@contember/engine-tenant-api 2.1.0-alpha.36 → 2.1.0-alpha.39

package/dist/production/src/migrations/snapshot.js

@@ -0,0 +1,288 @@
+import { createCredentials } from "./tenantCredentials.js";
+async function snapshot(builder, args) {
+  builder.sql(`
+CREATE TYPE "auth_log_type" AS ENUM (
+    'login',
+    'create_session_token',
+    'idp_login',
+    'password_reset_init',
+    'password_reset',
+    'password_change',
+    'email_change',
+    '2fa_disable',
+    '2fa_enable',
+    'passwordless_login_init',
+    'passwordless_login_exchange',
+    'passwordless_login',
+    'person_disable'
+);
+CREATE TYPE "config_policy" AS ENUM (
+    'always',
+    'never',
+    'optIn',
+    'optOut'
+);
+CREATE TYPE "config_singleton" AS ENUM (
+    'singleton'
+);
+CREATE TYPE "person_token_type" AS ENUM (
+    'password_reset',
+    'passwordless'
+);
+CREATE FUNCTION "project_deleted"() RETURNS "trigger"
+    LANGUAGE "plpgsql"
+    AS $$
+BEGIN
+	PERFORM pg_notify('project_updated', old.id::text);
+	RETURN NULL;
+END;
+$$;
+CREATE FUNCTION "project_secret_updated"() RETURNS "trigger"
+    LANGUAGE "plpgsql"
+    AS $$
+BEGIN
+	UPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);
+	PERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);
+	RETURN NULL;
+END;
+$$;
+CREATE FUNCTION "project_updated"() RETURNS "trigger"
+    LANGUAGE "plpgsql"
+    AS $$
+BEGIN
+	NEW.updated_at = 'now';
+	PERFORM pg_notify('project_updated', new.id::text);
+	RETURN new;
+END;
+$$;
+CREATE TABLE "api_key" (
+    "id" "uuid" NOT NULL,
+    "token_hash" "text" NOT NULL,
+    "type" "text" NOT NULL,
+    "identity_id" "uuid" NOT NULL,
+    "expires_at" timestamp with time zone,
+    "created_at" timestamp with time zone NOT NULL,
+    "expiration" integer,
+    "disabled_at" timestamp with time zone
+);
+CREATE TABLE "config" (
+    "id" "config_singleton" DEFAULT 'singleton'::"config_singleton" NOT NULL,
+    "passwordless_enabled" "config_policy" DEFAULT 'never'::"config_policy" NOT NULL,
+    "passwordless_url" "text",
+    "passwordless_expiration" interval DEFAULT '00:05:00'::interval NOT NULL,
+    "password_min_length" integer DEFAULT 8 NOT NULL,
+    "password_require_uppercase" integer DEFAULT 1 NOT NULL,
+    "password_require_lowercase" integer DEFAULT 1 NOT NULL,
+    "password_require_digit" integer DEFAULT 1 NOT NULL,
+    "password_require_special" integer DEFAULT 0 NOT NULL,
+    "password_pattern" "text",
+    "password_check_blacklist" boolean DEFAULT true NOT NULL,
+    "login_base_backoff" interval DEFAULT '00:00:01'::interval NOT NULL,
+    "login_max_backoff" interval DEFAULT '00:01:00'::interval NOT NULL,
+    "login_attempt_window" interval DEFAULT '00:05:00'::interval NOT NULL,
+    "login_reveal_user_exits" boolean DEFAULT true NOT NULL,
+    "login_default_token_expiration" interval DEFAULT '00:30:00'::interval NOT NULL,
+    "login_max_token_expiration" interval DEFAULT '6 mons'::interval
+);
+CREATE TABLE "identity" (
+    "id" "uuid" NOT NULL,
+    "parent_id" "uuid",
+    "roles" "jsonb" NOT NULL,
+    "description" "text",
+    "created_at" timestamp with time zone NOT NULL
+);
+CREATE TABLE "identity_provider" (
+    "id" "uuid" NOT NULL,
+    "slug" "text" NOT NULL,
+    "type" "text" NOT NULL,
+    "configuration" "jsonb" NOT NULL,
+    "disabled_at" timestamp with time zone,
+    "auto_sign_up" boolean DEFAULT false NOT NULL,
+    "exclusive" boolean DEFAULT false,
+    "init_returns_config" boolean DEFAULT false NOT NULL
+);
+CREATE TABLE "mail_template" (
+    "id" "uuid" NOT NULL,
+    "project_id" "uuid",
+    "mail_type" "text" NOT NULL,
+    "variant" "text" NOT NULL,
+    "subject" "text" NOT NULL,
+    "content" "text" NOT NULL,
+    "use_layout" boolean NOT NULL,
+    "reply_to" "text"
+);
+CREATE TABLE "person" (
+    "id" "uuid" NOT NULL,
+    "email" "text",
