@contember/engine-tenant-api 2.1.0-alpha.16 → 2.1.0-alpha.17

package/tests/cases/integration/mocked/confirmOtpMutation.test.ts

@@ -3,7 +3,7 @@ import { testUuid } from '../../../src/testUuid'
 import { getPersonByIdentity } from './sql/getPersonByIdentity'
 import { confirmOtpMutation } from './gql/confirmOtp'
 import { ConfirmOtpErrorCode } from '../../../../src/schema'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
 import { OtpAuthenticator } from '../../../../src'
 import { Buffer } from 'buffer'
 
@@ -43,6 +43,12 @@ test('confirm otp mutation with valid code', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: '2fa_enable',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })
 
@@ -61,13 +67,6 @@ test('confirm otp mutation with invalid code', async () => {
 					email: 'john@doe.com',
 				},
 			}),
-			{
-				sql: `update "tenant"."person" set "otp_activated_at" = ? where "id" = ?`,
-				parameters: [now, personId],
-				response: {
-					rowCount: 1,
-				},
-			},
 		],
 		return: {
 			data: {
@@ -77,6 +76,12 @@ test('confirm otp mutation with invalid code', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: '2fa_enable',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		}),
 	})
 })
 

package/tests/cases/integration/mocked/createSessionKeyMutation.test.ts

@@ -3,10 +3,11 @@ import { SQL } from '../../../src/tags'
 import { testUuid } from '../../../src/testUuid'
 import { selectMembershipsSql } from './sql/selectMembershipsSql'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql'
 import { createSessionTokenMutation } from './gql/createSessionToken'
 import { createSessionKeySql } from './sql/createSessionKeySql'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('create session key', async () => {
 	const email = 'john@doe.com'
@@ -18,6 +19,7 @@ test('create session key', async () => {
 		query: createSessionTokenMutation({ email }, { withData: true }),
 		executes: [
 			getPersonByEmailSql({ email, response: { personId, identityId, password: 'aaa', roles: [] } }),
+			getConfigSql(),
 			createSessionKeySql({ apiKeyId: apiKeyId, identityId: identityId }),
 			getIdentityProjectsSql({ identityId: identityId, projectId: projectId }),
 			selectMembershipsSql({
@@ -25,26 +27,6 @@ test('create session key', async () => {
 				projectId,
 				membershipsResponse: [{ role: 'editor', variables: [{ name: 'locale', values: ['cs'] }] }],
 			}),
-			{
-				sql: SQL`SELECT "id",
-						         "email",
-						         "identity_id"
-					         FROM "tenant"."person"
-					         WHERE "id" = ?`,
-				parameters: [personId],
-				response: { rows: [{ id: personId, email: email }] },
-			},
-			{
-				sql: SQL`SELECT "project"."id",
-						         "project"."name",
-						         "project"."slug",
-						         "project"."config"
-					         FROM "tenant"."project"
-						              INNER JOIN "tenant"."project_member" AS "project_member" ON "project_member"."project_id" = "project"."id"
-					         WHERE "project_member"."identity_id" = ?`,
-				parameters: [identityId],
-				response: { rows: [{ id: projectId, name: 'foo' }] },
-			},
 		],
 		return: {
 			data: {
@@ -74,6 +56,12 @@ test('create session key', async () => {
 				},
 			},
 		},
+		expectedAuthLog: expect.objectContaining({
+			type: 'create_session_token',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		}),
 	})
 })
 

package/tests/cases/integration/mocked/inviteMutations.test.ts

@@ -54,18 +54,6 @@ test('invite a new person', async () => {
 				getMailTemplateSql({ projectId, type: 'newUserInvited' }),
 				getMailTemplateSql({ projectId: null, type: 'newUserInvited' }),
 			),
-			disableOneOffKeySql({ id: authenticatedApiKeyId }),
-			{
-				sql: SQL`SELECT "project"."id",
-						         "project"."name",
-						         "project"."slug",
-						         "project"."config"
-					         FROM "tenant"."project"
-						              INNER JOIN "tenant"."project_member" AS "project_member" ON "project_member"."project_id" = "project"."id"
-					         WHERE "project_member"."identity_id" = ?`,
-				parameters: [identityId],
-				response: { rows: [{ id: membershipId, name: 'foo', slug: 'foo' }] },
-			},
 		],
 		sentMails: [
 			{
@@ -136,18 +124,6 @@ test('invite a new person with password reset', async () => {
 				getMailTemplateSql({ projectId, type: 'newUserInvited' }),
 				getMailTemplateSql({ projectId: null, type: 'newUserInvited' }),
 			),
-			disableOneOffKeySql({ id: authenticatedApiKeyId }),
-			{
-				sql: SQL`SELECT "project"."id",
-						         "project"."name",
-						         "project"."slug",
-						         "project"."config"
-					         FROM "tenant"."project"
-						              INNER JOIN "tenant"."project_member" AS "project_member" ON "project_member"."project_id" = "project"."id"
-					         WHERE "project_member"."identity_id" = ?`,
-				parameters: [identityId],
-				response: { rows: [{ id: membershipId, name: 'foo', slug: 'foo' }] },
-			},
 		],
 		sentMails: [
 			{

