npm - @contember/engine-tenant-api - Versions diffs - 2.1.0-alpha.21 → 2.1.0-alpha.23 - Mend

@contember/engine-tenant-api 2.1.0-alpha.21 → 2.1.0-alpha.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/dist/development/src/model/mailing/UserMailer.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UserMailer.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils'\nimport NewUserInvited from './templates/NewUserInvited.mustache'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache'\nimport PasswordReset from './templates/PasswordReset.mustache'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type'\nimport { MailTemplateQuery } from '../queries'\nimport Layout from './templates/Layout.mustache'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) { }\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; password: string \| null; token: string \| null; project: string; projectSlug: string; memberships: readonly Acl.Membership[]},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo ? {\n\t\t\t\treplyTo: template.replyTo,\n\t\t\t} : {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'> \| null> {\n\t\tconst customTemplate =\n\t\t\t(await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":["MailType","NewUserInvited","ExistingUserInvited","PasswordReset","PasswordlessSignIn","MailTemplateQuery","Layout"],"mappings":";;;;;;;;;;;;;;;;AAWO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMA,KAAS,SAAA,gBAAgB,GAAG,kBAAkB;AACzE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASC;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMD,KAAS,SAAA,qBAAqB,GAAG,kBAAkB;AAC9E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASE;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMF,KAAS,SAAA,eAAe,GAAG,kBAAkB;AACxE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASG;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMH,KAAS,SAAA,oBAAoB,GAAG,kBAAkB;AAC7E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASI;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AACrE,UAAA,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UAAU;AAAA,QACtB,SAAS,SAAS;AAAA,MAAA,IACf,CAAA;AAAA,IAAC,CACL;AAAA,EAAA;AAAA,EAGF,MAAc,kBACb,WACA,YAC4E;AACtE,UAAA,iBACJ,MAAM,UAAU,aAAa,MAAM,IAAIC,kBAAA,kBAAkB,UAAU,CAAC,KACjE,MAAM,UAAU,aAAa,MAAM,IAAIA,oCAAkB,EAAE,GAAG,YAAY,WAAW,KAAK,CAAC,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACb,aAAA;AAAA,IAAA;AAER,UAAM,UAAU,eAAe,YAAYC,gBAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAQ;AAAA,EAAA;AAErF;;"}
1	+ {"version":3,"file":"UserMailer.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils'\nimport NewUserInvited from './templates/NewUserInvited.mustache'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache'\nimport PasswordReset from './templates/PasswordReset.mustache'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type'\nimport { MailTemplateQuery } from '../queries'\nimport Layout from './templates/Layout.mustache'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) { }\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; password: string \| null; token: string \| null; project: string; projectSlug: string; memberships: readonly Acl.Membership[]},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string; requestId: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo ? {\n\t\t\t\treplyTo: template.replyTo,\n\t\t\t} : {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'> \| null> {\n\t\tconst customTemplate =\n\t\t\t(await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":["MailType","NewUserInvited","ExistingUserInvited","PasswordReset","PasswordlessSignIn","MailTemplateQuery","Layout"],"mappings":";;;;;;;;;;;;;;;;AAWO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMA,KAAS,SAAA,gBAAgB,GAAG,kBAAkB;AACzE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASC;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMD,KAAS,SAAA,qBAAqB,GAAG,kBAAkB;AAC9E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASE;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMF,KAAS,SAAA,eAAe,GAAG,kBAAkB;AACxE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASG;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMH,KAAS,SAAA,oBAAoB,GAAG,kBAAkB;AAC7E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASI;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AACrE,UAAA,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UAAU;AAAA,QACtB,SAAS,SAAS;AAAA,MAAA,IACf,CAAA;AAAA,IAAC,CACL;AAAA,EAAA;AAAA,EAGF,MAAc,kBACb,WACA,YAC4E;AACtE,UAAA,iBACJ,MAAM,UAAU,aAAa,MAAM,IAAIC,kBAAA,kBAAkB,UAAU,CAAC,KACjE,MAAM,UAAU,aAAa,MAAM,IAAIA,oCAAkB,EAAE,GAAG,YAAY,WAAW,KAAK,CAAC,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACb,aAAA;AAAA,IAAA;AAER,UAAM,UAAU,eAAe,YAAYC,gBAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAQ;AAAA,EAAA;AAErF;;"}

