@contember/engine-tenant-api 2.0.0-alpha.14 → 2.0.0-alpha.15

package/dist/development/src/model/service/PasswordlessSignInManager.js

@@ -0,0 +1,135 @@
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import { ImplementationException } from "../../exceptions.js";
+import { PersonQuery } from "../queries/person/PersonQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import "../type/ApiKey.js";
+import { ActivateOtpCommand } from "../commands/personToken/ActivateOtpCommand.js";
+import { CreatePersonTokenCommand } from "../commands/personToken/CreatePersonTokenCommand.js";
+import { InvalidateTokenCommand } from "../commands/personToken/InvalidateTokenCommand.js";
+import { IncreaseOtpAttemptCommand } from "../commands/personToken/IncreaseOtpAttemptCommand.js";
+import { PersonTokenQuery } from "../queries/personToken/PersonTokenQuery.js";
+import { validateToken } from "../utils/tokenUtils.js";
+import { getPreferredProject } from "./helpers/getPreferredProject.js";
+class PasswordlessSignInManager {
+  constructor(apiKeyManager, configurationManager, mailer, projectManager, otpAuthenticator) {
+    this.apiKeyManager = apiKeyManager;
+    this.configurationManager = configurationManager;
+    this.mailer = mailer;
+    this.projectManager = projectManager;
+    this.otpAuthenticator = otpAuthenticator;
+  }
+  async initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }) {
+    return db.transaction(async (db2) => {
+      const configuration = await this.configurationManager.fetchConfiguration(db2);
+      if (configuration.passwordless.enabled === "never") {
+        return new ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled");
+      }
+      const person = await db2.queryHandler.fetch(PersonQuery.byEmail(email));
+      if (!person) {
+        return new ResponseError("PERSON_NOT_FOUND", `Person ${email} not found`);
+      }
+      if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
+        return new ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
+      }
+      const createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, configuration.passwordless.expirationMinutes);
+      const result = await db2.commandBus.execute(createTokenCommand);
+      const url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? void 0;
+      const projects = await this.projectManager.getProjectsByIdentity(db2, person.identity_id, permissionContext);
+      const project = getPreferredProject(projects, mailProject ?? null);
+      await this.mailer.sendPasswordlessEmail(db2, {
+        email,
+        token: result.token,
+        url,
+        project: project?.name,
+        projectSlug: project?.slug
+      }, {
+        variant: mailVariant || "",
+        projectId: project?.id ?? null
+      });
+      return new ResponseOk({ requestId: result.id, expiresAt: result.expiresAt });
+    });
+  }
+  formatUrl(url, token, requestId, email) {
+    if (!url) {
+      return null;
+    }
+    const urlObj = new URL(url);
+    urlObj.searchParams.set("token", token);
+    urlObj.searchParams.set("request_id", requestId);
+    urlObj.searchParams.set("email", email);
+    return urlObj.toString();
+  }
+  async signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }) {
+    return db.transaction(async (db2) => {
+      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.byId(requestId, "passwordless"));
+      const tokenValidationResult = validateToken({
+        entry: tokenResult,
+        token,
+        now: db2.providers.now(),
+        validationType
+      });
+      if (!tokenValidationResult.ok) {
+        if (tokenValidationResult.error === "TOKEN_INVALID" && validationType === "otp") {
+          await db2.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult.id));
+        }
+        return tokenValidationResult;
+      }
+      const personRow = await db2.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id));
+      if (!personRow) {
+        throw new ImplementationException();
+      }
+      if (personRow.disabled_at !== null) {
+        return new ResponseError("PERSON_DISABLED", `Person is disabled`);
+      }
+      if (personRow.otp_uri && personRow.otp_activated_at) {
+        if (!mfaOtp) {
+          return new ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`);
+        }
+        if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
+          return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed");
+        }
+      }
+      await db2.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id));
+      const sessionToken = await this.apiKeyManager.createSessionApiKey(db2, personRow.identity_id, expiration);
+      return new ResponseOk({ person: personRow, token: sessionToken });
+    });
+  }
+  async activatePasswordlessOtp({ db, token, requestId, otpHash }) {
+    return db.transaction(async (db2) => {
+      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.byId(requestId, "passwordless"));
+      const tokenValidationResult = validateToken({
+        entry: tokenResult,
+        token,
+        now: db2.providers.now(),
+        validationType: "token"
+      });
+      if (!tokenValidationResult.ok) {
+        return tokenValidationResult;
+      }
+      await db2.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash));
+      return new ResponseOk(null);
+    });
+  }
+  isEnabled(globalValue, personValue) {
+    switch (globalValue) {
+      case "always":
+        return true;
+      case "never":
+        return false;
+      case "optIn":
+        return personValue === true;
+      case "optOut":
+        return personValue !== false;
+    }
+  }
+}
+export {
+  PasswordlessSignInManager
+};
+//# sourceMappingURL=PasswordlessSignInManager.js.map

