@contember/engine-tenant-api 2.1.0-alpha.36 → 2.1.0-alpha.39

package/dist/development/src/model/service/ProjectMemberManager.js

@@ -0,0 +1,120 @@
+import "../type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import { AddProjectMemberCommand } from "../commands/membership/AddProjectMemberCommand.js";
+import { RemoveProjectMemberCommand } from "../commands/membership/RemoveProjectMemberCommand.js";
+import { UpdateProjectMemberCommand } from "../commands/membership/UpdateProjectMemberCommand.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import { ProjectMembershipByIdentityQuery } from "../queries/membership/ProjectMembershipByIdentityQuery.js";
+import { ProjectMembersQuery } from "../queries/membership/ProjectMembersQuery.js";
+import { PermissionActions } from "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import { TenantRole } from "../authorization/Roles.js";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import { ProjectRole } from "@contember/schema";
+import { indexListBy, notEmpty } from "../../utils/array.js";
+import { createSetMembershipVariables } from "./membershipUtils.js";
+class ProjectMemberManager {
+  async addProjectMember(dbContext, projectId, identityId, memberships) {
+    return await dbContext.transaction(async (db) => {
+      return await db.commandBus.execute(
+        new AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships))
+      );
+    });
+  }
+  async updateProjectMember(dbContext, projectId, identityId, memberships) {
+    return await dbContext.transaction(
+      async (db) => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships))
+    );
+  }
+  async removeProjectMember(dbContext, projectId, identityId) {
+    return await dbContext.transaction(
+      async (db) => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId))
+    );
+  }
+  async getAllProjectMemberships(dbContext, project, identity, verifier) {
+    return [
+      ...this.getImplicitProjectMemberships(identity),
+      ...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier)
+    ];
+  }
+  async getEffectiveProjectMemberships(dbContext, project, identity) {
+    const implicit = this.getImplicitProjectMemberships(identity);
+    if (implicit.length > 0) {
+      return implicit;
+    }
+    return await this.getStoredProjectsMemberships(dbContext, project, identity, void 0);
+  }
+  async getStoredProjectsMemberships(dbContext, project, identity, verifier) {
+    const memberships = await dbContext.queryHandler.fetch(
+      new ProjectMembershipByIdentityQuery(project, [identity.id])
+    );
+    if (verifier === void 0) {
+      return memberships;
+    }
+    return await this.filterMemberships(memberships, verifier);
+  }
+  getImplicitProjectMemberships(identity) {
+    if (identity.roles?.includes(TenantRole.SUPER_ADMIN) || identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {
+      return [{ role: ProjectRole.ADMIN, variables: [] }];
+    }
+    return [];
+  }
+  async getProjectMembers(dbContext, projectId, accessVerifier, input) {
+    return dbContext.transaction(async (db) => {
+      const members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input));
+      const memberships = await db.queryHandler.fetch(
+        new ProjectMembershipByIdentityQuery(
+          { id: projectId },
+          members.map((it) => it.id)
+        )
+      );
+      const filteredMemberships = await this.filterMemberships(memberships, accessVerifier);
+      const byIdentity = indexListBy(filteredMemberships, "identityId");
+      return members.map((it) => byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null).filter(notEmpty);
+    });
+  }
+  async filterMemberships(memberships, verifier) {
+    const filteredMemberships = [];
+    nextMembership: for (const membership of memberships) {
+      if (!await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }]))) {
+        continue;
+      }
+      const variables = [];
+      for (const variable of membership.variables) {
+        const values = await this.filterProjectMembershipVariableValues(membership, variable, verifier);
+        if (values.length === 0) {
+          continue nextMembership;
+        }
+        variables.push({ name: variable.name, values });
+      }
+      filteredMemberships.push({ ...membership, variables });
+    }
+    return filteredMemberships;
+  }
+  async filterProjectMembershipVariableValues(membership, variable, verifier) {
+    const values = await Promise.all(
+      variable.values.map(async (value) => {
+        const subMembership = {
+          role: membership.role,
+          variables: [
+            {
+              name: variable.name,
+              values: [value]
+            }
+          ]
+        };
+        if (!await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership]))) {
+          return null;
+        }
+        return value;
+      })
+    );
+    return values.filter(notEmpty);
+  }
+}
+export {
+  ProjectMemberManager
+};
+//# sourceMappingURL=ProjectMemberManager.js.map