package/dist/development/src/model/mailing/UserMailer.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UserMailer.js","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils'\nimport NewUserInvited from './templates/NewUserInvited.mustache'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache'\nimport PasswordReset from './templates/PasswordReset.mustache'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type'\nimport { MailTemplateQuery } from '../queries'\nimport Layout from './templates/Layout.mustache'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) { }\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; password: string \| null; token: string \| null; project: string; projectSlug: string; memberships: readonly Acl.Membership[]},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo ? {\n\t\t\t\treplyTo: template.replyTo,\n\t\t\t} : {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'> \| null> {\n\t\tconst customTemplate =\n\t\t\t(await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAWO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,gBAAgB,GAAG,kBAAkB;AACzE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,qBAAqB,GAAG,kBAAkB;AAC9E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,eAAe,GAAG,kBAAkB;AACxE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,oBAAoB,GAAG,kBAAkB;AAC7E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AACrE,UAAA,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UAAU;AAAA,QACtB,SAAS,SAAS;AAAA,MAAA,IACf,CAAA;AAAA,IAAC,CACL;AAAA,EAAA;AAAA,EAGF,MAAc,kBACb,WACA,YAC4E;AACtE,UAAA,iBACJ,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,UAAU,CAAC,KACjE,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,EAAE,GAAG,YAAY,WAAW,KAAK,CAAC,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACb,aAAA;AAAA,IAAA;AAER,UAAM,UAAU,eAAe,YAAY,OAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAQ;AAAA,EAAA;AAErF;"}
1	+ {"version":3,"file":"UserMailer.js","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils'\nimport NewUserInvited from './templates/NewUserInvited.mustache'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache'\nimport PasswordReset from './templates/PasswordReset.mustache'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type'\nimport { MailTemplateQuery } from '../queries'\nimport Layout from './templates/Layout.mustache'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) { }\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; password: string \| null; token: string \| null; project: string; projectSlug: string; memberships: readonly Acl.Membership[]},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string; requestId: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo ? {\n\t\t\t\treplyTo: template.replyTo,\n\t\t\t} : {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'> \| null> {\n\t\tconst customTemplate =\n\t\t\t(await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAWO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,gBAAgB,GAAG,kBAAkB;AACzE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,qBAAqB,GAAG,kBAAkB;AAC9E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,eAAe,GAAG,kBAAkB;AACxE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,oBAAoB,GAAG,kBAAkB;AAC7E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AACrE,UAAA,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UAAU;AAAA,QACtB,SAAS,SAAS;AAAA,MAAA,IACf,CAAA;AAAA,IAAC,CACL;AAAA,EAAA;AAAA,EAGF,MAAc,kBACb,WACA,YAC4E;AACtE,UAAA,iBACJ,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,UAAU,CAAC,KACjE,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,EAAE,GAAG,YAAY,WAAW,KAAK,CAAC,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACb,aAAA;AAAA,IAAA;AAER,UAAM,UAAU,eAAe,YAAY,OAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAQ;AAAA,EAAA;AAErF;"}

package/dist/development/src/model/service/PasswordlessSignInManager.cjs CHANGED Viewed

