@contember/engine-tenant-api 2.1.0-alpha.2 → 2.1.0-alpha.21

package/dist/development/src/migrations/snapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\nimport { createCredentials } from './tenantCredentials'\n\nexport default async function (builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"config_policy\" AS ENUM (\n    'always',\n    'never',\n    'optIn',\n    'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n    'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n    'password_reset',\n    'passwordless'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"expiration\" integer,\n    \"disabled_at\" timestamp with time zone\n);\nCREATE TABLE \"config\" (\n    \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n    \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n    \"passwordless_url\" \"text\",\n    \"passwordless_expiration_minutes\" integer DEFAULT 5 NOT NULL\n);\nCREATE TABLE \"identity\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"parent_id\" \"uuid\",\n    \"roles\" \"jsonb\" NOT NULL,\n    \"description\" \"text\",\n    \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"configuration\" \"jsonb\" NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n    \"exclusive\" boolean DEFAULT false,\n    \"init_returns_config\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\",\n    \"mail_type\" \"text\" NOT NULL,\n    \"variant\" \"text\" NOT NULL,\n    \"subject\" \"text\" NOT NULL,\n    \"content\" \"text\" NOT NULL,\n    \"use_layout\" boolean NOT NULL,\n    \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"email\" \"text\",\n    \"password_hash\" \"text\",\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"otp_uri\" \"text\",\n    \"otp_activated_at\" timestamp with time zone,\n    \"name\" \"text\",\n    \"idp_only\" boolean DEFAULT false NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"passwordless_enabled\" boolean,\n    CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"identity_provider_id\" \"uuid\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_token\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"used_at\" timestamp with time zone,\n    \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n    \"otp_hash\" \"text\",\n    \"otp_attempts\" integer DEFAULT 0 NOT NULL\n);\nCREATE TABLE \"project\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"name\" \"text\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n    \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"membership_id\" \"uuid\" NOT NULL,\n    \"variable\" \"text\" NOT NULL,\n    \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"key\" \"text\" NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"updated_at\" timestamp with time zone NOT NULL,\n    \"value\" \"bytea\" NOT NULL,\n    \"version\" smallint NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n    ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n    ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA+B,SAA2B,MAA2B;AACpF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAgOZ;AAEM,QAAA,kBAAkB,SAAS,IAAI;AACtC;"}
+{"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\nimport { createCredentials } from './tenantCredentials'\n\nexport default async function (builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n    'login',\n    'create_session_token',\n    'idp_login',\n    'password_reset_init',\n    'password_reset',\n    'password_change',\n    'email_change',\n    '2fa_disable',\n    '2fa_enable',\n    'passwordless_login_init',\n    'passwordless_login_exchange',\n    'passwordless_login',\n    'person_disable'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n    'always',\n    'never',\n    'optIn',\n    'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n    'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n    'password_reset',\n    'passwordless'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"expiration\" integer,\n    \"disabled_at\" timestamp with time zone\n);\nCREATE TABLE \"config\" (\n    \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n    \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n    \"passwordless_url\" \"text\",\n    \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n    \"password_min_length\" integer DEFAULT 8 NOT NULL,\n    \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n    \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n    \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n    \"password_require_special\" integer DEFAULT 0 NOT NULL,\n    \"password_pattern\" \"text\",\n    \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n    \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n    \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n    \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n    \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n    \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n    \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval\n);\nCREATE TABLE \"identity\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"parent_id\" \"uuid\",\n    \"roles\" \"jsonb\" NOT NULL,\n    \"description\" \"text\",\n    \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"configuration\" \"jsonb\" NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n    \"exclusive\" boolean DEFAULT false,\n    \"init_returns_config\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\",\n    \"mail_type\" \"text\" NOT NULL,\n    \"variant\" \"text\" NOT NULL,\n    \"subject\" \"text\" NOT NULL,\n    \"content\" \"text\" NOT NULL,\n    \"use_layout\" boolean NOT NULL,\n    \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"email\" \"text\",\n    \"password_hash\" \"text\",\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"otp_uri\" \"text\",\n    \"otp_activated_at\" timestamp with time zone,\n    \"name\" \"text\",\n    \"idp_only\" boolean DEFAULT false NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"passwordless_enabled\" boolean,\n    CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"invoked_by_id\" \"uuid\",\n    \"person_id\" \"uuid\",\n    \"person_token_id\" \"uuid\",\n    \"person_input_identifier\" \"text\",\n    \"type\" \"auth_log_type\" NOT NULL,\n    \"success\" boolean NOT NULL,\n    \"error_code\" \"text\",\n    \"error_message\" \"text\",\n    \"ip_address\" \"inet\",\n    \"user_agent\" \"text\",\n    \"identity_provider_id\" \"uuid\",\n    \"metadata\" \"jsonb\"\n);\nCREATE TABLE \"person_identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"identity_provider_id\" \"uuid\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_token\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"used_at\" timestamp with time zone,\n    \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n    \"otp_hash\" \"text\",\n    \"otp_attempts\" integer DEFAULT 0 NOT NULL\n);\nCREATE TABLE \"project\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"name\" \"text\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n    \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"membership_id\" \"uuid\" NOT NULL,\n    \"variable\" \"text\" NOT NULL,\n    \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"key\" \"text\" NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"updated_at\" timestamp with time zone NOT NULL,\n    \"value\" \"bytea\" NOT NULL,\n    \"version\" smallint NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n    ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n    ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC);\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA+B,SAA2B,MAA2B;AACpF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAuRZ;AAEM,QAAA,kBAAkB,SAAS,IAAI;AACtC;"}

package/dist/development/src/model/authorization/MembershipMatcher.cjs

@@ -6,6 +6,12 @@ class MembershipMatcher {
   }
   matches(membership) {
     return this.memberships.some((invokerMembership) => {
+      if (invokerMembership.matchRule === true) {
+        return true;
+      }
+      if (!invokerMembership.matchRule) {
+        return false;
+      }
       const matchRule = invokerMembership.matchRule[membership.role];
       if (!matchRule) {
         return false;