package/dist/development/src/model/service/ProjectMemberManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectMemberManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectMemberManager.ts"],"sourcesContent":["import {\n\tAddProjectMemberCommand,\n\tMembershipUpdateInput,\n\tRemoveProjectMemberCommand,\n\tRemoveProjectMemberResponse,\n\tUpdateProjectMemberCommand,\n\tUpdateProjectMemberResponse,\n} from '../commands'\nimport { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries'\nimport { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema'\nimport { AccessVerifier, PermissionActions, TenantRole } from '../authorization'\nimport { indexListBy, notEmpty } from '../../utils/array'\nimport { createSetMembershipVariables } from './membershipUtils'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { Response } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\n\nexport class ProjectMemberManager {\n\tasync addProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t): Promise<AddProjectMemberResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await db.commandBus.execute(\n\t\t\t\tnew AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),\n\t\t\t)\n\t\t})\n\t}\n\n\tasync updateProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly MembershipUpdateInput[],\n\t): Promise<UpdateProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships)),\n\t\t)\n\t}\n\n\tasync removeProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string): Promise<RemoveProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId)),\n\t\t)\n\t}\n\n\tasync getAllProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\treturn [\n\t\t\t...this.getImplicitProjectMemberships(identity),\n\t\t\t...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier),\n\t\t]\n\t}\n\n\tasync getEffectiveProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst implicit = this.getImplicitProjectMemberships(identity)\n\t\tif (implicit.length > 0) {\n\t\t\treturn implicit\n\t\t}\n\t\treturn await this.getStoredProjectsMemberships(dbContext, project, identity, undefined)\n\t}\n\n\tasync getStoredProjectsMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst memberships = await dbContext.queryHandler.fetch(\n\t\t\tnew ProjectMembershipByIdentityQuery(project, [identity.id]),\n\t\t)\n\t\tif (verifier === undefined) {\n\t\t\treturn memberships\n\t\t}\n\t\treturn await this.filterMemberships(memberships, verifier)\n\t}\n\n\tprivate getImplicitProjectMemberships(identity: { id: string; roles?: readonly string[] }): readonly Acl.Membership[] {\n\t\tif (identity.roles?.includes(TenantRole.SUPER_ADMIN) || identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {\n\t\t\treturn [{ role: ProjectRole.ADMIN, variables: [] }]\n\t\t}\n\t\treturn []\n\t}\n\n\tasync getProjectMembers(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\taccessVerifier: AccessVerifier,\n\t\tinput: ProjectMembersInput,\n\t): Promise<GetProjectMembersResponse> {\n\t\treturn dbContext.transaction(async db => {\n\t\t\tconst members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))\n\t\t\tconst memberships = await db.queryHandler.fetch(\n\t\t\t\tnew ProjectMembershipByIdentityQuery(\n\t\t\t\t\t{ id: projectId },\n\t\t\t\t\tmembers.map(it => it.id),\n\t\t\t\t),\n\t\t\t)\n\t\t\tconst filteredMemberships = await this.filterMemberships(memberships, accessVerifier)\n\t\t\tconst byIdentity = indexListBy(filteredMemberships, 'identityId')\n\t\t\treturn members\n\t\t\t\t.map(it => (byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null))\n\t\t\t\t.filter(notEmpty)\n\t\t})\n\t}\n\n\tprivate async filterMemberships<T extends Acl.Membership>(\n\t\tmemberships: readonly T[],\n\t\tverifier: AccessVerifier,\n\t): Promise<T[]> {\n\t\tconst filteredMemberships: T[] = []\n\t\tnextMembership: for (const membership of memberships) {\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst variables: { values: Acl.MembershipVariable['values']; name: string }[] = []\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)\n\t\t\t\tif (values.length === 0) {\n\t\t\t\t\tcontinue