@contember/engine-tenant-api 2.0.0-alpha.8 → 2.0.0-beta.1

package/dist/production/src/model/service/OtpAuthenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpAuthenticator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpAuthenticator.ts"],"sourcesContent":["import { Providers } from '../providers'\nimport { Secret, TOTP, URI } from 'otpauth'\n\nexport interface OtpData {\n\tsecret: string\n\turi: string\n}\n\nconst digits = 6\n\nexport class OtpAuthenticator {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'now' | 'randomBytes'>,\n\t) {\n\t}\n\n\tpublic validate(secret: SecretLike, token: string): boolean {\n\t\tconst result = TOTP.validate({\n\t\t\ttoken,\n\t\t\tdigits,\n\t\t\tsecret: getSecret(secret),\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t\treturn result !== null\n\t}\n\n\tpublic generate(secret: SecretLike): string {\n\t\treturn TOTP.generate({\n\t\t\tsecret: getSecret(secret),\n\t\t\tdigits,\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t}\n\n\tpublic async create(user: string, label: string): Promise<OtpData> {\n\t\tconst secret = new Secret({ buffer: await this.providers.randomBytes(20) })\n\t\tconst totp = new TOTP({\n\t\t\tlabel: user,\n\t\t\tissuer: label,\n\t\t\tsecret,\n\t\t})\n\t\treturn {\n\t\t\tsecret: secret.base32,\n\t\t\turi: totp.toString(),\n\t\t}\n\t}\n}\n\ntype SecretLike = { uri: string } | { secret: string }\nconst getSecret = function (otp: SecretLike): Secret {\n\treturn 'uri' in otp ? (URI.parse(otp.uri).secret) : Secret.fromBase32(otp.secret)\n}\n"],"names":[],"mappings":";AAQA,MAAM,SAAS;AAER,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEO,SAAS,QAAoB,OAAwB;AACrD,UAAA,SAAS,KAAK,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,QAAQ,UAAU,MAAM;AAAA,MACxB,WAAW,KAAK,UAAU,IAAA,EAAM,QAAQ;AAAA,IAAA,CACxC;AACD,WAAO,WAAW;AAAA,EACnB;AAAA,EAEO,SAAS,QAA4B;AAC3C,WAAO,KAAK,SAAS;AAAA,MACpB,QAAQ,UAAU,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,KAAK,UAAU,IAAA,EAAM,QAAQ;AAAA,IAAA,CACxC;AAAA,EACF;AAAA,EAEA,MAAa,OAAO,MAAc,OAAiC;AAC5D,UAAA,SAAS,IAAI,OAAO,EAAE,QAAQ,MAAM,KAAK,UAAU,YAAY,EAAE,EAAA,CAAG;AACpE,UAAA,OAAO,IAAI,KAAK;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,IAAA,CACA;AACM,WAAA;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,KAAK,KAAK,SAAS;AAAA,IAAA;AAAA,EAErB;AACD;AAGA,MAAM,YAAY,SAAU,KAAyB;AAC7C,SAAA,SAAS,MAAO,IAAI,MAAM,IAAI,GAAG,EAAE,SAAU,OAAO,WAAW,IAAI,MAAM;AACjF;"}
+{"version":3,"file":"OtpAuthenticator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpAuthenticator.ts"],"sourcesContent":["import { Providers } from '../providers'\nimport { Secret, TOTP, URI } from 'otpauth'\n\nexport interface OtpData {\n\tsecret: string\n\turi: string\n}\n\nconst digits = 6\n\nexport class OtpAuthenticator {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'now' | 'randomBytes'>,\n\t) {\n\t}\n\n\tpublic validate(secret: SecretLike, token: string): boolean {\n\t\tconst result = TOTP.validate({\n\t\t\ttoken,\n\t\t\tdigits,\n\t\t\tsecret: getSecret(secret),\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t\treturn result !== null\n\t}\n\n\tpublic generate(secret: SecretLike): string {\n\t\treturn TOTP.generate({\n\t\t\tsecret: getSecret(secret),\n\t\t\tdigits,\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t}\n\n\tpublic async create(user: string, label: string): Promise<OtpData> {\n\t\tconst secret = new Secret({ buffer: (await this.providers.randomBytes(20)) as any })\n\t\tconst totp = new TOTP({\n\t\t\tlabel: user,\n\t\t\tissuer: label,\n\t\t\tsecret,\n\t\t})\n\t\treturn {\n\t\t\tsecret: secret.base32,\n\t\t\turi: totp.toString(),\n\t\t}\n\t}\n}\n\ntype SecretLike = { uri: string } | { secret: string }\nconst getSecret = function (otp: SecretLike): Secret {\n\treturn 'uri' in otp ? (URI.parse(otp.uri).secret) : Secret.fromBase32(otp.secret)\n}\n"],"names":[],"mappings":";AAQA,MAAM,SAAS;AAER,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAAA;AAAA,EAIX,SAAS,QAAoB,OAAwB;AACrD,UAAA,SAAS,KAAK,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,QAAQ,UAAU,MAAM;AAAA,MACxB,WAAW,KAAK,UAAU,MAAM,QAAQ;AAAA,IAAA,CACxC;AACD,WAAO,WAAW;AAAA,EAAA;AAAA,EAGZ,SAAS,QAA4B;AAC3C,WAAO,KAAK,SAAS;AAAA,MACpB,QAAQ,UAAU,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,KAAK,UAAU,MAAM,QAAQ;AAAA,IAAA,CACxC;AAAA,EAAA;AAAA,EAGF,MAAa,OAAO,MAAc,OAAiC;AAC5D,UAAA,SAAS,IAAI,OAAO,EAAE,QAAS,MAAM,KAAK,UAAU,YAAY,EAAE,GAAW;AAC7E,UAAA,OAAO,IAAI,KAAK;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,IAAA,CACA;AACM,WAAA;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,KAAK,KAAK,SAAS;AAAA,IACpB;AAAA,EAAA;AAEF;AAGA,MAAM,YAAY,SAAU,KAAyB;AAC7C,SAAA,SAAS,MAAO,IAAI,MAAM,IAAI,GAAG,EAAE,SAAU,OAAO,WAAW,IAAI,MAAM;AACjF;"}

