from './model/service/PasswordlessSignInManager'
+import { TogglePasswordlessMutationResolver } from './resolvers/mutation/person/TogglePasswordlessMutationResolver'
 
 export interface TenantContainer {
 	projectMemberManager: ProjectMemberManager
@@ -201,6 +207,10 @@ export class TenantContainerFactory {
 				new MailTemplateManager())
 			.addService('rolesManager', () =>
 				new RolesManager())
+			.addService('configurationManager', () =>
+				new ConfigurationManager())
+			.addService('passwordlessSignInManager', ({ apiKeyManager, configurationManager, userMailer, projectManager, otpAuthenticator }) =>
+				new PasswordlessSignInManager(apiKeyManager, configurationManager, userMailer, projectManager, otpAuthenticator))
 
 			.addService('identityTypeResolver', ({ projectMemberManager, projectManager, permissionContextFactory }) =>
 				new IdentityTypeResolver(projectMemberManager, projectManager, permissionContextFactory))
@@ -268,6 +278,14 @@ export class TenantContainerFactory {
 				new SetProjectSecretMutationResolver(projectManager, secretManager))
 			.addService('identityGlobalRolesMutationResolver', ({ rolesManager }) =>
 				new IdentityGlobalRolesMutationResolver(rolesManager))
+			.addService('configurationMutationResolver', ({ configurationManager }) =>
+				new ConfigurationMutationResolver(configurationManager))
+			.addService('configurationQueryResolver', ({ configurationManager }) =>
+				new ConfigurationQueryResolver(configurationManager))
+			.addService('passwordlessMutationResolver', ({ passwordlessSignInManager, signInResponseFactory }) =>
+				new PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory))
+			.addService('togglePasswordlessMutationResolver', ({ configurationManager, personManager }) =>
+				new TogglePasswordlessMutationResolver(configurationManager, personManager))
 			.addService('resolverContextFactory', ({ permissionContextFactory }) =>
 				new TenantResolverContextFactory(permissionContextFactory))
 			.addService('resolvers', container =>

package/src/migrations/2024-08-26-120000-passwordless.ts

@@ -0,0 +1,31 @@
+import { MigrationBuilder } from '@contember/database-migrations'
+
+const sql = `
+CREATE TYPE CONFIG_SINGLETON AS ENUM ('singleton');
+CREATE TYPE CONFIG_POLICY AS ENUM ('always', 'never', 'optIn', 'optOut');
+CREATE TABLE "config"
+(
+	id                              CONFIG_SINGLETON PRIMARY KEY DEFAULT 'singleton',
+	passwordless_enabled            CONFIG_POLICY NOT NULL       DEFAULT 'never',
+	passwordless_url                TEXT,
+	passwordless_expiration_minutes INTEGER       NOT NULL       DEFAULT 5
+);
+INSERT INTO "config" (id)
+VALUES (DEFAULT);
+
+ALTER TABLE person_password_reset
+	RENAME TO person_token;
+CREATE TYPE PERSON_TOKEN_TYPE AS ENUM ('password_reset', 'passwordless');
+ALTER TABLE person_token
+	ADD COLUMN type PERSON_TOKEN_TYPE NOT NULL DEFAULT 'password_reset',
+	ADD COLUMN otp_hash TEXT DEFAULT NULL,
+	ADD COLUMN otp_attempts INTEGER NOT NULL DEFAULT 0;
+
+ALTER TABLE person
+	ADD COLUMN passwordless_enabled BOOLEAN DEFAULT NULL;
+
+`
+
+export default async function (builder: MigrationBuilder) {
+	builder.sql(sql)
+}

package/src/migrations/runner.ts

@@ -37,6 +37,7 @@ import _20230120135500personemailnormalize from './2023-01-20-135500-person-emai
 import _20230603104000persondisabled from './2023-06-03-104000-person-disabled'
 import _20230901165000idpreturnconfig from './2023-09-01-165000-idp-return-config'
 import _20240620140000mailreply from './2024-06-20-140000-mail-reply'
+import _20240826120000passwordless from './2024-08-26-120000-passwordless'
 
 import snapshot from './snapshot'
 import { computeTokenHash, Providers } from '../model'
@@ -87,6 +88,7 @@ const migrations = {
 	'2023-06-03-104000-person-disabled': _20230603104000persondisabled,
 	'2023-09-01-165000-idp-return-config': _20230901165000idpreturnconfig,
 	'2024-06-20-140000-mail-reply': _20240620140000mailreply,
+	'2024-08-26-120000-passwordless': _20240826120000passwordless,
 }
 