nextMembership\n\t\t\t\t}\n\t\t\t\tvariables.push({ name: variable.name, values })\n\t\t\t}\n\t\t\tfilteredMemberships.push({ ...membership, variables })\n\t\t}\n\n\t\treturn filteredMemberships\n\t}\n\n\tprivate async filterProjectMembershipVariableValues(\n\t\tmembership: Acl.Membership,\n\t\tvariable: Acl.MembershipVariable,\n\t\tverifier: AccessVerifier,\n\t): Promise<Acl.MembershipVariable['values']> {\n\t\tconst values = await Promise.all(\n\t\t\tvariable.values.map(async (value): Promise<string | null> => {\n\t\t\t\tconst subMembership = {\n\t\t\t\t\trole: membership.role,\n\t\t\t\t\tvariables: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: variable.name,\n\t\t\t\t\t\t\tvalues: [value],\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t}\n\n\t\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership])))) {\n\t\t\t\t\treturn null\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t}),\n\t\t)\n\t\treturn values.filter(notEmpty)\n\t}\n}\n\nexport type AddProjectMemberResponse = Response<null, AddProjectMemberErrorCode>\n\nexport type GetProjectMembersResponse = {\n\tidentity: { id: string }\n\tmemberships: readonly Acl.Membership[]\n}[]\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAqB;AAAA,EACjC,MAAM,iBACL,WACA,WACA,YACA,aACoC;AACpC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,GAAG,WAAW;AAAA,QAC1B,IAAI,wBAAwB,WAAW,YAAY,6BAA6B,WAAW,CAAC;AAAA,MAAA;AAAA,IAE9F,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,oBACL,WACA,WACA,YACA,aACuC;AACvC,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,YAAY,WAAW,CAAC;AAAA,IAAA;AAAA,EAE5G;AAAA,EAEA,MAAM,oBAAoB,WAA4B,WAAmB,YAA0D;AAClI,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,UAAU,CAAC;AAAA,IAAA;AAAA,EAE/F;AAAA,EAEA,MAAM,yBACL,WACA,SACA,UACA,UACqC;AACrC,WAAO;AAAA,MACN,GAAG,KAAK,8BAA8B,QAAQ;AAAA,MAC9C,GAAG,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,QAAQ;AAAA,IAAA;AAAA,EAEnF;AAAA,EAEA,MAAM,+BACL,WACA,SACA,UACqC;AACrC,UAAM,WAAW,KAAK,8BAA8B,QAAQ;AAC5D,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,MAAS;AAAA,EACvF;AAAA,EAEA,MAAM,6BACL,WACA,SACA,UACA,UACqC;AACrC,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAI,iCAAiC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,IAAA;AAE5D,QAAI,aAAa,QAAW;AAC3B,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,kBAAkB,aAAa,QAAQ;AAAA,EAC1D;AAAA,EAEQ,8BAA8B,UAAgF;AACrH,QAAI,SAAS,OAAO,SAAS,WAAW,WAAW,KAAK,SAAS,OAAO,SAAS,WAAW,aAAa,GAAG;AAC3G,aAAO,CAAC,EAAE,MAAM,YAAY,OAAO,WAAW,CAAA,GAAI;AAAA,IACnD;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAM,kBACL,WACA,WACA,gBACA,OACqC;AACrC,WAAO,UAAU,YAAY,OAAM,OAAM;AACxC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,CAAC;AACrF,YAAM,cAAc,MAAM,GAAG,aAAa;AAAA,QACzC,IAAI;AAAA,UACH,EAAE,IAAI,UAAA;AAAA,UACN,QAAQ,IAAI,CAAA,OAAM,GAAG,EAAE;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,sBAAsB,MAAM,KAAK,kBAAkB,aAAa,cAAc;AACpF,YAAM,aAAa,YAAY,qBAAqB,YAAY;AAChE,aAAO,QACL,IAAI,CAAA,OAAO,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa,WAAW,GAAG,EAAE,EAAA,IAAM,IAAK,EACvF,OAAO,QAAQ;AAAA,IAClB,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,aACA,UACe;AACf,UAAM,sBAA2B,CAAA;AACjC,mBAAgB,YAAW,cAAc,aAAa;AACrD,UAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,EAAE,MAAM,WAAW,MAAM,WAAW,GAAC,CAAG,CAAC,CAAC,GAAI;AACzG;AAAA,MACD;AACA,YAAM,YAA0E,CAAA;AAChF,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,SAAS,MAAM,KAAK,sCAAsC,YAAY,UAAU,QAAQ;AAC9F,YAAI,OAAO,WAAW,GAAG;AACxB,mBAAS;AAAA,QACV;AACA,kBAAU,KAAK,EAAE,MAAM,SAAS,MAAM,QAAQ;AAAA,MAC/C;AACA,0BAAoB,KAAK,EAAE,GAAG,YAAY,WAAW;AAAA,IACtD;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,sCACb,YACA,UACA,UAC4C;AAC5C,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC5B,SAAS,OAAO,IAAI,OAAO,UAAkC;AAC5D,cAAM,gBAAgB;AAAA,UACrB,MAAM,WAAW;AAAA,UACjB,WAAW;AAAA,YACV;AAAA,cACC,MAAM,SAAS;AAAA,cACf,QAAQ,CAAC,KAAK;AAAA,YAAA;AAAA,UACf;AAAA,QACD;AAGD,YAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,aAAa,CAAC,CAAC,GAAI;AAC9E,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,MACR,CAAC;AAAA,IAAA;AAEF,WAAO,OAAO,OAAO,QAAQ;AAAA,EAC9B;AACD;"}