package/dist/production/src/model/service/OtpManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OtpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand } from '../commands'\nimport { DatabaseContext } from '../utils'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator'\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri))\n\t\treturn otp\n\t}\n\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\tverifyOtp(person: PersonRow, token: string): boolean {\n\t\tif (!person.otp_uri) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\treturn this.otpAuthenticator.validate({ uri: person.otp_uri }, token)\n\t}\n}\n\nexport class OtpError extends Error {\n\tconstructor(message?: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":["PrepareOtpCommand","ConfirmOtpCommand","DisableOtpCommand"],"mappings":";;;;;;;;AAKO,MAAM,WAAW;AAAA,EACvB,YACkB,kBAChB;AADgB,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAC1F,UAAA,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AACxF,UAAA,UAAU,WAAW,QAAQ,IAAIA,kBAAAA,kBAAkB,OAAO,IAAI,IAAI,GAAG,CAAC;AACrE,WAAA;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAIC,kBAAAA,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAIC,kBAAAA,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,UAAU,QAAmB,OAAwB;AAChD,QAAA,CAAC,OAAO,SAAS;AACd,YAAA,IAAI,SAAS,gBAAgB;AAAA,IACpC;AACO,WAAA,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,KAAK;AAAA,EACrE;AACD;AAEO,MAAM,iBAAiB,MAAM;AAAA,EACnC,YAAY,SAAkB;AAC7B,UAAM,OAAO;AAAA,EACd;AACD;;;"}
+{"version":3,"file":"OtpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand } from '../commands'\nimport { DatabaseContext } from '../utils'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator'\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri))\n\t\treturn otp\n\t}\n\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\tverifyOtp(person: PersonRow, token: string): boolean {\n\t\tif (!person.otp_uri) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\treturn this.otpAuthenticator.validate({ uri: person.otp_uri }, token)\n\t}\n}\n\nexport class OtpError extends Error {\n\tconstructor(message?: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":["PrepareOtpCommand","ConfirmOtpCommand","DisableOtpCommand"],"mappings":";;;;;;;;AAKO,MAAM,WAAW;AAAA,EACvB,YACkB,kBAChB;AADgB,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAC1F,UAAA,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AACxF,UAAA,UAAU,WAAW,QAAQ,IAAIA,kBAAAA,kBAAkB,OAAO,IAAI,IAAI,GAAG,CAAC;AACrE,WAAA;AAAA,EAAA;AAAA,EAGR,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAIC,kBAAAA,kBAAkB,OAAO,EAAE,CAAC;AAAA,EAAA;AAAA,EAGpE,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAIC,kBAAAA,kBAAkB,OAAO,EAAE,CAAC;AAAA,EAAA;AAAA,EAGpE,UAAU,QAAmB,OAAwB;AAChD,QAAA,CAAC,OAAO,SAAS;AACd,YAAA,IAAI,SAAS,gBAAgB;AAAA,IAAA;AAE7B,WAAA,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,KAAK;AAAA,EAAA;AAEtE;AAEO,MAAM,iBAAiB,MAAM;AAAA,EACnC,YAAY,SAAkB;AAC7B,UAAM,OAAO;AAAA,EAAA;AAEf;;;"}

package/dist/production/src/model/service/OtpManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand } from '../commands'\nimport { DatabaseContext } from '../utils'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator'\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri))\n\t\treturn otp\n\t}\n\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\tverifyOtp(person: PersonRow, token: string): boolean {\n\t\tif (!person.otp_uri) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\treturn this.otpAuthenticator.validate({ uri: person.otp_uri }, token)\n\t}\n}\n\nexport class OtpError extends Error {\n\tconstructor(message?: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":[],"mappings":";;;;;;AAKO,MAAM,WAAW;AAAA,EACvB,YACkB,kBAChB;AADgB,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAC1F,UAAA,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AACxF,UAAA,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,IAAI,IAAI,GAAG,CAAC;AACrE,WAAA;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,UAAU,QAAmB,OAAwB;AAChD,QAAA,CAAC,OAAO,SAAS;AACd,YAAA,IAAI,SAAS,gBAAgB;AAAA,IACpC;AACO,WAAA,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,KAAK;AAAA,EACrE;AACD;AAEO,MAAM,iBAAiB,MAAM;AAAA,EACnC,YAAY,SAAkB;AAC7B,UAAM,OAAO;AAAA,EACd;AACD;"}
+{"version":3,"file":"OtpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand } from '../commands'\nimport { DatabaseContext } from '../utils'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator'\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri))\n\t\treturn otp\n\t}\n\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\tverifyOtp(person: PersonRow, token: string): boolean {\n\t\tif (!person.otp_uri) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\treturn this.otpAuthenticator.validate({ uri: person.otp_uri }, token)\n\t}\n}\n\nexport class OtpError extends Error {\n\tconstructor(message?: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":[],"mappings":";;;;;;AAKO,MAAM,WAAW;AAAA,EACvB,YACkB,kBAChB;AADgB,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAC1F,UAAA,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AACxF,UAAA,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,IAAI,IAAI,GAAG,CAAC;AACrE,WAAA;AAAA,EAAA;AAAA,EAGR,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EAAA;AAAA,EAGpE,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EAAA;AAAA,EAGpE,UAAU,QAAmB,OAAwB;AAChD,QAAA,CAAC,OAAO,SAAS;AACd,YAAA,IAAI,SAAS,gBAAgB;AAAA,IAAA;AAE7B,WAAA,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,KAAK;AAAA,EAAA;AAEtE;AAEO,MAAM,iBAAiB,MAAM;AAAA,EACnC,YAAY,SAAkB;AAC7B,UAAM,OAAO;AAAA,EAAA;AAEf;"}

package/dist/production/src/model/service/PasswordChangeManager.cjs

@@ -3,8 +3,8 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../type/ApiKey.cjs");
 require("@contember/database");
 require("node:crypto");
-const ChangePasswordCommand = require("../commands/person/ChangePasswordCommand.cjs");
 const Response = require("../utils/Response.cjs");
+const ChangePasswordCommand = require("../commands/person/ChangePasswordCommand.cjs");
 const password = require("../utils/password.cjs");
 class PasswordChangeManager {
   constructor(providers) {

package/dist/production/src/model/service/PasswordChangeManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tasync changePassword(dbContext: DatabaseContext, personId: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(personId, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T>\n}\n\nexport { PasswordChangeManager }\n"],"names":["password","getPasswordWeaknessMessage","ResponseError","ChangePasswordCommand","ResponseOk"],"mappings":";;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,eAAe,WAA4B,UAAkBA,YAAkG;AAC9J,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAc,cAAA,YAAY,YAAY;AAAA,IAClD;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,UAAUH,UAAQ,CAAC;AACzE,WAAA,IAAII,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBAAiB,WAA4B,QAAmB,iBAAyBJ,YAAoG;AAC5L,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAc,cAAA,YAAY,YAAY;AAAA,IAClD;AACI,QAAA,CAAC,OAAO,eAAe;AACnB,aAAA,IAAIA,SAAc,cAAA,mBAAmB,iBAAiB;AAAA,IAC9D;AACI,QAAA,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AAC1E,aAAA,IAAIA,SAAc,cAAA,oBAAoB,yBAAyB;AAAA,IACvE;AAEM,UAAA,UAAU,WAAW,QAAQ,IAAIC,4CAAsB,OAAO,IAAIH,UAAQ,CAAC;AAC1E,WAAA,IAAII,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}
+{"version":3,"file":"PasswordChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tasync changePassword(dbContext: DatabaseContext, personId: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(personId, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T>\n}\n\nexport { PasswordChangeManager }\n"],"names":["password","getPasswordWeaknessMessage","ResponseError","ChangePasswordCommand","ResponseOk"],"mappings":";;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,eAAe,WAA4B,UAAkBA,YAAkG;AAC9J,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAAA,cAAc,YAAY,YAAY;AAAA,IAAA;AAElD,UAAM,UAAU,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,UAAUH,UAAQ,CAAC;AACzE,WAAA,IAAII,oBAAW,IAAI;AAAA,EAAA;AAAA,EAG3B,MAAM,iBAAiB,WAA4B,QAAmB,iBAAyBJ,YAAoG;AAC5L,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAAA,cAAc,YAAY,YAAY;AAAA,IAAA;AAE9C,QAAA,CAAC,OAAO,eAAe;AACnB,aAAA,IAAIA,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,IAAA;AAE1D,QAAA,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AAC1E,aAAA,IAAIA,SAAAA,cAAc,oBAAoB,yBAAyB;AAAA,IAAA;AAGjE,UAAA,UAAU,WAAW,QAAQ,IAAIC,4CAAsB,OAAO,IAAIH,UAAQ,CAAC;AAC1E,WAAA,IAAII,oBAAW,IAAI;AAAA,EAAA;AAE5B;;"}

