@contember/engine-tenant-api 2.1.0-alpha.36 → 2.1.0-alpha.39

package/dist/development/src/model/service/SignUpManager.js

@@ -0,0 +1,49 @@
+import "../type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import { ResponseOk } from "../utils/Response.js";
+import { CreatePersonCommand } from "../commands/person/CreatePersonCommand.js";
+import { CreateIdentityCommand } from "../commands/identity/CreateIdentityCommand.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import { TenantRole } from "../authorization/Roles.js";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+class SignUpManager {
+  constructor(emailValidator, passwordStrengthValidator) {
+    this.emailValidator = emailValidator;
+    this.passwordStrengthValidator = passwordStrengthValidator;
+  }
+  async signUp(dbContext, { email, password, roles = [] }) {
+    const validationError = await this.emailValidator.validateEmail(dbContext, email);
+    if (validationError !== null) {
+      return validationError;
+    }
+    const plainPassword = password.getPlain();
+    if (plainPassword) {
+      const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+      const passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, "TOO_WEAK");
+      if (!passwordVerifyResult.ok) {
+        return passwordVerifyResult;
+      }
+    }
+    const person = await dbContext.transaction(async (db) => {
+      const identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]));
+      return await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password }));
+    });
+    return new ResponseOk(new SignUpResult(person));
+  }
+}
+class SignUpResult {
+  constructor(person) {
+    this.person = person;
+  }
+}
+export {
+  SignUpManager,
+  SignUpResult
+};
+//# sourceMappingURL=SignUpManager.js.map

package/dist/development/src/model/service/SignUpManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignUpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { SignUpErrorCode, WeakPasswordReason } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { Response, ResponseOk } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\nimport { MaybePassword } from '../dtos'\nimport { EmailValidator } from './EmailValidator'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, { email, password, roles = [] }: SignUpUser): Promise<SignUpResponse> {\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, email)\n\t\tif (validationError !== null) {\n\t\t\treturn validationError\n\t\t}\n\t\tconst plainPassword = password.getPlain()\n\n\t\tif (plainPassword) {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tconst passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')\n\t\t\tif (!passwordVerifyResult.ok) {\n\t\t\t\treturn passwordVerifyResult\n\t\t\t}\n\t\t}\n\n\t\tconst person = await dbContext.transaction(async db => {\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\treturn await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password }))\n\t\t})\n\t\treturn new ResponseOk(new SignUpResult(person))\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>) {}\n}\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n}>\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAiBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBACA,2BAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EAElB;AAAA,EAEA,MAAM,OAAO,WAA4B,EAAE,OAAO,UAAU,QAAQ,CAAA,KAA2C;AAC9G,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK;AAChF,QAAI,oBAAoB,MAAM;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,gBAAgB,SAAS,SAAA;AAE/B,QAAI,eAAe;AAClB,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AAC1E,YAAM,uBAAuB,MAAM,KAAK,0BAA0B,OAAO,eAAe,OAAO,UAAU,UAAU;AACnH,UAAI,CAAC,qBAAqB,IAAI;AAC7B,eAAO;AAAA,MACR;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,OAAM;AACtD,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAI,sBAAsB,CAAC,GAAG,OAAO,WAAW,MAAM,CAAC,CAAC;AACvG,aAAO,MAAM,GAAG,WAAW,QAAQ,IAAI,oBAAoB,EAAE,YAAY,OAAO,SAAA,CAAU,CAAC;AAAA,IAC5F,CAAC;AACD,WAAO,IAAI,WAAW,IAAI,aAAa,MAAM,CAAC;AAAA,EAC/C;AACD;AAEO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkC;AAAlC,SAAA,SAAA;AAAA,EAAmC;AAChE;"}

package/dist/development/src/model/service/apiKey/ApiKeyManager.cjs

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const CreateApiKeyCommand = require("../../commands/apiKey/CreateApiKeyCommand.cjs");
+const DisableApiKeyCommand = require("../../commands/apiKey/DisableApiKeyCommand.cjs");
+const DisableIdentityApiKeysCommand = require("../../commands/apiKey/DisableIdentityApiKeysCommand.cjs");
+const DisableOneOffApiKeyCommand = require("../../commands/apiKey/DisableOneOffApiKeyCommand.cjs");