package/dist/development/src/model/service/RolesManager.cjs

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+const Response = require("../utils/Response.cjs");
+const PatchIdentityGlobalRoles = require("../commands/identity/PatchIdentityGlobalRoles.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+const Roles = require("../authorization/Roles.cjs");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+class RolesManager {
+  async addGlobalRoles(dbContext, identityId, roles) {
+    return this.patchGlobalRoles(dbContext, identityId, roles, []);
+  }
+  async removeGlobalRoles(dbContext, identityId, roles) {
+    return this.patchGlobalRoles(dbContext, identityId, [], roles);
+  }
+  async patchGlobalRoles(dbContext, identityId, addRoles, removeRoles) {
+    const rolesValidationError = this.validateRoles([...addRoles, ...removeRoles]);
+    if (rolesValidationError) {
+      return rolesValidationError;
+    }
+    const result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles.PatchIdentityGlobalRoles(identityId, addRoles, removeRoles));
+    if (!result) {
+      return new Response.ResponseError("IDENTITY_NOT_FOUND", `Identity ${identityId} not found`);
+    }
+    return new Response.ResponseOk(null);
+  }
+  validateRoles(roles) {
+    for (const role of roles) {
+      if (!Object.values(Roles.TenantRole).includes(role)) {
+        return new Response.ResponseError("INVALID_ROLE", `Role ${role} is not valid`);
+      }
+    }
+    return null;
+  }
+}
+exports.RolesManager = RolesManager;
+//# sourceMappingURL=RolesManager.cjs.map

package/dist/development/src/model/service/RolesManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RolesManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { PatchIdentityGlobalRoles } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { TenantRole } from '../authorization'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":["PatchIdentityGlobalRoles","ResponseError","ResponseOk","TenantRole"],"mappings":";;;;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAIA,yBAAAA,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAIC,SAAAA,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAOC,MAAAA,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAIF,SAAAA,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/service/RolesManager.js

@@ -0,0 +1,42 @@
+import "../type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { PatchIdentityGlobalRoles } from "../commands/identity/PatchIdentityGlobalRoles.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import { TenantRole } from "../authorization/Roles.js";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+class RolesManager {
+  async addGlobalRoles(dbContext, identityId, roles) {
+    return this.patchGlobalRoles(dbContext, identityId, roles, []);
+  }
+  async removeGlobalRoles(dbContext, identityId, roles) {
+    return this.patchGlobalRoles(dbContext, identityId, [], roles);
+  }
+  async patchGlobalRoles(dbContext, identityId, addRoles, removeRoles) {
+    const rolesValidationError = this.validateRoles([...addRoles, ...removeRoles]);
+    if (rolesValidationError) {
+      return rolesValidationError;
+    }
+    const result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles));
+    if (!result) {
+      return new ResponseError("IDENTITY_NOT_FOUND", `Identity ${identityId} not found`);
+    }
+    return new ResponseOk(null);
+  }
+  validateRoles(roles) {
+    for (const role of roles) {
+      if (!Object.values(TenantRole).includes(role)) {
+        return new ResponseError("INVALID_ROLE", `Role ${role} is not valid`);
+      }
+    }
+    return null;
+  }
+}
+export {
+  RolesManager
+};
+//# sourceMappingURL=RolesManager.js.map