package/dist/development/src/model/authorization/MembershipMatcher.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipMatcher.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/MembershipMatcher.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport type MembershipWithSubMembershipMatchRules =\n\t& Acl.Membership\n\t& {\n\t\tmatchRule: Acl.MembershipMatchRule\n\t}\n\nexport class MembershipMatcher {\n\tconstructor(private readonly memberships: readonly MembershipWithSubMembershipMatchRules[]) {\n\t}\n\n\tmatches(membership: Acl.Membership): boolean {\n\t\treturn this.memberships.some(invokerMembership => {\n\t\t\tconst matchRule = invokerMembership.matchRule[membership.role]\n\t\t\tif (!matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tconst variables = matchRule?.variables\n\t\t\tif (variables === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\treturn membership.variables.every(variable => {\n\t\t\t\tconst sourceVariableRule = variables?.[variable.name]\n\t\t\t\tif (!sourceVariableRule) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (sourceVariableRule === true) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t\tconst sourceVariable = invokerMembership.variables.find(it => typeof sourceVariableRule === 'string' && it.name === sourceVariableRule)\n\t\t\t\tif (!sourceVariable) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tconst sourceValues = new Set(sourceVariable.values)\n\t\t\t\treturn variable.values.every(it => sourceValues.has(it))\n\t\t\t})\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;AAQO,MAAM,kBAAkB;AAAA,EAC9B,YAA6B,aAA+D;AAA/D,SAAA,cAAA;AAAA,EAAA;AAAA,EAG7B,QAAQ,YAAqC;AACrC,WAAA,KAAK,YAAY,KAAK,CAAqB,sBAAA;AACjD,YAAM,YAAY,kBAAkB,UAAU,WAAW,IAAI;AAC7D,UAAI,CAAC,WAAW;AACR,eAAA;AAAA,MAAA;AAER,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAER,YAAM,YAAY,WAAW;AAC7B,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAED,aAAA,WAAW,UAAU,MAAM,CAAY,aAAA;AACvC,cAAA,qBAAqB,YAAY,SAAS,IAAI;AACpD,YAAI,CAAC,oBAAoB;AACjB,iBAAA;AAAA,QAAA;AAER,YAAI,uBAAuB,MAAM;AACzB,iBAAA;AAAA,QAAA;AAEF,cAAA,iBAAiB,kBAAkB,UAAU,KAAK,CAAA,OAAM,OAAO,uBAAuB,YAAY,GAAG,SAAS,kBAAkB;AACtI,YAAI,CAAC,gBAAgB;AACb,iBAAA;AAAA,QAAA;AAER,cAAM,eAAe,IAAI,IAAI,eAAe,MAAM;AAClD,eAAO,SAAS,OAAO,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AAAA,MAAA,CACvD;AAAA,IAAA,CACD;AAAA,EAAA;AAEH;;"}
+{"version":3,"file":"MembershipMatcher.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/MembershipMatcher.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport type MembershipWithSubMembershipMatchRules =\n\t& Acl.Membership\n\t& {\n\t\tmatchRule: Acl.MembershipMatchRule\n\t}\n\nexport class MembershipMatcher {\n\tconstructor(private readonly memberships: readonly MembershipWithSubMembershipMatchRules[]) {\n\t}\n\n\tmatches(membership: Acl.Membership): boolean {\n\t\treturn this.memberships.some(invokerMembership => {\n\t\t\tif (invokerMembership.matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tif (!invokerMembership.matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst matchRule = invokerMembership.matchRule[membership.role]\n\t\t\tif (!matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tconst variables = matchRule?.variables\n\t\t\tif (variables === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\treturn membership.variables.every(variable => {\n\t\t\t\tconst sourceVariableRule = variables?.[variable.name]\n\t\t\t\tif (!sourceVariableRule) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (sourceVariableRule === true) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t\tconst sourceVariable = invokerMembership.variables.find(it => typeof sourceVariableRule === 'string' && it.name === sourceVariableRule)\n\t\t\t\tif (!sourceVariable) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tconst sourceValues = new Set(sourceVariable.values)\n\t\t\t\treturn variable.values.every(it => sourceValues.has(it))\n\t\t\t})\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;AAQO,MAAM,kBAAkB;AAAA,EAC9B,YAA6B,aAA+D;AAA/D,SAAA,cAAA;AAAA,EAAA;AAAA,EAG7B,QAAQ,YAAqC;AACrC,WAAA,KAAK,YAAY,KAAK,CAAqB,sBAAA;AAC7C,UAAA,kBAAkB,cAAc,MAAM;AAClC,eAAA;AAAA,MAAA;AAEJ,UAAA,CAAC,kBAAkB,WAAW;AAC1B,eAAA;AAAA,MAAA;AAER,YAAM,YAAY,kBAAkB,UAAU,WAAW,IAAI;AAC7D,UAAI,CAAC,WAAW;AACR,eAAA;AAAA,MAAA;AAER,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAER,YAAM,YAAY,WAAW;AAC7B,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAED,aAAA,WAAW,UAAU,MAAM,CAAY,aAAA;AACvC,cAAA,qBAAqB,YAAY,SAAS,IAAI;AACpD,YAAI,CAAC,oBAAoB;AACjB,iBAAA;AAAA,QAAA;AAER,YAAI,uBAAuB,MAAM;AACzB,iBAAA;AAAA,QAAA;AAEF,cAAA,iBAAiB,kBAAkB,UAAU,KAAK,CAAA,OAAM,OAAO,uBAAuB,YAAY,GAAG,SAAS,kBAAkB;AACtI,YAAI,CAAC,gBAAgB;AACb,iBAAA;AAAA,QAAA;AAER,cAAM,eAAe,IAAI,IAAI,eAAe,MAAM;AAClD,eAAO,SAAS,OAAO,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AAAA,MAAA,CACvD;AAAA,IAAA,CACD;AAAA,EAAA;AAEH;;"}

package/dist/development/src/model/authorization/MembershipMatcher.js

@@ -4,6 +4,12 @@ class MembershipMatcher {
   }
   matches(membership) {
     return this.memberships.some((invokerMembership) => {
+      if (invokerMembership.matchRule === true) {
+        return true;
+      }
+      if (!invokerMembership.matchRule) {
+        return false;
+      }
       const matchRule = invokerMembership.matchRule[membership.role];
       if (!matchRule) {
         return false;