@@ -62,7 +62,8 @@ class PasswordlessSignInManager {
         token: result.token,
         url,
         project: project?.name,
-        projectSlug: project?.slug
+        projectSlug: project?.slug,
+        requestId: result.id
       }, {
         variant: mailVariant || "",
         projectId: project?.id ?? null

package/dist/development/src/model/service/PasswordlessSignInManager.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PasswordlessSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ActivatePasswordlessOtpErrorCode, ConfigPolicy, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant \|\| '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string \| null, token: string, requestId: string, email: string): string \| null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean \| null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, InitSignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, ActivatePasswordlessOtpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db","ConfigurationQuery","ResponseError","AuthLogService","PersonQuery","CreatePersonTokenCommand","intervalToSeconds","getPreferredProject","ResponseOk","token","PersonTokenQuery","validateToken","IncreaseOtpAttemptCommand","ImplementationException","InvalidateTokenCommand","ActivateOtpCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAEhB;AALgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AACtE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAIC,SAAAA,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAe,eAAA,IAAI,CAAE,CAAA;AAAA,QAAA,CAC/C;AAAA,MAAA;AAGI,YAAA,SAAS,MAAMH,IAAG,aAAa,MAAMI,wBAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAIF,SAAA,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UACb,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAID,SAAAA,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UACjB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGI,YAAA,qBAAqBE,yBAAAA,yBAAyB,0BAA0B,OAAO,IAAIC,2BAAkB,cAAc,aAAa,UAAU,IAAI,EAAE;AACtJ,YAAM,SAAS,MAAMN,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAUO,oBAAA,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBP,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA,GACpB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAChB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoBM,QAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAASA,MAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,mBAAYA,SAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOT,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAIY,0BAAAA,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAE3E,eAAO,IAAIV,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEF,UAAI,CAAC,aAAa;AACjB,cAAM,IAAIU,WAAAA,wBAAwB;AAAA,MAAA;AAE7B,YAAA,YAAY,MAAMb,IAAG,aAAa,MAAMI,wBAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAIS,WAAAA,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAIX,SAAc,cAAA,mBAAmB,sBAAsB;AAAA,UACjE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGE,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAID,SAAc,cAAA,gBAAgB,yCAAyC;AAAA,YACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAGE,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAID,SAAAA,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAAA,MACF;AAGKH,YAAAA,IAAG,WAAW,QAAQ,IAAIc,8CAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBd,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,WAAIM,SAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOT,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAIE,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGIH,YAAAA,IAAG,WAAW,QAAQ,IAAIe,mBAAAA,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAIP,SAAAA,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;;"}
1	+ {"version":3,"file":"PasswordlessSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ActivatePasswordlessOtpErrorCode, ConfigPolicy, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\trequestId: result.id,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant \|\| '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string \| null, token: string, requestId: string, email: string): string \| null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean \| null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, InitSignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, ActivatePasswordlessOtpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db","ConfigurationQuery","ResponseError","AuthLogService","PersonQuery","CreatePersonTokenCommand","intervalToSeconds","getPreferredProject","ResponseOk","token","PersonTokenQuery","validateToken","IncreaseOtpAttemptCommand","ImplementationException","InvalidateTokenCommand","ActivateOtpCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAEhB;AALgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AACtE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAIC,SAAAA,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAe,eAAA,IAAI,CAAE,CAAA;AAAA,QAAA,CAC/C;AAAA,MAAA;AAGI,YAAA,SAAS,MAAMH,IAAG,aAAa,MAAMI,wBAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAIF,SAAA,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UACb,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAID,SAAAA,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UACjB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGI,YAAA,qBAAqBE,yBAAAA,yBAAyB,0BAA0B,OAAO,IAAIC,2BAAkB,cAAc,aAAa,UAAU,IAAI,EAAE;AACtJ,YAAM,SAAS,MAAMN,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAUO,oBAAA,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBP,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,QACtB,WAAW,OAAO;AAAA,MAAA,GAChB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAChB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoBM,QAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAASA,MAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,mBAAYA,SAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOT,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAIY,0BAAAA,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAE3E,eAAO,IAAIV,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEF,UAAI,CAAC,aAAa;AACjB,cAAM,IAAIU,WAAAA,wBAAwB;AAAA,MAAA;AAE7B,YAAA,YAAY,MAAMb,IAAG,aAAa,MAAMI,wBAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAIS,WAAAA,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAIX,SAAc,cAAA,mBAAmB,sBAAsB;AAAA,UACjE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGE,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAID,SAAc,cAAA,gBAAgB,yCAAyC;AAAA,YACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAGE,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAID,SAAAA,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAAA,MACF;AAGKH,YAAAA,IAAG,WAAW,QAAQ,IAAIc,8CAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBd,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,WAAIM,SAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOT,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAIE,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGIH,YAAAA,IAAG,WAAW,QAAQ,IAAIe,mBAAAA,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAIP,SAAAA,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;;"}

package/dist/development/src/model/service/PasswordlessSignInManager.js CHANGED Viewed

