@contember/engine-tenant-api 2.1.0-alpha.30 → 2.1.0-alpha.35

package/dist/development/src/model/service/PasswordlessSignInManager.cjs

@@ -1,201 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-require("../queries/apiKey/ApiKeyQuery.cjs");
-const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
-require("@contember/database");
-const exceptions = require("../../exceptions.cjs");
-const PersonQuery = require("../queries/person/PersonQuery.cjs");
-require("../authorization/PermissionActions.cjs");
-require("@contember/authorization");
-require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
-require("@contember/schema");
-const Response = require("../utils/Response.cjs");
-require("../type/ApiKey.cjs");
-const ActivateOtpCommand = require("../commands/personToken/ActivateOtpCommand.cjs");
-const CreatePersonTokenCommand = require("../commands/personToken/CreatePersonTokenCommand.cjs");
-const InvalidateTokenCommand = require("../commands/personToken/InvalidateTokenCommand.cjs");
-const IncreaseOtpAttemptCommand = require("../commands/personToken/IncreaseOtpAttemptCommand.cjs");
-const PersonTokenQuery = require("../queries/personToken/PersonTokenQuery.cjs");
-const token = require("../utils/token.cjs");
-const getPreferredProject = require("./helpers/getPreferredProject.cjs");
-const AuthLogService = require("./AuthLogService.cjs");
-const interval = require("../utils/interval.cjs");
-class PasswordlessSignInManager {
-  constructor(apiKeyManager, mailer, projectManager, otpAuthenticator) {
-    this.apiKeyManager = apiKeyManager;
-    this.mailer = mailer;
-    this.projectManager = projectManager;
-    this.otpAuthenticator = otpAuthenticator;
-  }
-  async initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }) {
-    return db.transaction(async (db2) => {
-      const configuration = await db2.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
-      if (configuration.passwordless.enabled === "never") {
-        return new Response.ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled", {
-          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({})
-        });
-      }
-      const person = await db2.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email));
-      if (!person) {
-        return new Response.ResponseError("PERSON_NOT_FOUND", `Person ${email} not found`, {
-          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
-            personInput: email
-          })
-        });
-      }
-      if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
-        return new Response.ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person", {
-          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
-            personInput: email,
-            personId: person.id
-          })
-        });
-      }
-      const createTokenCommand = CreatePersonTokenCommand.CreatePersonTokenCommand.createPasswordlessRequest(person.id, interval.intervalToSeconds(configuration.passwordless.expiration) / 60);
-      const result = await db2.commandBus.execute(createTokenCommand);
-      const url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? void 0;
-      const projects = await this.projectManager.getProjectsByIdentity(db2, person.identity_id, permissionContext);
-      const project = getPreferredProject.getPreferredProject(projects, mailProject ?? null);
-      await this.mailer.sendPasswordlessEmail(db2, {
-        email,
-        token: result.token,
-        url,
-        project: project?.name,
-        projectSlug: project?.slug,
-        requestId: result.id
-      }, {
-        variant: mailVariant || "",
-        projectId: project?.id ?? null
-      });
-      return new Response.ResponseOk({
-        requestId: result.id,
-        expiresAt: result.expiresAt,
-        person,
-        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
-          personInput: email,
-          personId: person.id,
-          tokenId: result.id
-        })
-      });
-    });
-  }
-  formatUrl(url, token2, requestId, email) {
-    if (!url) {
-      return null;
-    }
-    const urlObj = new URL(url);
-    urlObj.searchParams.set("token", token2);
-    urlObj.searchParams.set("request_id", requestId);
-    urlObj.searchParams.set("email", email);
-    return urlObj.toString();
-  }