package/dist/development/src/model/service/PasswordlessSignInManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordlessSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport {\n\tActivatePasswordlessOtpErrorCode,\n\tConfigPolicy,\n\tInitSignInPasswordlessErrorCode,\n\tInitSignInPasswordlessResult,\n\tSignInPasswordlessErrorCode,\n} from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { ConfigurationManager } from './ConfigurationManager'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { InvalidateTokenCommand } from '../commands/personToken/InvalidateTokenCommand'\nimport { PersonToken } from '../type'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await this.configurationManager.fetchConfiguration(db)\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled')\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`)\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, configuration.passwordless.expirationMinutes)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({ requestId: result.id, expiresAt: result.expiresAt })\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string | null, token: string, requestId: string, email: string): string | null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn tokenValidationResult\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`)\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({ person: personRow, token: sessionToken })\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn tokenValidationResult\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean | null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult, InitSignInPasswordlessErrorCode>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode>\n\n\texport type ActivatePasswordlessOtpResponse = Response<null, ActivatePasswordlessOtpErrorCode>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db"],"mappings":";;;;;;;;;;;;;;;;;;AAuBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,sBACA,QACA,gBACA,kBAEhB;AANgB,SAAA,gBAAA;AACA,SAAA,uBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAEf;AAAA,EAEH,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAM,KAAK,qBAAqB,mBAAmBA,GAAE;AACvE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAI,cAAc,yBAAyB,kCAAkC;AAAA,MACrF;AAEM,YAAA,SAAS,MAAMA,IAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAI,cAAc,oBAAoB,UAAU,KAAK,YAAY;AAAA,MACzE;AACI,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAI,cAAc,yBAAyB,kDAAkD;AAAA,MACrG;AAEA,YAAM,qBAAqB,yBAAyB,0BAA0B,OAAO,IAAI,cAAc,aAAa,iBAAiB;AACrI,YAAM,SAAS,MAAMA,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAU,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBA,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA,GACpB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAEM,aAAA,IAAI,WAAW,EAAE,WAAW,OAAO,IAAI,WAAW,OAAO,UAAA,CAAW;AAAA,IAAA,CAC3E;AAAA,EACF;AAAA,EAEQ,UAAU,KAAoB,OAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IACR;AACM,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAAS,KAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO;EACf;AAAA,EAEA,MAAM,mBAAmB,EAAE,IAAI,YAAY,OAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOA,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAI,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAC3E;AACO,eAAA;AAAA,MACR;AACM,YAAA,YAAY,MAAMA,IAAG,aAAa,MAAM,YAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAI,wBAAwB;AAAA,MACnC;AACI,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAI,cAAc,mBAAmB,oBAAoB;AAAA,MACjE;AAEI,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAI,cAAc,gBAAgB,uCAAuC;AAAA,QACjF;AAEI,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAI,cAAc,qBAAqB,iCAAiC;AAAA,QAChF;AAAA,MACD;AAEMA,YAAAA,IAAG,WAAW,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBA,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAI,WAAW,EAAE,QAAQ,WAAW,OAAO,cAAc;AAAA,IAAA,CAChE;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,EAAE,IAAI,OAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOA,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AACvB,eAAA;AAAA,MACR;AAEMA,YAAAA,IAAG,WAAW,QAAQ,IAAI,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAErF,aAAA,IAAI,WAAW,IAAI;AAAA,IAAA,CAC1B;AAAA,EACF;AAAA,EAEQ,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IACzB;AAAA,EACD;AACD;"}

package/dist/development/src/model/service/PersonManager.cjs

@@ -10,6 +10,9 @@ require("@contember/authorization");
 require("../authorization/PermissionContext.cjs");
 require("../authorization/PermissionsFactory.cjs");
 require("@contember/schema");
+require("../type/ApiKey.cjs");
+require("node:crypto");
+const TogglePersonPasswordlessCommand = require("../commands/person/TogglePersonPasswordlessCommand.cjs");
 class PersonManager {
   constructor(emailValidator) {
     this.emailValidator = emailValidator;
@@ -29,6 +32,10 @@ class PersonManager {
     await dbContext.commandBus.execute(new ChangeProfileCommand.ChangeProfileCommand(person.id, data));
     return new Response.ResponseOk(null);
   }
+  async togglePasswordless(dbContext, person, value) {
+    await dbContext.commandBus.execute(new TogglePersonPasswordlessCommand.TogglePersonPasswordlessCommand(person.id, value));
+    return new Response.ResponseOk(null);
+  }
 }
 exports.PersonManager = PersonManager;
 //# sourceMappingURL=PersonManager.cjs.map

package/dist/development/src/model/service/PersonManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\tif (data.email !== undefined && person.email !== data.email) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data))\n\t\treturn new ResponseOk(null)\n\t}\n\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":["PersonQuery","ResponseError","ChangeProfileCommand","ResponseOk"],"mappings":";;;;;;;;;;;;AAMA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AACtF,WAAA,MAAM,UAAU,aAAa;AAAA,MACnCA,YAAA,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AACzI,QAAI,KAAK,UAAU,UAAa,OAAO,UAAU,KAAK,OAAO;AAC5D,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAK;AACrF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAIC,SAAA,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AACM,UAAA,UAAU,WAAW,QAAQ,IAAIC,0CAAqB,OAAO,IAAI,IAAI,CAAC;AACrE,WAAA,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAED;;"}
+{"version":3,"file":"PersonManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator'\nimport { TogglePersonPasswordlessCommand } from '../commands'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\tif (data.email !== undefined && person.email !== data.email) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":["PersonQuery","ResponseError","ChangeProfileCommand","ResponseOk","TogglePersonPasswordlessCommand"],"mappings":";;;;;;;;;;;;;;;AAOA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AACtF,WAAA,MAAM,UAAU,aAAa;AAAA,MACnCA,YAAA,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AACzI,QAAI,KAAK,UAAU,UAAa,OAAO,UAAU,KAAK,OAAO;AAC5D,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAK;AACrF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAIC,SAAA,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AACM,UAAA,UAAU,WAAW,QAAQ,IAAIC,0CAAqB,OAAO,IAAI,IAAI,CAAC;AACrE,WAAA,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACjH,UAAA,UAAU,WAAW,QAAQ,IAAIC,gEAAgC,OAAO,IAAI,KAAK,CAAC;AACjF,WAAA,IAAID,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAED;;"}

package/dist/development/src/model/service/PersonManager.js

@@ -8,6 +8,9 @@ import "@contember/authorization";
 import "../authorization/PermissionContext.js";
 import "../authorization/PermissionsFactory.js";
 import "@contember/schema";
+import "../type/ApiKey.js";
+import "node:crypto";
+import { TogglePersonPasswordlessCommand } from "../commands/person/TogglePersonPasswordlessCommand.js";
 class PersonManager {
   constructor(emailValidator) {
     this.emailValidator = emailValidator;
@@ -27,6 +30,10 @@ class PersonManager {
     await dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data));
     return new ResponseOk(null);
   }
+  async togglePasswordless(dbContext, person, value) {
+    await dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value));
+    return new ResponseOk(null);
+  }
 }
 export {
   PersonManager