+const ProlongApiKeyCommand = require("../../commands/apiKey/ProlongApiKeyCommand.cjs");
+require("@contember/database");
+const Response = require("../../utils/Response.cjs");
+require("node:crypto");
+const ApiKey = require("../../type/ApiKey.cjs");
+const assert = require("node:assert");
+const ApiKeyQuery = require("../../queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../../queries/configuration/ConfigurationQuery.cjs");
+require("../../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../authorization/PermissionContext.cjs");
+require("../../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+const interval = require("../../utils/interval.cjs");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class ApiKeyManager {
+  constructor(apiKeyService) {
+    this.apiKeyService = apiKeyService;
+  }
+  async verifyAndProlong(dbContext, readDbContext, token) {
+    const apiKeyRow = await readDbContext.queryHandler.fetch(new ApiKeyQuery.ApiKeyByTokenQuery(token));
+    if (apiKeyRow === null) {
+      return new Response.ResponseError("not_found", "API key was not found");
+    }
+    if (apiKeyRow.disabled_at !== null) {
+      return new Response.ResponseError(
+        "disabled",
+        `API key was disabled at ${apiKeyRow.disabled_at.toISOString()}`
+      );
+    }
+    const now = /* @__PURE__ */ new Date();
+    if (apiKeyRow.expires_at !== null && apiKeyRow.expires_at <= now) {
+      return new Response.ResponseError("disabled", `API key expired at ${apiKeyRow.expires_at.toISOString()}`);
+    }
+    setImmediate(async () => {
+      await dbContext.commandBus.execute(
+        new ProlongApiKeyCommand.ProlongApiKeyCommand(
+          apiKeyRow.id,
+          apiKeyRow.type,
+          apiKeyRow.expiration,
+          apiKeyRow.expires_at
+        )
+      );
+    });
+    return new Response.ResponseOk(new VerifyResult(apiKeyRow.identity_id, apiKeyRow.id, apiKeyRow.roles, apiKeyRow.person_id));
+  }
+  async createSessionApiKey(dbContext, identityId, expiration) {
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const expirationResolved = expiration ?? interval.intervalToSeconds(config.login.defaultTokenExpiration) / 60;
+    const expirationCapped = config.login.maxTokenExpiration ? Math.min(expirationResolved, interval.intervalToSeconds(config.login.maxTokenExpiration) / 60) : expirationResolved;
+    const command = new CreateApiKeyCommand.CreateApiKeyCommand({ type: ApiKey.ApiKey.Type.SESSION, identityId, expiration: expirationCapped });
+    const token = (await dbContext.commandBus.execute(command)).token;
+    assert(token !== void 0);
+    return token;
+  }
+  async findApiKey(dbContext, apiKeyId) {
+    return await dbContext.queryHandler.fetch(
+      new ApiKeyQuery.ApiKeyByIdQuery(apiKeyId)
+    );
+  }
+  async disableOneOffApiKey(dbContext, apiKeyId) {
+    await dbContext.commandBus.execute(new DisableOneOffApiKeyCommand.DisableOneOffApiKeyCommand(apiKeyId));
+  }
+  async disableApiKey(dbContext, apiKeyId) {
+    return await dbContext.commandBus.execute(new DisableApiKeyCommand.DisableApiKeyCommand(apiKeyId));
+  }
+  async disableIdentityApiKeys(dbContext, identityId) {
+    await dbContext.commandBus.execute(new DisableIdentityApiKeysCommand.DisableIdentityApiKeysCommand(identityId));
+  }
+  async createGlobalPermanentApiKey(dbContext, description, roles, tokenHash) {
+    return await dbContext.transaction(async (db) => {
+      return await this.apiKeyService.createPermanentApiKey(db, description, roles, tokenHash);
+    });
+  }
+  async createProjectPermanentApiKey(dbContext, projectId, memberships, description, tokenHash) {
+    return await dbContext.transaction(async (db) => {
+      return await this.apiKeyService.createProjectPermanentApiKey(db, projectId, memberships, description, tokenHash);
+    });
+  }
+}
+class VerifyResult {
+  constructor(identityId, apiKeyId, roles, personId) {
+    this.identityId = identityId;
+    this.apiKeyId = apiKeyId;
+    this.roles = roles;
+    this.personId = personId;
+    __publicField(this, "valid", true);
+  }
+}
+var VerifyErrorCode = /* @__PURE__ */ ((VerifyErrorCode2) => {
+  VerifyErrorCode2["NOT_FOUND"] = "not_found";
+  VerifyErrorCode2["DISABLED"] = "disabled";
+  VerifyErrorCode2["EXPIRED"] = "expired";
+  VerifyErrorCode2["NO_AUTH_HEADER"] = "no_auth_header";
+  VerifyErrorCode2["INVALID_AUTH_HEADER"] = "invalid_auth_header";
+  return VerifyErrorCode2;
+})(VerifyErrorCode || {});
+exports.ApiKeyManager = ApiKeyManager;
+exports.VerifyErrorCode = VerifyErrorCode;
+exports.VerifyResult = VerifyResult;
+//# sourceMappingURL=ApiKeyManager.cjs.map