package/dist/production/src/model/service/PasswordChangeManager.js

@@ -1,8 +1,8 @@
 import "../type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
-import { ChangePasswordCommand } from "../commands/person/ChangePasswordCommand.js";
 import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { ChangePasswordCommand } from "../commands/person/ChangePasswordCommand.js";
 import { getPasswordWeaknessMessage } from "../utils/password.js";
 class PasswordChangeManager {
   constructor(providers) {

package/dist/production/src/model/service/PasswordChangeManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tasync changePassword(dbContext: DatabaseContext, personId: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(personId, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T>\n}\n\nexport { PasswordChangeManager }\n"],"names":[],"mappings":";;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,eAAe,WAA4B,UAAkB,UAAkG;AAC9J,UAAA,eAAe,2BAA2B,QAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,YAAY,YAAY;AAAA,IAClD;AACA,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,UAAU,QAAQ,CAAC;AACzE,WAAA,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBAAiB,WAA4B,QAAmB,iBAAyB,UAAoG;AAC5L,UAAA,eAAe,2BAA2B,QAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,YAAY,YAAY;AAAA,IAClD;AACI,QAAA,CAAC,OAAO,eAAe;AACnB,aAAA,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,IAC9D;AACI,QAAA,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AAC1E,aAAA,IAAI,cAAc,oBAAoB,yBAAyB;AAAA,IACvE;AAEM,UAAA,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAC1E,WAAA,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}
+{"version":3,"file":"PasswordChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tasync changePassword(dbContext: DatabaseContext, personId: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(personId, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T>\n}\n\nexport { PasswordChangeManager }\n"],"names":[],"mappings":";;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,eAAe,WAA4B,UAAkB,UAAkG;AAC9J,UAAA,eAAe,2BAA2B,QAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,YAAY,YAAY;AAAA,IAAA;AAElD,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,UAAU,QAAQ,CAAC;AACzE,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAAA,EAG3B,MAAM,iBAAiB,WAA4B,QAAmB,iBAAyB,UAAoG;AAC5L,UAAA,eAAe,2BAA2B,QAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,YAAY,YAAY;AAAA,IAAA;AAE9C,QAAA,CAAC,OAAO,eAAe;AACnB,aAAA,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,IAAA;AAE1D,QAAA,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AAC1E,aAAA,IAAI,cAAc,oBAAoB,yBAAyB;AAAA,IAAA;AAGjE,UAAA,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAC1E,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAE5B;"}

package/dist/production/src/model/service/PasswordResetManager.cjs

@@ -1,29 +1,21 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("../type/ApiKey.cjs");
-require("@contember/database");
-require("node:crypto");
-const exceptions = require("../../exceptions.cjs");
 const Response = require("../utils/Response.cjs");
-const CreatePasswordResetRequestCommand = require("../commands/passwordReset/CreatePasswordResetRequestCommand.cjs");
-const ResetPasswordCommand = require("../commands/passwordReset/ResetPasswordCommand.cjs");
 const password = require("../utils/password.cjs");
+const exceptions = require("../../exceptions.cjs");
+const getPreferredProject = require("./helpers/getPreferredProject.cjs");
+require("@contember/database");
+const CreatePersonTokenCommand = require("../commands/personToken/CreatePersonTokenCommand.cjs");
+const ResetPasswordCommand = require("../commands/personToken/ResetPasswordCommand.cjs");
 class PasswordResetManager {
   constructor(mailer, projectManager) {
     this.mailer = mailer;
     this.projectManager = projectManager;
   }
   async createPasswordResetRequest(dbContext, permissionContext, person, mailOptions = {}) {
-    const result = await dbContext.commandBus.execute(new CreatePasswordResetRequestCommand.CreatePasswordResetRequestCommand(person.id));
+    const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.CreatePersonTokenCommand.createPasswordResetRequest(person.id));
     const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
-    const project = (() => {
-      if (projects.length === 1) {
-        return projects[0];
-      } else if (mailOptions.project) {
-        return projects.find((it) => it.slug === mailOptions.project) || null;
-      }
-      return null;
-    })();
+    const project = getPreferredProject.getPreferredProject(projects, mailOptions.project ?? null);
     if (!person.email) {
       throw new exceptions.ImplementationException();
     }