@@ -60,7 +60,8 @@ class PasswordlessSignInManager {
         token: result.token,
         url,
         project: project?.name,
-        projectSlug: project?.slug
+        projectSlug: project?.slug,
+        requestId: result.id
       }, {
         variant: mailVariant || "",
         projectId: project?.id ?? null

package/dist/development/src/model/service/PasswordlessSignInManager.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PasswordlessSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ActivatePasswordlessOtpErrorCode, ConfigPolicy, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant \|\| '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string \| null, token: string, requestId: string, email: string): string \| null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean \| null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, InitSignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, ActivatePasswordlessOtpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAEhB;AALgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAI,oBAAoB;AACtE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAI,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI,CAAE,CAAA;AAAA,QAAA,CAC/C;AAAA,MAAA;AAGI,YAAA,SAAS,MAAMA,IAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAI,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UACb,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAI,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UACjB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGI,YAAA,qBAAqB,yBAAyB,0BAA0B,OAAO,IAAI,kBAAkB,cAAc,aAAa,UAAU,IAAI,EAAE;AACtJ,YAAM,SAAS,MAAMA,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAU,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBA,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA,GACpB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAI,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAChB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoB,OAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAAS,KAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,YAAY,OAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOA,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAI,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAE3E,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEF,UAAI,CAAC,aAAa;AACjB,cAAM,IAAI,wBAAwB;AAAA,MAAA;AAE7B,YAAA,YAAY,MAAMA,IAAG,aAAa,MAAM,YAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAI,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAI,cAAc,mBAAmB,sBAAsB;AAAA,UACjE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGE,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAI,cAAc,gBAAgB,yCAAyC;AAAA,YACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAGE,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAAA,MACF;AAGKA,YAAAA,IAAG,WAAW,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBA,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,IAAI,OAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOA,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGIA,YAAAA,IAAG,WAAW,QAAQ,IAAI,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;"}
1	+ {"version":3,"file":"PasswordlessSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ActivatePasswordlessOtpErrorCode, ConfigPolicy, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\trequestId: result.id,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant \|\| '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string \| null, token: string, requestId: string, email: string): string \| null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean \| null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, InitSignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, ActivatePasswordlessOtpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAEhB;AALgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAI,oBAAoB;AACtE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAI,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI,CAAE,CAAA;AAAA,QAAA,CAC/C;AAAA,MAAA;AAGI,YAAA,SAAS,MAAMA,IAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAI,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UACb,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAI,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UACjB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGI,YAAA,qBAAqB,yBAAyB,0BAA0B,OAAO,IAAI,kBAAkB,cAAc,aAAa,UAAU,IAAI,EAAE;AACtJ,YAAM,SAAS,MAAMA,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAU,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBA,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,QACtB,WAAW,OAAO;AAAA,MAAA,GAChB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAI,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAChB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoB,OAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAAS,KAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,YAAY,OAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOA,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAI,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAE3E,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEF,UAAI,CAAC,aAAa;AACjB,cAAM,IAAI,wBAAwB;AAAA,MAAA;AAE7B,YAAA,YAAY,MAAMA,IAAG,aAAa,MAAM,YAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAI,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAI,cAAc,mBAAmB,sBAAsB;AAAA,UACjE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGE,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAI,cAAc,gBAAgB,yCAAyC;AAAA,YACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAGE,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAAA,MACF;AAGKA,YAAAA,IAAG,WAAW,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBA,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,IAAI,OAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOA,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGIA,YAAAA,IAAG,WAAW,QAAQ,IAAI,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;"}