package/dist/development/src/model/service/RolesManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RolesManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { PatchIdentityGlobalRoles } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { TenantRole } from '../authorization'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":[],"mappings":";;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAO,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAI,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/service/SecretsManager.cjs

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+const SetProjectSecretCommand = require("../commands/project/SetProjectSecretCommand.cjs");
+const UpdateProjectCommand = require("../commands/project/UpdateProjectCommand.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const ProjectSecretsQuery = require("../queries/project/ProjectSecretsQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+class SecretsManager {
+  constructor(providers) {
+    this.providers = providers;
+  }
+  async setSecret(dbContext, projectId, key, value) {
+    await this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }]);
+  }
+  async readSecrets(dbContext, projectId) {
+    const result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery.ProjectSecretsQuery(projectId, this.providers));
+    const forUpdate = result.filter((it) => it.needsReEncrypt);
+    await this.setSecrets(dbContext, projectId, forUpdate);
+    return Object.fromEntries(result.map((it) => [it.key, it.value.toString()]));
+  }
+  async setSecrets(dbContext, projectId, secrets) {
+    if (secrets.length === 0) {
+      return;
+    }
+    await dbContext.transaction(async (db) => {
+      for (const { key, value } of secrets) {
+        await db.commandBus.execute(new SetProjectSecretCommand.SetProjectSecretCommand(projectId, key, Buffer.from(value)));
+      }
+      await db.commandBus.execute(new UpdateProjectCommand.UpdateProjectCommand(projectId, {}));
+    });
+  }
+}
+exports.SecretsManager = SecretsManager;
+//# sourceMappingURL=SecretsManager.cjs.map

package/dist/development/src/model/service/SecretsManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { Providers } from '../providers'\nimport { ProjectSecretsQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":["ProjectSecretsQuery","SetProjectSecretCommand","UpdateProjectCommand"],"mappings":";;;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,oBAAAA,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;;"}

package/dist/development/src/model/service/SecretsManager.js

@@ -0,0 +1,41 @@
+import "../type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import { SetProjectSecretCommand } from "../commands/project/SetProjectSecretCommand.js";
+import { UpdateProjectCommand } from "../commands/project/UpdateProjectCommand.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import { ProjectSecretsQuery } from "../queries/project/ProjectSecretsQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+class SecretsManager {
+  constructor(providers) {
+    this.providers = providers;
+  }
+  async setSecret(dbContext, projectId, key, value) {
+    await this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }]);
+  }
+  async readSecrets(dbContext, projectId) {
+    const result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers));
+    const forUpdate = result.filter((it) => it.needsReEncrypt);
+    await this.setSecrets(dbContext, projectId, forUpdate);
+    return Object.fromEntries(result.map((it) => [it.key, it.value.toString()]));
+  }
+  async setSecrets(dbContext, projectId, secrets) {
+    if (secrets.length === 0) {
+      return;
+    }
+    await dbContext.transaction(async (db) => {
+      for (const { key, value } of secrets) {
+        await db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)));
+      }
+      await db.commandBus.execute(new UpdateProjectCommand(projectId, {}));
+    });
+  }
+}
+export {
+  SecretsManager
+};
+//# sourceMappingURL=SecretsManager.js.map

package/dist/development/src/model/service/SecretsManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecretsManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { Providers } from '../providers'\nimport { ProjectSecretsQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAI,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;"}