 export class TenantMigrationsRunner {

package/src/migrations/snapshot-template-end.txt

@@ -1,3 +1,6 @@
+INSERT INTO "config" (id)
+VALUES (DEFAULT);
+
 DO LANGUAGE plpgsql
 $$
 	BEGIN

package/src/migrations/snapshot.ts

@@ -4,6 +4,19 @@ import { createCredentials } from './tenantCredentials'
 
 export default async function (builder: MigrationBuilder, args: TenantMigrationArgs) {
 	builder.sql(`
+CREATE TYPE "config_policy" AS ENUM (
+    'always',
+    'never',
+    'optIn',
+    'optOut'
+);
+CREATE TYPE "config_singleton" AS ENUM (
+    'singleton'
+);
+CREATE TYPE "person_token_type" AS ENUM (
+    'password_reset',
+    'passwordless'
+);
 CREATE FUNCTION "project_deleted"() RETURNS "trigger"
     LANGUAGE "plpgsql"
     AS $$
@@ -40,6 +53,12 @@ CREATE TABLE "api_key" (
     "expiration" integer,
     "disabled_at" timestamp with time zone
 );
+CREATE TABLE "config" (
+    "id" "config_singleton" DEFAULT 'singleton'::"config_singleton" NOT NULL,
+    "passwordless_enabled" "config_policy" DEFAULT 'never'::"config_policy" NOT NULL,
+    "passwordless_url" "text",
+    "passwordless_expiration_minutes" integer DEFAULT 5 NOT NULL
+);
 CREATE TABLE "identity" (
     "id" "uuid" NOT NULL,
     "parent_id" "uuid",
@@ -77,6 +96,7 @@ CREATE TABLE "person" (
     "name" "text",
     "idp_only" boolean DEFAULT false NOT NULL,
     "disabled_at" timestamp with time zone,
+    "passwordless_enabled" boolean,
     CONSTRAINT "idp_only_no_email" CHECK ((("idp_only" = false) OR (("idp_only" = true) AND ("email" IS NULL))))
 );
 CREATE TABLE "person_identity_provider" (
@@ -86,13 +106,16 @@ CREATE TABLE "person_identity_provider" (
     "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
     "external_identifier" "text" NOT NULL
 );
-CREATE TABLE "person_password_reset" (
+CREATE TABLE "person_token" (
     "id" "uuid" NOT NULL,
     "token_hash" "text" NOT NULL,
     "person_id" "uuid" NOT NULL,
     "expires_at" timestamp with time zone NOT NULL,
     "created_at" timestamp with time zone NOT NULL,
-    "used_at" timestamp with time zone
+    "used_at" timestamp with time zone,
+    "type" "person_token_type" DEFAULT 'password_reset'::"person_token_type" NOT NULL,
+    "otp_hash" "text",
+    "otp_attempts" integer DEFAULT 0 NOT NULL
 );
 CREATE TABLE "project" (
     "id" "uuid" NOT NULL,
@@ -124,6 +147,8 @@ CREATE TABLE "project_secret" (
 );
 ALTER TABLE ONLY "api_key"
     ADD CONSTRAINT "api_key_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "config"
+    ADD CONSTRAINT "config_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "email_unique" UNIQUE ("email");
 ALTER TABLE ONLY "identity"
@@ -140,7 +165,7 @@ ALTER TABLE ONLY "person"
     ADD CONSTRAINT "person_identity_id_key" UNIQUE ("identity_id");
 ALTER TABLE ONLY "person_identity_provider"
     ADD CONSTRAINT "person_identity_provider_pkey" PRIMARY KEY ("id");
-ALTER TABLE ONLY "person_password_reset"
+ALTER TABLE ONLY "person_token"
     ADD CONSTRAINT "person_password_reset_id" PRIMARY KEY ("id");
 ALTER TABLE ONLY "project"
     ADD CONSTRAINT "project_id" PRIMARY KEY ("id");
@@ -161,7 +186,7 @@ CREATE INDEX "mail_template_project_index" ON "mail_template" USING "btree" ("pr
 CREATE INDEX "person_identity_id" ON "person" USING "btree" ("identity_id");
 CREATE UNIQUE INDEX "person_identity_provider_identifier" ON "person_identity_provider" USING "btree" ("identity_provider_id", "external_identifier");
 CREATE INDEX "person_identity_provider_person_id" ON "person_identity_provider" USING "btree" ("person_id");
-CREATE UNIQUE INDEX "person_password_reset_token" ON "person_password_reset" USING "btree" ("token_hash");
+CREATE UNIQUE INDEX "person_password_reset_token" ON "person_token" USING "btree" ("token_hash");
 CREATE INDEX "project_alias" ON "project" USING "gin" ((("config" -> 'alias'::"text")));
 CREATE INDEX "project_membership_identity_index" ON "project_membership" USING "btree" ("identity_id");
 CREATE UNIQUE INDEX "project_membership_unique" ON "project_membership" USING "btree" ("project_id", "identity_id", "role");
@@ -183,7 +208,7 @@ ALTER TABLE ONLY "person_identity_provider"
     ADD CONSTRAINT "person_identity_provider_idp" FOREIGN KEY ("identity_provider_id") REFERENCES "identity_provider"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "person_identity_provider"
     ADD CONSTRAINT "person_identity_provider_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
-ALTER TABLE ONLY "person_password_reset"
+ALTER TABLE ONLY "person_token"
     ADD CONSTRAINT "person_password_reset_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "project_membership"
     ADD CONSTRAINT "project_membership_identity" FOREIGN KEY ("identity_id") REFERENCES "identity"("id") ON DELETE CASCADE;
@@ -193,6 +218,9 @@ ALTER TABLE ONLY "project_membership_variable"
     ADD CONSTRAINT "project_membership_variable_membership" FOREIGN KEY ("membership_id") REFERENCES "project_membership"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "project_secret"
     ADD CONSTRAINT "project_secret_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
+INSERT INTO "config" (id)
+VALUES (DEFAULT);
+
 DO LANGUAGE plpgsql
 $$
 	BEGIN