package/dist/development/src/model/service/apiKey/ApiKeyManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/ApiKeyManager.ts"],"sourcesContent":["import {\n\tCreateApiKeyCommand,\n\tDisableApiKeyCommand,\n\tDisableIdentityApiKeysCommand,\n\tDisableOneOffApiKeyCommand,\n\tProlongApiKeyCommand,\n} from '../../commands'\nimport { ApiKey } from '../../type'\n\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response'\nimport { DatabaseContext, TokenHash } from '../../utils'\nimport { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService'\nimport assert from 'node:assert'\nimport { Acl } from '@contember/schema'\nimport { ApiKeyByIdQuery, ApiKeyByTokenQuery, ApiKeyRow, ConfigurationQuery } from '../../queries'\nimport PostgresInterval from 'postgres-interval'\nimport { Config } from '../../type/Config'\nimport { intervalToSeconds } from '../../utils/interval'\n\nexport class ApiKeyManager {\n\tconstructor(\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tasync verifyAndProlong(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\ttoken: string,\n\t): Promise<VerifyResponse> {\n\t\tconst apiKeyRow = await readDbContext.queryHandler.fetch(new ApiKeyByTokenQuery(token))\n\t\tif (apiKeyRow === null) {\n\t\t\treturn new ResponseError(VerifyErrorCode.NOT_FOUND, 'API key was not found')\n\t\t}\n\n\t\tif (apiKeyRow.disabled_at !== null) {\n\t\t\treturn new ResponseError(\n\t\t\t\tVerifyErrorCode.DISABLED,\n\t\t\t\t`API key was disabled at ${apiKeyRow.disabled_at.toISOString()}`,\n\t\t\t)\n\t\t}\n\n\t\tconst now = new Date()\n\t\tif (apiKeyRow.expires_at !== null && apiKeyRow.expires_at <= now) {\n\t\t\treturn new ResponseError(VerifyErrorCode.DISABLED, `API key expired at ${apiKeyRow.expires_at.toISOString()}`)\n\t\t}\n\n\t\tsetImmediate(async () => {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew ProlongApiKeyCommand(\n\t\t\t\t\tapiKeyRow.id,\n\t\t\t\t\tapiKeyRow.type,\n\t\t\t\t\tapiKeyRow.expiration,\n\t\t\t\t\tapiKeyRow.expires_at,\n\t\t\t\t),\n\t\t\t)\n\t\t})\n\n\t\treturn new ResponseOk(new VerifyResult(apiKeyRow.identity_id, apiKeyRow.id, apiKeyRow.roles, apiKeyRow.person_id))\n\t}\n\n\tasync createSessionApiKey(dbContext: DatabaseContext, identityId: string, expiration?: number): Promise<string> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst expirationResolved = expiration ?? (intervalToSeconds(config.login.defaultTokenExpiration) / 60)\n\t\tconst expirationCapped = config.login.maxTokenExpiration\n\t\t\t? Math.min(expirationResolved, intervalToSeconds(config.login.maxTokenExpiration) / 60)\n\t\t\t: expirationResolved\n\t\tconst command = new CreateApiKeyCommand({ type: ApiKey.Type.SESSION, identityId, expiration: expirationCapped })\n\t\tconst token = (await dbContext.commandBus.execute(command)).token\n\t\tassert(token !== undefined)\n\t\treturn token\n\t}\n\n\tasync findApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<ApiKeyRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tnew ApiKeyByIdQuery(apiKeyId),\n\t\t)\n\t}\n\n\tasync disableOneOffApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOneOffApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableIdentityApiKeys(dbContext: DatabaseContext, identityId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableIdentityApiKeysCommand(identityId))\n\t}\n\n\tasync createGlobalPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tdescription: string,\n\t\troles: readonly string[],\n\t\ttokenHash?: TokenHash,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createPermanentApiKey(db, description, roles, tokenHash)\n\t\t})\n\t}\n\n\tasync createProjectPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tdescription: string,\n\t\ttokenHash?: TokenHash,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createProjectPermanentApiKey(db, projectId, memberships, description, tokenHash)\n\t\t})\n\t}\n}\n\nexport type VerifyResponse = Response<VerifyResult, VerifyErrorCode>\n\nexport class VerifyResult {\n\treadonly valid = true\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly apiKeyId: string,\n\t\tpublic readonly roles: string[],\n\t\tpublic readonly personId: string | null,\n\t) {}\n}\n\nexport enum VerifyErrorCode {\n\tNOT_FOUND = 'not_found',\n\tDISABLED = 'disabled',\n\tEXPIRED = 'expired',\n\tNO_AUTH_HEADER = 'no_auth_header',\n\tINVALID_AUTH_HEADER = 'invalid_auth_header',\n}\n"],"names":["ApiKeyByTokenQuery","ResponseError","ProlongApiKeyCommand","ResponseOk","ConfigurationQuery","intervalToSeconds","CreateApiKeyCommand","ApiKey","ApiKeyByIdQuery","DisableOneOffApiKeyCommand","DisableApiKeyCommand","DisableIdentityApiKeysCommand","VerifyErrorCode"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmBO,MAAM,cAAc;AAAA,EAC1B,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBACL,WACA,eACA,OAC0B;AAC1B,UAAM,YAAY,MAAM,cAAc,aAAa,MAAM,IAAIA,YAAAA,mBAAmB,KAAK,CAAC;AACtF,QAAI,cAAc,MAAM;AACvB,aAAO,IAAIC,SAAAA,cAAc,aAA2B,uBAAuB;AAAA,IAC5E;AAEA,QAAI,UAAU,gBAAgB,MAAM;AACnC,aAAO,IAAIA,SAAAA;AAAAA,QACV;AAAA,QACA,2BAA2B,UAAU,YAAY,YAAA,CAAa;AAAA,MAAA;AAAA,IAEhE;AAEA,UAAM,0BAAU,KAAA;AAChB,QAAI,UAAU,eAAe,QAAQ,UAAU,cAAc,KAAK;AACjE,aAAO,IAAIA,SAAAA,cAAc,YAA0B,sBAAsB,UAAU,WAAW,YAAA,CAAa,EAAE;AAAA,IAC9G;AAEA,iBAAa,YAAY;AACxB,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAIC,qBAAAA;AAAAA,UACH,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,QAAA;AAAA,MACX;AAAA,IAEF,CAAC;AAED,WAAO,IAAIC,SAAAA,WAAW,IAAI,aAAa,UAAU,aAAa,UAAU,IAAI,UAAU,OAAO,UAAU,SAAS,CAAC;AAAA,EAClH;AAAA,EAEA,MAAM,oBAAoB,WAA4B,YAAoB,YAAsC;AAC/G,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAC1E,UAAM,qBAAqB,cAAeC,SAAAA,kBAAkB,OAAO,MAAM,sBAAsB,IAAI;AACnG,UAAM,mBAAmB,OAAO,MAAM,qBACnC,KAAK,IAAI,oBAAoBA,SAAAA,kBAAkB,OAAO,MAAM,kBAAkB,IAAI,EAAE,IACpF;AACH,UAAM,UAAU,IAAIC,wCAAoB,EAAE,MAAMC,OAAAA,OAAO,KAAK,SAAS,YAAY,YAAY,iBAAA,CAAkB;AAC/G,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,OAAO,GAAG;AAC5D,WAAO,UAAU,MAAS;AAC1B,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,WAA4B,UAA6C;AACzF,WAAO,MAAM,UAAU,aAAa;AAAA,MACnC,IAAIC,YAAAA,gBAAgB,QAAQ;AAAA,IAAA;AAAA,EAE9B;AAAA,EAEA,MAAM,oBAAoB,WAA4B,UAAiC;AACtF,UAAM,UAAU,WAAW,QAAQ,IAAIC,2BAAAA,2BAA2B,QAAQ,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAM,cAAc,WAA4B,UAAoC;AACnF,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,QAAQ,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,uBAAuB,WAA4B,YAAmC;AAC3F,UAAM,UAAU,WAAW,QAAQ,IAAIC,8BAAAA,8BAA8B,UAAU,CAAC;AAAA,EACjF;AAAA,EAEA,MAAM,4BACL,WACA,aACA,OACA,WACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,KAAK,cAAc,sBAAsB,IAAI,aAAa,OAAO,SAAS;AAAA,IACxF,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,6BACL,WACA,WACA,aACA,aACA,WACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,aAAa,aAAa,SAAS;AAAA,IAChH,CAAC;AAAA,EACF;AACD;AAIO,MAAM,aAAa;AAAA,EAGzB,YACiB,YACA,UACA,OACA,UACf;AAJe,SAAA,aAAA;AACA,SAAA,WAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AANjB,kBAAA,MAAS,SAAQ,IAAA;AAAA,EAOd;AACJ;AAEO,IAAK,oCAAAC,qBAAL;AACNA,mBAAA,WAAA,IAAY;AACZA,mBAAA,UAAA,IAAW;AACXA,mBAAA,SAAA,IAAU;AACVA,mBAAA,gBAAA,IAAiB;AACjBA,mBAAA,qBAAA,IAAsB;AALX,SAAAA;AAAA,GAAA,mBAAA,CAAA,CAAA;;;;"}