+    "password_hash" "text",
+    "identity_id" "uuid" NOT NULL,
+    "otp_uri" "text",
+    "otp_activated_at" timestamp with time zone,
+    "name" "text",
+    "idp_only" boolean DEFAULT false NOT NULL,
+    "disabled_at" timestamp with time zone,
+    "passwordless_enabled" boolean,
+    CONSTRAINT "idp_only_no_email" CHECK ((("idp_only" = false) OR (("idp_only" = true) AND ("email" IS NULL))))
+);
+CREATE TABLE "person_auth_log" (
+    "id" "uuid" NOT NULL,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "invoked_by_id" "uuid",
+    "person_id" "uuid",
+    "person_token_id" "uuid",
+    "person_input_identifier" "text",
+    "type" "auth_log_type" NOT NULL,
+    "success" boolean NOT NULL,
+    "error_code" "text",
+    "error_message" "text",
+    "ip_address" "inet",
+    "user_agent" "text",
+    "identity_provider_id" "uuid",
+    "metadata" "jsonb"
+);
+CREATE TABLE "person_identity_provider" (
+    "id" "uuid" NOT NULL,
+    "person_id" "uuid" NOT NULL,
+    "identity_provider_id" "uuid" NOT NULL,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "external_identifier" "text" NOT NULL
+);
+CREATE TABLE "person_token" (
+    "id" "uuid" NOT NULL,
+    "token_hash" "text" NOT NULL,
+    "person_id" "uuid" NOT NULL,
+    "expires_at" timestamp with time zone NOT NULL,
+    "created_at" timestamp with time zone NOT NULL,
+    "used_at" timestamp with time zone,
+    "type" "person_token_type" DEFAULT 'password_reset'::"person_token_type" NOT NULL,
+    "otp_hash" "text",
+    "otp_attempts" integer DEFAULT 0 NOT NULL
+);
+CREATE TABLE "project" (
+    "id" "uuid" NOT NULL,
+    "name" "text" NOT NULL,
+    "slug" "text" NOT NULL,
+    "config" "jsonb" DEFAULT '{}'::"jsonb" NOT NULL,
+    "updated_at" timestamp with time zone DEFAULT "now"() NOT NULL
+);
+CREATE TABLE "project_membership" (
+    "id" "uuid" NOT NULL,
+    "project_id" "uuid" NOT NULL,
+    "identity_id" "uuid" NOT NULL,
+    "role" "text" NOT NULL
+);
+CREATE TABLE "project_membership_variable" (
+    "id" "uuid" NOT NULL,
+    "membership_id" "uuid" NOT NULL,
+    "variable" "text" NOT NULL,
+    "value" "jsonb" NOT NULL
+);
+CREATE TABLE "project_secret" (
+    "id" "uuid" NOT NULL,
+    "project_id" "uuid" NOT NULL,
+    "key" "text" NOT NULL,
+    "created_at" timestamp with time zone NOT NULL,
+    "updated_at" timestamp with time zone NOT NULL,
+    "value" "bytea" NOT NULL,
+    "version" smallint NOT NULL
+);
+ALTER TABLE ONLY "api_key"
+    ADD CONSTRAINT "api_key_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "config"
+    ADD CONSTRAINT "config_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person"
+    ADD CONSTRAINT "email_unique" UNIQUE ("email");
+ALTER TABLE ONLY "identity"
+    ADD CONSTRAINT "identity_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "identity_provider"
+    ADD CONSTRAINT "identity_provider_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "identity_provider"
+    ADD CONSTRAINT "identity_provider_slug_key" UNIQUE ("slug");
+ALTER TABLE ONLY "mail_template"
+    ADD CONSTRAINT "mail_template_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person"
+    ADD CONSTRAINT "person_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person"
+    ADD CONSTRAINT "person_identity_id_key" UNIQUE ("identity_id");
+ALTER TABLE ONLY "person_identity_provider"
+    ADD CONSTRAINT "person_identity_provider_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person_token"
+    ADD CONSTRAINT "person_password_reset_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "project"
+    ADD CONSTRAINT "project_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "project_membership"
+    ADD CONSTRAINT "project_membership_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "project_membership_variable"