package/dist/production/src/model/service/PasswordResetManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { CreatePasswordResetRequestCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands'\nimport { Response, ResponseError } from '../utils/Response'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { UserMailer } from '../mailing'\nimport { PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) { }\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(new CreatePasswordResetRequestCommand(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = (() => {\n\t\t\tif (projects.length === 1) {\n\t\t\t\treturn projects[0]\n\t\t\t} else if (mailOptions.project) {\n\t\t\t\treturn projects.find(it => it.slug === mailOptions.project) || null\n\t\t\t}\n\t\t\treturn null\n\t\t})()\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('PASSWORD_TOO_WEAK', weakPassword)\n\t\t}\n\t\treturn await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t}\n}\n\nexport type ResetPasswordErrorCode = 'PASSWORD_TOO_WEAK'\n\nexport type ResetPasswordResponse = Response<null, ResetPasswordErrorCode | ResetPasswordCommandErrorCode>\n"],"names":["CreatePasswordResetRequestCommand","ImplementationException","password","getPasswordWeaknessMessage","ResponseError","ResetPasswordCommand"],"mappings":";;;;;;;;;;AAeO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EACd;AAAA,EAEJ,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AACV,UAAA,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAIA,oEAAkC,OAAO,EAAE,CAAC;AAC5F,UAAA,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,WAAW,MAAM;AAClB,UAAA,SAAS,WAAW,GAAG;AAC1B,eAAO,SAAS,CAAC;AAAA,MAAA,WACP,YAAY,SAAS;AAC/B,eAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,YAAY,OAAO,KAAK;AAAA,MAChE;AACO,aAAA;AAAA,IAAA;AAEJ,QAAA,CAAC,OAAO,OAAO;AAClB,YAAM,IAAIC,WAAwB,wBAAA;AAAA,IACnC;AAEA,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MACvB;AAAA,MACA;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAC3B;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAa,cAAc,WAA4B,OAAeC,YAAkD;AACjH,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAc,cAAA,qBAAqB,YAAY;AAAA,IAC3D;AACO,WAAA,MAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,OAAOH,UAAQ,CAAC;AAAA,EACpF;AACD;;"}
+{"version":3,"file":"PasswordResetManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError } from '../utils/Response'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { UserMailer } from '../mailing'\nimport { PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { CreatePersonTokenCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands/personToken'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) { }\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('PASSWORD_TOO_WEAK', weakPassword)\n\t\t}\n\t\treturn await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t}\n}\n\nexport type ResetPasswordErrorCode = 'PASSWORD_TOO_WEAK'\n\nexport type ResetPasswordResponse = Response<null, ResetPasswordErrorCode | ResetPasswordCommandErrorCode>\n"],"names":["CreatePersonTokenCommand","getPreferredProject","ImplementationException","password","getPasswordWeaknessMessage","ResponseError","ResetPasswordCommand"],"mappings":";;;;;;;;;AAgBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EAAA;AAAA,EAGlB,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AACV,UAAA,SAAS,MAAM,UAAU,WAAW,QAAQA,yBAAAA,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAC1G,UAAA,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUC,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AACrE,QAAA,CAAC,OAAO,OAAO;AAClB,YAAM,IAAIC,WAAAA,wBAAwB;AAAA,IAAA;AAGnC,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MACvB;AAAA,MACA;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAE5B;AAAA,EAAA;AAAA,EAGD,MAAa,cAAc,WAA4B,OAAeC,YAAkD;AACjH,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAAA,cAAc,qBAAqB,YAAY;AAAA,IAAA;AAEpD,WAAA,MAAM,UAAU,WAAW,QAAQ,IAAIC,0CAAqB,OAAOH,UAAQ,CAAC;AAAA,EAAA;AAErF;;"}

package/dist/production/src/model/service/PasswordResetManager.js

@@ -1,27 +1,19 @@
-import "../type/ApiKey.js";
-import "@contember/database";
-import "node:crypto";
-import { ImplementationException } from "../../exceptions.js";
 import { ResponseError } from "../utils/Response.js";
-import { CreatePasswordResetRequestCommand } from "../commands/passwordReset/CreatePasswordResetRequestCommand.js";
-import { ResetPasswordCommand } from "../commands/passwordReset/ResetPasswordCommand.js";
 import { getPasswordWeaknessMessage } from "../utils/password.js";
+import { ImplementationException } from "../../exceptions.js";
+import { getPreferredProject } from "./helpers/getPreferredProject.js";
+import "@contember/database";
+import { CreatePersonTokenCommand } from "../commands/personToken/CreatePersonTokenCommand.js";
+import { ResetPasswordCommand } from "../commands/personToken/ResetPasswordCommand.js";
 class PasswordResetManager {
   constructor(mailer, projectManager) {
     this.mailer = mailer;
     this.projectManager = projectManager;
   }
   async createPasswordResetRequest(dbContext, permissionContext, person, mailOptions = {}) {
-    const result = await dbContext.commandBus.execute(new CreatePasswordResetRequestCommand(person.id));
+    const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id));
     const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
-    const project = (() => {
-      if (projects.length === 1) {
-        return projects[0];
-      } else if (mailOptions.project) {
-        return projects.find((it) => it.slug === mailOptions.project) || null;
-      }
-      return null;
-    })();
+    const project = getPreferredProject(projects, mailOptions.project ?? null);
     if (!person.email) {
       throw new ImplementationException();
     }

package/dist/production/src/model/service/PasswordResetManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { CreatePasswordResetRequestCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands'\nimport { Response, ResponseError } from '../utils/Response'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { UserMailer } from '../mailing'\nimport { PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) { }\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(new CreatePasswordResetRequestCommand(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = (() => {\n\t\t\tif (projects.length === 1) {\n\t\t\t\treturn projects[0]\n\t\t\t} else if (mailOptions.project) {\n\t\t\t\treturn projects.find(it => it.slug === mailOptions.project) || null\n\t\t\t}\n\t\t\treturn null\n\t\t})()\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('PASSWORD_TOO_WEAK', weakPassword)\n\t\t}\n\t\treturn await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t}\n}\n\nexport type ResetPasswordErrorCode = 'PASSWORD_TOO_WEAK'\n\nexport type ResetPasswordResponse = Response<null, ResetPasswordErrorCode | ResetPasswordCommandErrorCode>\n"],"names":[],"mappings":";;;;;;;;AAeO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EACd;AAAA,EAEJ,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AACV,UAAA,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAI,kCAAkC,OAAO,EAAE,CAAC;AAC5F,UAAA,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,WAAW,MAAM;AAClB,UAAA,SAAS,WAAW,GAAG;AAC1B,eAAO,SAAS,CAAC;AAAA,MAAA,WACP,YAAY,SAAS;AAC/B,eAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,YAAY,OAAO,KAAK;AAAA,MAChE;AACO,aAAA;AAAA,IAAA;AAEJ,QAAA,CAAC,OAAO,OAAO;AAClB,YAAM,IAAI,wBAAwB;AAAA,IACnC;AAEA,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MACvB;AAAA,MACA;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAC3B;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAa,cAAc,WAA4B,OAAe,UAAkD;AACjH,UAAA,eAAe,2BAA2B,QAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,qBAAqB,YAAY;AAAA,IAC3D;AACO,WAAA,MAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,CAAC;AAAA,EACpF;AACD;"}
+{"version":3,"file":"PasswordResetManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError } from '../utils/Response'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { UserMailer } from '../mailing'\nimport { PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { CreatePersonTokenCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands/personToken'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) { }\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('PASSWORD_TOO_WEAK', weakPassword)\n\t\t}\n\t\treturn await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t}\n}\n\nexport type ResetPasswordErrorCode = 'PASSWORD_TOO_WEAK'\n\nexport type ResetPasswordResponse = Response<null, ResetPasswordErrorCode | ResetPasswordCommandErrorCode>\n"],"names":[],"mappings":";;;;;;;AAgBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EAAA;AAAA,EAGlB,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AACV,UAAA,SAAS,MAAM,UAAU,WAAW,QAAQ,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAC1G,UAAA,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AACrE,QAAA,CAAC,OAAO,OAAO;AAClB,YAAM,IAAI,wBAAwB;AAAA,IAAA;AAGnC,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MACvB;AAAA,MACA;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAE5B;AAAA,EAAA;AAAA,EAGD,MAAa,cAAc,WAA4B,OAAe,UAAkD;AACjH,UAAA,eAAe,2BAA2B,QAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,qBAAqB,YAAY;AAAA,IAAA;AAEpD,WAAA,MAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,QAAQ,CAAC;AAAA,EAAA;AAErF;"}