package/tests/cases/integration/mocked/signInIdpMutation.test.ts

@@ -1,6 +1,6 @@
 import { executeTenantTest } from '../../../src/testTenant'
 import { testUuid } from '../../../src/testUuid'
-import { test } from 'bun:test'
+import { expect, test } from 'bun:test'
 import { signInIDP } from './gql/signInIdp'
 import { sqlTransaction } from './sql/sqlTransaction'
 import { getIdpBySlugSql } from './sql/getIdpBySlugSql'
@@ -10,6 +10,7 @@ import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql'
 import { selectMembershipsSql } from './sql/selectMembershipsSql'
 import { createIdentitySql } from './sql/createIdentitySql'
 import { createPersonSql } from './sql/createPersonSql'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('signs in idp with existing identity', async () => {
 	const externalIdentifier = 'abcd'
@@ -57,6 +58,7 @@ test('signs in idp with existing identity', async () => {
 						roles: [],
 					},
 				}),
+				getConfigSql(),
 				createSessionKeySql({
 					apiKeyId,
 					identityId,
@@ -80,6 +82,12 @@ test('signs in idp with existing identity', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'idp_login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
 	})
 })
 
@@ -131,6 +139,7 @@ test('signs in exclusive idp', async () => {
 					parameters: [testUuid(3), idpId, personId, externalIdentifier],
 					response: { rowCount: 1 },
 				},
+				getConfigSql(),
 				createSessionKeySql({
 					apiKeyId,
 					identityId,
@@ -154,5 +163,11 @@ test('signs in exclusive idp', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'idp_login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
 	})
 })

package/tests/cases/integration/mocked/signInMutation.test.ts

@@ -5,11 +5,13 @@ import { selectMembershipsSql } from './sql/selectMembershipsSql'
 import { signInMutation } from './gql/signIn'
 import { getPersonByEmailSql } from './sql/getPersonByEmailSql'
 import { SignInErrorCode } from '../../../../src/schema'
-import { test } from 'bun:test'
+import { test, expect } from 'bun:test'
 import { OtpAuthenticator } from '../../../../src'
 import { Buffer } from 'buffer'
 import { createSessionKeySql } from './sql/createSessionKeySql'
 import { getIdentityProjectsSql } from './sql/getIdentityProjectsSql'
+import { getNextLoginAttemptSql } from './sql/getNextLoginAttemptSql'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('signs in', async () => {
 	const email = 'john@doe.com'
@@ -21,7 +23,9 @@ test('signs in', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password }, { withData: true }),
 		executes: [
+			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			getConfigSql(),
 			createSessionKeySql({ apiKeyId: apiKeyId, identityId: identityId }),
 			getIdentityProjectsSql({ identityId: identityId, projectId: projectId }),
 			selectMembershipsSql({
@@ -29,26 +33,6 @@ test('signs in', async () => {
 				projectId,
 				membershipsResponse: [{ role: 'editor', variables: [{ name: 'locale', values: ['cs'] }] }],
 			}),
-			{
-				sql: SQL`SELECT "id",
-						         "email",
-						         "identity_id"
-					         FROM "tenant"."person"
-					         WHERE "id" = ?`,
-				parameters: [personId],
-				response: { rows: [{ id: personId, email: email }] },
-			},
-			{
-				sql: SQL`SELECT "project"."id",
-						         "project"."name",
-						         "project"."slug",
-						         "project"."config"
-					         FROM "tenant"."project"
-						              INNER JOIN "tenant"."project_member" AS "project_member" ON "project_member"."project_id" = "project"."id"
-					         WHERE "project_member"."identity_id" = ?`,
-				parameters: [identityId],
-				response: { rows: [{ id: projectId, name: 'foo' }] },
-			},
 		],
 		return: {
 			data: {
@@ -78,6 +62,12 @@ test('signs in', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
 	})
 })
 
@@ -91,8 +81,10 @@ test('signs in - normalize email', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password }),
 		executes: [
+			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: null }),
 			getPersonByEmailSql({ email: 'john@doe.com', response: { personId, identityId, password, roles: [] } }),
+			getConfigSql(),
 			createSessionKeySql({ apiKeyId: apiKeyId, identityId: identityId }),
 			getIdentityProjectsSql({ identityId: identityId, projectId: projectId }),
 			selectMembershipsSql({
@@ -112,6 +104,12 @@ test('signs in - normalize email', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
 	})
 })
 
@@ -122,7 +120,11 @@ test('sign in - invalid password', async () => {
 	const personId = testUuid(7)
 	await executeTenantTest({
 		query: signInMutation({ email, password: 'abcd' }),
-		executes: [getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } })],
+		executes: [
+			getNextLoginAttemptSql(email),
+			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [] } }),
+			getConfigSql(),
+		],
 		return: {
 			data: {
 				signIn: {
@@ -132,6 +134,12 @@ test('sign in - invalid password', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		},
 	})
 })
 