package/dist/development/src/model/authorization/MembershipMatcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipMatcher.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/MembershipMatcher.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport type MembershipWithSubMembershipMatchRules =\n\t& Acl.Membership\n\t& {\n\t\tmatchRule: Acl.MembershipMatchRule\n\t}\n\nexport class MembershipMatcher {\n\tconstructor(private readonly memberships: readonly MembershipWithSubMembershipMatchRules[]) {\n\t}\n\n\tmatches(membership: Acl.Membership): boolean {\n\t\treturn this.memberships.some(invokerMembership => {\n\t\t\tconst matchRule = invokerMembership.matchRule[membership.role]\n\t\t\tif (!matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tconst variables = matchRule?.variables\n\t\t\tif (variables === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\treturn membership.variables.every(variable => {\n\t\t\t\tconst sourceVariableRule = variables?.[variable.name]\n\t\t\t\tif (!sourceVariableRule) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (sourceVariableRule === true) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t\tconst sourceVariable = invokerMembership.variables.find(it => typeof sourceVariableRule === 'string' && it.name === sourceVariableRule)\n\t\t\t\tif (!sourceVariable) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tconst sourceValues = new Set(sourceVariable.values)\n\t\t\t\treturn variable.values.every(it => sourceValues.has(it))\n\t\t\t})\n\t\t})\n\t}\n}\n"],"names":[],"mappings":"AAQO,MAAM,kBAAkB;AAAA,EAC9B,YAA6B,aAA+D;AAA/D,SAAA,cAAA;AAAA,EAAA;AAAA,EAG7B,QAAQ,YAAqC;AACrC,WAAA,KAAK,YAAY,KAAK,CAAqB,sBAAA;AACjD,YAAM,YAAY,kBAAkB,UAAU,WAAW,IAAI;AAC7D,UAAI,CAAC,WAAW;AACR,eAAA;AAAA,MAAA;AAER,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAER,YAAM,YAAY,WAAW;AAC7B,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAED,aAAA,WAAW,UAAU,MAAM,CAAY,aAAA;AACvC,cAAA,qBAAqB,YAAY,SAAS,IAAI;AACpD,YAAI,CAAC,oBAAoB;AACjB,iBAAA;AAAA,QAAA;AAER,YAAI,uBAAuB,MAAM;AACzB,iBAAA;AAAA,QAAA;AAEF,cAAA,iBAAiB,kBAAkB,UAAU,KAAK,CAAA,OAAM,OAAO,uBAAuB,YAAY,GAAG,SAAS,kBAAkB;AACtI,YAAI,CAAC,gBAAgB;AACb,iBAAA;AAAA,QAAA;AAER,cAAM,eAAe,IAAI,IAAI,eAAe,MAAM;AAClD,eAAO,SAAS,OAAO,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AAAA,MAAA,CACvD;AAAA,IAAA,CACD;AAAA,EAAA;AAEH;"}
+{"version":3,"file":"MembershipMatcher.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/MembershipMatcher.ts"],"sourcesContent":["import { Acl } from '@contember/schema'\n\nexport type MembershipWithSubMembershipMatchRules =\n\t& Acl.Membership\n\t& {\n\t\tmatchRule: Acl.MembershipMatchRule\n\t}\n\nexport class MembershipMatcher {\n\tconstructor(private readonly memberships: readonly MembershipWithSubMembershipMatchRules[]) {\n\t}\n\n\tmatches(membership: Acl.Membership): boolean {\n\t\treturn this.memberships.some(invokerMembership => {\n\t\t\tif (invokerMembership.matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tif (!invokerMembership.matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst matchRule = invokerMembership.matchRule[membership.role]\n\t\t\tif (!matchRule) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tif (matchRule === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\tconst variables = matchRule?.variables\n\t\t\tif (variables === true) {\n\t\t\t\treturn true\n\t\t\t}\n\t\t\treturn membership.variables.every(variable => {\n\t\t\t\tconst sourceVariableRule = variables?.[variable.name]\n\t\t\t\tif (!sourceVariableRule) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tif (sourceVariableRule === true) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t\tconst sourceVariable = invokerMembership.variables.find(it => typeof sourceVariableRule === 'string' && it.name === sourceVariableRule)\n\t\t\t\tif (!sourceVariable) {\n\t\t\t\t\treturn false\n\t\t\t\t}\n\t\t\t\tconst sourceValues = new Set(sourceVariable.values)\n\t\t\t\treturn variable.values.every(it => sourceValues.has(it))\n\t\t\t})\n\t\t})\n\t}\n}\n"],"names":[],"mappings":"AAQO,MAAM,kBAAkB;AAAA,EAC9B,YAA6B,aAA+D;AAA/D,SAAA,cAAA;AAAA,EAAA;AAAA,EAG7B,QAAQ,YAAqC;AACrC,WAAA,KAAK,YAAY,KAAK,CAAqB,sBAAA;AAC7C,UAAA,kBAAkB,cAAc,MAAM;AAClC,eAAA;AAAA,MAAA;AAEJ,UAAA,CAAC,kBAAkB,WAAW;AAC1B,eAAA;AAAA,MAAA;AAER,YAAM,YAAY,kBAAkB,UAAU,WAAW,IAAI;AAC7D,UAAI,CAAC,WAAW;AACR,eAAA;AAAA,MAAA;AAER,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAER,YAAM,YAAY,WAAW;AAC7B,UAAI,cAAc,MAAM;AAChB,eAAA;AAAA,MAAA;AAED,aAAA,WAAW,UAAU,MAAM,CAAY,aAAA;AACvC,cAAA,qBAAqB,YAAY,SAAS,IAAI;AACpD,YAAI,CAAC,oBAAoB;AACjB,iBAAA;AAAA,QAAA;AAER,YAAI,uBAAuB,MAAM;AACzB,iBAAA;AAAA,QAAA;AAEF,cAAA,iBAAiB,kBAAkB,UAAU,KAAK,CAAA,OAAM,OAAO,uBAAuB,YAAY,GAAG,SAAS,kBAAkB;AACtI,YAAI,CAAC,gBAAgB;AACb,iBAAA;AAAA,QAAA;AAER,cAAM,eAAe,IAAI,IAAI,eAAe,MAAM;AAClD,eAAO,SAAS,OAAO,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AAAA,MAAA,CACvD;AAAA,IAAA,CACD;AAAA,EAAA;AAEH;"}

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.cjs

@@ -3,18 +3,18 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const ApiKeyHelper = require("./ApiKeyHelper.cjs");
 const Database = require("@contember/database");
 require("../../type/ApiKey.cjs");
-const tokenUtils = require("../../utils/tokenUtils.cjs");
+const token = require("../../utils/token.cjs");
 class CreateApiKeyCommand {
   constructor(args) {
     this.args = args;
   }
   async execute({ db, providers }) {
     const apiKeyId = providers.uuid();
-    let token = void 0;
+    let token$1 = void 0;
     let tokenHash = this.args.tokenHash;
     if (!tokenHash) {
-      token = await tokenUtils.generateToken(providers);
-      tokenHash = tokenUtils.computeTokenHash(token);
+      token$1 = await token.generateToken(providers);
+      tokenHash = token.computeTokenHash(token$1);
     }
     await Database.InsertBuilder.create().into("api_key").values({
       id: apiKeyId,
@@ -26,13 +26,13 @@ class CreateApiKeyCommand {
       expiration: this.args.expiration || null,
       created_at: providers.now()
     }).execute(db);
-    return new CreateApiKeyCommandResult(apiKeyId, token);
+    return new CreateApiKeyCommandResult(apiKeyId, token$1);
   }
 }
 class CreateApiKeyCommandResult {
-  constructor(id, token) {
+  constructor(id, token2) {
     this.id = id;
-    this.token = token;
+    this.token = token2;
   }
 }
 exports.CreateApiKeyCommand = CreateApiKeyCommand;

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token = undefined\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["generateToken","computeTokenHash","InsertBuilder","ApiKeyHelper"],"mappings":";;;;;;AAwBO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAA;AAAA,EAEpB,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAC5E,UAAA,WAAW,UAAU,KAAK;AAChC,QAAI,QAAQ;AACR,QAAA,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACP,cAAA,MAAMA,yBAAc,SAAS;AACrC,kBAAYC,4BAAiB,KAAK;AAAA,IAAA;AAGnC,UAAMC,SAAAA,cAAc,OAAO,EACzB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAYC,aAAAA,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAI;AAAA,IAAA,CAC1B,EACA,QAAQ,EAAE;AAEL,WAAA,IAAI,0BAA0B,UAAU,KAAK;AAAA,EAAA;AAEtD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4B,OAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAA;AAAA,EAAA;AAEzD;;;"}
+{"version":3,"file":"CreateApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token = undefined\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["token","generateToken","computeTokenHash","InsertBuilder","ApiKeyHelper"],"mappings":";;;;;;AAwBO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAA;AAAA,EAEpB,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAC5E,UAAA,WAAW,UAAU,KAAK;AAChC,QAAIA,UAAQ;AACR,QAAA,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACPA,gBAAA,MAAMC,oBAAc,SAAS;AACrC,kBAAYC,uBAAiBF,OAAK;AAAA,IAAA;AAGnC,UAAMG,SAAAA,cAAc,OAAO,EACzB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAYC,aAAAA,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAI;AAAA,IAAA,CAC1B,EACA,QAAQ,EAAE;AAEL,WAAA,IAAI,0BAA0B,UAAUJ,OAAK;AAAA,EAAA;AAEtD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4BA,QAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAAA;AAAA,EAAA;AAEzD;;;"}