package/src/model/authorization/PermissionActions.ts

@@ -13,6 +13,10 @@ namespace PermissionActions {
 		idp = 'idp',
 	}
 
+
+	export const CONFIGURE = Authorizator.createAction(Resources.system, 'configure')
+	export const CONFIG_VIEW = Authorizator.createAction(Resources.system, 'viewConfig')
+
 	export const IDENTITY_VIEW_PERMISSIONS = Authorizator.createAction(Resources.identity, 'viewPermissions')
 	export const IDENTITY_ADD_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'addGlobalRoles', { roles })
 	export const IDENTITY_REMOVE_GLOBAL_ROLES = (roles?: readonly string[]) => Authorizator.createAction(Resources.identity, 'removeGlobalRoles', { roles })
@@ -26,11 +30,14 @@ namespace PermissionActions {
 	export const PERSON_SETUP_OTP = Authorizator.createAction(Resources.person, 'setupOtp')
 	export const PERSON_CHANGE_PROFILE = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changeProfile', { roles })
 	export const PERSON_CHANGE_MY_PROFILE = Authorizator.createAction(Resources.person, 'changeMyProfile')
+	export const PERSON_TOGGLE_PASSWORDLESS = Authorizator.createAction(Resources.person, 'togglePasswordless')
 	export const PERSON_CHANGE_PASSWORD = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'changePassword', { roles })
 	export const PERSON_CHANGE_MY_PASSWORD = Authorizator.createAction(Resources.person, 'changeMyPassword')
 	export const PERSON_RESET_PASSWORD = Authorizator.createAction(Resources.person, 'resetPassword')
 	export const PERSON_CREATE_IDP_URL = Authorizator.createAction(Resources.person, 'createIdPUrl')
 	export const PERSON_SIGN_IN_IDP = Authorizator.createAction(Resources.person, 'signInIdp')
+	export const PERSON_REQUEST_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'requestPasswordlessSignIn')
+	export const PERSON_PASSWORDLESS_SIGN_IN = Authorizator.createAction(Resources.person, 'passwordlessSignIn')
 	export const PERSON_CREATE_SESSION_KEY = (roles?: readonly string[]) => Authorizator.createAction(Resources.person, 'createSessionToken', { roles })
 
 	export const PERSON_INVITE = (memberships: readonly Acl.Membership[]) => Authorizator.createAction(Resources.person, 'invite', { memberships })

package/src/model/authorization/PermissionsFactory.ts

@@ -24,10 +24,13 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)
 		permissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)
 		permissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)
+		permissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)
+		permissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)
 