@@ -143,7 +151,9 @@ test('otp token not provided', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password }),
 		executes: [
+			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: 'otpauth://totp/contember:john?secret=ABCDEFG&period=30&digits=6&algorithm=SHA1&issuer=contember' } }),
+			getConfigSql(),
 		],
 		return: {
 			data: {
@@ -154,6 +164,12 @@ test('otp token not provided', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		},
 	})
 })
 
@@ -172,7 +188,9 @@ test('sign in - invalid otp token', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password, otpToken: '123456' }),
 		executes: [
+			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			getConfigSql(),
 		],
 		return: {
 			data: {
@@ -183,6 +201,12 @@ test('sign in - invalid otp token', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: false,
+			}),
+		},
 	})
 })
 
@@ -201,7 +225,9 @@ test('sign in - valid otp token', async () => {
 	await executeTenantTest({
 		query: signInMutation({ email, password, otpToken: otpAuth.generate(otp) }),
 		executes: [
+			getNextLoginAttemptSql(email),
 			getPersonByEmailSql({ email, response: { personId, identityId, password, roles: [], otpUri: otp.uri } }),
+			getConfigSql(),
 			createSessionKeySql({ apiKeyId, identityId }),
 			getIdentityProjectsSql({ identityId, projectId }),
 			selectMembershipsSql({
@@ -221,6 +247,12 @@ test('sign in - valid otp token', async () => {
 				},
 			},
 		},
+		expectedAuthLog: {
+			type: 'login',
+			response: expect.objectContaining({
+				ok: true,
+			}),
+		},
 	})
 })
 

package/tests/cases/integration/mocked/signOutMutation.test.ts

@@ -109,11 +109,6 @@ test('sign out - permanent api key', async () => {
 				apiKeyId: authenticatedApiKeyId,
 				response: { personId: personId, identityId: authenticatedIdentityId, apiKeyType: ApiKey.Type.PERMANENT },
 			}),
-			{
-				sql: SQL`update "tenant"."api_key" set "disabled_at" = ? where "identity_id" = ?`,
-				parameters: [(val: any) => val instanceof Date, identityId],
-				response: { rowCount: 1 },
-			},
 		],
 		return: {
 			data: {

package/tests/cases/integration/mocked/signUpMutation.test.ts

@@ -8,10 +8,11 @@ import { getPersonByEmailSql } from './sql/getPersonByEmailSql'
 import { sqlTransaction } from './sql/sqlTransaction'
 import { disableOneOffKeySql } from './sql/disableOneOffKeySql'
 import { test } from 'bun:test'
+import { getConfigSql } from './sql/getConfigSql'
 
 test('signs up a new user', async () => {
 	const email = 'john@doe.com'
-	const password = '123456'
+	const password = 'Ab1Cd23456'
 	const identityId = testUuid(1)
 	const personId = testUuid(2)
 	const projectId = testUuid(3)
@@ -19,6 +20,7 @@ test('signs up a new user', async () => {
 		query: signUpMutation({ email, password }),
 		executes: [
 			getPersonByEmailSql({ email, response: null }),
+			getConfigSql(),
 			...sqlTransaction(
 				createIdentitySql({ identityId, roles: ['person'] }),
 				createPersonSql({ personId, email, password, identityId }),
@@ -29,17 +31,6 @@ test('signs up a new user', async () => {
 				parameters: [testUuid(1)],
 				response: { rows: [{ id: testUuid(1), description: '', roles: ['person'] }] },
 			},
-			{
-				sql: SQL`select
-                       "project"."id",
-                       "project"."name",
-                       "project"."slug"
-                     from "tenant"."project"
-                       inner join "tenant"."project_member" as "project_member" on "project_member"."project_id" = "project"."id"
-                     where "project_member"."identity_id" = ?`,
-				parameters: [identityId],
-				response: { rows: [{ id: projectId, name: 'foo', slug: 'foo' }] },
-			},
 		],
 		return: {
 			data: {

package/tests/cases/integration/mocked/sql/createSessionKeySql.ts

@@ -12,7 +12,7 @@ export const createSessionKeySql = function ({ apiKeyId, identityId }: { apiKeyI
 			identityId,
 			null,
 			new Date('2019-09-04 12:30'),
-			null,
+			30,
 			new Date('2019-09-04 12:00'),
 		],
 		response: { rowCount: 1 },

package/tests/cases/integration/mocked/sql/getConfigSql.ts

@@ -0,0 +1,29 @@
+import { ExpectedQuery } from '@contember/database-tester/src'
+import PostgresInterval from 'postgres-interval'
+export const getConfigSql = (): ExpectedQuery => ({
+	sql: `select *  from "tenant"."config"`,
+	parameters: [],
+	response: {
+		rows: [
+			{
+				id: 'b65949a6-b481-40b5-a0ed-0acdb5a24cb6',
+				passwordless_enabled: 'never',
+				passwordless_url: null,
+				passwordless_expiration: PostgresInterval('00:10:00'),
+				password_min_length: 6,
+				password_require_uppercase: 1,
+				password_require_lowercase: 1,
+				password_require_digit: 1,
+				password_require_special: 0,
+				password_pattern: null,
+				password_check_blacklist: true,
+				login_base_backoff: PostgresInterval('00:00:01'),
+				login_max_backoff: PostgresInterval('00:01:00'),
+				login_attempt_window: PostgresInterval('00:05:00'),
+				login_reveal_user_exits: true,
+				login_default_token_expiration: PostgresInterval('00:30:00'),
+				login_max_token_expiration: PostgresInterval('12:00:00'),
+			},
+		],
+	},
+})