package/dist/development/src/model/service/apiKey/ApiKeyManager.js

@@ -0,0 +1,109 @@
+import { CreateApiKeyCommand } from "../../commands/apiKey/CreateApiKeyCommand.js";
+import { DisableApiKeyCommand } from "../../commands/apiKey/DisableApiKeyCommand.js";
+import { DisableIdentityApiKeysCommand } from "../../commands/apiKey/DisableIdentityApiKeysCommand.js";
+import { DisableOneOffApiKeyCommand } from "../../commands/apiKey/DisableOneOffApiKeyCommand.js";
+import { ProlongApiKeyCommand } from "../../commands/apiKey/ProlongApiKeyCommand.js";
+import "@contember/database";
+import { ResponseError, ResponseOk } from "../../utils/Response.js";
+import "node:crypto";
+import { ApiKey } from "../../type/ApiKey.js";
+import assert from "node:assert";
+import { ApiKeyByTokenQuery, ApiKeyByIdQuery } from "../../queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../../queries/configuration/ConfigurationQuery.js";
+import "../../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../authorization/PermissionContext.js";
+import "../../authorization/PermissionsFactory.js";
+import "@contember/schema";
+import { intervalToSeconds } from "../../utils/interval.js";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class ApiKeyManager {
+  constructor(apiKeyService) {
+    this.apiKeyService = apiKeyService;
+  }
+  async verifyAndProlong(dbContext, readDbContext, token) {
+    const apiKeyRow = await readDbContext.queryHandler.fetch(new ApiKeyByTokenQuery(token));
+    if (apiKeyRow === null) {
+      return new ResponseError("not_found", "API key was not found");
+    }
+    if (apiKeyRow.disabled_at !== null) {
+      return new ResponseError(
+        "disabled",
+        `API key was disabled at ${apiKeyRow.disabled_at.toISOString()}`
+      );
+    }
+    const now = /* @__PURE__ */ new Date();
+    if (apiKeyRow.expires_at !== null && apiKeyRow.expires_at <= now) {
+      return new ResponseError("disabled", `API key expired at ${apiKeyRow.expires_at.toISOString()}`);
+    }
+    setImmediate(async () => {
+      await dbContext.commandBus.execute(
+        new ProlongApiKeyCommand(
+          apiKeyRow.id,
+          apiKeyRow.type,
+          apiKeyRow.expiration,
+          apiKeyRow.expires_at
+        )
+      );
+    });
+    return new ResponseOk(new VerifyResult(apiKeyRow.identity_id, apiKeyRow.id, apiKeyRow.roles, apiKeyRow.person_id));
+  }
+  async createSessionApiKey(dbContext, identityId, expiration) {
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+    const expirationResolved = expiration ?? intervalToSeconds(config.login.defaultTokenExpiration) / 60;
+    const expirationCapped = config.login.maxTokenExpiration ? Math.min(expirationResolved, intervalToSeconds(config.login.maxTokenExpiration) / 60) : expirationResolved;
+    const command = new CreateApiKeyCommand({ type: ApiKey.Type.SESSION, identityId, expiration: expirationCapped });
+    const token = (await dbContext.commandBus.execute(command)).token;
+    assert(token !== void 0);
+    return token;
+  }
+  async findApiKey(dbContext, apiKeyId) {
+    return await dbContext.queryHandler.fetch(
+      new ApiKeyByIdQuery(apiKeyId)
+    );
+  }
+  async disableOneOffApiKey(dbContext, apiKeyId) {
+    await dbContext.commandBus.execute(new DisableOneOffApiKeyCommand(apiKeyId));
+  }
+  async disableApiKey(dbContext, apiKeyId) {
+    return await dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyId));
+  }
+  async disableIdentityApiKeys(dbContext, identityId) {
+    await dbContext.commandBus.execute(new DisableIdentityApiKeysCommand(identityId));
+  }
+  async createGlobalPermanentApiKey(dbContext, description, roles, tokenHash) {
+    return await dbContext.transaction(async (db) => {
+      return await this.apiKeyService.createPermanentApiKey(db, description, roles, tokenHash);
+    });
+  }
+  async createProjectPermanentApiKey(dbContext, projectId, memberships, description, tokenHash) {
+    return await dbContext.transaction(async (db) => {
+      return await this.apiKeyService.createProjectPermanentApiKey(db, projectId, memberships, description, tokenHash);
+    });
+  }
+}
+class VerifyResult {
+  constructor(identityId, apiKeyId, roles, personId) {
+    this.identityId = identityId;
+    this.apiKeyId = apiKeyId;
+    this.roles = roles;
+    this.personId = personId;
+    __publicField(this, "valid", true);
+  }
+}
+var VerifyErrorCode = /* @__PURE__ */ ((VerifyErrorCode2) => {
+  VerifyErrorCode2["NOT_FOUND"] = "not_found";
+  VerifyErrorCode2["DISABLED"] = "disabled";
+  VerifyErrorCode2["EXPIRED"] = "expired";
+  VerifyErrorCode2["NO_AUTH_HEADER"] = "no_auth_header";
+  VerifyErrorCode2["INVALID_AUTH_HEADER"] = "invalid_auth_header";
+  return VerifyErrorCode2;
+})(VerifyErrorCode || {});
+export {
+  ApiKeyManager,
+  VerifyErrorCode,
+  VerifyResult
+};
+//# sourceMappingURL=ApiKeyManager.js.map