package/dist/production/src/model/service/PasswordlessSignInManager.cjs

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+const exceptions = require("../../exceptions.cjs");
+const PersonQuery = require("../queries/person/PersonQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+const Response = require("../utils/Response.cjs");
+require("../type/ApiKey.cjs");
+const ActivateOtpCommand = require("../commands/personToken/ActivateOtpCommand.cjs");
+const CreatePersonTokenCommand = require("../commands/personToken/CreatePersonTokenCommand.cjs");
+const InvalidateTokenCommand = require("../commands/personToken/InvalidateTokenCommand.cjs");
+const IncreaseOtpAttemptCommand = require("../commands/personToken/IncreaseOtpAttemptCommand.cjs");
+const PersonTokenQuery = require("../queries/personToken/PersonTokenQuery.cjs");
+const tokenUtils = require("../utils/tokenUtils.cjs");
+const getPreferredProject = require("./helpers/getPreferredProject.cjs");
+class PasswordlessSignInManager {
+  constructor(apiKeyManager, configurationManager, mailer, projectManager, otpAuthenticator) {
+    this.apiKeyManager = apiKeyManager;
+    this.configurationManager = configurationManager;
+    this.mailer = mailer;
+    this.projectManager = projectManager;
+    this.otpAuthenticator = otpAuthenticator;
+  }
+  async initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }) {
+    return db.transaction(async (db2) => {
+      const configuration = await this.configurationManager.fetchConfiguration(db2);
+      if (configuration.passwordless.enabled === "never") {
+        return new Response.ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled");
+      }
+      const person = await db2.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email));
+      if (!person) {
+        return new Response.ResponseError("PERSON_NOT_FOUND", `Person ${email} not found`);
+      }
+      if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
+        return new Response.ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
+      }
+      const createTokenCommand = CreatePersonTokenCommand.CreatePersonTokenCommand.createPasswordlessRequest(person.id, configuration.passwordless.expirationMinutes);
+      const result = await db2.commandBus.execute(createTokenCommand);
+      const url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? void 0;
+      const projects = await this.projectManager.getProjectsByIdentity(db2, person.identity_id, permissionContext);
+      const project = getPreferredProject.getPreferredProject(projects, mailProject ?? null);
+      await this.mailer.sendPasswordlessEmail(db2, {
+        email,
+        token: result.token,
+        url,
+        project: project?.name,
+        projectSlug: project?.slug
+      }, {
+        variant: mailVariant || "",
+        projectId: project?.id ?? null
+      });
+      return new Response.ResponseOk({ requestId: result.id, expiresAt: result.expiresAt });
+    });
+  }
+  formatUrl(url, token, requestId, email) {
+    if (!url) {
+      return null;
+    }
+    const urlObj = new URL(url);
+    urlObj.searchParams.set("token", token);
+    urlObj.searchParams.set("request_id", requestId);
+    urlObj.searchParams.set("email", email);
+    return urlObj.toString();
+  }
+  async signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }) {
+    return db.transaction(async (db2) => {
+      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byId(requestId, "passwordless"));
+      const tokenValidationResult = tokenUtils.validateToken({
+        entry: tokenResult,
+        token,
+        now: db2.providers.now(),
+        validationType
+      });
+      if (!tokenValidationResult.ok) {
+        if (tokenValidationResult.error === "TOKEN_INVALID" && validationType === "otp") {
+          await db2.commandBus.execute(new IncreaseOtpAttemptCommand.IncreaseOtpAttemptCommand(tokenResult.id));
+        }
+        return tokenValidationResult;
+      }
+      const personRow = await db2.queryHandler.fetch(PersonQuery.PersonQuery.byId(tokenValidationResult.result.person_id));
+      if (!personRow) {
+        throw new exceptions.ImplementationException();
+      }
+      if (personRow.disabled_at !== null) {
+        return new Response.ResponseError("PERSON_DISABLED", `Person is disabled`);
+      }
+      if (personRow.otp_uri && personRow.otp_activated_at) {
+        if (!mfaOtp) {
+          return new Response.ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`);
+        }
+        if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed");
+        }
+      }
+      await db2.commandBus.execute(new InvalidateTokenCommand.InvalidateTokenCommand(tokenValidationResult.result.id));
+      const sessionToken = await this.apiKeyManager.createSessionApiKey(db2, personRow.identity_id, expiration);
+      return new Response.ResponseOk({ person: personRow, token: sessionToken });
+    });
+  }
+  async activatePasswordlessOtp({ db, token, requestId, otpHash }) {
+    return db.transaction(async (db2) => {
+      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byId(requestId, "passwordless"));
+      const tokenValidationResult = tokenUtils.validateToken({
+        entry: tokenResult,
+        token,
+        now: db2.providers.now(),
+        validationType: "token"
+      });
+      if (!tokenValidationResult.ok) {
+        return tokenValidationResult;
+      }
+      await db2.commandBus.execute(new ActivateOtpCommand.ActivateOtpCommand(tokenValidationResult.result.id, otpHash));
+      return new Response.ResponseOk(null);
+    });
+  }
+  isEnabled(globalValue, personValue) {
+    switch (globalValue) {
+      case "always":
+        return true;
+      case "never":
+        return false;
+      case "optIn":
+        return personValue === true;
+      case "optOut":
+        return personValue !== false;
+    }
+  }
+}
+exports.PasswordlessSignInManager = PasswordlessSignInManager;
+//# sourceMappingURL=PasswordlessSignInManager.cjs.map