package/tests/cases/integration/mocked/sql/getNextLoginAttemptSql.ts

@@ -0,0 +1,20 @@
+import { ExpectedQuery } from '@contember/database-tester'
+
+export const getNextLoginAttemptSql = (email: string): ExpectedQuery => ({
+	sql: `with "cfg" as (select *  from "tenant"."config"), "last_successful_reset" as (select MAX(person_auth_log.created_at) as "created_at"  from "tenant"."person_auth_log" inner join  "tenant"."person" as "person" on  "person"."id" = "person_auth_log"."person_id"  where "type" = ? and "success" = ? and "email" = ?), "window_start" as (select
+                                        GREATEST(
+                                                COALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window),
+                                                NOW() - cfg.login_attempt_window
+                                        ) as "start_time"  from "cfg", "last_successful_reset"), "failed_logins" as (select COUNT(*) as "fails", MAX(person_auth_log.created_at) as "last_fail"  from "tenant"."person_auth_log", "window_start"  where "person_input_identifier" = ? and "type" = ? and "success" = ? and person_auth_log.created_at >= window_start.start_time) select
+                                CASE WHEN failed_logins.fails = 0
+                                THEN NOW()
+                                ELSE LEAST(
+                                        failed_logins.last_fail + cfg.login_max_backoff,
+                                        failed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))
+                                ) END as "next_allowed_login"  from "failed_logins", "cfg"`,
+	parameters: ['password_reset', true, email, email, 'login', false],
+	response: {
+		rows: [
+		],
+	},
+})

package/tests/src/testTenant.ts

@@ -22,12 +22,15 @@ import { dbCredentials } from './dbUtils'
 import { IdPMock } from './IdPMock'
 import { createLogger, JsonStreamLoggerHandler } from '@contember/logger'
 import { emptySchema } from '@contember/schema-utils'
+import { expect } from 'bun:test'
+import { AuthLogService } from '../../src/model/service/AuthLogService'
 
 export interface Test {
 	query: GraphQLTestQuery
 	executes: ExpectedQuery[]
 	return: object
 	sentMails?: ExpectedMessage[]
+	expectedAuthLog?: AuthLogService.LogArgs
 }
 
 export const createUuidGenerator = () => {
@@ -114,6 +117,14 @@ export const executeTenantTest = async (test: Test) => {
 			authenticatedApiKeyId,
 		),
 		logger: createLogger(new JsonStreamLoggerHandler(process.stderr)),
+		logAuthAction: async args => {
+			if (!test.expectedAuthLog) {
+				console.log(JSON.stringify(args))
+				throw new Error('No expected auth log')
+			}
+			expect(args).toEqual(test.expectedAuthLog)
+			test.expectedAuthLog = undefined
+		},
 		db: databaseContext,
 	}
 
@@ -135,4 +146,6 @@ export const executeTenantTest = async (test: Test) => {
 		mailer.expectMessage(email)
 	}
 	mailer.expectEmpty()
+	expect(test.executes).toHaveLength(0)
+	expect(test.expectedAuthLog).toBeUndefined()
 }

package/dist/development/src/model/utils/password.cjs

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const MIN_PASSWORD_LENGTH = 6;
-const getPasswordWeaknessMessage = (password) => {
-  if (password.length < MIN_PASSWORD_LENGTH) {
-    return `Password is too weak. Minimum length is ${MIN_PASSWORD_LENGTH}`;
-  }
-  return null;
-};
-exports.MIN_PASSWORD_LENGTH = MIN_PASSWORD_LENGTH;
-exports.getPasswordWeaknessMessage = getPasswordWeaknessMessage;
-//# sourceMappingURL=password.cjs.map

package/dist/development/src/model/utils/password.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"password.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/password.ts"],"sourcesContent":["export const MIN_PASSWORD_LENGTH = 6\nexport const isWeakPassword = (password: string) => password.length < MIN_PASSWORD_LENGTH\nexport const getPasswordWeaknessMessage = (password: string): null | string => {\n\tif (password.length < MIN_PASSWORD_LENGTH) {\n\t\treturn `Password is too weak. Minimum length is ${MIN_PASSWORD_LENGTH}`\n\t}\n\treturn null\n}\n"],"names":[],"mappings":";;AAAO,MAAM,sBAAsB;AAEtB,MAAA,6BAA6B,CAAC,aAAoC;AAC1E,MAAA,SAAS,SAAS,qBAAqB;AAC1C,WAAO,2CAA2C,mBAAmB;AAAA,EAAA;AAE/D,SAAA;AACR;;;"}