package/dist/production/src/model/mailing/UserMailer.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UserMailer.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils'\nimport NewUserInvited from './templates/NewUserInvited.mustache'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache'\nimport PasswordReset from './templates/PasswordReset.mustache'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type'\nimport { MailTemplateQuery } from '../queries'\nimport Layout from './templates/Layout.mustache'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) { }\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; password: string \| null; token: string \| null; project: string; projectSlug: string; memberships: readonly Acl.Membership[]},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo ? {\n\t\t\t\treplyTo: template.replyTo,\n\t\t\t} : {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'> \| null> {\n\t\tconst customTemplate =\n\t\t\t(await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":["MailType","NewUserInvited","ExistingUserInvited","PasswordReset","PasswordlessSignIn","MailTemplateQuery","Layout"],"mappings":";;;;;;;;;;;;;;;;AAWO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMA,KAAS,SAAA,gBAAgB,GAAG,kBAAkB;AACzE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASC;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMD,KAAS,SAAA,qBAAqB,GAAG,kBAAkB;AAC9E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASE;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMF,KAAS,SAAA,eAAe,GAAG,kBAAkB;AACxE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASG;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMH,KAAS,SAAA,oBAAoB,GAAG,kBAAkB;AAC7E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASI;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AACrE,UAAA,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UAAU;AAAA,QACtB,SAAS,SAAS;AAAA,MAAA,IACf,CAAA;AAAA,IAAC,CACL;AAAA,EAAA;AAAA,EAGF,MAAc,kBACb,WACA,YAC4E;AACtE,UAAA,iBACJ,MAAM,UAAU,aAAa,MAAM,IAAIC,kBAAA,kBAAkB,UAAU,CAAC,KACjE,MAAM,UAAU,aAAa,MAAM,IAAIA,oCAAkB,EAAE,GAAG,YAAY,WAAW,KAAK,CAAC,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACb,aAAA;AAAA,IAAA;AAER,UAAM,UAAU,eAAe,YAAYC,gBAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAQ;AAAA,EAAA;AAErF;;"}
1	+ {"version":3,"file":"UserMailer.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils'\nimport NewUserInvited from './templates/NewUserInvited.mustache'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache'\nimport PasswordReset from './templates/PasswordReset.mustache'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type'\nimport { MailTemplateQuery } from '../queries'\nimport Layout from './templates/Layout.mustache'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) { }\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; password: string \| null; token: string \| null; project: string; projectSlug: string; memberships: readonly Acl.Membership[]},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string; requestId: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo ? {\n\t\t\t\treplyTo: template.replyTo,\n\t\t\t} : {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'> \| null> {\n\t\tconst customTemplate =\n\t\t\t(await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":["MailType","NewUserInvited","ExistingUserInvited","PasswordReset","PasswordlessSignIn","MailTemplateQuery","Layout"],"mappings":";;;;;;;;;;;;;;;;AAWO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMA,KAAS,SAAA,gBAAgB,GAAG,kBAAkB;AACzE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASC;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMD,KAAS,SAAA,qBAAqB,GAAG,kBAAkB;AAC9E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASE;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMF,KAAS,SAAA,eAAe,GAAG,kBAAkB;AACxE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASG;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMH,KAAS,SAAA,oBAAoB,GAAG,kBAAkB;AAC7E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASI;AAAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AACrE,UAAA,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UAAU;AAAA,QACtB,SAAS,SAAS;AAAA,MAAA,IACf,CAAA;AAAA,IAAC,CACL;AAAA,EAAA;AAAA,EAGF,MAAc,kBACb,WACA,YAC4E;AACtE,UAAA,iBACJ,MAAM,UAAU,aAAa,MAAM,IAAIC,kBAAA,kBAAkB,UAAU,CAAC,KACjE,MAAM,UAAU,aAAa,MAAM,IAAIA,oCAAkB,EAAE,GAAG,YAAY,WAAW,KAAK,CAAC,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACb,aAAA;AAAA,IAAA;AAER,UAAM,UAAU,eAAe,YAAYC,gBAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAQ;AAAA,EAAA;AAErF;;"}