package/dist/development/src/model/service/PersonManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\tif (data.email !== undefined && person.email !== data.email) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data))\n\t\treturn new ResponseOk(null)\n\t}\n\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":[],"mappings":";;;;;;;;;;AAMA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AACtF,WAAA,MAAM,UAAU,aAAa;AAAA,MACnC,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AACzI,QAAI,KAAK,UAAU,UAAa,OAAO,UAAU,KAAK,OAAO;AAC5D,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAK;AACrF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AACM,UAAA,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,IAAI,IAAI,CAAC;AACrE,WAAA,IAAI,WAAW,IAAI;AAAA,EAC3B;AAED;"}
+{"version":3,"file":"PersonManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator'\nimport { TogglePersonPasswordlessCommand } from '../commands'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\tif (data.email !== undefined && person.email !== data.email) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":[],"mappings":";;;;;;;;;;;;;AAOA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AACtF,WAAA,MAAM,UAAU,aAAa;AAAA,MACnC,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AACzI,QAAI,KAAK,UAAU,UAAa,OAAO,UAAU,KAAK,OAAO;AAC5D,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAK;AACrF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AACM,UAAA,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,IAAI,IAAI,CAAC;AACrE,WAAA,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACjH,UAAA,UAAU,WAAW,QAAQ,IAAI,gCAAgC,OAAO,IAAI,KAAK,CAAC;AACjF,WAAA,IAAI,WAAW,IAAI;AAAA,EAC3B;AAED;"}

package/dist/development/src/model/service/ProjectManager.cjs

@@ -3,12 +3,12 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
+const exceptions = require("../../exceptions.cjs");
+const Response = require("../utils/Response.cjs");
 const CreateProjectCommand = require("../commands/project/CreateProjectCommand.cjs");
 const SetProjectSecretCommand = require("../commands/project/SetProjectSecretCommand.cjs");
 const UpdateProjectCommand = require("../commands/project/UpdateProjectCommand.cjs");
 const AddProjectMemberCommand = require("../commands/membership/AddProjectMemberCommand.cjs");
-const exceptions = require("../../exceptions.cjs");
-const Response = require("../utils/Response.cjs");
 require("../queries/apiKey/ApiKeyQuery.cjs");
 const ProjectBySlugQuery = require("../queries/project/ProjectBySlugQuery.cjs");
 const ProjectsByIdentityQuery = require("../queries/project/ProjectsByIdentityQuery.cjs");

package/dist/development/src/model/service/ProjectManager.js

@@ -1,12 +1,12 @@
 import "../type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
+import { ImplementationException } from "../../exceptions.js";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
 import { CreateProjectCommand } from "../commands/project/CreateProjectCommand.js";
 import { SetProjectSecretCommand } from "../commands/project/SetProjectSecretCommand.js";
 import { UpdateProjectCommand } from "../commands/project/UpdateProjectCommand.js";
 import { AddProjectMemberCommand } from "../commands/membership/AddProjectMemberCommand.js";
-import { ImplementationException } from "../../exceptions.js";
-import { ResponseError, ResponseOk } from "../utils/Response.js";
 import "../queries/apiKey/ApiKeyQuery.js";
 import { ProjectBySlugQuery } from "../queries/project/ProjectBySlugQuery.js";
 import { ProjectsByIdentityQuery } from "../queries/project/ProjectsByIdentityQuery.js";

package/dist/development/src/model/service/RolesManager.cjs

@@ -3,8 +3,8 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
-const PatchIdentityGlobalRoles = require("../commands/identity/PatchIdentityGlobalRoles.cjs");
 const Response = require("../utils/Response.cjs");
+const PatchIdentityGlobalRoles = require("../commands/identity/PatchIdentityGlobalRoles.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
 const Roles = require("../authorization/Roles.cjs");

package/dist/development/src/model/service/RolesManager.js

@@ -1,8 +1,8 @@
 import "../type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
-import { PatchIdentityGlobalRoles } from "../commands/identity/PatchIdentityGlobalRoles.js";
 import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { PatchIdentityGlobalRoles } from "../commands/identity/PatchIdentityGlobalRoles.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
 import { TenantRole } from "../authorization/Roles.js";

package/dist/development/src/model/service/SignUpManager.cjs

@@ -3,9 +3,9 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
+const Response = require("../utils/Response.cjs");
 const CreatePersonCommand = require("../commands/person/CreatePersonCommand.cjs");
 const CreateIdentityCommand = require("../commands/identity/CreateIdentityCommand.cjs");
-const Response = require("../utils/Response.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
 const Roles = require("../authorization/Roles.cjs");

package/dist/development/src/model/service/SignUpManager.js

@@ -1,9 +1,9 @@
 import "../type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
 import { CreatePersonCommand } from "../commands/person/CreatePersonCommand.js";
 import { CreateIdentityCommand } from "../commands/identity/CreateIdentityCommand.js";
-import { ResponseError, ResponseOk } from "../utils/Response.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
 import { TenantRole } from "../authorization/Roles.js";

package/dist/development/src/model/service/helpers/getPreferredProject.cjs

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const getPreferredProject = (projects, preferredProjectSlug) => {
+  if (projects.length === 1) {
+    return projects[0];
+  }
+  if (preferredProjectSlug) {
+    return projects.find((it) => it.slug === preferredProjectSlug) || null;
+  }
+  return null;
+};
+exports.getPreferredProject = getPreferredProject;
+//# sourceMappingURL=getPreferredProject.cjs.map

package/dist/development/src/model/service/helpers/getPreferredProject.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getPreferredProject.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":";;AAEa,MAAA,sBAAsB,CAAC,UAAqB,yBAAwD;AAC5G,MAAA,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACO,SAAA;AACR;;"}

package/dist/development/src/model/service/helpers/getPreferredProject.js

@@ -0,0 +1,13 @@
+const getPreferredProject = (projects, preferredProjectSlug) => {
+  if (projects.length === 1) {
+    return projects[0];
+  }
+  if (preferredProjectSlug) {
+    return projects.find((it) => it.slug === preferredProjectSlug) || null;
+  }
+  return null;
+};
+export {
+  getPreferredProject
+};
+//# sourceMappingURL=getPreferredProject.js.map

package/dist/development/src/model/service/helpers/getPreferredProject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getPreferredProject.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":"AAEa,MAAA,sBAAsB,CAAC,UAAqB,yBAAwD;AAC5G,MAAA,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACO,SAAA;AACR;"}

package/dist/development/src/model/service/idp/providers/OIDCProvider.cjs

@@ -37,7 +37,8 @@ class OIDCProvider {
       {
         client_id: configuration.clientId,
         client_secret: configuration.clientSecret,
-        response_types: [configuration.responseType || "code"]
+        response_types: [configuration.responseType || "code"],
+        id_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? "RS256"
       },
       void 0,
       {