package/dist/development/src/model/utils/password.js

@@ -1,12 +0,0 @@
-const MIN_PASSWORD_LENGTH = 6;
-const getPasswordWeaknessMessage = (password) => {
-  if (password.length < MIN_PASSWORD_LENGTH) {
-    return `Password is too weak. Minimum length is ${MIN_PASSWORD_LENGTH}`;
-  }
-  return null;
-};
-export {
-  MIN_PASSWORD_LENGTH,
-  getPasswordWeaknessMessage
-};
-//# sourceMappingURL=password.js.map

package/dist/development/src/model/utils/password.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"password.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/password.ts"],"sourcesContent":["export const MIN_PASSWORD_LENGTH = 6\nexport const isWeakPassword = (password: string) => password.length < MIN_PASSWORD_LENGTH\nexport const getPasswordWeaknessMessage = (password: string): null | string => {\n\tif (password.length < MIN_PASSWORD_LENGTH) {\n\t\treturn `Password is too weak. Minimum length is ${MIN_PASSWORD_LENGTH}`\n\t}\n\treturn null\n}\n"],"names":[],"mappings":"AAAO,MAAM,sBAAsB;AAEtB,MAAA,6BAA6B,CAAC,aAAoC;AAC1E,MAAA,SAAS,SAAS,qBAAqB;AAC1C,WAAO,2CAA2C,mBAAmB;AAAA,EAAA;AAE/D,SAAA;AACR;"}

package/dist/development/src/model/utils/tokenUtils.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"tokenUtils.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/tokenUtils.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { FixedLengthHexString, isFixedLengthHexString } from './typeUtils'\nimport { PersonToken } from '../type'\nimport { ImplementationException } from '../../exceptions'\nimport { Response, ResponseError, ResponseOk } from './Response'\n\nexport const generateToken = async (generator: {\n\trandomBytes: (bytes: number) => Promise<Buffer>\n}): Promise<string> => {\n\treturn (await generator.randomBytes(20)).toString('hex')\n}\n\nexport type TokenHash = FixedLengthHexString<64>\n\nexport const computeTokenHash = (token: string): TokenHash => {\n\treturn crypto //\n\t\t.createHash('sha256')\n\t\t.update(token, 'ascii')\n\t\t.digest('hex') as TokenHash\n}\n\nexport const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)\n\n\nconst MAX_OTP_ATTEMPTS = 3\n\nexport const validateToken = ({ entry, validationType, token, now }: {\n\tentry: PersonToken.Row | null\n\tvalidationType: PersonToken.ValidationType\n\ttoken: string\n\tnow: Date\n}): Response<PersonToken.Row, PersonToken.TokenValidationError> => {\n\tif (!entry) {\n\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found')\n\t}\n\tif (validationType === 'otp' && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'OTP attempts exceeded')\n\t}\n\tswitch (validationType) {\n\t\tcase 'token':\n\t\t\tif (entry.otp_hash !== null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'The token was exchanged for OTP')\n\t\t\t}\n\t\t\tif (entry.token_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'Token invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tcase 'otp':\n\t\t\tif (entry.otp_hash === null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP not set')\n\t\t\t}\n\t\t\tif (entry.otp_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tdefault:\n\t\t\tthrow new ImplementationException()\n\t}\n\tif (entry.used_at) {\n\t\treturn new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())\n\t}\n\tif (entry.expires_at < now) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())\n\t}\n\treturn new ResponseOk(entry)\n}\n"],"names":["isFixedLengthHexString","ResponseError","ImplementationException","ResponseOk"],"mappings":";;;;;;AAMa,MAAA,gBAAgB,OAAO,cAEb;AACtB,UAAQ,MAAM,UAAU,YAAY,EAAE,GAAG,SAAS,KAAK;AACxD;AAIa,MAAA,mBAAmB,CAAC,UAA6B;AACtD,SAAA,OACL,WAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,EACrB,OAAO,KAAK;AACf;AAEO,MAAM,cAAc,CAAC,UAAsCA,UAAA,uBAAuB,OAAO,EAAE;AAGlG,MAAM,mBAAmB;AAElB,MAAM,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAKK;AAClE,MAAI,CAAC,OAAO;AACJ,WAAA,IAAIC,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,EAAA;AAE9D,MAAI,mBAAmB,SAAS,MAAM,gBAAgB,kBAAkB;AAChE,WAAA,IAAIA,SAAAA,cAAc,iBAAiB,uBAAuB;AAAA,EAAA;AAElE,UAAQ,gBAAgB;AAAA,IACvB,KAAK;AACA,UAAA,MAAM,aAAa,MAAM;AACrB,eAAA,IAAIA,SAAAA,cAAc,iBAAiB,iCAAiC;AAAA,MAAA;AAE5E,UAAI,MAAM,eAAe,iBAAiB,KAAK,GAAG;AAC1C,eAAA,IAAIA,SAAAA,cAAc,iBAAiB,eAAe;AAAA,MAAA;AAE1D;AAAA,IACD,KAAK;AACA,UAAA,MAAM,aAAa,MAAM;AACrB,eAAA,IAAIA,SAAAA,cAAc,iBAAiB,aAAa;AAAA,MAAA;AAExD,UAAI,MAAM,aAAa,iBAAiB,KAAK,GAAG;AACxC,eAAA,IAAIA,SAAAA,cAAc,iBAAiB,aAAa;AAAA,MAAA;AAExD;AAAA,IACD;AACC,YAAM,IAAIC,WAAAA,wBAAwB;AAAA,EAAA;AAEpC,MAAI,MAAM,SAAS;AAClB,WAAO,IAAID,SAAc,cAAA,cAAc,mBAAmB,MAAM,QAAQ,aAAa;AAAA,EAAA;AAElF,MAAA,MAAM,aAAa,KAAK;AAC3B,WAAO,IAAIA,SAAc,cAAA,iBAAiB,sBAAsB,MAAM,WAAW,aAAa;AAAA,EAAA;AAExF,SAAA,IAAIE,oBAAW,KAAK;AAC5B;;;;;"}