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.js

@@ -1,7 +1,7 @@
 import { ApiKeyHelper } from "./ApiKeyHelper.js";
 import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
 import "../../type/ApiKey.js";
-import { generateToken, computeTokenHash } from "../../utils/tokenUtils.js";
+import { generateToken, computeTokenHash } from "../../utils/token.js";
 class CreateApiKeyCommand {
   constructor(args) {
     this.args = args;

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.cjs

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class CreateAuthLogEntryCommand {
+  constructor(data) {
+    this.data = data;
+  }
+  async execute({ db, providers }) {
+    await Database.InsertBuilder.create().into("person_auth_log").values({
+      id: providers.uuid(),
+      invoked_by_id: this.data.invokedById,
+      person_id: this.data.personId,
+      person_input_identifier: this.data.personInputIdentifier,
+      person_token_id: this.data.personTokenId,
+      type: this.data.type,
+      success: this.data.success,
+      error_code: this.data.errorCode,
+      error_message: this.data.errorMessage,
+      ip_address: this.data.ipAddress,
+      user_agent: this.data.userAgent,
+      identity_provider_id: this.data.identityProviderId,
+      metadata: this.data.metadata ?? {}
+    }).execute(db);
+  }
+}
+exports.CreateAuthLogEntryCommand = CreateAuthLogEntryCommand;
+//# sourceMappingURL=CreateAuthLogEntryCommand.cjs.map

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateAuthLogEntryCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { AuthActionType } from '../../type/AuthLog'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t})\n\t\t\t.execute(db)\n\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\tinvokedById: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAAA;AAAA,EAKlB,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAO,EACzB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAK;AAAA,MACnB,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,IAAC,CACjC,EACA,QAAQ,EAAE;AAAA,EAAA;AAGd;;"}

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.js

@@ -0,0 +1,27 @@
+import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+class CreateAuthLogEntryCommand {
+  constructor(data) {
+    this.data = data;
+  }
+  async execute({ db, providers }) {
+    await InsertBuilder$1.create().into("person_auth_log").values({
+      id: providers.uuid(),
+      invoked_by_id: this.data.invokedById,
+      person_id: this.data.personId,
+      person_input_identifier: this.data.personInputIdentifier,
+      person_token_id: this.data.personTokenId,
+      type: this.data.type,
+      success: this.data.success,
+      error_code: this.data.errorCode,
+      error_message: this.data.errorMessage,
+      ip_address: this.data.ipAddress,
+      user_agent: this.data.userAgent,
+      identity_provider_id: this.data.identityProviderId,
+      metadata: this.data.metadata ?? {}
+    }).execute(db);
+  }
+}
+export {
+  CreateAuthLogEntryCommand
+};
+//# sourceMappingURL=CreateAuthLogEntryCommand.js.map

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateAuthLogEntryCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { AuthActionType } from '../../type/AuthLog'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t})\n\t\t\t.execute(db)\n\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\tinvokedById: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAAA;AAAA,EAKlB,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAO,EACzB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAK;AAAA,MACnB,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,IAAC,CACjC,EACA,QAAQ,EAAE;AAAA,EAAA;AAGd;"}

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.cjs

@@ -7,9 +7,22 @@ class UpdateConfigurationCommand {
   }
   async execute({ db }) {
     const result = await Database.UpdateBuilder.create().table("config").where({ id: "singleton" }).values({
-      passwordless_enabled: this.configuration.passwordless?.enabled,
+      passwordless_enabled: this.configuration.passwordless?.enabled ?? void 0,
       passwordless_url: this.configuration.passwordless?.url,
-      passwordless_expiration_minutes: this.configuration.passwordless?.expirationMinutes
+      passwordless_expiration: this.configuration.passwordless?.expiration ?? void 0,
+      password_min_length: this.configuration.password?.minLength ?? void 0,
+      password_require_uppercase: this.configuration.password?.requireUppercase ?? void 0,
+      password_require_lowercase: this.configuration.password?.requireLowercase ?? void 0,
+      password_require_digit: this.configuration.password?.requireDigit ?? void 0,
+      password_require_special: this.configuration.password?.requireSpecial ?? void 0,
+      password_pattern: this.configuration.password?.pattern,
+      password_check_blacklist: this.configuration.password?.checkBlacklist ?? void 0,
+      login_base_backoff: this.configuration.login?.baseBackoff ?? void 0,
+      login_max_backoff: this.configuration.login?.maxBackoff ?? void 0,
+      login_attempt_window: this.configuration.login?.attemptWindow ?? void 0,
+      login_reveal_user_exits: this.configuration.login?.revealUserExists ?? void 0,
+      login_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? void 0,
+      login_max_token_expiration: this.configuration.login?.maxTokenExpiration
     }).execute(db);
     if (!result) {
       throw new Error("Configuration not found");

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateConfigurationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ConfigInput } from '../../../schema'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values({\n\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled,\n\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\tpasswordless_expiration_minutes: this.configuration.passwordless?.expirationMinutes,\n\t\t\t})\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAIO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,SAAS,MAAMA,SAAAA,cAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAa,CAAA,EACzB,OAAO;AAAA,MACP,sBAAsB,KAAK,cAAc,cAAc;AAAA,MACvD,kBAAkB,KAAK,cAAc,cAAc;AAAA,MACnD,iCAAiC,KAAK,cAAc,cAAc;AAAA,IAAA,CAClE,EACA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACN,YAAA,IAAI,MAAM,yBAAyB;AAAA,IAAA;AAAA,EAC1C;AAGF;;"}
+{"version":3,"file":"UpdateConfigurationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ConfigInput } from '../../../schema'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values({\n\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t} satisfies {\n\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t})\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,QAAQ,EAAE,MAAmC;AAElD,UAAM,SAAS,MAAMA,SAAAA,cAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAa,CAAA,EACzB,OAAO;AAAA,MACP,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,MAClE,kBAAkB,KAAK,cAAc,cAAc;AAAA,MACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,MACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,MAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,MAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,MAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,MACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,MACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,MAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,MACzE,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,MAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,MAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,MACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,MACvE,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,MACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,IAAA,CAGtD,EACA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACN,YAAA,IAAI,MAAM,yBAAyB;AAAA,IAAA;AAAA,EAC1C;AAGF;;"}

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.js

@@ -5,9 +5,22 @@ class UpdateConfigurationCommand {
   }
   async execute({ db }) {
     const result = await UpdateBuilder$1.create().table("config").where({ id: "singleton" }).values({
-      passwordless_enabled: this.configuration.passwordless?.enabled,
+      passwordless_enabled: this.configuration.passwordless?.enabled ?? void 0,
       passwordless_url: this.configuration.passwordless?.url,
-      passwordless_expiration_minutes: this.configuration.passwordless?.expirationMinutes
+      passwordless_expiration: this.configuration.passwordless?.expiration ?? void 0,
+      password_min_length: this.configuration.password?.minLength ?? void 0,
+      password_require_uppercase: this.configuration.password?.requireUppercase ?? void 0,
+      password_require_lowercase: this.configuration.password?.requireLowercase ?? void 0,
+      password_require_digit: this.configuration.password?.requireDigit ?? void 0,
+      password_require_special: this.configuration.password?.requireSpecial ?? void 0,
+      password_pattern: this.configuration.password?.pattern,
+      password_check_blacklist: this.configuration.password?.checkBlacklist ?? void 0,
+      login_base_backoff: this.configuration.login?.baseBackoff ?? void 0,
+      login_max_backoff: this.configuration.login?.maxBackoff ?? void 0,
+      login_attempt_window: this.configuration.login?.attemptWindow ?? void 0,
+      login_reveal_user_exits: this.configuration.login?.revealUserExists ?? void 0,
+      login_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? void 0,
+      login_max_token_expiration: this.configuration.login?.maxTokenExpiration
     }).execute(db);
     if (!result) {
       throw new Error("Configuration not found");