+    ADD CONSTRAINT "project_membership_variable_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "project_membership_variable"
+    ADD CONSTRAINT "project_membership_variable_unique" UNIQUE ("membership_id", "variable");
+ALTER TABLE ONLY "project_secret"
+    ADD CONSTRAINT "project_secret_pkey" PRIMARY KEY ("id");
+CREATE INDEX "api_key_identity_id" ON "api_key" USING "btree" ("identity_id");
+CREATE UNIQUE INDEX "api_key_token_hash" ON "api_key" USING "btree" ("token_hash");
+CREATE INDEX "identity_parent_id" ON "identity" USING "btree" ("parent_id");
+CREATE UNIQUE INDEX "mail_template_identifier" ON "mail_template" USING "btree" ("project_id", "mail_type", "variant") WHERE ("project_id" IS NOT NULL);
+CREATE UNIQUE INDEX "mail_template_identifier_global" ON "mail_template" USING "btree" ("mail_type", "variant") WHERE ("project_id" IS NULL);
+CREATE INDEX "mail_template_project_index" ON "mail_template" USING "btree" ("project_id");
+CREATE INDEX "person_auth_log_person_input_identifier_created_at_idx" ON "person_auth_log" USING "btree" ("person_input_identifier", "created_at" DESC);
+CREATE INDEX "person_identity_id" ON "person" USING "btree" ("identity_id");
+CREATE UNIQUE INDEX "person_identity_provider_identifier" ON "person_identity_provider" USING "btree" ("identity_provider_id", "external_identifier");
+CREATE INDEX "person_identity_provider_person_id" ON "person_identity_provider" USING "btree" ("person_id");
+CREATE UNIQUE INDEX "person_password_reset_token" ON "person_token" USING "btree" ("token_hash");
+CREATE INDEX "project_alias" ON "project" USING "gin" ((("config" -> 'alias'::"text")));
+CREATE INDEX "project_membership_identity_index" ON "project_membership" USING "btree" ("identity_id");
+CREATE UNIQUE INDEX "project_membership_unique" ON "project_membership" USING "btree" ("project_id", "identity_id", "role");
+CREATE INDEX "project_secret_project_index" ON "project_secret" USING "btree" ("project_id");
+CREATE UNIQUE INDEX "project_secret_unique" ON "project_secret" USING "btree" ("project_id", "key");
+CREATE UNIQUE INDEX "project_slug" ON "project" USING "btree" ("slug");
+CREATE TRIGGER "project_deleted" AFTER DELETE ON "project" FOR EACH ROW EXECUTE FUNCTION "project_deleted"();
+CREATE TRIGGER "project_secret_updated" AFTER INSERT OR DELETE OR UPDATE ON "project_secret" FOR EACH ROW EXECUTE FUNCTION "project_secret_updated"();
+CREATE TRIGGER "project_updated" BEFORE INSERT OR UPDATE OF "name", "slug", "config" ON "project" FOR EACH ROW EXECUTE FUNCTION "project_updated"();
+ALTER TABLE ONLY "api_key"
+    ADD CONSTRAINT "api_key_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
+ALTER TABLE ONLY "identity"
+    ADD CONSTRAINT "identity_parent_id_fkey" FOREIGN KEY ("parent_id") REFERENCES "identity"("id");
+ALTER TABLE ONLY "mail_template"
+    ADD CONSTRAINT "mail_template_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_identity_provider_id_fkey" FOREIGN KEY ("identity_provider_id") REFERENCES "identity_provider"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_invoked_by_id_fkey" FOREIGN KEY ("invoked_by_id") REFERENCES "identity"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_person_id_fkey" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_person_token_id_fkey" FOREIGN KEY ("person_token_id") REFERENCES "person_token"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person"
+    ADD CONSTRAINT "person_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
+ALTER TABLE ONLY "person_identity_provider"
+    ADD CONSTRAINT "person_identity_provider_idp" FOREIGN KEY ("identity_provider_id") REFERENCES "identity_provider"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "person_identity_provider"
+    ADD CONSTRAINT "person_identity_provider_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "person_token"
+    ADD CONSTRAINT "person_password_reset_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "project_membership"