package/dist/production/src/model/service/PasswordlessSignInManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordlessSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport {\n\tActivatePasswordlessOtpErrorCode,\n\tConfigPolicy,\n\tInitSignInPasswordlessErrorCode,\n\tInitSignInPasswordlessResult,\n\tSignInPasswordlessErrorCode,\n} from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { ConfigurationManager } from './ConfigurationManager'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { InvalidateTokenCommand } from '../commands/personToken/InvalidateTokenCommand'\nimport { PersonToken } from '../type'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await this.configurationManager.fetchConfiguration(db)\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled')\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`)\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, configuration.passwordless.expirationMinutes)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({ requestId: result.id, expiresAt: result.expiresAt })\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string | null, token: string, requestId: string, email: string): string | null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn tokenValidationResult\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`)\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({ person: personRow, token: sessionToken })\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn tokenValidationResult\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean | null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult, InitSignInPasswordlessErrorCode>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode>\n\n\texport type ActivatePasswordlessOtpResponse = Response<null, ActivatePasswordlessOtpErrorCode>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db","ResponseError","PersonQuery","CreatePersonTokenCommand","getPreferredProject","ResponseOk","PersonTokenQuery","validateToken","IncreaseOtpAttemptCommand","ImplementationException","InvalidateTokenCommand","ActivateOtpCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,sBACA,QACA,gBACA,kBAEhB;AANgB,SAAA,gBAAA;AACA,SAAA,uBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAM,KAAK,qBAAqB,mBAAmBA,GAAE;AACvE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAIC,SAAAA,cAAc,yBAAyB,kCAAkC;AAAA,MAAA;AAG/E,YAAA,SAAS,MAAMD,IAAG,aAAa,MAAME,wBAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAID,SAAA,cAAc,oBAAoB,UAAU,KAAK,YAAY;AAAA,MAAA;AAErE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAIA,SAAAA,cAAc,yBAAyB,kDAAkD;AAAA,MAAA;AAGrG,YAAM,qBAAqBE,yBAAyB,yBAAA,0BAA0B,OAAO,IAAI,cAAc,aAAa,iBAAiB;AACrI,YAAM,SAAS,MAAMH,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAUI,oBAAA,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBJ,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA,GACpB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAEM,aAAA,IAAIK,SAAAA,WAAW,EAAE,WAAW,OAAO,IAAI,WAAW,OAAO,WAAW;AAAA,IAAA,CAC3E;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoB,OAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAAS,KAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,YAAY,OAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOL,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMM,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,WAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKP,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAIQ,0BAAAA,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAEpE,eAAA;AAAA,MAAA;AAEF,YAAA,YAAY,MAAMR,IAAG,aAAa,MAAME,wBAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAIO,WAAAA,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAIR,SAAc,cAAA,mBAAmB,oBAAoB;AAAA,MAAA;AAG7D,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAIA,SAAc,cAAA,gBAAgB,uCAAuC;AAAA,QAAA;AAG7E,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAIA,SAAAA,cAAc,qBAAqB,iCAAiC;AAAA,QAAA;AAAA,MAChF;AAGKD,YAAAA,IAAG,WAAW,QAAQ,IAAIU,8CAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBV,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAIK,SAAW,WAAA,EAAE,QAAQ,WAAW,OAAO,cAAc;AAAA,IAAA,CAChE;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,IAAI,OAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOL,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMM,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,WAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKP,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AACvB,eAAA;AAAA,MAAA;AAGFA,YAAAA,IAAG,WAAW,QAAQ,IAAIW,mBAAAA,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAErF,aAAA,IAAIN,oBAAW,IAAI;AAAA,IAAA,CAC1B;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;;"}

package/dist/production/src/model/service/PasswordlessSignInManager.js

@@ -0,0 +1,135 @@
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import { ImplementationException } from "../../exceptions.js";
+import { PersonQuery } from "../queries/person/PersonQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import "../type/ApiKey.js";
+import { ActivateOtpCommand } from "../commands/personToken/ActivateOtpCommand.js";
+import { CreatePersonTokenCommand } from "../commands/personToken/CreatePersonTokenCommand.js";
+import { InvalidateTokenCommand } from "../commands/personToken/InvalidateTokenCommand.js";
+import { IncreaseOtpAttemptCommand } from "../commands/personToken/IncreaseOtpAttemptCommand.js";
+import { PersonTokenQuery } from "../queries/personToken/PersonTokenQuery.js";
+import { validateToken } from "../utils/tokenUtils.js";
+import { getPreferredProject } from "./helpers/getPreferredProject.js";
+class PasswordlessSignInManager {
+  constructor(apiKeyManager, configurationManager, mailer, projectManager, otpAuthenticator) {
+    this.apiKeyManager = apiKeyManager;
+    this.configurationManager = configurationManager;
+    this.mailer = mailer;
+    this.projectManager = projectManager;
+    this.otpAuthenticator = otpAuthenticator;
+  }
+  async initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }) {
+    return db.transaction(async (db2) => {
+      const configuration = await this.configurationManager.fetchConfiguration(db2);
+      if (configuration.passwordless.enabled === "never") {
+        return new ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled");
+      }
+      const person = await db2.queryHandler.fetch(PersonQuery.byEmail(email));
+      if (!person) {
+        return new ResponseError("PERSON_NOT_FOUND", `Person ${email} not found`);
+      }
+      if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
+        return new ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person");
+      }
+      const createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, configuration.passwordless.expirationMinutes);
+      const result = await db2.commandBus.execute(createTokenCommand);
+      const url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? void 0;
+      const projects = await this.projectManager.getProjectsByIdentity(db2, person.identity_id, permissionContext);
+      const project = getPreferredProject(projects, mailProject ?? null);
+      await this.mailer.sendPasswordlessEmail(db2, {
+        email,
+        token: result.token,
+        url,
+        project: project?.name,
+        projectSlug: project?.slug
+      }, {
+        variant: mailVariant || "",
+        projectId: project?.id ?? null
+      });
+      return new ResponseOk({ requestId: result.id, expiresAt: result.expiresAt });
+    });
+  }
+  formatUrl(url, token, requestId, email) {
+    if (!url) {
+      return null;
+    }
+    const urlObj = new URL(url);
+    urlObj.searchParams.set("token", token);
+    urlObj.searchParams.set("request_id", requestId);
+    urlObj.searchParams.set("email", email);
+    return urlObj.toString();
+  }
+  async signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }) {
+    return db.transaction(async (db2) => {
+      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.byId(requestId, "passwordless"));
+      const tokenValidationResult = validateToken({
+        entry: tokenResult,
+        token,
+        now: db2.providers.now(),
+        validationType
+      });
+      if (!tokenValidationResult.ok) {
+        if (tokenValidationResult.error === "TOKEN_INVALID" && validationType === "otp") {
+          await db2.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult.id));
+        }
+        return tokenValidationResult;
+      }
+      const personRow = await db2.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id));
+      if (!personRow) {
+        throw new ImplementationException();
+      }
+      if (personRow.disabled_at !== null) {
+        return new ResponseError("PERSON_DISABLED", `Person is disabled`);
+      }
+      if (personRow.otp_uri && personRow.otp_activated_at) {
+        if (!mfaOtp) {
+          return new ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`);
+        }
+        if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
+          return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed");
+        }
+      }
+      await db2.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id));
+      const sessionToken = await this.apiKeyManager.createSessionApiKey(db2, personRow.identity_id, expiration);
+      return new ResponseOk({ person: personRow, token: sessionToken });
+    });
+  }
+  async activatePasswordlessOtp({ db, token, requestId, otpHash }) {
+    return db.transaction(async (db2) => {
+      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.byId(requestId, "passwordless"));
+      const tokenValidationResult = validateToken({
+        entry: tokenResult,
+        token,
+        now: db2.providers.now(),
+        validationType: "token"
+      });
+      if (!tokenValidationResult.ok) {
+        return tokenValidationResult;
+      }
+      await db2.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash));
+      return new ResponseOk(null);
+    });
+  }
+  isEnabled(globalValue, personValue) {
+    switch (globalValue) {
+      case "always":
+        return true;
+      case "never":
+        return false;
+      case "optIn":
+        return personValue === true;
+      case "optOut":
+        return personValue !== false;
+    }
+  }
+}
+export {
+  PasswordlessSignInManager
+};
+//# sourceMappingURL=PasswordlessSignInManager.js.map