-  async signInPasswordless({ db, expiration, token: token$1, requestId, mfaOtp, validationType }) {
-    return db.transaction(async (db2) => {
-      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byId(requestId, "passwordless"));
-      const tokenValidationResult = token.validateToken({
-        entry: tokenResult,
-        token: token$1,
-        now: db2.providers.now(),
-        validationType
-      });
-      if (!tokenValidationResult.ok) {
-        if (tokenValidationResult.error === "TOKEN_INVALID" && validationType === "otp") {
-          await db2.commandBus.execute(new IncreaseOtpAttemptCommand.IncreaseOtpAttemptCommand(tokenResult.id));
-        }
-        return new Response.ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
-          ...tokenValidationResult.metadata ?? {},
-          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
-            personId: tokenResult?.person_id,
-            tokenId: tokenResult?.id
-          })
-        });
-      }
-      if (!tokenResult) {
-        throw new exceptions.ImplementationException();
-      }
-      const personRow = await db2.queryHandler.fetch(PersonQuery.PersonQuery.byId(tokenValidationResult.result.person_id));
-      if (!personRow) {
-        throw new exceptions.ImplementationException();
-      }
-      if (personRow.disabled_at !== null) {
-        return new Response.ResponseError("PERSON_DISABLED", `Person is disabled`, {
-          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
-            personId: personRow.id,
-            tokenId: tokenResult?.id
-          })
-        });
-      }
-      if (personRow.otp_uri && personRow.otp_activated_at) {
-        if (!mfaOtp) {
-          return new Response.ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, {
-            [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
-              personId: personRow.id,
-              tokenId: tokenResult?.id
-            })
-          });
-        }
-        if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
-          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", {
-            [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
-              personId: personRow.id,
-              tokenId: tokenResult?.id
-            })
-          });
-        }
-      }
-      await db2.commandBus.execute(new InvalidateTokenCommand.InvalidateTokenCommand(tokenValidationResult.result.id));
-      const sessionToken = await this.apiKeyManager.createSessionApiKey(db2, personRow.identity_id, expiration);
-      return new Response.ResponseOk({
-        person: personRow,
-        token: sessionToken,
-        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
-          personId: personRow.id,
-          tokenId: tokenResult?.id
-        })
-      });
-    });
-  }
-  async activatePasswordlessOtp({ db, token: token$1, requestId, otpHash }) {
-    return db.transaction(async (db2) => {
-      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byId(requestId, "passwordless"));
-      const tokenValidationResult = token.validateToken({
-        entry: tokenResult,
-        token: token$1,
-        now: db2.providers.now(),
-        validationType: "token"
-      });
-      if (!tokenValidationResult.ok) {
-        return new Response.ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
-          ...tokenValidationResult.metadata ?? {},
-          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
-            personId: tokenResult?.person_id,
-            tokenId: tokenResult?.id
-          })
-        });
-      }
-      await db2.commandBus.execute(new ActivateOtpCommand.ActivateOtpCommand(tokenValidationResult.result.id, otpHash));
-      return new Response.ResponseOk({
-        person: tokenResult?.person_id,
-        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
-          personId: tokenResult?.person_id,
-          tokenId: tokenResult?.id
-        })
-      });
-    });
-  }
-  isEnabled(globalValue, personValue) {
-    switch (globalValue) {
-      case "always":
-        return true;
-      case "never":
-        return false;
-      case "optIn":
-        return personValue === true;
-      case "optOut":
-        return personValue !== false;
-    }
-  }
-}
-exports.PasswordlessSignInManager = PasswordlessSignInManager;
-//# sourceMappingURL=PasswordlessSignInManager.cjs.map