package/dist/development/src/model/utils/tokenUtils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"tokenUtils.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/tokenUtils.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { FixedLengthHexString, isFixedLengthHexString } from './typeUtils'\nimport { PersonToken } from '../type'\nimport { ImplementationException } from '../../exceptions'\nimport { Response, ResponseError, ResponseOk } from './Response'\n\nexport const generateToken = async (generator: {\n\trandomBytes: (bytes: number) => Promise<Buffer>\n}): Promise<string> => {\n\treturn (await generator.randomBytes(20)).toString('hex')\n}\n\nexport type TokenHash = FixedLengthHexString<64>\n\nexport const computeTokenHash = (token: string): TokenHash => {\n\treturn crypto //\n\t\t.createHash('sha256')\n\t\t.update(token, 'ascii')\n\t\t.digest('hex') as TokenHash\n}\n\nexport const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)\n\n\nconst MAX_OTP_ATTEMPTS = 3\n\nexport const validateToken = ({ entry, validationType, token, now }: {\n\tentry: PersonToken.Row | null\n\tvalidationType: PersonToken.ValidationType\n\ttoken: string\n\tnow: Date\n}): Response<PersonToken.Row, PersonToken.TokenValidationError> => {\n\tif (!entry) {\n\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found')\n\t}\n\tif (validationType === 'otp' && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'OTP attempts exceeded')\n\t}\n\tswitch (validationType) {\n\t\tcase 'token':\n\t\t\tif (entry.otp_hash !== null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'The token was exchanged for OTP')\n\t\t\t}\n\t\t\tif (entry.token_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'Token invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tcase 'otp':\n\t\t\tif (entry.otp_hash === null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP not set')\n\t\t\t}\n\t\t\tif (entry.otp_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tdefault:\n\t\t\tthrow new ImplementationException()\n\t}\n\tif (entry.used_at) {\n\t\treturn new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())\n\t}\n\tif (entry.expires_at < now) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())\n\t}\n\treturn new ResponseOk(entry)\n}\n"],"names":["crypto"],"mappings":";;;;AAMa,MAAA,gBAAgB,OAAO,cAEb;AACtB,UAAQ,MAAM,UAAU,YAAY,EAAE,GAAG,SAAS,KAAK;AACxD;AAIa,MAAA,mBAAmB,CAAC,UAA6B;AACtD,SAAAA,gBACL,WAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,EACrB,OAAO,KAAK;AACf;AAEO,MAAM,cAAc,CAAC,UAAsC,uBAAuB,OAAO,EAAE;AAGlG,MAAM,mBAAmB;AAElB,MAAM,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAKK;AAClE,MAAI,CAAC,OAAO;AACJ,WAAA,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,EAAA;AAE9D,MAAI,mBAAmB,SAAS,MAAM,gBAAgB,kBAAkB;AAChE,WAAA,IAAI,cAAc,iBAAiB,uBAAuB;AAAA,EAAA;AAElE,UAAQ,gBAAgB;AAAA,IACvB,KAAK;AACA,UAAA,MAAM,aAAa,MAAM;AACrB,eAAA,IAAI,cAAc,iBAAiB,iCAAiC;AAAA,MAAA;AAE5E,UAAI,MAAM,eAAe,iBAAiB,KAAK,GAAG;AAC1C,eAAA,IAAI,cAAc,iBAAiB,eAAe;AAAA,MAAA;AAE1D;AAAA,IACD,KAAK;AACA,UAAA,MAAM,aAAa,MAAM;AACrB,eAAA,IAAI,cAAc,iBAAiB,aAAa;AAAA,MAAA;AAExD,UAAI,MAAM,aAAa,iBAAiB,KAAK,GAAG;AACxC,eAAA,IAAI,cAAc,iBAAiB,aAAa;AAAA,MAAA;AAExD;AAAA,IACD;AACC,YAAM,IAAI,wBAAwB;AAAA,EAAA;AAEpC,MAAI,MAAM,SAAS;AAClB,WAAO,IAAI,cAAc,cAAc,mBAAmB,MAAM,QAAQ,aAAa;AAAA,EAAA;AAElF,MAAA,MAAM,aAAa,KAAK;AAC3B,WAAO,IAAI,cAAc,iBAAiB,sBAAsB,MAAM,WAAW,aAAa;AAAA,EAAA;AAExF,SAAA,IAAI,WAAW,KAAK;AAC5B;"}