package/dist/development/src/model/service/idp/providers/OIDCProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tclaims: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPClaim> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\treturn new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["catchTypesafe","OIDCConfiguration","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer"],"mappings":";;;;;;;;;;;AASO,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,CAAA,CAAC;AAE/B,kBAAA,MAAA,yBAAAA,QAAA,cAAcC,6BAAmBC,6BAA4B,4BAAA,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAWF,QAAAA,cAAcG,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMC,yBAAa,QAAQ;AAAA,MACjC,QAAQ,cAAc;AAAA,MACtB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAkC;AAChG,UAAM,eAAeL,QAAAA,cAAcM,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMG,YAAmB,mBAAA,QAAQ,YAAY;AAAA,EACrD;AAAA,EAGA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAC3F,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAlCnF,QAAA,IAAA;AAmCO,KAAA,KAAA,KAAA,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAMC,aAAA,OAAO,SAAS,cAAc,GAAG;AAE/E,WAAO,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MAC9C;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"OIDCProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tclaims: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPClaim> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\treturn new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["catchTypesafe","OIDCConfiguration","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer"],"mappings":";;;;;;;;;;;AASO,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,CAAA,CAAC;AAE/B,kBAAA,MAAA,yBAAAA,QAAA,cAAcC,6BAAmBC,6BAA4B,4BAAA,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAWF,QAAAA,cAAcG,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMC,yBAAa,QAAQ;AAAA,MACjC,QAAQ,cAAc;AAAA,MACtB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAkC;AAChG,UAAM,eAAeL,QAAAA,cAAcM,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAMG,YAAmB,mBAAA,QAAQ,YAAY;AAAA,EACrD;AAAA,EAGA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAC3F,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAlCnF,QAAA,IAAA;AAmCO,KAAA,KAAA,KAAA,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAMC,aAAA,OAAO,SAAS,cAAc,GAAG;AAE/E,WAAO,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MAC9C;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,MACzE;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;;"}

package/dist/development/src/model/service/idp/providers/OIDCProvider.js

@@ -35,7 +35,8 @@ class OIDCProvider {
       {
         client_id: configuration.clientId,
         client_secret: configuration.clientSecret,
-        response_types: [configuration.responseType || "code"]
+        response_types: [configuration.responseType || "code"],
+        id_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? "RS256"
       },
       void 0,
       {

package/dist/development/src/model/service/idp/providers/OIDCProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tclaims: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPClaim> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\treturn new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AASO,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,CAAA,CAAC;AAE/B,kBAAA,MAAA,yBAAA,cAAc,mBAAmB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,aAAa,QAAQ;AAAA,MACjC,QAAQ,cAAc;AAAA,MACtB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAkC;AAChG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAGA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAC3F,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAlCnF,QAAA,IAAA;AAmCO,KAAA,KAAA,KAAA,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAM,OAAO,SAAS,cAAc,GAAG;AAE/E,WAAO,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MAC9C;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;"}
+{"version":3,"file":"OIDCProvider.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCProvider.ts"],"sourcesContent":["import { Client, Issuer } from 'openid-client'\nimport { IdentityProviderHandler, IDPClaim, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { catchTypesafe } from './helpers'\nimport { OIDCConfiguration, OIDCInitData, OIDCResponseData } from './OIDCTypes'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { IDPValidationError } from '../IDPValidationError'\n\n\nexport class OIDCProvider implements IdentityProviderHandler<OIDCConfiguration> {\n\tprivate issuerCache: Record<string, Issuer<Client>> = {}\n\n\tvalidateConfiguration = catchTypesafe(OIDCConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: OIDCConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tclaims: configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: OIDCConfiguration, data: unknown): Promise<IDPClaim> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\n\tgetPublicConfiguration({ clientSecret, ...config }: OIDCConfiguration): Partial<OIDCConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: OIDCConfiguration): Promise<Client> {\n\t\tthis.issuerCache[configuration.url] ??= await Issuer.discover(configuration.url)\n\n\t\treturn new this.issuerCache[configuration.url].Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: configuration.clientSecret,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t\tid_token_signed_response_alg: configuration.idTokenSignedResponseAlg ?? 'RS256',\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AASO,MAAM,aAAmE;AAAA,EAAzE,cAAA;AACN,kBAAA,MAAQ,eAA8C,CAAA,CAAC;AAE/B,kBAAA,MAAA,yBAAA,cAAc,mBAAmB,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAErF,MAAa,SAAS,eAAkC,MAA2C;AAClG,UAAM,WAAW,cAAc,cAAc,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,aAAa,QAAQ;AAAA,MACjC,QAAQ,cAAc;AAAA,MACtB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAkC,MAAkC;AAChG,UAAM,eAAe,cAAc,kBAAkB,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACjD,WAAA,MAAM,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAGA,uBAAuB,EAAE,cAAc,GAAG,UAAyD;AAC3F,WAAA;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAmD;AAlCnF,QAAA,IAAA;AAmCO,KAAA,KAAA,KAAA,aAAL,KAAiB,cAAc,GAAA,MAA/B,SAAwC,MAAM,OAAO,SAAS,cAAc,GAAG;AAE/E,WAAO,IAAI,KAAK,YAAY,cAAc,GAAG,EAAE;AAAA,MAC9C;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe,cAAc;AAAA,QAC7B,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,QACrD,8BAA8B,cAAc,4BAA4B;AAAA,MACzE;AAAA,MACA;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MACnF;AAAA,IAAA;AAAA,EAEF;AACD;"}

package/dist/development/src/model/service/idp/providers/OIDCTypes.cjs

@@ -21,7 +21,8 @@ const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
 const OIDCConfigurationOptions = Typesafe__namespace.partial({
   responseType: Typesafe__namespace.enumeration("code", "code id_token", "code id_token token", "code token", "id_token", "id_token token", "none"),
   claims: Typesafe__namespace.string,
-  additionalAuthorizedParties: Typesafe__namespace.array(Typesafe__namespace.string)
+  additionalAuthorizedParties: Typesafe__namespace.array(Typesafe__namespace.string),
+  idTokenSignedResponseAlg: Typesafe__namespace.string
 });
 const BaseOIDCConfiguration = Typesafe__namespace.intersection(
   Typesafe__namespace.object({