package/dist/development/src/model/service/apiKey/ApiKeyManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/ApiKeyManager.ts"],"sourcesContent":["import {\n\tCreateApiKeyCommand,\n\tDisableApiKeyCommand,\n\tDisableIdentityApiKeysCommand,\n\tDisableOneOffApiKeyCommand,\n\tProlongApiKeyCommand,\n} from '../../commands'\nimport { ApiKey } from '../../type'\n\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response'\nimport { DatabaseContext, TokenHash } from '../../utils'\nimport { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService'\nimport assert from 'node:assert'\nimport { Acl } from '@contember/schema'\nimport { ApiKeyByIdQuery, ApiKeyByTokenQuery, ApiKeyRow, ConfigurationQuery } from '../../queries'\nimport PostgresInterval from 'postgres-interval'\nimport { Config } from '../../type/Config'\nimport { intervalToSeconds } from '../../utils/interval'\n\nexport class ApiKeyManager {\n\tconstructor(\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tasync verifyAndProlong(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\ttoken: string,\n\t): Promise<VerifyResponse> {\n\t\tconst apiKeyRow = await readDbContext.queryHandler.fetch(new ApiKeyByTokenQuery(token))\n\t\tif (apiKeyRow === null) {\n\t\t\treturn new ResponseError(VerifyErrorCode.NOT_FOUND, 'API key was not found')\n\t\t}\n\n\t\tif (apiKeyRow.disabled_at !== null) {\n\t\t\treturn new ResponseError(\n\t\t\t\tVerifyErrorCode.DISABLED,\n\t\t\t\t`API key was disabled at ${apiKeyRow.disabled_at.toISOString()}`,\n\t\t\t)\n\t\t}\n\n\t\tconst now = new Date()\n\t\tif (apiKeyRow.expires_at !== null && apiKeyRow.expires_at <= now) {\n\t\t\treturn new ResponseError(VerifyErrorCode.DISABLED, `API key expired at ${apiKeyRow.expires_at.toISOString()}`)\n\t\t}\n\n\t\tsetImmediate(async () => {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew ProlongApiKeyCommand(\n\t\t\t\t\tapiKeyRow.id,\n\t\t\t\t\tapiKeyRow.type,\n\t\t\t\t\tapiKeyRow.expiration,\n\t\t\t\t\tapiKeyRow.expires_at,\n\t\t\t\t),\n\t\t\t)\n\t\t})\n\n\t\treturn new ResponseOk(new VerifyResult(apiKeyRow.identity_id, apiKeyRow.id, apiKeyRow.roles, apiKeyRow.person_id))\n\t}\n\n\tasync createSessionApiKey(dbContext: DatabaseContext, identityId: string, expiration?: number): Promise<string> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst expirationResolved = expiration ?? (intervalToSeconds(config.login.defaultTokenExpiration) / 60)\n\t\tconst expirationCapped = config.login.maxTokenExpiration\n\t\t\t? Math.min(expirationResolved, intervalToSeconds(config.login.maxTokenExpiration) / 60)\n\t\t\t: expirationResolved\n\t\tconst command = new CreateApiKeyCommand({ type: ApiKey.Type.SESSION, identityId, expiration: expirationCapped })\n\t\tconst token = (await dbContext.commandBus.execute(command)).token\n\t\tassert(token !== undefined)\n\t\treturn token\n\t}\n\n\tasync findApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<ApiKeyRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tnew ApiKeyByIdQuery(apiKeyId),\n\t\t)\n\t}\n\n\tasync disableOneOffApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOneOffApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableIdentityApiKeys(dbContext: DatabaseContext, identityId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableIdentityApiKeysCommand(identityId))\n\t}\n\n\tasync createGlobalPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tdescription: string,\n\t\troles: readonly string[],\n\t\ttokenHash?: TokenHash,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createPermanentApiKey(db, description, roles, tokenHash)\n\t\t})\n\t}\n\n\tasync createProjectPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tdescription: string,\n\t\ttokenHash?: TokenHash,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createProjectPermanentApiKey(db, projectId, memberships, description, tokenHash)\n\t\t})\n\t}\n}\n\nexport type VerifyResponse = Response<VerifyResult, VerifyErrorCode>\n\nexport class VerifyResult {\n\treadonly valid = true\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly apiKeyId: string,\n\t\tpublic readonly roles: string[],\n\t\tpublic readonly personId: string | null,\n\t) {}\n}\n\nexport enum VerifyErrorCode {\n\tNOT_FOUND = 'not_found',\n\tDISABLED = 'disabled',\n\tEXPIRED = 'expired',\n\tNO_AUTH_HEADER = 'no_auth_header',\n\tINVALID_AUTH_HEADER = 'invalid_auth_header',\n}\n"],"names":["VerifyErrorCode"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAmBO,MAAM,cAAc;AAAA,EAC1B,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBACL,WACA,eACA,OAC0B;AAC1B,UAAM,YAAY,MAAM,cAAc,aAAa,MAAM,IAAI,mBAAmB,KAAK,CAAC;AACtF,QAAI,cAAc,MAAM;AACvB,aAAO,IAAI,cAAc,aAA2B,uBAAuB;AAAA,IAC5E;AAEA,QAAI,UAAU,gBAAgB,MAAM;AACnC,aAAO,IAAI;AAAA,QACV;AAAA,QACA,2BAA2B,UAAU,YAAY,YAAA,CAAa;AAAA,MAAA;AAAA,IAEhE;AAEA,UAAM,0BAAU,KAAA;AAChB,QAAI,UAAU,eAAe,QAAQ,UAAU,cAAc,KAAK;AACjE,aAAO,IAAI,cAAc,YAA0B,sBAAsB,UAAU,WAAW,YAAA,CAAa,EAAE;AAAA,IAC9G;AAEA,iBAAa,YAAY;AACxB,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAI;AAAA,UACH,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,QAAA;AAAA,MACX;AAAA,IAEF,CAAC;AAED,WAAO,IAAI,WAAW,IAAI,aAAa,UAAU,aAAa,UAAU,IAAI,UAAU,OAAO,UAAU,SAAS,CAAC;AAAA,EAClH;AAAA,EAEA,MAAM,oBAAoB,WAA4B,YAAoB,YAAsC;AAC/G,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AAC1E,UAAM,qBAAqB,cAAe,kBAAkB,OAAO,MAAM,sBAAsB,IAAI;AACnG,UAAM,mBAAmB,OAAO,MAAM,qBACnC,KAAK,IAAI,oBAAoB,kBAAkB,OAAO,MAAM,kBAAkB,IAAI,EAAE,IACpF;AACH,UAAM,UAAU,IAAI,oBAAoB,EAAE,MAAM,OAAO,KAAK,SAAS,YAAY,YAAY,iBAAA,CAAkB;AAC/G,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,OAAO,GAAG;AAC5D,WAAO,UAAU,MAAS;AAC1B,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,WAA4B,UAA6C;AACzF,WAAO,MAAM,UAAU,aAAa;AAAA,MACnC,IAAI,gBAAgB,QAAQ;AAAA,IAAA;AAAA,EAE9B;AAAA,EAEA,MAAM,oBAAoB,WAA4B,UAAiC;AACtF,UAAM,UAAU,WAAW,QAAQ,IAAI,2BAA2B,QAAQ,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAM,cAAc,WAA4B,UAAoC;AACnF,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,uBAAuB,WAA4B,YAAmC;AAC3F,UAAM,UAAU,WAAW,QAAQ,IAAI,8BAA8B,UAAU,CAAC;AAAA,EACjF;AAAA,EAEA,MAAM,4BACL,WACA,aACA,OACA,WACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,KAAK,cAAc,sBAAsB,IAAI,aAAa,OAAO,SAAS;AAAA,IACxF,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,6BACL,WACA,WACA,aACA,aACA,WACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,aAAa,aAAa,SAAS;AAAA,IAChH,CAAC;AAAA,EACF;AACD;AAIO,MAAM,aAAa;AAAA,EAGzB,YACiB,YACA,UACA,OACA,UACf;AAJe,SAAA,aAAA;AACA,SAAA,WAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AANjB,kBAAA,MAAS,SAAQ,IAAA;AAAA,EAOd;AACJ;AAEO,IAAK,oCAAAA,qBAAL;AACNA,mBAAA,WAAA,IAAY;AACZA,mBAAA,UAAA,IAAW;AACXA,mBAAA,SAAA,IAAU;AACVA,mBAAA,gBAAA,IAAiB;AACjBA,mBAAA,qBAAA,IAAsB;AALX,SAAAA;AAAA,GAAA,mBAAA,CAAA,CAAA;"}