package/dist/development/src/model/service/SignInManager.cjs

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+const exceptions = require("../../exceptions.cjs");
+const PersonQuery = require("../queries/person/PersonQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+const Response = require("../utils/Response.cjs");
+const AuthLogService = require("./AuthLogService.cjs");
+class SignInManager {
+  constructor(apiKeyManager, providers, otpAuthenticator) {
+    this.apiKeyManager = apiKeyManager;
+    this.providers = providers;
+    this.otpAuthenticator = otpAuthenticator;
+  }
+  async signIn(dbContext, email, password, expiration, otpCode) {
+    const person = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email));
+    if (person === null) {
+      return new Response.ResponseError("UNKNOWN_EMAIL", `Person with email ${email} not found`, {
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+          personInput: email
+        })
+      });
+    }
+    const authLogData = {
+      [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+        personInput: email,
+        personId: person.id
+      })
+    };
+    if (!person.password_hash) {
+      return new Response.ResponseError("NO_PASSWORD_SET", `No password set`, authLogData);
+    }
+    if (person.disabled_at !== null) {
+      return new Response.ResponseError("PERSON_DISABLED", `Person is disabled`, authLogData);
+    }
+    const passwordValid = await this.providers.bcryptCompare(password, person.password_hash);
+    if (!passwordValid) {
+      return new Response.ResponseError("INVALID_PASSWORD", `Password does not match`, authLogData);
+    }
+    if (person.otp_uri && person.otp_activated_at) {
+      if (!otpCode) {
+        return new Response.ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, authLogData);
+      }
+      if (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {
+        return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+      }
+    }
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
+    return new Response.ResponseOk({ person, token: sessionToken, ...authLogData });
+  }
+  async createSessionToken(dbContext, personIdentifier, expiration, verifier) {
+    const person = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byUniqueIdentifier(personIdentifier));
+    if (person === null) {
+      if (personIdentifier.type === "email") {
+        return new Response.ResponseError("UNKNOWN_EMAIL", `Person with email ${personIdentifier.email} not found`, {
+          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+            personInput: personIdentifier.email
+          })
+        });
+      } else if (personIdentifier.type === "id") {
+        return new Response.ResponseError("UNKNOWN_PERSON_ID", `Person with id ${personIdentifier.id} not found`, {
+          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+            personInput: personIdentifier.id
+          })
+        });
+      }
+      throw new exceptions.ImplementationException();
+    }
+    const inputValue = personIdentifier.type === "email" ? personIdentifier.email : personIdentifier.id;
+    if (person.disabled_at !== null) {
+      return new Response.ResponseError("PERSON_DISABLED", `Person with id ${person.id} is disabled`, {
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+          personId: person.id,
+          personInput: inputValue
+        })
+      });
+    }
+    await verifier?.(person);
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
+    return new Response.ResponseOk({
+      person,
+      token: sessionToken,
+      [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+        personId: person.id,
+        personInput: inputValue
+      })
+    });
+  }
+}
+exports.SignInManager = SignInManager;
+//# sourceMappingURL=SignInManager.cjs.map

package/dist/development/src/model/service/SignInManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, SignInErrorCode } from '../../schema'\nimport { ApiKeyManager, OtpAuthenticator } from '../service'\nimport { PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ImplementationException } from '../../exceptions'\nimport { AuthLogService } from './AuthLogService'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\tif (person.otp_uri && person.otp_activated_at) {\n\t\t\tif (!otpCode) {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\n\t\t\tif (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\n\t\treturn new ResponseOk({ person, token: sessionToken, ...authLogData })\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":["PersonQuery","ResponseError","AuthLogService","ResponseOk","ImplementationException"],"mappings":";;;;;;;;;;;;;AASA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,kBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,WAA4B,OAAe,UAAkB,YAAqB,SAA2C;AACzI,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMA,wBAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAACA,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAID,SAAAA,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIA,SAAAA,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAEA,QAAI,OAAO,WAAW,OAAO,kBAAkB;AAC9C,UAAI,CAAC,SAAS;AACb,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAEA,UAAI,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,OAAO,GAAG;AACtE,eAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AAAA,IACD;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAE3G,WAAO,IAAIE,SAAAA,WAAW,EAAE,QAAQ,OAAO,cAAc,GAAG,aAAa;AAAA,EACtE;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMH,wBAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAID,SAAAA,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAIE,WAAAA,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIH,SAAAA,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAC3G,WAAO,IAAIC,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAACD,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;;"}