package/dist/development/src/model/service/idp/providers/OIDCTypes.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCTypes.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ResponseType } from 'openid-client'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQa,MAAA,2BAA2BA,oBAAS,QAAQ;AAAA,EACxD,cAAcA,oBAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQA,oBAAS;AAAA,EACjB,6BAA6BA,oBAAS,MAAMA,oBAAS,MAAM;AAC5D,CAAC;AACM,MAAM,wBAAwBA,oBAAS;AAAA,EAC7CA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,IACd,UAAUA,oBAAS;AAAA,IACnB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoBA,oBAAS;AAAA,EACzC;AAAA,EACAA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmBA,oBAAS;AAAA,EACxCA,oBAAS;AAAA,IACRA,oBAAS,OAAO;AAAA,MACf,KAAKA,oBAAS;AAAA,IAAA,CACd;AAAA,IACDA,oBAAS,OAAO;AAAA,MACf,YAAYA,oBAAS,OAAOA,oBAAS,QAAQA,oBAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EACF;AAAA,EACAA,oBAAS,QAAQ;AAAA,IAChB,aAAaA,oBAAS;AAAA,IACtB,aAAaA,oBAAS,QAAQ;AAAA,MAC7B,OAAOA,oBAAS;AAAA,MAChB,OAAOA,oBAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CAED;AACF;AAIa,MAAA,eAAeA,oBAAS,aAAaA,oBAAS;AAAA,EAC1DA,oBAAS,OAAO;AAAA,IACf,aAAaA,oBAAS;AAAA,EAAA,CACtB;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AACF,CAAC;;;;;;"}
+{"version":3,"file":"OIDCTypes.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ResponseType } from 'openid-client'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n\tidTokenSignedResponseAlg: Typesafe.string,\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AAQa,MAAA,2BAA2BA,oBAAS,QAAQ;AAAA,EACxD,cAAcA,oBAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQA,oBAAS;AAAA,EACjB,6BAA6BA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,EAC3D,0BAA0BA,oBAAS;AACpC,CAAC;AACM,MAAM,wBAAwBA,oBAAS;AAAA,EAC7CA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,IACd,UAAUA,oBAAS;AAAA,IACnB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoBA,oBAAS;AAAA,EACzC;AAAA,EACAA,oBAAS,OAAO;AAAA,IACf,KAAKA,oBAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmBA,oBAAS;AAAA,EACxCA,oBAAS;AAAA,IACRA,oBAAS,OAAO;AAAA,MACf,KAAKA,oBAAS;AAAA,IAAA,CACd;AAAA,IACDA,oBAAS,OAAO;AAAA,MACf,YAAYA,oBAAS,OAAOA,oBAAS,QAAQA,oBAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EACF;AAAA,EACAA,oBAAS,QAAQ;AAAA,IAChB,aAAaA,oBAAS;AAAA,IACtB,aAAaA,oBAAS,QAAQ;AAAA,MAC7B,OAAOA,oBAAS;AAAA,MAChB,OAAOA,oBAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CAED;AACF;AAIa,MAAA,eAAeA,oBAAS,aAAaA,oBAAS;AAAA,EAC1DA,oBAAS,OAAO;AAAA,IACf,aAAaA,oBAAS;AAAA,EAAA,CACtB;AAAA,EACDA,oBAAS,QAAQ;AAAA,IAChB,cAAcA,oBAAS;AAAA,EAAA,CACvB;AACF,CAAC;;;;;;"}

package/dist/development/src/model/service/idp/providers/OIDCTypes.js

@@ -2,7 +2,8 @@ import * as Typesafe from "@contember/typesafe";
 const OIDCConfigurationOptions = Typesafe.partial({
   responseType: Typesafe.enumeration("code", "code id_token", "code id_token token", "code token", "id_token", "id_token token", "none"),
   claims: Typesafe.string,
-  additionalAuthorizedParties: Typesafe.array(Typesafe.string)
+  additionalAuthorizedParties: Typesafe.array(Typesafe.string),
+  idTokenSignedResponseAlg: Typesafe.string
 });
 const BaseOIDCConfiguration = Typesafe.intersection(
   Typesafe.object({