package/dist/production/src/model/mailing/UserMailer.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UserMailer.js","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils'\nimport NewUserInvited from './templates/NewUserInvited.mustache'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache'\nimport PasswordReset from './templates/PasswordReset.mustache'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type'\nimport { MailTemplateQuery } from '../queries'\nimport Layout from './templates/Layout.mustache'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) { }\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; password: string \| null; token: string \| null; project: string; projectSlug: string; memberships: readonly Acl.Membership[]},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo ? {\n\t\t\t\treplyTo: template.replyTo,\n\t\t\t} : {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'> \| null> {\n\t\tconst customTemplate =\n\t\t\t(await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAWO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,gBAAgB,GAAG,kBAAkB;AACzE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,qBAAqB,GAAG,kBAAkB;AAC9E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,eAAe,GAAG,kBAAkB;AACxE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,oBAAoB,GAAG,kBAAkB;AAC7E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AACrE,UAAA,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UAAU;AAAA,QACtB,SAAS,SAAS;AAAA,MAAA,IACf,CAAA;AAAA,IAAC,CACL;AAAA,EAAA;AAAA,EAGF,MAAc,kBACb,WACA,YAC4E;AACtE,UAAA,iBACJ,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,UAAU,CAAC,KACjE,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,EAAE,GAAG,YAAY,WAAW,KAAK,CAAC,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACb,aAAA;AAAA,IAAA;AAER,UAAM,UAAU,eAAe,YAAY,OAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAQ;AAAA,EAAA;AAErF;"}
1	+ {"version":3,"file":"UserMailer.js","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils'\nimport NewUserInvited from './templates/NewUserInvited.mustache'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache'\nimport PasswordReset from './templates/PasswordReset.mustache'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type'\nimport { MailTemplateQuery } from '../queries'\nimport Layout from './templates/Layout.mustache'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) { }\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; password: string \| null; token: string \| null; project: string; projectSlug: string; memberships: readonly Acl.Membership[]},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string; requestId: string },\n\t\tcustomMailOptions: { projectId: string \| null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) \|\| {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo ? {\n\t\t\t\treplyTo: template.replyTo,\n\t\t\t} : {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' \| 'content' \| 'replyTo'> \| null> {\n\t\tconst customTemplate =\n\t\t\t(await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAWO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,gBAAgB,GAAG,kBAAkB;AACzE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,qBAAqB,GAAG,kBAAkB;AAC9E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,eAAe,GAAG,kBAAkB;AACxE,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,oBAAoB,GAAG,kBAAkB;AAC7E,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IACV;AACA,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EAAA;AAAA,EAGxD,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AACrE,UAAA,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UAAU;AAAA,QACtB,SAAS,SAAS;AAAA,MAAA,IACf,CAAA;AAAA,IAAC,CACL;AAAA,EAAA;AAAA,EAGF,MAAc,kBACb,WACA,YAC4E;AACtE,UAAA,iBACJ,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,UAAU,CAAC,KACjE,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,EAAE,GAAG,YAAY,WAAW,KAAK,CAAC,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACb,aAAA;AAAA,IAAA;AAER,UAAM,UAAU,eAAe,YAAY,OAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAQ;AAAA,EAAA;AAErF;"}

package/dist/production/src/model/service/PasswordlessSignInManager.cjs CHANGED Viewed