package/dist/development/src/model/service/apiKey/ApiKeyService.cjs

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const CreateApiKeyCommand = require("../../commands/apiKey/CreateApiKeyCommand.cjs");
+require("@contember/database");
+const ApiKey = require("../../type/ApiKey.cjs");
+const CreateIdentityCommand = require("../../commands/identity/CreateIdentityCommand.cjs");
+const AddProjectMemberCommand = require("../../commands/membership/AddProjectMemberCommand.cjs");
+const exceptions = require("../../../exceptions.cjs");
+const Response = require("../../utils/Response.cjs");
+require("node:crypto");
+const membershipUtils = require("../membershipUtils.cjs");
+class ApiKeyService {
+  async createPermanentApiKey(db, description, roles = [], tokenHash) {
+    const identityId = await db.commandBus.execute(new CreateIdentityCommand.CreateIdentityCommand(roles, description));
+    const apiKeyResult = await db.commandBus.execute(new CreateApiKeyCommand.CreateApiKeyCommand({ type: ApiKey.ApiKey.Type.PERMANENT, identityId, tokenHash }));
+    return new Response.ResponseOk(new CreateApiKeyResult({ id: identityId, description }, apiKeyResult));
+  }
+  async createProjectPermanentApiKey(db, projectId, memberships, description, tokenHash) {
+    const response = await this.createPermanentApiKey(db, description, [], tokenHash);
+    const addMemberResult = await db.commandBus.execute(
+      new AddProjectMemberCommand.AddProjectMemberCommand(projectId, response.result.identity.id, membershipUtils.createSetMembershipVariables(memberships))
+    );
+    if (!addMemberResult.ok) {
+      throw new exceptions.ImplementationException();
+    }
+    return response;
+  }
+}
+class CreateApiKeyResult {
+  constructor(identity, apiKey) {
+    this.identity = identity;
+    this.apiKey = apiKey;
+  }
+  toApiKeyWithToken() {
+    return {
+      id: this.apiKey.id,
+      token: this.apiKey.token,
+      identity: {
+        ...this.identity,
+        projects: []
+      }
+    };
+  }
+}
+exports.ApiKeyService = ApiKeyService;
+exports.CreateApiKeyResult = CreateApiKeyResult;
+//# sourceMappingURL=ApiKeyService.cjs.map

package/dist/development/src/model/service/apiKey/ApiKeyService.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyService.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/ApiKeyService.ts"],"sourcesContent":["import { DatabaseContext, TokenHash } from '../../utils'\nimport { AddProjectMemberCommand, CreateApiKeyCommand, CreateIdentityCommand } from '../../commands'\nimport { ApiKey } from '../../type'\nimport { createSetMembershipVariables } from '../membershipUtils'\nimport { ImplementationException } from '../../../exceptions'\nimport { Response, ResponseOk } from '../../utils/Response'\nimport { ApiKeyWithToken } from '../../../schema'\nimport { Acl } from '@contember/schema'\n\nexport class ApiKeyService {\n\tasync createPermanentApiKey(\n\t\tdb: DatabaseContext,\n\t\tdescription: string,\n\t\troles: readonly string[] = [],\n\t\ttokenHash?: TokenHash,\n\t) {\n\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand(roles, description))\n\t\tconst apiKeyResult = await db.commandBus.execute(new CreateApiKeyCommand({ type: ApiKey.Type.PERMANENT, identityId, tokenHash }))\n\n\t\treturn new ResponseOk(new CreateApiKeyResult({ id: identityId, description }, apiKeyResult))\n\t}\n\n\tasync createProjectPermanentApiKey(\n\t\tdb: DatabaseContext,\n\t\tprojectId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tdescription: string,\n\t\ttokenHash?: TokenHash,\n\t) {\n\t\tconst response = await this.createPermanentApiKey(db, description, [], tokenHash)\n\n\t\tconst addMemberResult = await db.commandBus.execute(\n\t\t\tnew AddProjectMemberCommand(projectId, response.result.identity.id, createSetMembershipVariables(memberships)),\n\t\t)\n\t\tif (!addMemberResult.ok) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\treturn response\n\t}\n}\n\nexport type CreateApiKeyResponse = Response<CreateApiKeyResult, never>\n\nexport class CreateApiKeyResult {\n\tconstructor(public readonly identity: { id: string; description?: string }, public readonly apiKey: { id: string; token?: string }) {\n\t}\n\n\ttoApiKeyWithToken(): ApiKeyWithToken {\n\t\treturn {\n\t\t\tid: this.apiKey.id,\n\t\t\ttoken: this.apiKey.token,\n\t\t\tidentity: {\n\t\t\t\t...this.identity,\n\t\t\t\tprojects: [],\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["CreateIdentityCommand","CreateApiKeyCommand","ApiKey","ResponseOk","AddProjectMemberCommand","createSetMembershipVariables","ImplementationException"],"mappings":";;;;;;;;;;;AASO,MAAM,cAAc;AAAA,EAC1B,MAAM,sBACL,IACA,aACA,QAA2B,CAAA,GAC3B,WACC;AACD,UAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIA,sBAAAA,sBAAsB,OAAO,WAAW,CAAC;AAC5F,UAAM,eAAe,MAAM,GAAG,WAAW,QAAQ,IAAIC,oBAAAA,oBAAoB,EAAE,MAAMC,OAAAA,OAAO,KAAK,WAAW,YAAY,UAAA,CAAW,CAAC;AAEhI,WAAO,IAAIC,SAAAA,WAAW,IAAI,mBAAmB,EAAE,IAAI,YAAY,eAAe,YAAY,CAAC;AAAA,EAC5F;AAAA,EAEA,MAAM,6BACL,IACA,WACA,aACA,aACA,WACC;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,IAAI,aAAa,CAAA,GAAI,SAAS;AAEhF,UAAM,kBAAkB,MAAM,GAAG,WAAW;AAAA,MAC3C,IAAIC,wBAAAA,wBAAwB,WAAW,SAAS,OAAO,SAAS,IAAIC,gBAAAA,6BAA6B,WAAW,CAAC;AAAA,IAAA;AAE9G,QAAI,CAAC,gBAAgB,IAAI;AACxB,YAAM,IAAIC,WAAAA,wBAAA;AAAA,IACX;AACA,WAAO;AAAA,EACR;AACD;AAIO,MAAM,mBAAmB;AAAA,EAC/B,YAA4B,UAAgE,QAAwC;AAAxG,SAAA,WAAA;AAAgE,SAAA,SAAA;AAAA,EAC5F;AAAA,EAEA,oBAAqC;AACpC,WAAO;AAAA,MACN,IAAI,KAAK,OAAO;AAAA,MAChB,OAAO,KAAK,OAAO;AAAA,MACnB,UAAU;AAAA,QACT,GAAG,KAAK;AAAA,QACR,UAAU,CAAA;AAAA,MAAC;AAAA,IACZ;AAAA,EAEF;AACD;;;"}