package/dist/development/src/model/service/PasswordlessSignInManager.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"PasswordlessSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ActivatePasswordlessOtpErrorCode, ConfigPolicy, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\trequestId: result.id,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string | null, token: string, requestId: string, email: string): string | null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean | null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, InitSignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, ActivatePasswordlessOtpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db","ConfigurationQuery","ResponseError","AuthLogService","PersonQuery","CreatePersonTokenCommand","intervalToSeconds","getPreferredProject","ResponseOk","token","PersonTokenQuery","validateToken","IncreaseOtpAttemptCommand","ImplementationException","InvalidateTokenCommand","ActivateOtpCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAEhB;AALgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AACtE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAIC,SAAAA,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAe,eAAA,IAAI,CAAE,CAAA;AAAA,QAAA,CAC/C;AAAA,MAAA;AAGI,YAAA,SAAS,MAAMH,IAAG,aAAa,MAAMI,wBAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAIF,SAAA,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UACb,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAID,SAAAA,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UACjB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGI,YAAA,qBAAqBE,yBAAAA,yBAAyB,0BAA0B,OAAO,IAAIC,2BAAkB,cAAc,aAAa,UAAU,IAAI,EAAE;AACtJ,YAAM,SAAS,MAAMN,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAUO,oBAAA,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBP,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,QACtB,WAAW,OAAO;AAAA,MAAA,GAChB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAChB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoBM,QAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAASA,MAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,mBAAYA,SAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOT,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAIY,0BAAAA,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAE3E,eAAO,IAAIV,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEF,UAAI,CAAC,aAAa;AACjB,cAAM,IAAIU,WAAAA,wBAAwB;AAAA,MAAA;AAE7B,YAAA,YAAY,MAAMb,IAAG,aAAa,MAAMI,wBAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAIS,WAAAA,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAIX,SAAc,cAAA,mBAAmB,sBAAsB;AAAA,UACjE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGE,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAID,SAAc,cAAA,gBAAgB,yCAAyC;AAAA,YACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAGE,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAID,SAAAA,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAAA,MACF;AAGKH,YAAAA,IAAG,WAAW,QAAQ,IAAIc,8CAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBd,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,WAAIM,SAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOT,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAIE,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGIH,YAAAA,IAAG,WAAW,QAAQ,IAAIe,mBAAAA,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAIP,SAAAA,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;;"}