package/dist/development/src/model/service/idp/providers/OIDCTypes.js.map

@@ -1 +1 @@
-{"version":3,"file":"OIDCTypes.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ResponseType } from 'openid-client'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":[],"mappings":";AAQa,MAAA,2BAA2B,SAAS,QAAQ;AAAA,EACxD,cAAc,SAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQ,SAAS;AAAA,EACjB,6BAA6B,SAAS,MAAM,SAAS,MAAM;AAC5D,CAAC;AACM,MAAM,wBAAwB,SAAS;AAAA,EAC7C,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,IACd,UAAU,SAAS;AAAA,IACnB,cAAc,SAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoB,SAAS;AAAA,EACzC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmB,SAAS;AAAA,EACxC,SAAS;AAAA,IACR,SAAS,OAAO;AAAA,MACf,KAAK,SAAS;AAAA,IAAA,CACd;AAAA,IACD,SAAS,OAAO;AAAA,MACf,YAAY,SAAS,OAAO,SAAS,QAAQ,SAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EACF;AAAA,EACA,SAAS,QAAQ;AAAA,IAChB,aAAa,SAAS;AAAA,IACtB,aAAa,SAAS,QAAQ;AAAA,MAC7B,OAAO,SAAS;AAAA,MAChB,OAAO,SAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CAED;AACF;AAIa,MAAA,eAAe,SAAS,aAAa,SAAS;AAAA,EAC1D,SAAS,OAAO;AAAA,IACf,aAAa,SAAS;AAAA,EAAA,CACtB;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,cAAc,SAAS;AAAA,EAAA,CACvB;AACF,CAAC;"}
+{"version":3,"file":"OIDCTypes.js","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/OIDCTypes.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { ResponseType } from 'openid-client'\n\nexport interface OIDCSessionData {\n\tnonce: string\n\tstate: string\n}\n\nexport const OIDCConfigurationOptions = Typesafe.partial({\n\tresponseType: Typesafe.enumeration<ResponseType>('code', 'code id_token', 'code id_token token', 'code token', 'id_token', 'id_token token', 'none'),\n\tclaims: Typesafe.string,\n\tadditionalAuthorizedParties: Typesafe.array(Typesafe.string),\n\tidTokenSignedResponseAlg: Typesafe.string,\n})\nexport const BaseOIDCConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tclientSecret: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\nexport const OIDCConfiguration = Typesafe.intersection(\n\tBaseOIDCConfiguration,\n\tTypesafe.object({\n\t\turl: Typesafe.string,\n\t}),\n)\n\nexport type OIDCConfiguration = ReturnType<typeof OIDCConfiguration>\n\nexport const OIDCResponseData = Typesafe.intersection(\n\tTypesafe.union(\n\t\tTypesafe.object({\n\t\t\turl: Typesafe.string,\n\t\t}),\n\t\tTypesafe.object({\n\t\t\tparameters: Typesafe.record(Typesafe.string, Typesafe.string),\n\t\t}),\n\t),\n\tTypesafe.partial({\n\t\tredirectUrl: Typesafe.string,\n\t\tsessionData: Typesafe.partial({\n\t\t\tnonce: Typesafe.string,\n\t\t\tstate: Typesafe.string,\n\t\t}),\n\n\t}),\n)\n\nexport type OIDCResponseData = ReturnType<typeof OIDCResponseData>\n\nexport const OIDCInitData = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tredirectUrl: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\tresponseMode: Typesafe.string,\n\t}),\n))\n\nexport type OIDCInitData = ReturnType<typeof OIDCInitData>\n"],"names":[],"mappings":";AAQa,MAAA,2BAA2B,SAAS,QAAQ;AAAA,EACxD,cAAc,SAAS,YAA0B,QAAQ,iBAAiB,uBAAuB,cAAc,YAAY,kBAAkB,MAAM;AAAA,EACnJ,QAAQ,SAAS;AAAA,EACjB,6BAA6B,SAAS,MAAM,SAAS,MAAM;AAAA,EAC3D,0BAA0B,SAAS;AACpC,CAAC;AACM,MAAM,wBAAwB,SAAS;AAAA,EAC7C,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,IACd,UAAU,SAAS;AAAA,IACnB,cAAc,SAAS;AAAA,EAAA,CACvB;AAAA,EACD;AACD;AAEO,MAAM,oBAAoB,SAAS;AAAA,EACzC;AAAA,EACA,SAAS,OAAO;AAAA,IACf,KAAK,SAAS;AAAA,EAAA,CACd;AACF;AAIO,MAAM,mBAAmB,SAAS;AAAA,EACxC,SAAS;AAAA,IACR,SAAS,OAAO;AAAA,MACf,KAAK,SAAS;AAAA,IAAA,CACd;AAAA,IACD,SAAS,OAAO;AAAA,MACf,YAAY,SAAS,OAAO,SAAS,QAAQ,SAAS,MAAM;AAAA,IAAA,CAC5D;AAAA,EACF;AAAA,EACA,SAAS,QAAQ;AAAA,IAChB,aAAa,SAAS;AAAA,IACtB,aAAa,SAAS,QAAQ;AAAA,MAC7B,OAAO,SAAS;AAAA,MAChB,OAAO,SAAS;AAAA,IAAA,CAChB;AAAA,EAAA,CAED;AACF;AAIa,MAAA,eAAe,SAAS,aAAa,SAAS;AAAA,EAC1D,SAAS,OAAO;AAAA,IACf,aAAa,SAAS;AAAA,EAAA,CACtB;AAAA,EACD,SAAS,QAAQ;AAAA,IAChB,cAAc,SAAS;AAAA,EAAA,CACvB;AACF,CAAC;"}

package/dist/development/src/model/utils/tokenUtils.cjs

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const crypto = require("node:crypto");
 const typeUtils = require("./typeUtils.cjs");
+const exceptions = require("../../exceptions.cjs");
+const Response = require("./Response.cjs");
 const generateToken = async (generator) => {
   return (await generator.randomBytes(20)).toString("hex");
 };
@@ -9,7 +11,44 @@ const computeTokenHash = (token) => {
   return crypto.createHash("sha256").update(token, "ascii").digest("hex");
 };
 const isTokenHash = (token) => typeUtils.isFixedLengthHexString(token, 64);
+const MAX_OTP_ATTEMPTS = 3;
+const validateToken = ({ entry, validationType, token, now }) => {
+  if (!entry) {
+    return new Response.ResponseError("TOKEN_NOT_FOUND", "Token not found");
+  }
+  if (validationType === "otp" && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {
+    return new Response.ResponseError("TOKEN_EXPIRED", "OTP attempts exceeded");
+  }
+  switch (validationType) {
+    case "token":
+      if (entry.otp_hash !== null) {
+        return new Response.ResponseError("TOKEN_INVALID", "The token was exchanged for OTP");
+      }
+      if (entry.token_hash !== computeTokenHash(token)) {
+        return new Response.ResponseError("TOKEN_INVALID", "Token invalid");
+      }
+      break;
+    case "otp":
+      if (entry.otp_hash === null) {
+        return new Response.ResponseError("TOKEN_INVALID", "OTP not set");
+      }
+      if (entry.otp_hash !== computeTokenHash(token)) {
+        return new Response.ResponseError("TOKEN_INVALID", "OTP invalid");
+      }
+      break;
+    default:
+      throw new exceptions.ImplementationException();
+  }
+  if (entry.used_at) {
+    return new Response.ResponseError("TOKEN_USED", "Token used at " + entry.used_at.toISOString());
+  }
+  if (entry.expires_at < now) {
+    return new Response.ResponseError("TOKEN_EXPIRED", "Token expired at " + entry.expires_at.toISOString());
+  }
+  return new Response.ResponseOk(entry);
+};
 exports.computeTokenHash = computeTokenHash;
 exports.generateToken = generateToken;
 exports.isTokenHash = isTokenHash;
+exports.validateToken = validateToken;
 //# sourceMappingURL=tokenUtils.cjs.map