+    ADD CONSTRAINT "project_membership_identity" FOREIGN KEY ("identity_id") REFERENCES "identity"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "project_membership"
+    ADD CONSTRAINT "project_membership_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "project_membership_variable"
+    ADD CONSTRAINT "project_membership_variable_membership" FOREIGN KEY ("membership_id") REFERENCES "project_membership"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "project_secret"
+    ADD CONSTRAINT "project_secret_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
+INSERT INTO "config" (id)
+VALUES (DEFAULT);
+
+DO LANGUAGE plpgsql
+$$
+	BEGIN
+		EXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));
+	END
+$$;
+`);
+  await createCredentials(builder, args);
+}
+export {
+  snapshot as default
+};
+//# sourceMappingURL=snapshot.js.map

package/dist/production/src/migrations/snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\nimport { createCredentials } from './tenantCredentials'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n    'login',\n    'create_session_token',\n    'idp_login',\n    'password_reset_init',\n    'password_reset',\n    'password_change',\n    'email_change',\n    '2fa_disable',\n    '2fa_enable',\n    'passwordless_login_init',\n    'passwordless_login_exchange',\n    'passwordless_login',\n    'person_disable'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n    'always',\n    'never',\n    'optIn',\n    'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n    'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n    'password_reset',\n    'passwordless'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"expiration\" integer,\n    \"disabled_at\" timestamp with time zone\n);\nCREATE TABLE \"config\" (\n    \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n    \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n    \"passwordless_url\" \"text\",\n    \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n    \"password_min_length\" integer DEFAULT 8 NOT NULL,\n    \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n    \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n    \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n    \"password_require_special\" integer DEFAULT 0 NOT NULL,\n    \"password_pattern\" \"text\",\n    \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n    \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n    \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n    \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n    \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n    \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n    \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval\n);\nCREATE TABLE \"identity\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"parent_id\" \"uuid\",\n    \"roles\" \"jsonb\" NOT NULL,\n    \"description\" \"text\",\n    \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"configuration\" \"jsonb\" NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n    \"exclusive\" boolean DEFAULT false,\n    \"init_returns_config\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\",\n    \"mail_type\" \"text\" NOT NULL,\n    \"variant\" \"text\" NOT NULL,\n    \"subject\" \"text\" NOT NULL,\n    \"content\" \"text\" NOT NULL,\n    \"use_layout\" boolean NOT NULL,\n    \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"email\" \"text\",\n    \"password_hash\" \"text\",\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"otp_uri\" \"text\",\n    \"otp_activated_at\" timestamp with time zone,\n    \"name\" \"text\",\n    \"idp_only\" boolean DEFAULT false NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"passwordless_enabled\" boolean,\n    CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"invoked_by_id\" \"uuid\",\n    \"person_id\" \"uuid\",\n    \"person_token_id\" \"uuid\",\n    \"person_input_identifier\" \"text\",\n    \"type\" \"auth_log_type\" NOT NULL,\n    \"success\" boolean NOT NULL,\n    \"error_code\" \"text\",\n    \"error_message\" \"text\",\n    \"ip_address\" \"inet\",\n    \"user_agent\" \"text\",\n    \"identity_provider_id\" \"uuid\",\n    \"metadata\" \"jsonb\"\n);\nCREATE TABLE \"person_identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"identity_provider_id\" \"uuid\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_token\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"used_at\" timestamp with time zone,\n    \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n    \"otp_hash\" \"text\",\n    \"otp_attempts\" integer DEFAULT 0 NOT NULL\n);\nCREATE TABLE \"project\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"name\" \"text\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n    \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"membership_id\" \"uuid\" NOT NULL,\n    \"variable\" \"text\" NOT NULL,\n    \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"key\" \"text\" NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"updated_at\" timestamp with time zone NOT NULL,\n    \"value\" \"bytea\" NOT NULL,\n    \"version\" smallint NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n    ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n    ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC);\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAuRZ;AAEA,QAAM,kBAAkB,SAAS,IAAI;AACtC;"}

package/dist/production/src/migrations/tenantCredentials.cjs

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const databaseMigrations = require("@contember/database-migrations");
+const createCredentials = async (builder, args) => {
+  const credentials = await args.getCredentials();
+  if (credentials.loginTokenHash) {
+    const tokenHash = credentials.loginTokenHash;
+    builder.sql(`
+			WITH identity AS (
+			    INSERT INTO identity(id, parent_id, roles, description, created_at)
+				VALUES (${databaseMigrations.escapeValue(args.providers.uuid())}, NULL, '["login"]'::JSONB, 'Login key', now()) RETURNING id
+			)
+			INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
+			SELECT ${databaseMigrations.escapeValue(args.providers.uuid())}, ${databaseMigrations.escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
+			FROM identity
+			`);
+  }
+  if (!credentials.rootTokenHash) {
+    throw "Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.";
+  }
+  if (credentials.rootEmail && !credentials.rootPasswordBcrypted) {
+    throw "Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.";
+  }
+  const rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || "root@localhost" : null;
+  const rootPasswordHash = credentials.rootPasswordBcrypted || null;
+  const rootTokenHash = credentials.rootTokenHash;
+  builder.sql(`
+			WITH identity AS (
+				INSERT INTO identity(id, parent_id, roles, description, created_at)
+				VALUES (
+						${databaseMigrations.escapeValue(args.providers.uuid())},
+						NULL,
+						'["super_admin"]'::JSONB
+							|| (CASE WHEN ${databaseMigrations.escapeValue(rootEmail)} IS NOT NULL THEN '["person"]'::JSONB ELSE '[]'::JSONB END),
+						'Superadmin',
+						now()
+					) RETURNING id
+			),
+			person AS (
+				INSERT INTO person(id, email, password_hash, identity_id)
+				SELECT ${databaseMigrations.escapeValue(args.providers.uuid())}, ${databaseMigrations.escapeValue(rootEmail)}, ${databaseMigrations.escapeValue(rootPasswordHash)}, identity.id
+				FROM identity
+				WHERE ${databaseMigrations.escapeValue(rootEmail)} IS NOT NULL
+			    RETURNING id
+			),
+			api_key AS (
+				INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