package/dist/development/src/model/service/PasswordlessSignInManager.js

@@ -1,201 +0,0 @@
-import "../queries/apiKey/ApiKeyQuery.js";
-import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
-import "@contember/database";
-import { ImplementationException } from "../../exceptions.js";
-import { PersonQuery } from "../queries/person/PersonQuery.js";
-import "../authorization/PermissionActions.js";
-import "@contember/authorization";
-import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
-import "@contember/schema";
-import { ResponseError, ResponseOk } from "../utils/Response.js";
-import "../type/ApiKey.js";
-import { ActivateOtpCommand } from "../commands/personToken/ActivateOtpCommand.js";
-import { CreatePersonTokenCommand } from "../commands/personToken/CreatePersonTokenCommand.js";
-import { InvalidateTokenCommand } from "../commands/personToken/InvalidateTokenCommand.js";
-import { IncreaseOtpAttemptCommand } from "../commands/personToken/IncreaseOtpAttemptCommand.js";
-import { PersonTokenQuery } from "../queries/personToken/PersonTokenQuery.js";
-import { validateToken } from "../utils/token.js";
-import { getPreferredProject } from "./helpers/getPreferredProject.js";
-import { AuthLogService } from "./AuthLogService.js";
-import { intervalToSeconds } from "../utils/interval.js";
-class PasswordlessSignInManager {
-  constructor(apiKeyManager, mailer, projectManager, otpAuthenticator) {
-    this.apiKeyManager = apiKeyManager;
-    this.mailer = mailer;
-    this.projectManager = projectManager;
-    this.otpAuthenticator = otpAuthenticator;
-  }
-  async initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }) {
-    return db.transaction(async (db2) => {
-      const configuration = await db2.queryHandler.fetch(new ConfigurationQuery());
-      if (configuration.passwordless.enabled === "never") {
-        return new ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled", {
-          [AuthLogService.Key]: new AuthLogService.Bag({})
-        });
-      }
-      const person = await db2.queryHandler.fetch(PersonQuery.byEmail(email));
-      if (!person) {
-        return new ResponseError("PERSON_NOT_FOUND", `Person ${email} not found`, {
-          [AuthLogService.Key]: new AuthLogService.Bag({
-            personInput: email
-          })
-        });
-      }
-      if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
-        return new ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person", {
-          [AuthLogService.Key]: new AuthLogService.Bag({
-            personInput: email,
-            personId: person.id
-          })
-        });
-      }
-      const createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60);
-      const result = await db2.commandBus.execute(createTokenCommand);
-      const url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? void 0;
-      const projects = await this.projectManager.getProjectsByIdentity(db2, person.identity_id, permissionContext);
-      const project = getPreferredProject(projects, mailProject ?? null);
-      await this.mailer.sendPasswordlessEmail(db2, {
-        email,
-        token: result.token,
-        url,
-        project: project?.name,
-        projectSlug: project?.slug,
-        requestId: result.id
-      }, {
-        variant: mailVariant || "",
-        projectId: project?.id ?? null
-      });
-      return new ResponseOk({
-        requestId: result.id,
-        expiresAt: result.expiresAt,
-        person,
-        [AuthLogService.Key]: new AuthLogService.Bag({
-          personInput: email,
-          personId: person.id,
-          tokenId: result.id
-        })
-      });
-    });
-  }
-  formatUrl(url, token, requestId, email) {
-    if (!url) {
-      return null;
-    }
-    const urlObj = new URL(url);
-    urlObj.searchParams.set("token", token);
-    urlObj.searchParams.set("request_id", requestId);
-    urlObj.searchParams.set("email", email);
-    return urlObj.toString();
-  }
-  async signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }) {
-    return db.transaction(async (db2) => {
-      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.byId(requestId, "passwordless"));
-      const tokenValidationResult = validateToken({
-        entry: tokenResult,
-        token,
-        now: db2.providers.now(),
-        validationType
-      });
-      if (!tokenValidationResult.ok) {
-        if (tokenValidationResult.error === "TOKEN_INVALID" && validationType === "otp") {
-          await db2.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult.id));
-        }
-        return new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
-          ...tokenValidationResult.metadata ?? {},
-          [AuthLogService.Key]: new AuthLogService.Bag({
-            personId: tokenResult?.person_id,
-            tokenId: tokenResult?.id
-          })
-        });
-      }
-      if (!tokenResult) {
-        throw new ImplementationException();
-      }
-      const personRow = await db2.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id));
-      if (!personRow) {
-        throw new ImplementationException();
-      }
-      if (personRow.disabled_at !== null) {
-        return new ResponseError("PERSON_DISABLED", `Person is disabled`, {
-          [AuthLogService.Key]: new AuthLogService.Bag({
-            personId: personRow.id,
-            tokenId: tokenResult?.id
-          })
-        });
-      }
-      if (personRow.otp_uri && personRow.otp_activated_at) {
-        if (!mfaOtp) {
-          return new ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, {
-            [AuthLogService.Key]: new AuthLogService.Bag({
-              personId: personRow.id,
-              tokenId: tokenResult?.id
-            })
-          });
-        }
-        if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
-          return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", {
-            [AuthLogService.Key]: new AuthLogService.Bag({
-              personId: personRow.id,
-              tokenId: tokenResult?.id
-            })
-          });
-        }
-      }
-      await db2.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id));
-      const sessionToken = await this.apiKeyManager.createSessionApiKey(db2, personRow.identity_id, expiration);
-      return new ResponseOk({
-        person: personRow,
-        token: sessionToken,
-        [AuthLogService.Key]: new AuthLogService.Bag({
-          personId: personRow.id,
-          tokenId: tokenResult?.id
-        })
-      });
-    });
-  }
-  async activatePasswordlessOtp({ db, token, requestId, otpHash }) {
-    return db.transaction(async (db2) => {
-      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.byId(requestId, "passwordless"));
-      const tokenValidationResult = validateToken({
-        entry: tokenResult,
-        token,
-        now: db2.providers.now(),
-        validationType: "token"
-      });
-      if (!tokenValidationResult.ok) {
-        return new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
-          ...tokenValidationResult.metadata ?? {},
-          [AuthLogService.Key]: new AuthLogService.Bag({
-            personId: tokenResult?.person_id,
-            tokenId: tokenResult?.id
-          })
-        });
-      }
-      await db2.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash));
-      return new ResponseOk({
-        person: tokenResult?.person_id,
-        [AuthLogService.Key]: new AuthLogService.Bag({
-          personId: tokenResult?.person_id,
-          tokenId: tokenResult?.id
-        })
-      });
-    });
-  }
-  isEnabled(globalValue, personValue) {
-    switch (globalValue) {
-      case "always":
-        return true;
-      case "never":
-        return false;
-      case "optIn":
-        return personValue === true;
-      case "optOut":
-        return personValue !== false;
-    }
-  }
-}
-export {
-  PasswordlessSignInManager
-};
-//# sourceMappingURL=PasswordlessSignInManager.js.map