package/dist/development/src/model/utils/tokenUtils.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"tokenUtils.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/tokenUtils.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { FixedLengthHexString, isFixedLengthHexString } from './typeUtils'\n\nexport const generateToken = async (generator: {\n\trandomBytes: (bytes: number) => Promise<Buffer>\n}): Promise<string> => {\n\treturn (await generator.randomBytes(20)).toString('hex')\n}\n\nexport type TokenHash = FixedLengthHexString<64>\n\nexport const computeTokenHash = (token: string): TokenHash => {\n\treturn crypto //\n\t\t.createHash('sha256')\n\t\t.update(token, 'ascii')\n\t\t.digest('hex') as TokenHash\n}\n\nexport const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)\n"],"names":["isFixedLengthHexString"],"mappings":";;;;AAGa,MAAA,gBAAgB,OAAO,cAEb;AACtB,UAAQ,MAAM,UAAU,YAAY,EAAE,GAAG,SAAS,KAAK;AACxD;AAIa,MAAA,mBAAmB,CAAC,UAA6B;AACtD,SAAA,OACL,WAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,EACrB,OAAO,KAAK;AACf;AAEO,MAAM,cAAc,CAAC,UAAsCA,UAAA,uBAAuB,OAAO,EAAE;;;;"}
+{"version":3,"file":"tokenUtils.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/tokenUtils.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { FixedLengthHexString, isFixedLengthHexString } from './typeUtils'\nimport { PersonToken } from '../type'\nimport { ImplementationException } from '../../exceptions'\nimport { Response, ResponseError, ResponseOk } from './Response'\n\nexport const generateToken = async (generator: {\n\trandomBytes: (bytes: number) => Promise<Buffer>\n}): Promise<string> => {\n\treturn (await generator.randomBytes(20)).toString('hex')\n}\n\nexport type TokenHash = FixedLengthHexString<64>\n\nexport const computeTokenHash = (token: string): TokenHash => {\n\treturn crypto //\n\t\t.createHash('sha256')\n\t\t.update(token, 'ascii')\n\t\t.digest('hex') as TokenHash\n}\n\nexport const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)\n\n\nconst MAX_OTP_ATTEMPTS = 3\n\nexport const validateToken = ({ entry, validationType, token, now }: {\n\tentry: PersonToken.Row | null\n\tvalidationType: PersonToken.ValidationType\n\ttoken: string\n\tnow: Date\n}): Response<PersonToken.Row, PersonToken.TokenValidationError> => {\n\tif (!entry) {\n\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found')\n\t}\n\tif (validationType === 'otp' && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'OTP attempts exceeded')\n\t}\n\tswitch (validationType) {\n\t\tcase 'token':\n\t\t\tif (entry.otp_hash !== null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'The token was exchanged for OTP')\n\t\t\t}\n\t\t\tif (entry.token_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'Token invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tcase 'otp':\n\t\t\tif (entry.otp_hash === null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP not set')\n\t\t\t}\n\t\t\tif (entry.otp_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tdefault:\n\t\t\tthrow new ImplementationException()\n\t}\n\tif (entry.used_at) {\n\t\treturn new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())\n\t}\n\tif (entry.expires_at < now) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())\n\t}\n\treturn new ResponseOk(entry)\n}\n"],"names":["isFixedLengthHexString","ResponseError","ImplementationException","ResponseOk"],"mappings":";;;;;;AAMa,MAAA,gBAAgB,OAAO,cAEb;AACtB,UAAQ,MAAM,UAAU,YAAY,EAAE,GAAG,SAAS,KAAK;AACxD;AAIa,MAAA,mBAAmB,CAAC,UAA6B;AACtD,SAAA,OACL,WAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,EACrB,OAAO,KAAK;AACf;AAEO,MAAM,cAAc,CAAC,UAAsCA,iCAAuB,OAAO,EAAE;AAGlG,MAAM,mBAAmB;AAElB,MAAM,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAKK;AAClE,MAAI,CAAC,OAAO;AACJ,WAAA,IAAIC,SAAc,cAAA,mBAAmB,iBAAiB;AAAA,EAC9D;AACA,MAAI,mBAAmB,SAAS,MAAM,gBAAgB,kBAAkB;AAChE,WAAA,IAAIA,SAAc,cAAA,iBAAiB,uBAAuB;AAAA,EAClE;AACA,UAAQ,gBAAgB;AAAA,IACvB,KAAK;AACA,UAAA,MAAM,aAAa,MAAM;AACrB,eAAA,IAAIA,SAAc,cAAA,iBAAiB,iCAAiC;AAAA,MAC5E;AACA,UAAI,MAAM,eAAe,iBAAiB,KAAK,GAAG;AAC1C,eAAA,IAAIA,SAAc,cAAA,iBAAiB,eAAe;AAAA,MAC1D;AACA;AAAA,IACD,KAAK;AACA,UAAA,MAAM,aAAa,MAAM;AACrB,eAAA,IAAIA,SAAc,cAAA,iBAAiB,aAAa;AAAA,MACxD;AACA,UAAI,MAAM,aAAa,iBAAiB,KAAK,GAAG;AACxC,eAAA,IAAIA,SAAc,cAAA,iBAAiB,aAAa;AAAA,MACxD;AACA;AAAA,IACD;AACC,YAAM,IAAIC,WAAwB,wBAAA;AAAA,EACpC;AACA,MAAI,MAAM,SAAS;AAClB,WAAO,IAAID,SAAc,cAAA,cAAc,mBAAmB,MAAM,QAAQ,aAAa;AAAA,EACtF;AACI,MAAA,MAAM,aAAa,KAAK;AAC3B,WAAO,IAAIA,SAAc,cAAA,iBAAiB,sBAAsB,MAAM,WAAW,aAAa;AAAA,EAC/F;AACO,SAAA,IAAIE,SAAAA,WAAW,KAAK;AAC5B;;;;;"}

package/dist/development/src/model/utils/tokenUtils.js

@@ -1,5 +1,7 @@
 import crypto__default from "node:crypto";
 import { isFixedLengthHexString } from "./typeUtils.js";
+import { ImplementationException } from "../../exceptions.js";
+import { ResponseError, ResponseOk } from "./Response.js";
 const generateToken = async (generator) => {
   return (await generator.randomBytes(20)).toString("hex");
 };
@@ -7,9 +9,46 @@ const computeTokenHash = (token) => {
   return crypto__default.createHash("sha256").update(token, "ascii").digest("hex");
 };
 const isTokenHash = (token) => isFixedLengthHexString(token, 64);
+const MAX_OTP_ATTEMPTS = 3;
+const validateToken = ({ entry, validationType, token, now }) => {
+  if (!entry) {
+    return new ResponseError("TOKEN_NOT_FOUND", "Token not found");
+  }
+  if (validationType === "otp" && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {
+    return new ResponseError("TOKEN_EXPIRED", "OTP attempts exceeded");
+  }
+  switch (validationType) {
+    case "token":
+      if (entry.otp_hash !== null) {
+        return new ResponseError("TOKEN_INVALID", "The token was exchanged for OTP");
+      }
+      if (entry.token_hash !== computeTokenHash(token)) {
+        return new ResponseError("TOKEN_INVALID", "Token invalid");
+      }
+      break;
+    case "otp":
+      if (entry.otp_hash === null) {
+        return new ResponseError("TOKEN_INVALID", "OTP not set");
+      }
+      if (entry.otp_hash !== computeTokenHash(token)) {
+        return new ResponseError("TOKEN_INVALID", "OTP invalid");
+      }
+      break;
+    default:
+      throw new ImplementationException();
+  }
+  if (entry.used_at) {
+    return new ResponseError("TOKEN_USED", "Token used at " + entry.used_at.toISOString());
+  }
+  if (entry.expires_at < now) {
+    return new ResponseError("TOKEN_EXPIRED", "Token expired at " + entry.expires_at.toISOString());
+  }
+  return new ResponseOk(entry);
+};
 export {
   computeTokenHash,
   generateToken,
-  isTokenHash
+  isTokenHash,
+  validateToken
 };
 //# sourceMappingURL=tokenUtils.js.map