package/dist/development/src/model/service/apiKey/ApiKeyService.js

@@ -0,0 +1,47 @@
+import { CreateApiKeyCommand } from "../../commands/apiKey/CreateApiKeyCommand.js";
+import "@contember/database";
+import { ApiKey } from "../../type/ApiKey.js";
+import { CreateIdentityCommand } from "../../commands/identity/CreateIdentityCommand.js";
+import { AddProjectMemberCommand } from "../../commands/membership/AddProjectMemberCommand.js";
+import { ImplementationException } from "../../../exceptions.js";
+import { ResponseOk } from "../../utils/Response.js";
+import "node:crypto";
+import { createSetMembershipVariables } from "../membershipUtils.js";
+class ApiKeyService {
+  async createPermanentApiKey(db, description, roles = [], tokenHash) {
+    const identityId = await db.commandBus.execute(new CreateIdentityCommand(roles, description));
+    const apiKeyResult = await db.commandBus.execute(new CreateApiKeyCommand({ type: ApiKey.Type.PERMANENT, identityId, tokenHash }));
+    return new ResponseOk(new CreateApiKeyResult({ id: identityId, description }, apiKeyResult));
+  }
+  async createProjectPermanentApiKey(db, projectId, memberships, description, tokenHash) {
+    const response = await this.createPermanentApiKey(db, description, [], tokenHash);
+    const addMemberResult = await db.commandBus.execute(
+      new AddProjectMemberCommand(projectId, response.result.identity.id, createSetMembershipVariables(memberships))
+    );
+    if (!addMemberResult.ok) {
+      throw new ImplementationException();
+    }
+    return response;
+  }
+}
+class CreateApiKeyResult {
+  constructor(identity, apiKey) {
+    this.identity = identity;
+    this.apiKey = apiKey;
+  }
+  toApiKeyWithToken() {
+    return {
+      id: this.apiKey.id,
+      token: this.apiKey.token,
+      identity: {
+        ...this.identity,
+        projects: []
+      }
+    };
+  }
+}
+export {
+  ApiKeyService,
+  CreateApiKeyResult
+};
+//# sourceMappingURL=ApiKeyService.js.map

package/dist/development/src/model/service/apiKey/ApiKeyService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyService.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/ApiKeyService.ts"],"sourcesContent":["import { DatabaseContext, TokenHash } from '../../utils'\nimport { AddProjectMemberCommand, CreateApiKeyCommand, CreateIdentityCommand } from '../../commands'\nimport { ApiKey } from '../../type'\nimport { createSetMembershipVariables } from '../membershipUtils'\nimport { ImplementationException } from '../../../exceptions'\nimport { Response, ResponseOk } from '../../utils/Response'\nimport { ApiKeyWithToken } from '../../../schema'\nimport { Acl } from '@contember/schema'\n\nexport class ApiKeyService {\n\tasync createPermanentApiKey(\n\t\tdb: DatabaseContext,\n\t\tdescription: string,\n\t\troles: readonly string[] = [],\n\t\ttokenHash?: TokenHash,\n\t) {\n\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand(roles, description))\n\t\tconst apiKeyResult = await db.commandBus.execute(new CreateApiKeyCommand({ type: ApiKey.Type.PERMANENT, identityId, tokenHash }))\n\n\t\treturn new ResponseOk(new CreateApiKeyResult({ id: identityId, description }, apiKeyResult))\n\t}\n\n\tasync createProjectPermanentApiKey(\n\t\tdb: DatabaseContext,\n\t\tprojectId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tdescription: string,\n\t\ttokenHash?: TokenHash,\n\t) {\n\t\tconst response = await this.createPermanentApiKey(db, description, [], tokenHash)\n\n\t\tconst addMemberResult = await db.commandBus.execute(\n\t\t\tnew AddProjectMemberCommand(projectId, response.result.identity.id, createSetMembershipVariables(memberships)),\n\t\t)\n\t\tif (!addMemberResult.ok) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\treturn response\n\t}\n}\n\nexport type CreateApiKeyResponse = Response<CreateApiKeyResult, never>\n\nexport class CreateApiKeyResult {\n\tconstructor(public readonly identity: { id: string; description?: string }, public readonly apiKey: { id: string; token?: string }) {\n\t}\n\n\ttoApiKeyWithToken(): ApiKeyWithToken {\n\t\treturn {\n\t\t\tid: this.apiKey.id,\n\t\t\ttoken: this.apiKey.token,\n\t\t\tidentity: {\n\t\t\t\t...this.identity,\n\t\t\t\tprojects: [],\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AASO,MAAM,cAAc;AAAA,EAC1B,MAAM,sBACL,IACA,aACA,QAA2B,CAAA,GAC3B,WACC;AACD,UAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAI,sBAAsB,OAAO,WAAW,CAAC;AAC5F,UAAM,eAAe,MAAM,GAAG,WAAW,QAAQ,IAAI,oBAAoB,EAAE,MAAM,OAAO,KAAK,WAAW,YAAY,UAAA,CAAW,CAAC;AAEhI,WAAO,IAAI,WAAW,IAAI,mBAAmB,EAAE,IAAI,YAAY,eAAe,YAAY,CAAC;AAAA,EAC5F;AAAA,EAEA,MAAM,6BACL,IACA,WACA,aACA,aACA,WACC;AACD,UAAM,WAAW,MAAM,KAAK,sBAAsB,IAAI,aAAa,CAAA,GAAI,SAAS;AAEhF,UAAM,kBAAkB,MAAM,GAAG,WAAW;AAAA,MAC3C,IAAI,wBAAwB,WAAW,SAAS,OAAO,SAAS,IAAI,6BAA6B,WAAW,CAAC;AAAA,IAAA;AAE9G,QAAI,CAAC,gBAAgB,IAAI;AACxB,YAAM,IAAI,wBAAA;AAAA,IACX;AACA,WAAO;AAAA,EACR;AACD;AAIO,MAAM,mBAAmB;AAAA,EAC/B,YAA4B,UAAgE,QAAwC;AAAxG,SAAA,WAAA;AAAgE,SAAA,SAAA;AAAA,EAC5F;AAAA,EAEA,oBAAqC;AACpC,WAAO;AAAA,MACN,IAAI,KAAK,OAAO;AAAA,MAChB,OAAO,KAAK,OAAO;AAAA,MACnB,UAAU;AAAA,QACT,GAAG,KAAK;AAAA,QACR,UAAU,CAAA;AAAA,MAAC;AAAA,IACZ;AAAA,EAEF;AACD;"}

package/dist/development/src/model/service/helpers/getPreferredProject.cjs

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const getPreferredProject = (projects, preferredProjectSlug) => {
+  if (projects.length === 1) {
+    return projects[0];
+  }
+  if (preferredProjectSlug) {
+    return projects.find((it) => it.slug === preferredProjectSlug) || null;
+  }
+  return null;
+};
+exports.getPreferredProject = getPreferredProject;
+//# sourceMappingURL=getPreferredProject.cjs.map