package/dist/development/src/model/service/SignInManager.js

@@ -0,0 +1,96 @@
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import { ImplementationException } from "../../exceptions.js";
+import { PersonQuery } from "../queries/person/PersonQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { AuthLogService } from "./AuthLogService.js";
+class SignInManager {
+  constructor(apiKeyManager, providers, otpAuthenticator) {
+    this.apiKeyManager = apiKeyManager;
+    this.providers = providers;
+    this.otpAuthenticator = otpAuthenticator;
+  }
+  async signIn(dbContext, email, password, expiration, otpCode) {
+    const person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email));
+    if (person === null) {
+      return new ResponseError("UNKNOWN_EMAIL", `Person with email ${email} not found`, {
+        [AuthLogService.Key]: new AuthLogService.Bag({
+          personInput: email
+        })
+      });
+    }
+    const authLogData = {
+      [AuthLogService.Key]: new AuthLogService.Bag({
+        personInput: email,
+        personId: person.id
+      })
+    };
+    if (!person.password_hash) {
+      return new ResponseError("NO_PASSWORD_SET", `No password set`, authLogData);
+    }
+    if (person.disabled_at !== null) {
+      return new ResponseError("PERSON_DISABLED", `Person is disabled`, authLogData);
+    }
+    const passwordValid = await this.providers.bcryptCompare(password, person.password_hash);
+    if (!passwordValid) {
+      return new ResponseError("INVALID_PASSWORD", `Password does not match`, authLogData);
+    }
+    if (person.otp_uri && person.otp_activated_at) {
+      if (!otpCode) {
+        return new ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, authLogData);
+      }
+      if (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {
+        return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+      }
+    }
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
+    return new ResponseOk({ person, token: sessionToken, ...authLogData });
+  }
+  async createSessionToken(dbContext, personIdentifier, expiration, verifier) {
+    const person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier));
+    if (person === null) {
+      if (personIdentifier.type === "email") {
+        return new ResponseError("UNKNOWN_EMAIL", `Person with email ${personIdentifier.email} not found`, {
+          [AuthLogService.Key]: new AuthLogService.Bag({
+            personInput: personIdentifier.email
+          })
+        });
+      } else if (personIdentifier.type === "id") {
+        return new ResponseError("UNKNOWN_PERSON_ID", `Person with id ${personIdentifier.id} not found`, {
+          [AuthLogService.Key]: new AuthLogService.Bag({
+            personInput: personIdentifier.id
+          })
+        });
+      }
+      throw new ImplementationException();
+    }
+    const inputValue = personIdentifier.type === "email" ? personIdentifier.email : personIdentifier.id;
+    if (person.disabled_at !== null) {
+      return new ResponseError("PERSON_DISABLED", `Person with id ${person.id} is disabled`, {
+        [AuthLogService.Key]: new AuthLogService.Bag({
+          personId: person.id,
+          personInput: inputValue
+        })
+      });
+    }
+    await verifier?.(person);
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
+    return new ResponseOk({
+      person,
+      token: sessionToken,
+      [AuthLogService.Key]: new AuthLogService.Bag({
+        personId: person.id,
+        personInput: inputValue
+      })
+    });
+  }
+}
+export {
+  SignInManager
+};
+//# sourceMappingURL=SignInManager.js.map

package/dist/development/src/model/service/SignInManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, SignInErrorCode } from '../../schema'\nimport { ApiKeyManager, OtpAuthenticator } from '../service'\nimport { PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ImplementationException } from '../../exceptions'\nimport { AuthLogService } from './AuthLogService'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\tif (person.otp_uri && person.otp_activated_at) {\n\t\t\tif (!otpCode) {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\n\t\t\tif (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\n\t\treturn new ResponseOk({ person, token: sessionToken, ...authLogData })\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":[],"mappings":";;;;;;;;;;;AASA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,kBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,WAA4B,OAAe,UAAkB,YAAqB,SAA2C;AACzI,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAI,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAI,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAI,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAEA,QAAI,OAAO,WAAW,OAAO,kBAAkB;AAC9C,UAAI,CAAC,SAAS;AACb,eAAO,IAAI,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAEA,UAAI,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,OAAO,GAAG;AACtE,eAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AAAA,IACD;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAE3G,WAAO,IAAI,WAAW,EAAE,QAAQ,OAAO,cAAc,GAAG,aAAa;AAAA,EACtE;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAI,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAI,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAI,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAC3G,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;"}