 		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)
 		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)
 		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)
+		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)
 		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)
 		permissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)
 
@@ -65,6 +68,8 @@ class PermissionsFactory {
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)
 
 		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)
+		permissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)
 
 		permissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)
 		permissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)

package/src/model/commands/configuration/UpdateConfigurationCommand.ts

@@ -0,0 +1,26 @@
+import { Command } from '../Command'
+import { ConfigInput } from '../../../schema'
+import { UpdateBuilder } from '@contember/database'
+
+export class UpdateConfigurationCommand implements Command<void> {
+	constructor(
+		private readonly configuration: ConfigInput,
+	) {
+	}
+
+	async execute({ db }: Command.Args): Promise<void> {
+		const result = await UpdateBuilder.create()
+			.table('config')
+			.where({ id: 'singleton' })
+			.values({
+				passwordless_enabled: this.configuration.passwordless?.enabled,
+				passwordless_url: this.configuration.passwordless?.url,
+				passwordless_expiration_minutes: this.configuration.passwordless?.expirationMinutes,
+			})
+			.execute(db)
+		if (!result) {
+			throw new Error('Configuration not found')
+		}
+	}
+
+}

package/src/model/commands/configuration/index.ts

@@ -0,0 +1 @@
+export * from './UpdateConfigurationCommand'

package/src/model/commands/index.ts

@@ -1,5 +1,5 @@
 export * from './apiKey'
-export * from './apiKey'
+export * from './configuration'
 export * from './person'
 export * from './Command'
 export * from './CommandBus'
@@ -8,4 +8,4 @@ export * from './project'
 export * from './mailTemplate'
 export * from './membership'
 export * from './otp'
-export * from './passwordReset'
+export * from './personToken'

package/src/model/commands/person/CreatePersonCommand.ts

@@ -40,6 +40,7 @@ export class CreatePersonCommand implements Command<Omit<PersonRow, 'roles'>> {
 			otp_uri: null,
 			otp_activated_at: null,
 			disabled_at: null,
+			passwordless_enabled: null,
 		}
 	}
 }

package/src/model/commands/person/TogglePersonPasswordlessCommand.ts

@@ -0,0 +1,18 @@
+import { Command } from '../Command'
+import { UpdateBuilder } from '@contember/database'
+
+export class TogglePersonPasswordlessCommand implements Command<void> {
+	constructor(private readonly personId: string, private readonly value: boolean | null) { }
+
+	async execute({ db }: Command.Args): Promise<void> {
+		await UpdateBuilder.create()
+			.table('person')
+			.values({
+				passwordless_enabled: this.value,
+			})
+			.where({
+				id: this.personId,
+			})
+			.execute(db)
+	}
+}

package/src/model/commands/person/index.ts

@@ -1,3 +1,4 @@
 export * from './ChangePasswordCommand'
 export * from './CreatePersonCommand'
 export * from './CreatePersonIdentityProviderIdentifierCommand'
+export * from './TogglePersonPasswordlessCommand'

package/src/model/commands/personToken/ActivateOtpCommand.ts

@@ -0,0 +1,24 @@
+import { Command } from '../Command'
+import { UpdateBuilder } from '@contember/database'
+import { ImplementationException } from '../../../exceptions'
+
+export class ActivateOtpCommand implements Command<void> {
+	constructor(
+		private readonly id: string,
+		private readonly otpHash: string,
+	) {}
+
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		const count = await UpdateBuilder.create()
+			.table('person_token')
+			.where({ id: this.id })
+			.values({
+				otp_hash: this.otpHash,
+			})
+			.execute(db)
+
+		if (count === 0) {
+			throw new ImplementationException()
+		}
+	}
+}