package/dist/development/src/model/utils/typeUtils.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"typeUtils.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/typeUtils.ts"],"sourcesContent":["export type FixedLengthHexString<Length extends number> = string & { __brand: `hexstring_${Length}` }\n\nconst isHex = /^[a-f0-9]+$/\n\nexport const isFixedLengthHexString = <Length extends number>(input: string, length: Length): input is FixedLengthHexString<Length> => (\n\tinput.length === length && input.match(isHex) !== null\n)\n"],"names":[],"mappings":";;AAEA,MAAM,QAAQ;AAED,MAAA,yBAAyB,CAAwB,OAAe,WAC5E,MAAM,WAAW,UAAU,MAAM,MAAM,KAAK,MAAM;;"}

package/dist/development/src/model/utils/typeUtils.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"typeUtils.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/typeUtils.ts"],"sourcesContent":["export type FixedLengthHexString<Length extends number> = string & { __brand: `hexstring_${Length}` }\n\nconst isHex = /^[a-f0-9]+$/\n\nexport const isFixedLengthHexString = <Length extends number>(input: string, length: Length): input is FixedLengthHexString<Length> => (\n\tinput.length === length && input.match(isHex) !== null\n)\n"],"names":[],"mappings":"AAEA,MAAM,QAAQ;AAED,MAAA,yBAAyB,CAAwB,OAAe,WAC5E,MAAM,WAAW,UAAU,MAAM,MAAM,KAAK,MAAM;"}

package/dist/production/src/model/utils/password.cjs

@@ -1,12 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const MIN_PASSWORD_LENGTH = 6;
-const getPasswordWeaknessMessage = (password) => {
-  if (password.length < MIN_PASSWORD_LENGTH) {
-    return `Password is too weak. Minimum length is ${MIN_PASSWORD_LENGTH}`;
-  }
-  return null;
-};
-exports.MIN_PASSWORD_LENGTH = MIN_PASSWORD_LENGTH;
-exports.getPasswordWeaknessMessage = getPasswordWeaknessMessage;
-//# sourceMappingURL=password.cjs.map

package/dist/production/src/model/utils/password.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"password.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/password.ts"],"sourcesContent":["export const MIN_PASSWORD_LENGTH = 6\nexport const isWeakPassword = (password: string) => password.length < MIN_PASSWORD_LENGTH\nexport const getPasswordWeaknessMessage = (password: string): null | string => {\n\tif (password.length < MIN_PASSWORD_LENGTH) {\n\t\treturn `Password is too weak. Minimum length is ${MIN_PASSWORD_LENGTH}`\n\t}\n\treturn null\n}\n"],"names":[],"mappings":";;AAAO,MAAM,sBAAsB;AAEtB,MAAA,6BAA6B,CAAC,aAAoC;AAC1E,MAAA,SAAS,SAAS,qBAAqB;AAC1C,WAAO,2CAA2C,mBAAmB;AAAA,EAAA;AAE/D,SAAA;AACR;;;"}

package/dist/production/src/model/utils/password.js

@@ -1,12 +0,0 @@
-const MIN_PASSWORD_LENGTH = 6;
-const getPasswordWeaknessMessage = (password) => {
-  if (password.length < MIN_PASSWORD_LENGTH) {
-    return `Password is too weak. Minimum length is ${MIN_PASSWORD_LENGTH}`;
-  }
-  return null;
-};
-export {
-  MIN_PASSWORD_LENGTH,
-  getPasswordWeaknessMessage
-};
-//# sourceMappingURL=password.js.map

package/dist/production/src/model/utils/password.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"password.js","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/password.ts"],"sourcesContent":["export const MIN_PASSWORD_LENGTH = 6\nexport const isWeakPassword = (password: string) => password.length < MIN_PASSWORD_LENGTH\nexport const getPasswordWeaknessMessage = (password: string): null | string => {\n\tif (password.length < MIN_PASSWORD_LENGTH) {\n\t\treturn `Password is too weak. Minimum length is ${MIN_PASSWORD_LENGTH}`\n\t}\n\treturn null\n}\n"],"names":[],"mappings":"AAAO,MAAM,sBAAsB;AAEtB,MAAA,6BAA6B,CAAC,aAAoC;AAC1E,MAAA,SAAS,SAAS,qBAAqB;AAC1C,WAAO,2CAA2C,mBAAmB;AAAA,EAAA;AAE/D,SAAA;AACR;"}