package/dist/production/src/model/service/PasswordlessSignInManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordlessSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport {\n\tActivatePasswordlessOtpErrorCode,\n\tConfigPolicy,\n\tInitSignInPasswordlessErrorCode,\n\tInitSignInPasswordlessResult,\n\tSignInPasswordlessErrorCode,\n} from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { ConfigurationManager } from './ConfigurationManager'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { InvalidateTokenCommand } from '../commands/personToken/InvalidateTokenCommand'\nimport { PersonToken } from '../type'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly configurationManager: ConfigurationManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await this.configurationManager.fetchConfiguration(db)\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled')\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`)\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person')\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, configuration.passwordless.expirationMinutes)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({ requestId: result.id, expiresAt: result.expiresAt })\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string | null, token: string, requestId: string, email: string): string | null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn tokenValidationResult\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`)\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({ person: personRow, token: sessionToken })\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn tokenValidationResult\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean | null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult, InitSignInPasswordlessErrorCode>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode>\n\n\texport type ActivatePasswordlessOtpResponse = Response<null, ActivatePasswordlessOtpErrorCode>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db"],"mappings":";;;;;;;;;;;;;;;;;;AAuBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,sBACA,QACA,gBACA,kBAEhB;AANgB,SAAA,gBAAA;AACA,SAAA,uBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAM,KAAK,qBAAqB,mBAAmBA,GAAE;AACvE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAI,cAAc,yBAAyB,kCAAkC;AAAA,MAAA;AAG/E,YAAA,SAAS,MAAMA,IAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAI,cAAc,oBAAoB,UAAU,KAAK,YAAY;AAAA,MAAA;AAErE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAI,cAAc,yBAAyB,kDAAkD;AAAA,MAAA;AAGrG,YAAM,qBAAqB,yBAAyB,0BAA0B,OAAO,IAAI,cAAc,aAAa,iBAAiB;AACrI,YAAM,SAAS,MAAMA,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAU,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBA,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA,GACpB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAEM,aAAA,IAAI,WAAW,EAAE,WAAW,OAAO,IAAI,WAAW,OAAO,WAAW;AAAA,IAAA,CAC3E;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoB,OAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAAS,KAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,YAAY,OAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOA,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAI,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAEpE,eAAA;AAAA,MAAA;AAEF,YAAA,YAAY,MAAMA,IAAG,aAAa,MAAM,YAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAI,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAI,cAAc,mBAAmB,oBAAoB;AAAA,MAAA;AAG7D,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAI,cAAc,gBAAgB,uCAAuC;AAAA,QAAA;AAG7E,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAI,cAAc,qBAAqB,iCAAiC;AAAA,QAAA;AAAA,MAChF;AAGKA,YAAAA,IAAG,WAAW,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBA,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAI,WAAW,EAAE,QAAQ,WAAW,OAAO,cAAc;AAAA,IAAA,CAChE;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,IAAI,OAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOA,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AACvB,eAAA;AAAA,MAAA;AAGFA,YAAAA,IAAG,WAAW,QAAQ,IAAI,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAErF,aAAA,IAAI,WAAW,IAAI;AAAA,IAAA,CAC1B;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;"}

package/dist/production/src/model/service/PersonAccessManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonAccessManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { PersonQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand'\nimport { ApiKeyManager } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DisablePersonErrorCode } from '../../schema'\n\nclass PersonAccessManager {\n\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, personId: string): Promise<PersonDisableAccessResponse> {\n\t\tconst result = await dbContext.transaction(async trx => {\n\t\t\tconst personRow = await trx.queryHandler.fetch(\n\t\t\t\tPersonQuery.byId(personId),\n\t\t\t)\n\n\t\t\tif (personRow === null) {\n\t\t\t\treturn 'PERSON_NOT_FOUND'\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn 'PERSON_ALREADY_DISABLED'\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, personRow.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, personRow.identity_id)\n\n\t\t\treturn null\n\t\t})\n\n\t\tswitch (result) {\n\t\t\tcase null:\n\t\t\t\treturn new ResponseOk(null)\n\n\t\t\tcase 'PERSON_ALREADY_DISABLED':\n\t\t\t\treturn new ResponseError(result, 'Person is already disable')\n\n\t\t\tcase 'PERSON_NOT_FOUND':\n\t\t\t\treturn new ResponseError(result, 'Person not found')\n\t\t}\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":["PersonQuery","ResponseOk","ResponseError","DisablePersonCommand"],"mappings":";;;;;;;;;;;;AAOA,MAAM,oBAAoB;AAAA,EAEzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,WAA4B,UAAwD;AACvG,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,QAAO;AACjD,YAAA,YAAY,MAAM,IAAI,aAAa;AAAA,QACxCA,YAAA,YAAY,KAAK,QAAQ;AAAA,MAAA;AAG1B,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MACR;AAEI,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA;AAAA,MACR;AAGA,YAAM,KAAK,qBAAqB,KAAK,UAAU,EAAE;AACjD,YAAM,KAAK,uBAAuB,KAAK,UAAU,WAAW;AAErD,aAAA;AAAA,IAAA,CACP;AAED,YAAQ,QAAQ;AAAA,MACf,KAAK;AACG,eAAA,IAAIC,SAAAA,WAAW,IAAI;AAAA,MAE3B,KAAK;AACG,eAAA,IAAIC,SAAc,cAAA,QAAQ,2BAA2B;AAAA,MAE7D,KAAK;AACG,eAAA,IAAIA,SAAc,cAAA,QAAQ,kBAAkB;AAAA,IACrD;AAAA,EACD;AAAA,EAEA,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAA,qBAAqB,QAAQ,CAAC;AAAA,EACtE;AAAA,EAEA,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAC5E;AACD;;"}
+{"version":3,"file":"PersonAccessManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { PersonQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand'\nimport { ApiKeyManager } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DisablePersonErrorCode } from '../../schema'\n\nclass PersonAccessManager {\n\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, personId: string): Promise<PersonDisableAccessResponse> {\n\t\tconst result = await dbContext.transaction(async trx => {\n\t\t\tconst personRow = await trx.queryHandler.fetch(\n\t\t\t\tPersonQuery.byId(personId),\n\t\t\t)\n\n\t\t\tif (personRow === null) {\n\t\t\t\treturn 'PERSON_NOT_FOUND'\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn 'PERSON_ALREADY_DISABLED'\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, personRow.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, personRow.identity_id)\n\n\t\t\treturn null\n\t\t})\n\n\t\tswitch (result) {\n\t\t\tcase null:\n\t\t\t\treturn new ResponseOk(null)\n\n\t\t\tcase 'PERSON_ALREADY_DISABLED':\n\t\t\t\treturn new ResponseError(result, 'Person is already disable')\n\n\t\t\tcase 'PERSON_NOT_FOUND':\n\t\t\t\treturn new ResponseError(result, 'Person not found')\n\t\t}\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":["PersonQuery","ResponseOk","ResponseError","DisablePersonCommand"],"mappings":";;;;;;;;;;;;AAOA,MAAM,oBAAoB;AAAA,EAEzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,cAAc,WAA4B,UAAwD;AACvG,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,QAAO;AACjD,YAAA,YAAY,MAAM,IAAI,aAAa;AAAA,QACxCA,YAAA,YAAY,KAAK,QAAQ;AAAA,MAC1B;AAEA,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAGJ,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA;AAAA,MAAA;AAIR,YAAM,KAAK,qBAAqB,KAAK,UAAU,EAAE;AACjD,YAAM,KAAK,uBAAuB,KAAK,UAAU,WAAW;AAErD,aAAA;AAAA,IAAA,CACP;AAED,YAAQ,QAAQ;AAAA,MACf,KAAK;AACG,eAAA,IAAIC,oBAAW,IAAI;AAAA,MAE3B,KAAK;AACG,eAAA,IAAIC,SAAAA,cAAc,QAAQ,2BAA2B;AAAA,MAE7D,KAAK;AACG,eAAA,IAAIA,SAAAA,cAAc,QAAQ,kBAAkB;AAAA,IAAA;AAAA,EACrD;AAAA,EAGD,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAA,qBAAqB,QAAQ,CAAC;AAAA,EAAA;AAAA,EAGtE,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAAA;AAE7E;;"}