package/dist/development/src/model/service/PasswordlessSignInManager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PasswordlessSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ActivatePasswordlessOtpErrorCode, ConfigPolicy, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(person.id, intervalToSeconds(configuration.passwordless.expiration) / 60)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\trequestId: result.id,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string | null, token: string, requestId: string, email: string): string | null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean | null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, InitSignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}, ActivatePasswordlessOtpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAEhB;AALgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AAC9D,WAAA,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAI,oBAAoB;AACtE,UAAA,cAAc,aAAa,YAAY,SAAS;AAC5C,eAAA,IAAI,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI,CAAE,CAAA;AAAA,QAAA,CAC/C;AAAA,MAAA;AAGI,YAAA,SAAS,MAAMA,IAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAI,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UACb,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEE,UAAA,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC9E,eAAA,IAAI,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UACjB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGI,YAAA,qBAAqB,yBAAyB,0BAA0B,OAAO,IAAI,kBAAkB,cAAc,aAAa,UAAU,IAAI,EAAE;AACtJ,YAAM,SAAS,MAAMA,IAAG,WAAW,QAAQ,kBAAkB;AAG7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEhG,YAAA,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAU,oBAAoB,UAAU,eAAe,IAAI;AAE3D,YAAA,KAAK,OAAO,sBAAsBA,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,QACtB,WAAW,OAAO;AAAA,MAAA,GAChB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAI,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAChB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,KAAoB,OAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACF,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,IAAI,IAAI,GAAG;AACnB,WAAA,aAAa,IAAI,SAAS,KAAK;AAC/B,WAAA,aAAa,IAAI,cAAc,SAAS;AACxC,WAAA,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAS;AAAA,EAAA;AAAA,EAGxB,MAAM,mBAAmB,EAAE,IAAI,YAAY,OAAO,WAAW,QAAQ,kBAOH;AAC1D,WAAA,GAAG,YAAY,OAAOA,QAAsE;AAE5F,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB;AAAA,MAAA,CACA;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAI,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAAA;AAE3E,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAEF,UAAI,CAAC,aAAa;AACjB,cAAM,IAAI,wBAAwB;AAAA,MAAA;AAE7B,YAAA,YAAY,MAAMA,IAAG,aAAa,MAAM,YAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAI,wBAAwB;AAAA,MAAA;AAE/B,UAAA,UAAU,gBAAgB,MAAM;AAC5B,eAAA,IAAI,cAAc,mBAAmB,sBAAsB;AAAA,UACjE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGE,UAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACL,iBAAA,IAAI,cAAc,gBAAgB,yCAAyC;AAAA,YACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAGE,YAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACjE,iBAAA,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YACtB,CAAA;AAAA,UAAA,CACD;AAAA,QAAA;AAAA,MACF;AAGKA,YAAAA,IAAG,WAAW,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACjF,YAAA,eAAe,MAAM,KAAK,cAAc,oBAAoBA,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGF,MAAM,wBAAwB,EAAE,IAAI,OAAO,WAAW,WAKiB;AAC/D,WAAA,GAAG,YAAY,OAAOA,QAA2E;AAEjG,YAAA,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAI;AAAA,QACtB,gBAAgB;AAAA,MAAA,CAChB;AACG,UAAA,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAC;AAAA,UACtC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UACtB,CAAA;AAAA,QAAA,CACD;AAAA,MAAA;AAGIA,YAAAA,IAAG,WAAW,QAAQ,IAAI,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QACtB,CAAA;AAAA,MAAA,CACD;AAAA,IAAA,CACD;AAAA,EAAA;AAAA,EAGM,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAa;AAAA,MACpB,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACG,eAAA;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EACzB;AAEF;"}