@@ -62,7 +62,8 @@ class PasswordlessSignInManager {
         token: result.token,
         url,
         project: project?.name,
-        projectSlug: project?.slug
+        projectSlug: project?.slug,
+        requestId: result.id
       }, {
         variant: mailVariant || "",
         projectId: project?.id ?? null

package/dist/production/src/model/service/PasswordlessSignInManager.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PasswordlessSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ActivatePasswordlessOtpErrorCode, ConfigPolicy, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant \|\| '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string \| null, token: string, requestId: string, email: string): string \| null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean \| null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, InitSignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, ActivatePasswordlessOtpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db","ConfigurationQuery","ResponseError","AuthLogService","PersonQuery","CreatePersonTokenCommand","intervalToSeconds","getPreferredProject","ResponseOk","token","PersonTokenQuery","validateToken","IncreaseOtpAttemptCommand","ImplementationException","InvalidateTokenCommand","ActivateOtpCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAEhB;AALgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AACtE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAIC,SAAAA,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAe,eAAA,IAAI,CAAE,CAAA;AAAA,QAAA,CAC/C;AAAA,MAAA;AAGI,YAAA,SAAS,MAAMH,IAAG,aAAa,MAAMI,wBAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAIF,SAAA,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UACb,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAID,SAAAA,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UACjB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGI,YAAA,qBAAqBE,yBAAAA,yBAAyB,0BAA0B,OAAO,IAAIC,2BAAkB,cAAc,aAAa,UAAU,IAAI,EAAE;AACtJ,YAAM,SAAS,MAAMN,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAUO,oBAAA,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBP,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA,GACpB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAChB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoBM,QAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAASA,MAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,mBAAYA,SAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOT,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAIY,0BAAAA,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAE3E,eAAO,IAAIV,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEF,UAAI,CAAC,aAAa;AACjB,cAAM,IAAIU,WAAAA,wBAAwB;AAAA,MAAA;AAE7B,YAAA,YAAY,MAAMb,IAAG,aAAa,MAAMI,wBAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAIS,WAAAA,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAIX,SAAc,cAAA,mBAAmB,sBAAsB;AAAA,UACjE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGE,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAID,SAAc,cAAA,gBAAgB,yCAAyC;AAAA,YACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAGE,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAID,SAAAA,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAAA,MACF;AAGKH,YAAAA,IAAG,WAAW,QAAQ,IAAIc,8CAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBd,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,WAAIM,SAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOT,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAIE,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGIH,YAAAA,IAAG,WAAW,QAAQ,IAAIe,mBAAAA,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAIP,SAAAA,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;;"}
1	+ {"version":3,"file":"PasswordlessSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ActivatePasswordlessOtpErrorCode, ConfigPolicy, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\trequestId: result.id,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant \|\| '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string \| null, token: string, requestId: string, email: string): string \| null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean \| null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, InitSignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, ActivatePasswordlessOtpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db","ConfigurationQuery","ResponseError","AuthLogService","PersonQuery","CreatePersonTokenCommand","intervalToSeconds","getPreferredProject","ResponseOk","token","PersonTokenQuery","validateToken","IncreaseOtpAttemptCommand","ImplementationException","InvalidateTokenCommand","ActivateOtpCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAEhB;AALgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AACtE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAIC,SAAAA,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAe,eAAA,IAAI,CAAE,CAAA;AAAA,QAAA,CAC/C;AAAA,MAAA;AAGI,YAAA,SAAS,MAAMH,IAAG,aAAa,MAAMI,wBAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAIF,SAAA,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UACb,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAID,SAAAA,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UACjB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGI,YAAA,qBAAqBE,yBAAAA,yBAAyB,0BAA0B,OAAO,IAAIC,2BAAkB,cAAc,aAAa,UAAU,IAAI,EAAE;AACtJ,YAAM,SAAS,MAAMN,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAUO,oBAAA,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBP,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,QACtB,WAAW,OAAO;AAAA,MAAA,GAChB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAChB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoBM,QAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAASA,MAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,mBAAYA,SAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOT,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAIY,0BAAAA,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAE3E,eAAO,IAAIV,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEF,UAAI,CAAC,aAAa;AACjB,cAAM,IAAIU,WAAAA,wBAAwB;AAAA,MAAA;AAE7B,YAAA,YAAY,MAAMb,IAAG,aAAa,MAAMI,wBAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAIS,WAAAA,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAIX,SAAc,cAAA,mBAAmB,sBAAsB;AAAA,UACjE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGE,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAID,SAAc,cAAA,gBAAgB,yCAAyC;AAAA,YACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAGE,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAID,SAAAA,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAAA,MACF;AAGKH,YAAAA,IAAG,WAAW,QAAQ,IAAIc,8CAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBd,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,WAAIM,SAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOT,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAIE,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGIH,YAAAA,IAAG,WAAW,QAAQ,IAAIe,mBAAAA,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAIP,SAAAA,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;;"}

package/dist/production/src/model/service/PasswordlessSignInManager.js CHANGED Viewed