package/dist/development/src/model/utils/tokenUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"tokenUtils.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/tokenUtils.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { FixedLengthHexString, isFixedLengthHexString } from './typeUtils'\n\nexport const generateToken = async (generator: {\n\trandomBytes: (bytes: number) => Promise<Buffer>\n}): Promise<string> => {\n\treturn (await generator.randomBytes(20)).toString('hex')\n}\n\nexport type TokenHash = FixedLengthHexString<64>\n\nexport const computeTokenHash = (token: string): TokenHash => {\n\treturn crypto //\n\t\t.createHash('sha256')\n\t\t.update(token, 'ascii')\n\t\t.digest('hex') as TokenHash\n}\n\nexport const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)\n"],"names":["crypto"],"mappings":";;AAGa,MAAA,gBAAgB,OAAO,cAEb;AACtB,UAAQ,MAAM,UAAU,YAAY,EAAE,GAAG,SAAS,KAAK;AACxD;AAIa,MAAA,mBAAmB,CAAC,UAA6B;AACtD,SAAAA,gBACL,WAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,EACrB,OAAO,KAAK;AACf;AAEO,MAAM,cAAc,CAAC,UAAsC,uBAAuB,OAAO,EAAE;"}
+{"version":3,"file":"tokenUtils.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/tokenUtils.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { FixedLengthHexString, isFixedLengthHexString } from './typeUtils'\nimport { PersonToken } from '../type'\nimport { ImplementationException } from '../../exceptions'\nimport { Response, ResponseError, ResponseOk } from './Response'\n\nexport const generateToken = async (generator: {\n\trandomBytes: (bytes: number) => Promise<Buffer>\n}): Promise<string> => {\n\treturn (await generator.randomBytes(20)).toString('hex')\n}\n\nexport type TokenHash = FixedLengthHexString<64>\n\nexport const computeTokenHash = (token: string): TokenHash => {\n\treturn crypto //\n\t\t.createHash('sha256')\n\t\t.update(token, 'ascii')\n\t\t.digest('hex') as TokenHash\n}\n\nexport const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)\n\n\nconst MAX_OTP_ATTEMPTS = 3\n\nexport const validateToken = ({ entry, validationType, token, now }: {\n\tentry: PersonToken.Row | null\n\tvalidationType: PersonToken.ValidationType\n\ttoken: string\n\tnow: Date\n}): Response<PersonToken.Row, PersonToken.TokenValidationError> => {\n\tif (!entry) {\n\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found')\n\t}\n\tif (validationType === 'otp' && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'OTP attempts exceeded')\n\t}\n\tswitch (validationType) {\n\t\tcase 'token':\n\t\t\tif (entry.otp_hash !== null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'The token was exchanged for OTP')\n\t\t\t}\n\t\t\tif (entry.token_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'Token invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tcase 'otp':\n\t\t\tif (entry.otp_hash === null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP not set')\n\t\t\t}\n\t\t\tif (entry.otp_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tdefault:\n\t\t\tthrow new ImplementationException()\n\t}\n\tif (entry.used_at) {\n\t\treturn new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())\n\t}\n\tif (entry.expires_at < now) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())\n\t}\n\treturn new ResponseOk(entry)\n}\n"],"names":["crypto"],"mappings":";;;;AAMa,MAAA,gBAAgB,OAAO,cAEb;AACtB,UAAQ,MAAM,UAAU,YAAY,EAAE,GAAG,SAAS,KAAK;AACxD;AAIa,MAAA,mBAAmB,CAAC,UAA6B;AACtD,SAAAA,gBACL,WAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,EACrB,OAAO,KAAK;AACf;AAEO,MAAM,cAAc,CAAC,UAAsC,uBAAuB,OAAO,EAAE;AAGlG,MAAM,mBAAmB;AAElB,MAAM,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAKK;AAClE,MAAI,CAAC,OAAO;AACJ,WAAA,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,EAC9D;AACA,MAAI,mBAAmB,SAAS,MAAM,gBAAgB,kBAAkB;AAChE,WAAA,IAAI,cAAc,iBAAiB,uBAAuB;AAAA,EAClE;AACA,UAAQ,gBAAgB;AAAA,IACvB,KAAK;AACA,UAAA,MAAM,aAAa,MAAM;AACrB,eAAA,IAAI,cAAc,iBAAiB,iCAAiC;AAAA,MAC5E;AACA,UAAI,MAAM,eAAe,iBAAiB,KAAK,GAAG;AAC1C,eAAA,IAAI,cAAc,iBAAiB,eAAe;AAAA,MAC1D;AACA;AAAA,IACD,KAAK;AACA,UAAA,MAAM,aAAa,MAAM;AACrB,eAAA,IAAI,cAAc,iBAAiB,aAAa;AAAA,MACxD;AACA,UAAI,MAAM,aAAa,iBAAiB,KAAK,GAAG;AACxC,eAAA,IAAI,cAAc,iBAAiB,aAAa;AAAA,MACxD;AACA;AAAA,IACD;AACC,YAAM,IAAI,wBAAwB;AAAA,EACpC;AACA,MAAI,MAAM,SAAS;AAClB,WAAO,IAAI,cAAc,cAAc,mBAAmB,MAAM,QAAQ,aAAa;AAAA,EACtF;AACI,MAAA,MAAM,aAAa,KAAK;AAC3B,WAAO,IAAI,cAAc,iBAAiB,sBAAsB,MAAM,WAAW,aAAa;AAAA,EAC/F;AACO,SAAA,IAAI,WAAW,KAAK;AAC5B;"}