package/dist/development/src/model/service/PersonAccessManager.cjs

@@ -1,27 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const DisablePersonCommand = require("../commands/person/DisablePersonCommand.cjs");
-const Response = require("../utils/Response.cjs");
-class PersonAccessManager {
-  constructor(apiKeyManager) {
-    this.apiKeyManager = apiKeyManager;
-  }
-  async disablePerson(dbContext, person) {
-    return await dbContext.transaction(async (trx) => {
-      if (person.disabled_at !== null) {
-        return new Response.ResponseError("PERSON_ALREADY_DISABLED", "Person is already disabled");
-      }
-      await this.disablePersonAccount(trx, person.id);
-      await this.disableIdentityApiKeys(trx, person.identity_id);
-      return new Response.ResponseOk(null);
-    });
-  }
-  async disablePersonAccount(dbContext, personId) {
-    await dbContext.commandBus.execute(new DisablePersonCommand.DisablePersonCommand(personId));
-  }
-  async disableIdentityApiKeys(dbContext, personIdentityId) {
-    await this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId);
-  }
-}
-exports.PersonAccessManager = PersonAccessManager;
-//# sourceMappingURL=PersonAccessManager.cjs.map

package/dist/development/src/model/service/PersonAccessManager.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"PersonAccessManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand'\nimport { ApiKeyManager } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DisablePersonErrorCode } from '../../schema'\n\nclass PersonAccessManager {\n\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonDisableAccessResponse> {\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tif (person.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, person.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, person.identity_id)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":["ResponseError","ResponseOk","DisablePersonCommand"],"mappings":";;;;AAOA,MAAM,oBAAoB;AAAA,EAEzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,cAAc,WAA4B,QAAyD;AACxG,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC3C,UAAA,OAAO,gBAAgB,MAAM;AACzB,eAAA,IAAIA,SAAAA,cAAc,2BAA2B,4BAA4B;AAAA,MAAA;AAIjF,YAAM,KAAK,qBAAqB,KAAK,OAAO,EAAE;AAC9C,YAAM,KAAK,uBAAuB,KAAK,OAAO,WAAW;AAElD,aAAA,IAAIC,oBAAW,IAAI;AAAA,IAAA,CAC1B;AAAA,EAAA;AAAA,EAGF,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAA,qBAAqB,QAAQ,CAAC;AAAA,EAAA;AAAA,EAGtE,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAAA;AAE7E;;"}

package/dist/development/src/model/service/PersonAccessManager.js

@@ -1,27 +0,0 @@
-import { DisablePersonCommand } from "../commands/person/DisablePersonCommand.js";
-import { ResponseError, ResponseOk } from "../utils/Response.js";
-class PersonAccessManager {
-  constructor(apiKeyManager) {
-    this.apiKeyManager = apiKeyManager;
-  }
-  async disablePerson(dbContext, person) {
-    return await dbContext.transaction(async (trx) => {
-      if (person.disabled_at !== null) {
-        return new ResponseError("PERSON_ALREADY_DISABLED", "Person is already disabled");
-      }
-      await this.disablePersonAccount(trx, person.id);
-      await this.disableIdentityApiKeys(trx, person.identity_id);
-      return new ResponseOk(null);
-    });
-  }
-  async disablePersonAccount(dbContext, personId) {
-    await dbContext.commandBus.execute(new DisablePersonCommand(personId));
-  }
-  async disableIdentityApiKeys(dbContext, personIdentityId) {
-    await this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId);
-  }
-}
-export {
-  PersonAccessManager
-};
-//# sourceMappingURL=PersonAccessManager.js.map

package/dist/development/src/model/service/PersonAccessManager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PersonAccessManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand'\nimport { ApiKeyManager } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DisablePersonErrorCode } from '../../schema'\n\nclass PersonAccessManager {\n\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonDisableAccessResponse> {\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tif (person.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, person.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, person.identity_id)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":[],"mappings":";;AAOA,MAAM,oBAAoB;AAAA,EAEzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAAA;AAAA,EAE7B,MAAM,cAAc,WAA4B,QAAyD;AACxG,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC3C,UAAA,OAAO,gBAAgB,MAAM;AACzB,eAAA,IAAI,cAAc,2BAA2B,4BAA4B;AAAA,MAAA;AAIjF,YAAM,KAAK,qBAAqB,KAAK,OAAO,EAAE;AAC9C,YAAM,KAAK,uBAAuB,KAAK,OAAO,WAAW;AAElD,aAAA,IAAI,WAAW,IAAI;AAAA,IAAA,CAC1B;AAAA,EAAA;AAAA,EAGF,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,CAAC;AAAA,EAAA;AAAA,EAGtE,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAAA;AAE7E;"}

package/dist/development/src/model/service/PersonManager.cjs

@@ -1,41 +0,0 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const ChangeProfileCommand = require("../commands/person/ChangeProfileCommand.cjs");
-const Response = require("../utils/Response.cjs");
-require("../queries/apiKey/ApiKeyQuery.cjs");
-require("@contember/database");
-const PersonQuery = require("../queries/person/PersonQuery.cjs");
-require("../authorization/PermissionActions.cjs");
-require("@contember/authorization");
-require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
-require("@contember/schema");
-require("../type/ApiKey.cjs");
-require("node:crypto");
-const TogglePersonPasswordlessCommand = require("../commands/person/TogglePersonPasswordlessCommand.cjs");
-class PersonManager {
-  constructor(emailValidator) {
-    this.emailValidator = emailValidator;
-  }
-  async findPersonById(dbContext, personId) {
-    return await dbContext.queryHandler.fetch(
-      PersonQuery.PersonQuery.byId(personId)
-    );
-  }
-  async changeProfile(dbContext, person, data) {
-    if (data.email !== void 0 && person.email !== data.email) {
-      const validationError = await this.emailValidator.validateEmail(dbContext, data.email);
-      if (validationError !== null) {
-        return new Response.ResponseError(validationError.error, validationError.errorMessage);
-      }
-    }
-    await dbContext.commandBus.execute(new ChangeProfileCommand.ChangeProfileCommand(person.id, data));
-    return new Response.ResponseOk(null);
-  }
-  async togglePasswordless(dbContext, person, value) {
-    await dbContext.commandBus.execute(new TogglePersonPasswordlessCommand.TogglePersonPasswordlessCommand(person.id, value));
-    return new Response.ResponseOk(null);
-  }
-}
-exports.PersonManager = PersonManager;
-//# sourceMappingURL=PersonManager.cjs.map