@@ -60,7 +60,8 @@ class PasswordlessSignInManager {
         token: result.token,
         url,
         project: project?.name,
-        projectSlug: project?.slug
+        projectSlug: project?.slug,
+        requestId: result.id
       }, {
         variant: mailVariant || "",
         projectId: project?.id ?? null

package/dist/production/src/model/service/PasswordlessSignInManager.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PasswordlessSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ActivatePasswordlessOtpErrorCode, ConfigPolicy, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant \|\| '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string \| null, token: string, requestId: string, email: string): string \| null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean \| null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, InitSignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, ActivatePasswordlessOtpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAEhB;AALgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAI,oBAAoB;AACtE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAI,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI,CAAE,CAAA;AAAA,QAAA,CAC/C;AAAA,MAAA;AAGI,YAAA,SAAS,MAAMA,IAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAI,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UACb,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAI,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UACjB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGI,YAAA,qBAAqB,yBAAyB,0BAA0B,OAAO,IAAI,kBAAkB,cAAc,aAAa,UAAU,IAAI,EAAE;AACtJ,YAAM,SAAS,MAAMA,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAU,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBA,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA,GACpB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAI,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAChB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoB,OAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAAS,KAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,YAAY,OAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOA,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAI,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAE3E,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEF,UAAI,CAAC,aAAa;AACjB,cAAM,IAAI,wBAAwB;AAAA,MAAA;AAE7B,YAAA,YAAY,MAAMA,IAAG,aAAa,MAAM,YAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAI,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAI,cAAc,mBAAmB,sBAAsB;AAAA,UACjE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGE,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAI,cAAc,gBAAgB,yCAAyC;AAAA,YACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAGE,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAAA,MACF;AAGKA,YAAAA,IAAG,WAAW,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBA,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,IAAI,OAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOA,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGIA,YAAAA,IAAG,WAAW,QAAQ,IAAI,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;"}
1	+ {"version":3,"file":"PasswordlessSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ActivatePasswordlessOtpErrorCode, ConfigPolicy, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\trequestId: result.id,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant \|\| '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string \| null, token: string, requestId: string, email: string): string \| null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean \| null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, InitSignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, ActivatePasswordlessOtpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAEhB;AALgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAI,oBAAoB;AACtE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAI,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI,CAAE,CAAA;AAAA,QAAA,CAC/C;AAAA,MAAA;AAGI,YAAA,SAAS,MAAMA,IAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAI,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UACb,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAI,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UACjB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGI,YAAA,qBAAqB,yBAAyB,0BAA0B,OAAO,IAAI,kBAAkB,cAAc,aAAa,UAAU,IAAI,EAAE;AACtJ,YAAM,SAAS,MAAMA,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAU,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBA,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,QACtB,WAAW,OAAO;AAAA,MAAA,GAChB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAI,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAChB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoB,OAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAAS,KAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,YAAY,OAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOA,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAI,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAE3E,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEF,UAAI,CAAC,aAAa;AACjB,cAAM,IAAI,wBAAwB;AAAA,MAAA;AAE7B,YAAA,YAAY,MAAMA,IAAG,aAAa,MAAM,YAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAI,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAI,cAAc,mBAAmB,sBAAsB;AAAA,UACjE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGE,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAI,cAAc,gBAAgB,yCAAyC;AAAA,YACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAGE,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAAA,MACF;AAGKA,YAAAA,IAAG,WAAW,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBA,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,IAAI,OAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOA,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGIA,YAAAA,IAAG,WAAW,QAAQ,IAAI,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;"}