package/dist/production/src/model/service/PersonAccessManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonAccessManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { PersonQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand'\nimport { ApiKeyManager } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DisablePersonErrorCode } from '../../schema'\n\nclass PersonAccessManager {\n\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, personId: string): Promise<PersonDisableAccessResponse> {\n\t\tconst result = await dbContext.transaction(async trx => {\n\t\t\tconst personRow = await trx.queryHandler.fetch(\n\t\t\t\tPersonQuery.byId(personId),\n\t\t\t)\n\n\t\t\tif (personRow === null) {\n\t\t\t\treturn 'PERSON_NOT_FOUND'\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn 'PERSON_ALREADY_DISABLED'\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, personRow.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, personRow.identity_id)\n\n\t\t\treturn null\n\t\t})\n\n\t\tswitch (result) {\n\t\t\tcase null:\n\t\t\t\treturn new ResponseOk(null)\n\n\t\t\tcase 'PERSON_ALREADY_DISABLED':\n\t\t\t\treturn new ResponseError(result, 'Person is already disable')\n\n\t\t\tcase 'PERSON_NOT_FOUND':\n\t\t\t\treturn new ResponseError(result, 'Person not found')\n\t\t}\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":[],"mappings":";;;;;;;;;;AAOA,MAAM,oBAAoB;AAAA,EAEzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,WAA4B,UAAwD;AACvG,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,QAAO;AACjD,YAAA,YAAY,MAAM,IAAI,aAAa;AAAA,QACxC,YAAY,KAAK,QAAQ;AAAA,MAAA;AAG1B,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MACR;AAEI,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA;AAAA,MACR;AAGA,YAAM,KAAK,qBAAqB,KAAK,UAAU,EAAE;AACjD,YAAM,KAAK,uBAAuB,KAAK,UAAU,WAAW;AAErD,aAAA;AAAA,IAAA,CACP;AAED,YAAQ,QAAQ;AAAA,MACf,KAAK;AACG,eAAA,IAAI,WAAW,IAAI;AAAA,MAE3B,KAAK;AACG,eAAA,IAAI,cAAc,QAAQ,2BAA2B;AAAA,MAE7D,KAAK;AACG,eAAA,IAAI,cAAc,QAAQ,kBAAkB;AAAA,IACrD;AAAA,EACD;AAAA,EAEA,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,CAAC;AAAA,EACtE;AAAA,EAEA,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAC5E;AACD;"}
+{"version":3,"file":"PersonAccessManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { PersonQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand'\nimport { ApiKeyManager } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DisablePersonErrorCode } from '../../schema'\n\nclass PersonAccessManager {\n\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, personId: string): Promise<PersonDisableAccessResponse> {\n\t\tconst result = await dbContext.transaction(async trx => {\n\t\t\tconst personRow = await trx.queryHandler.fetch(\n\t\t\t\tPersonQuery.byId(personId),\n\t\t\t)\n\n\t\t\tif (personRow === null) {\n\t\t\t\treturn 'PERSON_NOT_FOUND'\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn 'PERSON_ALREADY_DISABLED'\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, personRow.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, personRow.identity_id)\n\n\t\t\treturn null\n\t\t})\n\n\t\tswitch (result) {\n\t\t\tcase null:\n\t\t\t\treturn new ResponseOk(null)\n\n\t\t\tcase 'PERSON_ALREADY_DISABLED':\n\t\t\t\treturn new ResponseError(result, 'Person is already disable')\n\n\t\t\tcase 'PERSON_NOT_FOUND':\n\t\t\t\treturn new ResponseError(result, 'Person not found')\n\t\t}\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":[],"mappings":";;;;;;;;;;AAOA,MAAM,oBAAoB;AAAA,EAEzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,cAAc,WAA4B,UAAwD;AACvG,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,QAAO;AACjD,YAAA,YAAY,MAAM,IAAI,aAAa;AAAA,QACxC,YAAY,KAAK,QAAQ;AAAA,MAC1B;AAEA,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAGJ,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA;AAAA,MAAA;AAIR,YAAM,KAAK,qBAAqB,KAAK,UAAU,EAAE;AACjD,YAAM,KAAK,uBAAuB,KAAK,UAAU,WAAW;AAErD,aAAA;AAAA,IAAA,CACP;AAED,YAAQ,QAAQ;AAAA,MACf,KAAK;AACG,eAAA,IAAI,WAAW,IAAI;AAAA,MAE3B,KAAK;AACG,eAAA,IAAI,cAAc,QAAQ,2BAA2B;AAAA,MAE7D,KAAK;AACG,eAAA,IAAI,cAAc,QAAQ,kBAAkB;AAAA,IAAA;AAAA,EACrD;AAAA,EAGD,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,CAAC;AAAA,EAAA;AAAA,EAGtE,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAAA;AAE7E;"}

package/dist/production/src/model/service/PersonManager.cjs

@@ -10,6 +10,9 @@ require("@contember/authorization");
 require("../authorization/PermissionContext.cjs");
 require("../authorization/PermissionsFactory.cjs");
 require("@contember/schema");
+require("../type/ApiKey.cjs");
+require("node:crypto");
+const TogglePersonPasswordlessCommand = require("../commands/person/TogglePersonPasswordlessCommand.cjs");
 class PersonManager {
   constructor(emailValidator) {
     this.emailValidator = emailValidator;
@@ -29,6 +32,10 @@ class PersonManager {
     await dbContext.commandBus.execute(new ChangeProfileCommand.ChangeProfileCommand(person.id, data));
     return new Response.ResponseOk(null);
   }
+  async togglePasswordless(dbContext, person, value) {
+    await dbContext.commandBus.execute(new TogglePersonPasswordlessCommand.TogglePersonPasswordlessCommand(person.id, value));
+    return new Response.ResponseOk(null);
+  }
 }
 exports.PersonManager = PersonManager;
 //# sourceMappingURL=PersonManager.cjs.map