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateConfigurationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ConfigInput } from '../../../schema'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values({\n\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled,\n\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\tpasswordless_expiration_minutes: this.configuration.passwordless?.expirationMinutes,\n\t\t\t})\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n\n}\n"],"names":["UpdateBuilder"],"mappings":";AAIO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAa,CAAA,EACzB,OAAO;AAAA,MACP,sBAAsB,KAAK,cAAc,cAAc;AAAA,MACvD,kBAAkB,KAAK,cAAc,cAAc;AAAA,MACnD,iCAAiC,KAAK,cAAc,cAAc;AAAA,IAAA,CAClE,EACA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACN,YAAA,IAAI,MAAM,yBAAyB;AAAA,IAAA;AAAA,EAC1C;AAGF;"}
+{"version":3,"file":"UpdateConfigurationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ConfigInput } from '../../../schema'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values({\n\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t} satisfies {\n\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t})\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n\n}\n"],"names":["UpdateBuilder"],"mappings":";AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,QAAQ,EAAE,MAAmC;AAElD,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAa,CAAA,EACzB,OAAO;AAAA,MACP,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,MAClE,kBAAkB,KAAK,cAAc,cAAc;AAAA,MACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,MACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,MAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,MAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,MAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,MACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,MACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,MAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,MACzE,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,MAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,MAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,MACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,MACvE,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,MACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,IAAA,CAGtD,EACA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACN,YAAA,IAAI,MAAM,yBAAyB;AAAA,IAAA;AAAA,EAC1C;AAGF;"}

package/dist/development/src/model/commands/personToken/CreatePersonTokenCommand.cjs

@@ -4,7 +4,7 @@ require("@contember/database");
 require("../../type/ApiKey.cjs");
 const SavePersonTokenCommand = require("./SavePersonTokenCommand.cjs");
 const expirations = require("../../consts/expirations.cjs");
-const tokenUtils = require("../../utils/tokenUtils.cjs");
+const token = require("../../utils/token.cjs");
 class CreatePersonTokenCommand {
   constructor(personId, type, expirationMinutes) {
     this.personId = personId;
@@ -18,15 +18,15 @@ class CreatePersonTokenCommand {
     return new CreatePersonTokenCommand(personId, "passwordless", expirationMinutes);
   }
   async execute({ db, providers, bus }) {
-    const token = await tokenUtils.generateToken(providers);
-    const tokenHash = tokenUtils.computeTokenHash(token);
+    const token$1 = await token.generateToken(providers);
+    const tokenHash = token.computeTokenHash(token$1);
     const result = await bus.execute(new SavePersonTokenCommand.SavePersonTokenCommand(
       this.personId,
       tokenHash,
       this.type,
       this.expirationMinutes
     ));
-    return { ...result, token };
+    return { ...result, token: token$1 };
   }
 }
 exports.CreatePersonTokenCommand = CreatePersonTokenCommand;

package/dist/development/src/model/commands/personToken/CreatePersonTokenCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreatePersonTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/CreatePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { computeTokenHash, generateToken } from '../../utils'\nimport { SavePersonTokenCommand } from './SavePersonTokenCommand'\nimport { PersonToken } from '../../type'\nimport { PASSWORD_RESET_EXPIRATION_MINUTES } from '../../consts/expirations'\n\nexport class CreatePersonTokenCommand implements Command<CreatePersonTokenCommand.Result> {\n\tprivate constructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tstatic createPasswordResetRequest(personId: string, expirationMinutes: number = PASSWORD_RESET_EXPIRATION_MINUTES): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'password_reset', expirationMinutes)\n\t}\n\n\tstatic createPasswordlessRequest(personId: string, expirationMinutes: number): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'passwordless', expirationMinutes)\n\t}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<CreatePersonTokenCommand.Result> {\n\t\tconst token = await generateToken(providers)\n\t\tconst tokenHash = computeTokenHash(token)\n\t\tconst result = await bus.execute(new SavePersonTokenCommand(\n\t\t\tthis.personId,\n\t\t\ttokenHash,\n\t\t\tthis.type,\n\t\t\tthis.expirationMinutes,\n\t\t))\n\n\t\treturn { ...result, token }\n\t}\n}\n\nnamespace CreatePersonTokenCommand {\n\texport interface Result {\n\t\treadonly id: string\n\t\treadonly token: string\n\t\treadonly expiresAt: Date\n\t}\n}\n"],"names":["PASSWORD_RESET_EXPIRATION_MINUTES","generateToken","computeTokenHash","SavePersonTokenCommand"],"mappings":";;;;;;;AAMO,MAAM,yBAA6E;AAAA,EACjF,YACU,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EAAA;AAAA,EAGlB,OAAO,2BAA2B,UAAkB,oBAA4BA,+CAA6D;AAC5I,WAAO,IAAI,yBAAyB,UAAU,kBAAkB,iBAAiB;AAAA,EAAA;AAAA,EAGlF,OAAO,0BAA0B,UAAkB,mBAAqD;AACvG,WAAO,IAAI,yBAAyB,UAAU,gBAAgB,iBAAiB;AAAA,EAAA;AAAA,EAGhF,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA+D;AACvF,UAAA,QAAQ,MAAMC,WAAA,cAAc,SAAS;AACrC,UAAA,YAAYC,4BAAiB,KAAK;AACxC,UAAM,SAAS,MAAM,IAAI,QAAQ,IAAIC,uBAAA;AAAA,MACpC,KAAK;AAAA,MACL;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,IAAA,CACL;AAEM,WAAA,EAAE,GAAG,QAAQ,MAAM;AAAA,EAAA;AAE5B;;"}
+{"version":3,"file":"CreatePersonTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/CreatePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { computeTokenHash, generateToken } from '../../utils'\nimport { SavePersonTokenCommand } from './SavePersonTokenCommand'\nimport { PersonToken } from '../../type'\nimport { PASSWORD_RESET_EXPIRATION_MINUTES } from '../../consts/expirations'\n\nexport class CreatePersonTokenCommand implements Command<CreatePersonTokenCommand.Result> {\n\tprivate constructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tstatic createPasswordResetRequest(personId: string, expirationMinutes: number = PASSWORD_RESET_EXPIRATION_MINUTES): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'password_reset', expirationMinutes)\n\t}\n\n\tstatic createPasswordlessRequest(personId: string, expirationMinutes: number): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'passwordless', expirationMinutes)\n\t}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<CreatePersonTokenCommand.Result> {\n\t\tconst token = await generateToken(providers)\n\t\tconst tokenHash = computeTokenHash(token)\n\t\tconst result = await bus.execute(new SavePersonTokenCommand(\n\t\t\tthis.personId,\n\t\t\ttokenHash,\n\t\t\tthis.type,\n\t\t\tthis.expirationMinutes,\n\t\t))\n\n\t\treturn { ...result, token }\n\t}\n}\n\nnamespace CreatePersonTokenCommand {\n\texport interface Result {\n\t\treadonly id: string\n\t\treadonly token: string\n\t\treadonly expiresAt: Date\n\t}\n}\n"],"names":["PASSWORD_RESET_EXPIRATION_MINUTES","token","generateToken","computeTokenHash","SavePersonTokenCommand"],"mappings":";;;;;;;AAMO,MAAM,yBAA6E;AAAA,EACjF,YACU,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EAAA;AAAA,EAGlB,OAAO,2BAA2B,UAAkB,oBAA4BA,+CAA6D;AAC5I,WAAO,IAAI,yBAAyB,UAAU,kBAAkB,iBAAiB;AAAA,EAAA;AAAA,EAGlF,OAAO,0BAA0B,UAAkB,mBAAqD;AACvG,WAAO,IAAI,yBAAyB,UAAU,gBAAgB,iBAAiB;AAAA,EAAA;AAAA,EAGhF,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA+D;AACvF,UAAAC,UAAQ,MAAMC,MAAA,cAAc,SAAS;AACrC,UAAA,YAAYC,uBAAiBF,OAAK;AACxC,UAAM,SAAS,MAAM,IAAI,QAAQ,IAAIG,uBAAA;AAAA,MACpC,KAAK;AAAA,MACL;AAAA,MACA,KAAK;AAAA,MACL,KAAK;AAAA,IAAA,CACL;AAEM,WAAA,EAAE,GAAG,QAAA,OAAQH,QAAM;AAAA,EAAA;AAE5B;;"}