package/src/model/commands/personToken/CreatePersonTokenCommand.ts

@@ -0,0 +1,42 @@
+import { Command } from '../Command'
+import { computeTokenHash, generateToken } from '../../utils'
+import { SavePersonTokenCommand } from './SavePersonTokenCommand'
+import { PersonToken } from '../../type'
+import { PASSWORD_RESET_EXPIRATION_MINUTES } from '../../consts/expirations'
+
+export class CreatePersonTokenCommand implements Command<CreatePersonTokenCommand.Result> {
+	private constructor(
+		private readonly personId: string,
+		private readonly type: PersonToken.Type,
+		private readonly expirationMinutes: number,
+	) {}
+
+	static createPasswordResetRequest(personId: string, expirationMinutes: number = PASSWORD_RESET_EXPIRATION_MINUTES): CreatePersonTokenCommand {
+		return new CreatePersonTokenCommand(personId, 'password_reset', expirationMinutes)
+	}
+
+	static createPasswordlessRequest(personId: string, expirationMinutes: number): CreatePersonTokenCommand {
+		return new CreatePersonTokenCommand(personId, 'passwordless', expirationMinutes)
+	}
+
+	async execute({ db, providers, bus }: Command.Args): Promise<CreatePersonTokenCommand.Result> {
+		const token = await generateToken(providers)
+		const tokenHash = computeTokenHash(token)
+		const result = await bus.execute(new SavePersonTokenCommand(
+			this.personId,
+			tokenHash,
+			this.type,
+			this.expirationMinutes,
+		))
+
+		return { ...result, token }
+	}
+}
+
+namespace CreatePersonTokenCommand {
+	export interface Result {
+		readonly id: string
+		readonly token: string
+		readonly expiresAt: Date
+	}
+}

package/src/model/commands/personToken/IncreaseOtpAttemptCommand.ts

@@ -0,0 +1,23 @@
+import { Command } from '../Command'
+import { Literal, UpdateBuilder } from '@contember/database'
+import { ImplementationException } from '../../../exceptions'
+
+export class IncreaseOtpAttemptCommand implements Command<void> {
+	constructor(
+		private readonly id: string,
+	) {}
+
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		const count = await UpdateBuilder.create()
+			.table('person_token')
+			.where({ id: this.id })
+			.values({
+				otp_attempts: new Literal('otp_attempts + 1'),
+			})
+			.execute(db)
+
+		if (count === 0) {
+			throw new ImplementationException()
+		}
+	}
+}

package/src/model/commands/personToken/InvalidateTokenCommand.ts

@@ -0,0 +1,22 @@
+import { Command } from '../Command'
+import { UpdateBuilder } from '@contember/database'
+import { ImplementationException } from '../../../exceptions'
+
+export class InvalidateTokenCommand implements Command<void> {
+	constructor(private readonly id: string) {}
+
+	async execute({ db, providers }: Command.Args): Promise<void> {
+		const count = await UpdateBuilder.create()
+			.table('person_token')
+			.where({ id: this.id })
+			.where(expr => expr.isNull('used_at'))
+			.values({
+				used_at: providers.now(),
+			})
+			.execute(db)
+
+		if (count === 0) {
+			throw new ImplementationException()
+		}
+	}
+}

package/src/model/commands/personToken/ResetPasswordCommand.ts

@@ -0,0 +1,28 @@
+import { Command } from '../Command'
+import { ChangePasswordCommand } from '../person/ChangePasswordCommand'
+import { Response, ResponseOk } from '../../utils/Response'
+import { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery'
+import { InvalidateTokenCommand } from './InvalidateTokenCommand'
+import { validateToken } from '../../utils'
+import { PersonToken } from '../../type'
+
+export class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {
+	constructor(private readonly token: string, private readonly password: string) {}
+
+	async execute({ db, providers, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {
+		const now = providers.now()
+		const token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))
+		const tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: 'token' })
+		if (!tokenValidationResult.ok) {
+			return tokenValidationResult
+		}
+		await bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))
+		await bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))
+
+		return new ResponseOk(null)
+	}
+}
+export type ResetPasswordCommandErrorCode =
+	| PersonToken.TokenValidationError
+
+export type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>

package/src/model/commands/personToken/SavePersonTokenCommand.ts

@@ -0,0 +1,42 @@
+import { Command } from '../Command'
+import { InsertBuilder } from '@contember/database'
+import { plusMinutes } from '../../utils/time'
+import { TokenHash } from '../../utils'
+import { PersonToken } from '../../type'
+
+class SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {
+	constructor(
+		private readonly personId: string,
+		private readonly tokenHash: TokenHash,
+		private readonly type: PersonToken.Type,
+		private readonly expirationMinutes: number,
+	) {}
+
+	async execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {
+		const id = providers.uuid()
+		const expiresAt = plusMinutes(providers.now(), this.expirationMinutes)
+		await InsertBuilder.create()
+			.into('person_token')
+			.values({
+				id: id,
+				token_hash: this.tokenHash,
+				person_id: this.personId,
+				expires_at: expiresAt,
+				created_at: providers.now(),
+				used_at: null,
+				type: this.type,
+			})
+			.execute(db)
+
+		return { id, expiresAt }
+	}
+}
+
+namespace SavePersonTokenCommand {
+	export interface Result {
+		id: string
+		expiresAt: Date
+	}
+}
+
+export { SavePersonTokenCommand }