package/dist/production/src/model/utils/tokenUtils.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"tokenUtils.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/utils/tokenUtils.ts"],"sourcesContent":["import crypto from 'node:crypto'\nimport { FixedLengthHexString, isFixedLengthHexString } from './typeUtils'\nimport { PersonToken } from '../type'\nimport { ImplementationException } from '../../exceptions'\nimport { Response, ResponseError, ResponseOk } from './Response'\n\nexport const generateToken = async (generator: {\n\trandomBytes: (bytes: number) => Promise<Buffer>\n}): Promise<string> => {\n\treturn (await generator.randomBytes(20)).toString('hex')\n}\n\nexport type TokenHash = FixedLengthHexString<64>\n\nexport const computeTokenHash = (token: string): TokenHash => {\n\treturn crypto //\n\t\t.createHash('sha256')\n\t\t.update(token, 'ascii')\n\t\t.digest('hex') as TokenHash\n}\n\nexport const isTokenHash = (token: string): token is TokenHash => isFixedLengthHexString(token, 64)\n\n\nconst MAX_OTP_ATTEMPTS = 3\n\nexport const validateToken = ({ entry, validationType, token, now }: {\n\tentry: PersonToken.Row | null\n\tvalidationType: PersonToken.ValidationType\n\ttoken: string\n\tnow: Date\n}): Response<PersonToken.Row, PersonToken.TokenValidationError> => {\n\tif (!entry) {\n\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found')\n\t}\n\tif (validationType === 'otp' && entry.otp_attempts >= MAX_OTP_ATTEMPTS) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'OTP attempts exceeded')\n\t}\n\tswitch (validationType) {\n\t\tcase 'token':\n\t\t\tif (entry.otp_hash !== null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'The token was exchanged for OTP')\n\t\t\t}\n\t\t\tif (entry.token_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'Token invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tcase 'otp':\n\t\t\tif (entry.otp_hash === null) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP not set')\n\t\t\t}\n\t\t\tif (entry.otp_hash !== computeTokenHash(token)) {\n\t\t\t\treturn new ResponseError('TOKEN_INVALID', 'OTP invalid')\n\t\t\t}\n\t\t\tbreak\n\t\tdefault:\n\t\t\tthrow new ImplementationException()\n\t}\n\tif (entry.used_at) {\n\t\treturn new ResponseError('TOKEN_USED', 'Token used at ' + entry.used_at.toISOString())\n\t}\n\tif (entry.expires_at < now) {\n\t\treturn new ResponseError('TOKEN_EXPIRED', 'Token expired at ' + entry.expires_at.toISOString())\n\t}\n\treturn new ResponseOk(entry)\n}\n"],"names":["isFixedLengthHexString","ResponseError","ImplementationException","ResponseOk"],"mappings":";;;;;;AAMa,MAAA,gBAAgB,OAAO,cAEb;AACtB,UAAQ,MAAM,UAAU,YAAY,EAAE,GAAG,SAAS,KAAK;AACxD;AAIa,MAAA,mBAAmB,CAAC,UAA6B;AACtD,SAAA,OACL,WAAW,QAAQ,EACnB,OAAO,OAAO,OAAO,EACrB,OAAO,KAAK;AACf;AAEO,MAAM,cAAc,CAAC,UAAsCA,UAAA,uBAAuB,OAAO,EAAE;AAGlG,MAAM,mBAAmB;AAElB,MAAM,gBAAgB,CAAC,EAAE,OAAO,gBAAgB,OAAO,UAKK;AAClE,MAAI,CAAC,OAAO;AACJ,WAAA,IAAIC,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,EAAA;AAE9D,MAAI,mBAAmB,SAAS,MAAM,gBAAgB,kBAAkB;AAChE,WAAA,IAAIA,SAAAA,cAAc,iBAAiB,uBAAuB;AAAA,EAAA;AAElE,UAAQ,gBAAgB;AAAA,IACvB,KAAK;AACA,UAAA,MAAM,aAAa,MAAM;AACrB,eAAA,IAAIA,SAAAA,cAAc,iBAAiB,iCAAiC;AAAA,MAAA;AAE5E,UAAI,MAAM,eAAe,iBAAiB,KAAK,GAAG;AAC1C,eAAA,IAAIA,SAAAA,cAAc,iBAAiB,eAAe;AAAA,MAAA;AAE1D;AAAA,IACD,KAAK;AACA,UAAA,MAAM,aAAa,MAAM;AACrB,eAAA,IAAIA,SAAAA,cAAc,iBAAiB,aAAa;AAAA,MAAA;AAExD,UAAI,MAAM,aAAa,iBAAiB,KAAK,GAAG;AACxC,eAAA,IAAIA,SAAAA,cAAc,iBAAiB,aAAa;AAAA,MAAA;AAExD;AAAA,IACD;AACC,YAAM,IAAIC,WAAAA,wBAAwB;AAAA,EAAA;AAEpC,MAAI,MAAM,SAAS;AAClB,WAAO,IAAID,SAAc,cAAA,cAAc,mBAAmB,MAAM,QAAQ,aAAa;AAAA,EAAA;AAElF,MAAA,MAAM,aAAa,KAAK;AAC3B,WAAO,IAAIA,SAAc,cAAA,iBAAiB,sBAAsB,MAAM,WAAW,aAAa;AAAA,EAAA;AAExF,SAAA,IAAIE,oBAAW,KAAK;AAC5B;;;;;"}