package/dist/development/src/model/commands/personToken/CreatePersonTokenCommand.js

@@ -2,7 +2,7 @@ import "@contember/database";
 import "../../type/ApiKey.js";
 import { SavePersonTokenCommand } from "./SavePersonTokenCommand.js";
 import { PASSWORD_RESET_EXPIRATION_MINUTES } from "../../consts/expirations.js";
-import { generateToken, computeTokenHash } from "../../utils/tokenUtils.js";
+import { generateToken, computeTokenHash } from "../../utils/token.js";
 class CreatePersonTokenCommand {
   constructor(personId, type, expirationMinutes) {
     this.personId = personId;

package/dist/development/src/model/commands/personToken/ResetPasswordCommand.cjs

@@ -6,16 +6,16 @@ const PersonTokenQuery = require("../../queries/personToken/PersonTokenQuery.cjs
 const InvalidateTokenCommand = require("./InvalidateTokenCommand.cjs");
 require("@contember/database");
 require("../../type/ApiKey.cjs");
-const tokenUtils = require("../../utils/tokenUtils.cjs");
+const token = require("../../utils/token.cjs");
 class ResetPasswordCommand {
-  constructor(token, password) {
-    this.token = token;
+  constructor(token2, password) {
+    this.token = token2;
     this.password = password;
   }
   async execute({ db, providers, bus }) {
     const now = providers.now();
-    const token = await db.createQueryHandler().fetch(PersonTokenQuery.PersonTokenQuery.byToken(this.token, "password_reset"));
-    const tokenValidationResult = tokenUtils.validateToken({ entry: token, token: this.token, now, validationType: "token" });
+    const token$1 = await db.createQueryHandler().fetch(PersonTokenQuery.PersonTokenQuery.byToken(this.token, "password_reset"));
+    const tokenValidationResult = token.validateToken({ entry: token$1, token: this.token, now, validationType: "token" });
     if (!tokenValidationResult.ok) {
       return tokenValidationResult;
     }

package/dist/development/src/model/commands/personToken/ResetPasswordCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand'\nimport { Response, ResponseOk } from '../../utils/Response'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand'\nimport { validateToken } from '../../utils'\nimport { PersonToken } from '../../type'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst now = providers.now()\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode =\n\t| PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":["PersonTokenQuery","validateToken","InvalidateTokenCommand","ChangePasswordCommand","ResponseOk"],"mappings":";;;;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6B,OAAgC,UAAkB;AAAlD,SAAA,QAAA;AAAgC,SAAA,WAAA;AAAA,EAAA;AAAA,EAE7D,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA4D;AACpF,UAAA,MAAM,UAAU,IAAI;AACpB,UAAA,QAAQ,MAAM,GAAG,qBAAqB,MAAMA,iBAAA,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AAClG,UAAA,wBAAwBC,WAAAA,cAAc,EAAE,OAAO,OAAO,OAAO,KAAK,OAAO,KAAK,gBAAgB,QAAA,CAAS;AACzG,QAAA,CAAC,sBAAsB,IAAI;AACvB,aAAA;AAAA,IAAA;AAER,UAAM,IAAI,QAAQ,IAAIC,uBAAAA,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACvE,UAAA,IAAI,QAAQ,IAAIC,4CAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAE3F,WAAA,IAAIC,oBAAW,IAAI;AAAA,EAAA;AAE5B;;"}
+{"version":3,"file":"ResetPasswordCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand'\nimport { Response, ResponseOk } from '../../utils/Response'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand'\nimport { validateToken } from '../../utils'\nimport { PersonToken } from '../../type'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst now = providers.now()\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode =\n\t| PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":["token","PersonTokenQuery","validateToken","InvalidateTokenCommand","ChangePasswordCommand","ResponseOk"],"mappings":";;;;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6BA,QAAgC,UAAkB;AAAlD,SAAA,QAAAA;AAAgC,SAAA,WAAA;AAAA,EAAA;AAAA,EAE7D,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA4D;AACpF,UAAA,MAAM,UAAU,IAAI;AACpB,UAAAA,UAAQ,MAAM,GAAG,qBAAqB,MAAMC,iBAAA,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AAClG,UAAA,wBAAwBC,MAAAA,cAAc,EAAE,OAAOF,SAAO,OAAO,KAAK,OAAO,KAAK,gBAAgB,QAAA,CAAS;AACzG,QAAA,CAAC,sBAAsB,IAAI;AACvB,aAAA;AAAA,IAAA;AAER,UAAM,IAAI,QAAQ,IAAIG,uBAAAA,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACvE,UAAA,IAAI,QAAQ,IAAIC,4CAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAE3F,WAAA,IAAIC,oBAAW,IAAI;AAAA,EAAA;AAE5B;;"}

package/dist/development/src/model/commands/personToken/ResetPasswordCommand.js

@@ -4,7 +4,7 @@ import { PersonTokenQuery } from "../../queries/personToken/PersonTokenQuery.js"
 import { InvalidateTokenCommand } from "./InvalidateTokenCommand.js";
 import "@contember/database";
 import "../../type/ApiKey.js";
-import { validateToken } from "../../utils/tokenUtils.js";
+import { validateToken } from "../../utils/token.js";
 class ResetPasswordCommand {
   constructor(token, password) {
     this.token = token;

package/dist/development/src/model/queries/apiKey/ApiKeyQuery.cjs

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
 require("../../type/ApiKey.cjs");
-const tokenUtils = require("../../utils/tokenUtils.cjs");
+const token = require("../../utils/token.cjs");
 class ApiKeyByIdQuery extends Database.DatabaseQuery {
   constructor(apiKeyId) {
     super();
@@ -16,12 +16,12 @@ class ApiKeyByIdQuery extends Database.DatabaseQuery {
   }
 }
 class ApiKeyByTokenQuery extends Database.DatabaseQuery {
-  constructor(token) {
+  constructor(token2) {
     super();
-    this.token = token;
+    this.token = token2;
   }
   async fetch({ db }) {
-    const tokenHash = tokenUtils.computeTokenHash(this.token);
+    const tokenHash = token.computeTokenHash(this.token);
     const rows = await apiKeyBaseQuery.where({ token_hash: tokenHash }).getResult(db);
     return this.fetchOneOrNull(rows);
   }