package/dist/development/src/model/service/SignUpManager.cjs

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+const Response = require("../utils/Response.cjs");
+const CreatePersonCommand = require("../commands/person/CreatePersonCommand.cjs");
+const CreateIdentityCommand = require("../commands/identity/CreateIdentityCommand.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+const Roles = require("../authorization/Roles.cjs");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+class SignUpManager {
+  constructor(emailValidator, passwordStrengthValidator) {
+    this.emailValidator = emailValidator;
+    this.passwordStrengthValidator = passwordStrengthValidator;
+  }
+  async signUp(dbContext, { email, password, roles = [] }) {
+    const validationError = await this.emailValidator.validateEmail(dbContext, email);
+    if (validationError !== null) {
+      return validationError;
+    }
+    const plainPassword = password.getPlain();
+    if (plainPassword) {
+      const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+      const passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, "TOO_WEAK");
+      if (!passwordVerifyResult.ok) {
+        return passwordVerifyResult;
+      }
+    }
+    const person = await dbContext.transaction(async (db) => {
+      const identityId = await db.commandBus.execute(new CreateIdentityCommand.CreateIdentityCommand([...roles, Roles.TenantRole.PERSON]));
+      return await db.commandBus.execute(new CreatePersonCommand.CreatePersonCommand({ identityId, email, password }));
+    });
+    return new Response.ResponseOk(new SignUpResult(person));
+  }
+}
+class SignUpResult {
+  constructor(person) {
+    this.person = person;
+  }
+}
+exports.SignUpManager = SignUpManager;
+exports.SignUpResult = SignUpResult;
+//# sourceMappingURL=SignUpManager.cjs.map

package/dist/development/src/model/service/SignUpManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignUpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { SignUpErrorCode, WeakPasswordReason } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { Response, ResponseOk } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\nimport { MaybePassword } from '../dtos'\nimport { EmailValidator } from './EmailValidator'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, { email, password, roles = [] }: SignUpUser): Promise<SignUpResponse> {\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, email)\n\t\tif (validationError !== null) {\n\t\t\treturn validationError\n\t\t}\n\t\tconst plainPassword = password.getPlain()\n\n\t\tif (plainPassword) {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tconst passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')\n\t\t\tif (!passwordVerifyResult.ok) {\n\t\t\t\treturn passwordVerifyResult\n\t\t\t}\n\t\t}\n\n\t\tconst person = await dbContext.transaction(async db => {\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\treturn await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password }))\n\t\t})\n\t\treturn new ResponseOk(new SignUpResult(person))\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>) {}\n}\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n}>\n"],"names":["ConfigurationQuery","CreateIdentityCommand","TenantRole","CreatePersonCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;AAiBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBACA,2BAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EAElB;AAAA,EAEA,MAAM,OAAO,WAA4B,EAAE,OAAO,UAAU,QAAQ,CAAA,KAA2C;AAC9G,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK;AAChF,QAAI,oBAAoB,MAAM;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,gBAAgB,SAAS,SAAA;AAE/B,QAAI,eAAe;AAClB,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,mBAAAA,oBAAoB;AAC1E,YAAM,uBAAuB,MAAM,KAAK,0BAA0B,OAAO,eAAe,OAAO,UAAU,UAAU;AACnH,UAAI,CAAC,qBAAqB,IAAI;AAC7B,eAAO;AAAA,MACR;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,OAAM;AACtD,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIC,4CAAsB,CAAC,GAAG,OAAOC,iBAAW,MAAM,CAAC,CAAC;AACvG,aAAO,MAAM,GAAG,WAAW,QAAQ,IAAIC,wCAAoB,EAAE,YAAY,OAAO,SAAA,CAAU,CAAC;AAAA,IAC5F,CAAC;AACD,WAAO,IAAIC,SAAAA,WAAW,IAAI,aAAa,MAAM,CAAC;AAAA,EAC/C;AACD;AAEO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkC;AAAlC,SAAA,SAAA;AAAA,EAAmC;AAChE;;;"}