package/dist/development/src/model/service/PersonManager.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"PersonManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator'\nimport { TogglePersonPasswordlessCommand } from '../commands'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\tif (data.email !== undefined && person.email !== data.email) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":["PersonQuery","ResponseError","ChangeProfileCommand","ResponseOk","TogglePersonPasswordlessCommand"],"mappings":";;;;;;;;;;;;;;;AAOA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,eAAe,WAA4B,UAA6C;AACtF,WAAA,MAAM,UAAU,aAAa;AAAA,MACnCA,YAAA,YAAY,KAAK,QAAQ;AAAA,IAC1B;AAAA,EAAA;AAAA,EAGD,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AACzI,QAAI,KAAK,UAAU,UAAa,OAAO,UAAU,KAAK,OAAO;AAC5D,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAK;AACrF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAIC,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAAA;AAAA,IAC7E;AAEK,UAAA,UAAU,WAAW,QAAQ,IAAIC,0CAAqB,OAAO,IAAI,IAAI,CAAC;AACrE,WAAA,IAAIC,oBAAW,IAAI;AAAA,EAAA;AAAA,EAG3B,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACjH,UAAA,UAAU,WAAW,QAAQ,IAAIC,gEAAgC,OAAO,IAAI,KAAK,CAAC;AACjF,WAAA,IAAID,oBAAW,IAAI;AAAA,EAAA;AAG5B;;"}

package/dist/development/src/model/service/PersonManager.js

@@ -1,41 +0,0 @@
-import { ChangeProfileCommand } from "../commands/person/ChangeProfileCommand.js";
-import { ResponseError, ResponseOk } from "../utils/Response.js";
-import "../queries/apiKey/ApiKeyQuery.js";
-import "@contember/database";
-import { PersonQuery } from "../queries/person/PersonQuery.js";
-import "../authorization/PermissionActions.js";
-import "@contember/authorization";
-import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
-import "@contember/schema";
-import "../type/ApiKey.js";
-import "node:crypto";
-import { TogglePersonPasswordlessCommand } from "../commands/person/TogglePersonPasswordlessCommand.js";
-class PersonManager {
-  constructor(emailValidator) {
-    this.emailValidator = emailValidator;
-  }
-  async findPersonById(dbContext, personId) {
-    return await dbContext.queryHandler.fetch(
-      PersonQuery.byId(personId)
-    );
-  }
-  async changeProfile(dbContext, person, data) {
-    if (data.email !== void 0 && person.email !== data.email) {
-      const validationError = await this.emailValidator.validateEmail(dbContext, data.email);
-      if (validationError !== null) {
-        return new ResponseError(validationError.error, validationError.errorMessage);
-      }
-    }
-    await dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data));
-    return new ResponseOk(null);
-  }
-  async togglePasswordless(dbContext, person, value) {
-    await dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value));
-    return new ResponseOk(null);
-  }
-}
-export {
-  PersonManager
-};
-//# sourceMappingURL=PersonManager.js.map

package/dist/development/src/model/service/PersonManager.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"PersonManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator'\nimport { TogglePersonPasswordlessCommand } from '../commands'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\tif (data.email !== undefined && person.email !== data.email) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":[],"mappings":";;;;;;;;;;;;;AAOA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,eAAe,WAA4B,UAA6C;AACtF,WAAA,MAAM,UAAU,aAAa;AAAA,MACnC,YAAY,KAAK,QAAQ;AAAA,IAC1B;AAAA,EAAA;AAAA,EAGD,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AACzI,QAAI,KAAK,UAAU,UAAa,OAAO,UAAU,KAAK,OAAO;AAC5D,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAK;AACrF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAAA;AAAA,IAC7E;AAEK,UAAA,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,IAAI,IAAI,CAAC;AACrE,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAAA,EAG3B,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACjH,UAAA,UAAU,WAAW,QAAQ,IAAI,gCAAgC,OAAO,IAAI,KAAK,CAAC;AACjF,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAG5B;"}