package/dist/development/src/model/queries/apiKey/ApiKeyQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/apiKey/ApiKeyQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'\nimport { ApiKey } from '../../type'\nimport { computeTokenHash } from '../../utils'\n\nexport class ApiKeyByIdQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly apiKeyId: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where(\n\t\t\t\twhere => where.compare(['api_key', 'id'], Operator.eq, this.apiKeyId),\n\t\t\t)\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport class ApiKeyByTokenQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly token: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst tokenHash = computeTokenHash(this.token)\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where({ token_hash: tokenHash })\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport type ApiKeyRow = {\n\treadonly id: string\n\treadonly type: ApiKey.Type\n\treadonly identity_id: string\n\treadonly disabled_at: Date | null\n\treadonly expires_at: Date | null\n\treadonly expiration: number | null\n\treadonly roles: string[]\n\treadonly person_id: string | null\n}\n\nconst apiKeyBaseQuery = SelectBuilder.create<null | ApiKeyRow>()\n\t.select(['api_key', 'id'])\n\t.select(['api_key', 'type'])\n\t.select(['api_key', 'identity_id'])\n\t.select(['api_key', 'disabled_at'])\n\t.select(['api_key', 'expires_at'])\n\t.select(['identity', 'roles'])\n\t.select(['api_key', 'expiration'])\n\t.select(['person', 'id'], 'person_id')\n\t.from('api_key')\n\t.join('identity', 'identity', joinClause =>\n\t\tjoinClause.compareColumns(['api_key', 'identity_id'], Operator.eq, ['identity', 'id']),\n\t)\n\t.leftJoin(\n\t\t'person', 'person', on => on.compareColumns(\n\t\t\t['person', 'identity_id'], Operator.eq, ['identity', 'id'],\n\t\t),\n\t)\n"],"names":["DatabaseQuery","Operator","computeTokenHash","SelectBuilder"],"mappings":";;;;;AAIO,MAAM,wBAAwBA,SAAAA,cAAgC;AAAA,EACpE,YAA6B,UAAkB;AACxC,UAAA;AADsB,SAAA,WAAA;AAAA,EAAA;AAAA,EAI7B,MAAM,MAAM,EAAE,MAAoD;AAC3D,UAAA,OAAO,MAAM,gBACjB;AAAA,MACA,CAAA,UAAS,MAAM,QAAQ,CAAC,WAAW,IAAI,GAAGC,SAAA,SAAS,IAAI,KAAK,QAAQ;AAAA,IAAA,EAEpE,UAAU,EAAE;AAEP,WAAA,KAAK,eAAe,IAAI;AAAA,EAAA;AAEjC;AAEO,MAAM,2BAA2BD,SAAAA,cAAgC;AAAA,EACvE,YAA6B,OAAe;AACrC,UAAA;AADsB,SAAA,QAAA;AAAA,EAAA;AAAA,EAI7B,MAAM,MAAM,EAAE,MAAoD;AAC3D,UAAA,YAAYE,WAAAA,iBAAiB,KAAK,KAAK;AACvC,UAAA,OAAO,MAAM,gBACjB,MAAM,EAAE,YAAY,UAAW,CAAA,EAC/B,UAAU,EAAE;AAEP,WAAA,KAAK,eAAe,IAAI;AAAA,EAAA;AAEjC;AAaA,MAAM,kBAAkBC,SAAAA,cAAc,OAAA,EACpC,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,UAAU,IAAI,GAAG,WAAW,EACpC,KAAK,SAAS,EACd;AAAA,EAAK;AAAA,EAAY;AAAA,EAAY,CAC7B,eAAA,WAAW,eAAe,CAAC,WAAW,aAAa,GAAGF,kBAAS,IAAI,CAAC,YAAY,IAAI,CAAC;AACtF,EACC;AAAA,EACA;AAAA,EAAU;AAAA,EAAU,QAAM,GAAG;AAAA,IAC5B,CAAC,UAAU,aAAa;AAAA,IAAGA,SAAAA,SAAS;AAAA,IAAI,CAAC,YAAY,IAAI;AAAA,EAAA;AAE3D;;;"}
+{"version":3,"file":"ApiKeyQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/apiKey/ApiKeyQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'\nimport { ApiKey } from '../../type'\nimport { computeTokenHash } from '../../utils'\n\nexport class ApiKeyByIdQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly apiKeyId: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where(\n\t\t\t\twhere => where.compare(['api_key', 'id'], Operator.eq, this.apiKeyId),\n\t\t\t)\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport class ApiKeyByTokenQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly token: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst tokenHash = computeTokenHash(this.token)\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where({ token_hash: tokenHash })\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport type ApiKeyRow = {\n\treadonly id: string\n\treadonly type: ApiKey.Type\n\treadonly identity_id: string\n\treadonly disabled_at: Date | null\n\treadonly expires_at: Date | null\n\treadonly expiration: number | null\n\treadonly roles: string[]\n\treadonly person_id: string | null\n}\n\nconst apiKeyBaseQuery = SelectBuilder.create<null | ApiKeyRow>()\n\t.select(['api_key', 'id'])\n\t.select(['api_key', 'type'])\n\t.select(['api_key', 'identity_id'])\n\t.select(['api_key', 'disabled_at'])\n\t.select(['api_key', 'expires_at'])\n\t.select(['identity', 'roles'])\n\t.select(['api_key', 'expiration'])\n\t.select(['person', 'id'], 'person_id')\n\t.from('api_key')\n\t.join('identity', 'identity', joinClause =>\n\t\tjoinClause.compareColumns(['api_key', 'identity_id'], Operator.eq, ['identity', 'id']),\n\t)\n\t.leftJoin(\n\t\t'person', 'person', on => on.compareColumns(\n\t\t\t['person', 'identity_id'], Operator.eq, ['identity', 'id'],\n\t\t),\n\t)\n"],"names":["DatabaseQuery","Operator","token","computeTokenHash","SelectBuilder"],"mappings":";;;;;AAIO,MAAM,wBAAwBA,SAAAA,cAAgC;AAAA,EACpE,YAA6B,UAAkB;AACxC,UAAA;AADsB,SAAA,WAAA;AAAA,EAAA;AAAA,EAI7B,MAAM,MAAM,EAAE,MAAoD;AAC3D,UAAA,OAAO,MAAM,gBACjB;AAAA,MACA,CAAA,UAAS,MAAM,QAAQ,CAAC,WAAW,IAAI,GAAGC,SAAA,SAAS,IAAI,KAAK,QAAQ;AAAA,IAAA,EAEpE,UAAU,EAAE;AAEP,WAAA,KAAK,eAAe,IAAI;AAAA,EAAA;AAEjC;AAEO,MAAM,2BAA2BD,SAAAA,cAAgC;AAAA,EACvE,YAA6BE,QAAe;AACrC,UAAA;AADsB,SAAA,QAAAA;AAAA,EAAA;AAAA,EAI7B,MAAM,MAAM,EAAE,MAAoD;AAC3D,UAAA,YAAYC,MAAAA,iBAAiB,KAAK,KAAK;AACvC,UAAA,OAAO,MAAM,gBACjB,MAAM,EAAE,YAAY,UAAW,CAAA,EAC/B,UAAU,EAAE;AAEP,WAAA,KAAK,eAAe,IAAI;AAAA,EAAA;AAEjC;AAaA,MAAM,kBAAkBC,SAAAA,cAAc,OAAA,EACpC,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,UAAU,IAAI,GAAG,WAAW,EACpC,KAAK,SAAS,EACd;AAAA,EAAK;AAAA,EAAY;AAAA,EAAY,CAC7B,eAAA,WAAW,eAAe,CAAC,WAAW,aAAa,GAAGH,kBAAS,IAAI,CAAC,YAAY,IAAI,CAAC;AACtF,EACC;AAAA,EACA;AAAA,EAAU;AAAA,EAAU,QAAM,GAAG;AAAA,IAC5B,CAAC,UAAU,aAAa;AAAA,IAAGA,SAAAA,SAAS;AAAA,IAAI,CAAC,YAAY,IAAI;AAAA,EAAA;AAE3D;;;"}