package/src/model/commands/personToken/index.ts

@@ -0,0 +1,6 @@
+export * from './ActivateOtpCommand'
+export * from './CreatePersonTokenCommand'
+export * from './InvalidateTokenCommand'
+export * from './IncreaseOtpAttemptCommand'
+export * from './ResetPasswordCommand'
+export * from './SavePersonTokenCommand'

package/src/model/consts/expirations.ts

@@ -0,0 +1,2 @@
+export const PASSWORD_RESET_EXPIRATION_MINUTES = 60
+export const INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = 60 * 24

package/src/model/mailing/UserMailer.ts

@@ -2,6 +2,7 @@ import { Mailer, TemplateRenderer } from '../../utils'
 import NewUserInvited from './templates/NewUserInvited.mustache'
 import ExistingUserInvited from './templates/ExistingUserInvited.mustache'
 import PasswordReset from './templates/PasswordReset.mustache'
+import PasswordlessSignIn from './templates/PasswordlessSignIn.mustache'
 import { MailTemplateData, MailTemplateIdentifier, MailType } from './type'
 import { MailTemplateQuery } from '../queries'
 import Layout from './templates/Layout.mustache'
@@ -52,6 +53,19 @@ export class UserMailer {
 		await this.sendTemplate(template, mailArguments)
 	}
 
+	async sendPasswordlessEmail(
+		dbContext: DatabaseContext,
+		mailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string },
+		customMailOptions: { projectId: string | null; variant: string },
+	): Promise<void> {
+		const template = (await this.getCustomTemplate(dbContext, { type: MailType.passwordlessSignIn, ...customMailOptions })) || {
+			subject: 'Sign in here',
+			content: PasswordlessSignIn,
+			replyTo: null,
+		}
+		await this.sendTemplate(template, mailArguments)
+	}
+
 	private async sendTemplate(
 		template: Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'>,
 		mailArguments: Record<string, any>,

package/src/model/mailing/templates/PasswordlessSignIn.mustache.ts

@@ -0,0 +1,15 @@
+import Layout from './Layout.mustache'
+// language=Mustache
+export default Layout(`
+	<p>Hello,</p>
+	<p>
+		sign in was requested for your account ({{email}}):<br>
+		{{#url}}
+			<p>Click the following link to sign in:</p>
+			<a href="{{url}}">{{url}}</a>
+		{{/url}}
+		{{^url}}
+			<p>Passwordless sign-in is misconfigured. Please contact your administrator.</p>
+		{{/url}}
+	</p>
+`)

package/src/model/mailing/type.ts

@@ -4,6 +4,7 @@ export enum MailType {
 	existingUserInvited = 'existingUserInvited',
 	newUserInvited = 'newUserInvited',
 	passwordReset = 'passwordReset',
+	passwordlessSignIn = 'passwordlessSignIn',
 }
 
 export const mailTypeFromSchemaToDb = (type: SchemaMailType): MailType => {
@@ -11,6 +12,7 @@ export const mailTypeFromSchemaToDb = (type: SchemaMailType): MailType => {
 		EXISTING_USER_INVITED: MailType.existingUserInvited,
 		NEW_USER_INVITED: MailType.newUserInvited,
 		RESET_PASSWORD_REQUEST: MailType.passwordReset,
+		PASSWORDLESS_SIGN_IN: MailType.passwordlessSignIn,
 	}[type]
 }
 
@@ -19,6 +21,7 @@ export const mailTypeFromDbToSchema = (type: MailType): SchemaMailType => {
 		[MailType.existingUserInvited]: 'EXISTING_USER_INVITED' as const,
 		[MailType.newUserInvited]: 'NEW_USER_INVITED' as const,
 		[MailType.passwordReset]: 'RESET_PASSWORD_REQUEST' as const,
+		[MailType.passwordlessSignIn]: 'PASSWORDLESS_SIGN_IN' as const,
 	}[type]
 }