package/dist/development/src/model/service/helpers/getPreferredProject.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"getPreferredProject.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":";;AAEO,MAAM,sBAAsB,CAAC,UAAqB,yBAAwD;AAChH,MAAI,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACA,SAAO;AACR;;"}

package/dist/development/src/model/service/helpers/getPreferredProject.js

@@ -0,0 +1,13 @@
+const getPreferredProject = (projects, preferredProjectSlug) => {
+  if (projects.length === 1) {
+    return projects[0];
+  }
+  if (preferredProjectSlug) {
+    return projects.find((it) => it.slug === preferredProjectSlug) || null;
+  }
+  return null;
+};
+export {
+  getPreferredProject
+};
+//# sourceMappingURL=getPreferredProject.js.map

package/dist/development/src/model/service/helpers/getPreferredProject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"getPreferredProject.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":"AAEO,MAAM,sBAAsB,CAAC,UAAqB,yBAAwD;AAChH,MAAI,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACA,SAAO;AACR;"}

package/dist/development/src/model/service/idp/IDPHandlerRegistry.cjs

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const IdentityProviderNotFoundError = require("./IdentityProviderNotFoundError.cjs");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class IDPHandlerRegistry {
+  constructor() {
+    __publicField(this, "providers", {});
+  }
+  registerHandler(type, provider) {
+    this.providers[type] = provider;
+  }
+  getHandlerOrNull(type) {
+    return this.providers[type] ?? null;
+  }
+  getHandler(type) {
+    const provider = this.providers[type];
+    if (!provider) {
+      throw new IdentityProviderNotFoundError.IdentityProviderNotFoundError(`Identity provider handler ${type} not found`);
+    }
+    return provider;
+  }
+}
+exports.IDPHandlerRegistry = IDPHandlerRegistry;
+//# sourceMappingURL=IDPHandlerRegistry.cjs.map

package/dist/development/src/model/service/idp/IDPHandlerRegistry.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPHandlerRegistry.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPHandlerRegistry.ts"],"sourcesContent":["import { IdentityProviderHandler } from './IdentityProviderHandler'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError'\n\nexport class IDPHandlerRegistry {\n\tprivate providers: Record<string, IdentityProviderHandler<any>> = {}\n\n\tpublic registerHandler(type: string, provider: IdentityProviderHandler<any>): void {\n\t\tthis.providers[type] = provider\n\t}\n\n\tpublic getHandlerOrNull(type: string): IdentityProviderHandler<{}> | null {\n\t\treturn this.providers[type] ?? null\n\t}\n\n\tpublic getHandler(type: string): IdentityProviderHandler<{}> {\n\t\tconst provider = this.providers[type]\n\t\tif (!provider) {\n\t\t\tthrow new IdentityProviderNotFoundError(`Identity provider handler ${type} not found`)\n\t\t}\n\t\treturn provider\n\t}\n}\n"],"names":["IdentityProviderNotFoundError"],"mappings":";;;;;;AAGO,MAAM,mBAAmB;AAAA,EAAzB,cAAA;AACN,kBAAA,MAAQ,aAA0D,EAAC;AAAA,EAAA;AAAA,EAE5D,gBAAgB,MAAc,UAA8C;AAClF,SAAK,UAAU,IAAI,IAAI;AAAA,EACxB;AAAA,EAEO,iBAAiB,MAAkD;AACzE,WAAO,KAAK,UAAU,IAAI,KAAK;AAAA,EAChC;AAAA,EAEO,WAAW,MAA2C;AAC5D,UAAM,WAAW,KAAK,UAAU,IAAI;AACpC,QAAI,CAAC,UAAU;AACd,YAAM,IAAIA,8BAAAA,8BAA8B,6BAA6B,IAAI,YAAY;AAAA,IACtF;AACA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/service/idp/IDPHandlerRegistry.js

@@ -0,0 +1,26 @@
+import { IdentityProviderNotFoundError } from "./IdentityProviderNotFoundError.js";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class IDPHandlerRegistry {
+  constructor() {
+    __publicField(this, "providers", {});
+  }
+  registerHandler(type, provider) {
+    this.providers[type] = provider;
+  }
+  getHandlerOrNull(type) {
+    return this.providers[type] ?? null;
+  }
+  getHandler(type) {
+    const provider = this.providers[type];
+    if (!provider) {
+      throw new IdentityProviderNotFoundError(`Identity provider handler ${type} not found`);
+    }
+    return provider;
+  }
+}
+export {
+  IDPHandlerRegistry
+};
+//# sourceMappingURL=IDPHandlerRegistry.js.map

package/dist/development/src/model/service/idp/IDPHandlerRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPHandlerRegistry.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPHandlerRegistry.ts"],"sourcesContent":["import { IdentityProviderHandler } from './IdentityProviderHandler'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError'\n\nexport class IDPHandlerRegistry {\n\tprivate providers: Record<string, IdentityProviderHandler<any>> = {}\n\n\tpublic registerHandler(type: string, provider: IdentityProviderHandler<any>): void {\n\t\tthis.providers[type] = provider\n\t}\n\n\tpublic getHandlerOrNull(type: string): IdentityProviderHandler<{}> | null {\n\t\treturn this.providers[type] ?? null\n\t}\n\n\tpublic getHandler(type: string): IdentityProviderHandler<{}> {\n\t\tconst provider = this.providers[type]\n\t\tif (!provider) {\n\t\t\tthrow new IdentityProviderNotFoundError(`Identity provider handler ${type} not found`)\n\t\t}\n\t\treturn provider\n\t}\n}\n"],"names":[],"mappings":";;;;AAGO,MAAM,mBAAmB;AAAA,EAAzB,cAAA;AACN,kBAAA,MAAQ,aAA0D,EAAC;AAAA,EAAA;AAAA,EAE5D,gBAAgB,MAAc,UAA8C;AAClF,SAAK,UAAU,IAAI,IAAI;AAAA,EACxB;AAAA,EAEO,iBAAiB,MAAkD;AACzE,WAAO,KAAK,UAAU,IAAI,KAAK;AAAA,EAChC;AAAA,EAEO,WAAW,MAA2C;AAC5D,UAAM,WAAW,KAAK,UAAU,IAAI;AACpC,QAAI,CAAC,UAAU;AACd,YAAM,IAAI,8BAA8B,6BAA6B,IAAI,YAAY;AAAA,IACtF;AACA,WAAO;AAAA,EACR;AACD;"}