package/dist/development/src/model/queries/apiKey/ApiKeyQuery.js

@@ -1,6 +1,6 @@
 import { SelectBuilder, Operator, DatabaseQuery } from "@contember/database";
 import "../../type/ApiKey.js";
-import { computeTokenHash } from "../../utils/tokenUtils.js";
+import { computeTokenHash } from "../../utils/token.js";
 class ApiKeyByIdQuery extends DatabaseQuery {
   constructor(apiKeyId) {
     super();

package/dist/development/src/model/queries/authLog/NextLoginAttemptQuery.cjs

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class NextLoginAttemptQuery extends Database.DatabaseQuery {
+  constructor(email) {
+    super();
+    this.email = email;
+  }
+  async fetch({ db }) {
+    const qb = Database.SelectBuilder.create().with("cfg", (it) => it.from("config")).with(
+      "last_successful_reset",
+      (it) => it.select(new Database.Literal("MAX(person_auth_log.created_at)"), "created_at").from("person_auth_log").join("person", "person", (it2) => it2.columnsEq(["person", "id"], ["person_auth_log", "person_id"])).where({
+        type: "password_reset",
+        success: true,
+        email: this.email
+      })
+    ).with(
+      "window_start",
+      (it) => it.select(new Database.Literal(`
+					GREATEST(
+						COALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window), 
+						NOW() - cfg.login_attempt_window
+					)`), "start_time").from("cfg").from("last_successful_reset")
+    ).with(
+      "failed_logins",
+      (it) => it.select(new Database.Literal("COUNT(*)"), "fails").select(new Database.Literal("MAX(person_auth_log.created_at)"), "last_fail").from("person_auth_log").from("window_start").where({
+        person_input_identifier: this.email,
+        type: "login",
+        success: false
+      }).where(new Database.Literal("person_auth_log.created_at >= window_start.start_time"))
+    ).select(new Database.Literal(`
+				CASE WHEN failed_logins.fails = 0 
+				THEN NOW() 
+				ELSE LEAST(
+					failed_logins.last_fail + cfg.login_max_backoff, 
+					failed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))
+				) END`), "next_allowed_login").from("failed_logins").from("cfg");
+    const result = await qb.getResult(db);
+    if (result.length === 0) {
+      return /* @__PURE__ */ new Date();
+    }
+    return result[0].next_allowed_login;
+  }
+}
+exports.NextLoginAttemptQuery = NextLoginAttemptQuery;
+//# sourceMappingURL=NextLoginAttemptQuery.cjs.map

package/dist/development/src/model/queries/authLog/NextLoginAttemptQuery.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"NextLoginAttemptQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextLoginAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\n\nexport class NextLoginAttemptQuery extends DatabaseQuery<Date> {\n\n\tconstructor(\n\t\tprivate readonly email: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Date> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_successful_reset', it => it\n\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t.from('person_auth_log')\n\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t.where({\n\t\t\t\t\ttype: 'password_reset',\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\temail: this.email,\n\t\t\t\t}),\n\t\t\t)\n\t\t\t.with('window_start', it => it\n\t\t\t\t.select(new Literal(`\n\t\t\t\t\tGREATEST(\n\t\t\t\t\t\tCOALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window), \n\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t)`), 'start_time')\n\t\t\t\t.from('cfg')\n\t\t\t\t.from('last_successful_reset'),\n\t\t\t)\n\t\t\t.with('failed_logins', it => it\n\t\t\t\t.select(new Literal('COUNT(*)'), 'fails')\n\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_fail')\n\t\t\t\t.from('person_auth_log')\n\t\t\t\t.from('window_start')\n\t\t\t\t.where({\n\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\ttype: 'login',\n\t\t\t\t\tsuccess: false,\n\t\t\t\t})\n\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')),\n\t\t\t)\n\t\t\t.select(new Literal(`\n\t\t\t\tCASE WHEN failed_logins.fails = 0 \n\t\t\t\tTHEN NOW() \n\t\t\t\tELSE LEAST(\n\t\t\t\t\tfailed_logins.last_fail + cfg.login_max_backoff, \n\t\t\t\t\tfailed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))\n\t\t\t\t) END`), 'next_allowed_login')\n\t\t\t.from('failed_logins')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new Date()\n\t\t}\n\t\treturn result[0].next_allowed_login\n\t}\n\n\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal","it"],"mappings":";;;AAEO,MAAM,8BAA8BA,SAAAA,cAAoB;AAAA,EAE9D,YACkB,OAChB;AACK,UAAA;AAFW,SAAA,QAAA;AAAA,EAAA;AAAA,EAKlB,MAAM,MAAM,EAAE,MAAwC;AAC/C,UAAA,KAAKC,SAAAA,cAAc,OAAA,EACvB,KAAK,OAAO,CAAA,OAAM,GAAG,KAAK,QAAQ,CAAC,EACnC;AAAA,MAAK;AAAA,MAAyB,CAAM,OAAA,GACnC,OAAO,IAAIC,SAAAA,QAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAC,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,QACN,MAAM;AAAA,QACN,SAAS;AAAA,QACT,OAAO,KAAK;AAAA,MACZ,CAAA;AAAA,IAAA,EAED;AAAA,MAAK;AAAA,MAAgB,CAAM,OAAA,GAC1B,OAAO,IAAID,SAAAA,QAAQ;AAAA;AAAA;AAAA;AAAA,OAIjB,GAAG,YAAY,EACjB,KAAK,KAAK,EACV,KAAK,uBAAuB;AAAA,IAAA,EAE7B;AAAA,MAAK;AAAA,MAAiB,CAAA,OAAM,GAC3B,OAAO,IAAIA,iBAAQ,UAAU,GAAG,OAAO,EACvC,OAAO,IAAIA,iBAAQ,iCAAiC,GAAG,WAAW,EAClE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,QACN,yBAAyB,KAAK;AAAA,QAC9B,MAAM;AAAA,QACN,SAAS;AAAA,MACT,CAAA,EACA,MAAM,IAAIA,SAAA,QAAQ,uDAAuD,CAAC;AAAA,IAAA,EAE3E,OAAO,IAAIA,iBAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMb,GAAG,oBAAoB,EAC7B,KAAK,eAAe,EACpB,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AAChC,QAAA,OAAO,WAAW,GAAG;AACxB,iCAAW,KAAK;AAAA,IAAA;AAEV,WAAA,OAAO,CAAC,EAAE;AAAA,EAAA;AAInB;;"}