+				SELECT ${databaseMigrations.escapeValue(args.providers.uuid())}, ${databaseMigrations.escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
+				FROM identity WHERE ${databaseMigrations.escapeValue(rootTokenHash)} IS NOT NULL
+			    RETURNING id
+			)
+			SELECT * FROM person, api_key
+		`);
+};
+exports.createCredentials = createCredentials;
+//# sourceMappingURL=tenantCredentials.cjs.map

package/dist/production/src/migrations/tenantCredentials.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenantCredentials.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/tenantCredentials.ts"],"sourcesContent":["import { escapeValue, MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\n\nexport const createCredentials = async (builder: MigrationBuilder, args: TenantMigrationArgs) => {\n\tconst credentials = await args.getCredentials()\n\tif (credentials.loginTokenHash) {\n\t\tconst tokenHash = credentials.loginTokenHash\n\t\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t    INSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (${escapeValue(args.providers.uuid())}, NULL, '[\"login\"]'::JSONB, 'Login key', now()) RETURNING id\n\t\t\t)\n\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\tFROM identity\n\t\t\t`)\n\t}\n\n\tif (!credentials.rootTokenHash) {\n\t\tthrow 'Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.'\n\t}\n\n\tif (credentials.rootEmail && !credentials.rootPasswordBcrypted) {\n\t\tthrow 'Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.'\n\t}\n\tconst rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || 'root@localhost' : null\n\tconst rootPasswordHash = credentials.rootPasswordBcrypted || null\n\n\tconst rootTokenHash = credentials.rootTokenHash\n\n\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t\tINSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (\n\t\t\t\t\t\t${escapeValue(args.providers.uuid())},\n\t\t\t\t\t\tNULL,\n\t\t\t\t\t\t'[\"super_admin\"]'::JSONB\n\t\t\t\t\t\t\t|| (CASE WHEN ${escapeValue(rootEmail)} IS NOT NULL THEN '[\"person\"]'::JSONB ELSE '[]'::JSONB END),\n\t\t\t\t\t\t'Superadmin',\n\t\t\t\t\t\tnow()\n\t\t\t\t\t) RETURNING id\n\t\t\t),\n\t\t\tperson AS (\n\t\t\t\tINSERT INTO person(id, email, password_hash, identity_id)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootEmail)}, ${escapeValue(rootPasswordHash)}, identity.id\n\t\t\t\tFROM identity\n\t\t\t\tWHERE ${escapeValue(rootEmail)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t),\n\t\t\tapi_key AS (\n\t\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\t\tFROM identity WHERE ${escapeValue(rootTokenHash)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t)\n\t\t\tSELECT * FROM person, api_key\n\t\t`)\n}\n"],"names":["escapeValue"],"mappings":";;;AAGO,MAAM,oBAAoB,OAAO,SAA2B,SAA8B;AAChG,QAAM,cAAc,MAAM,KAAK,eAAA;AAC/B,MAAI,YAAY,gBAAgB;AAC/B,UAAM,YAAY,YAAY;AAC9B,YAAQ,IAAI;AAAA;AAAA;AAAA,cAGAA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,YAGpCA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAKA,+BAAY,SAAS,CAAC;AAAA;AAAA,IAErE;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,eAAe;AAC/B,UAAM;AAAA,EACP;AAEA,MAAI,YAAY,aAAa,CAAC,YAAY,sBAAsB;AAC/D,UAAM;AAAA,EACP;AACA,QAAM,YAAY,YAAY,uBAAuB,YAAY,aAAa,mBAAmB;AACjG,QAAM,mBAAmB,YAAY,wBAAwB;AAE7D,QAAM,gBAAgB,YAAY;AAElC,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,QAILA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,uBAGnBA,mBAAAA,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAOhCA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAKA,mBAAAA,YAAY,SAAS,CAAC,KAAKA,mBAAAA,YAAY,gBAAgB,CAAC;AAAA;AAAA,YAEhGA,mBAAAA,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,aAKrBA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAKA,+BAAY,aAAa,CAAC;AAAA,0BACpDA,mBAAAA,YAAY,aAAa,CAAC;AAAA;AAAA;AAAA;AAAA,GAIjD;AACH;;"}

package/dist/production/src/migrations/tenantCredentials.js

@@ -0,0 +1,56 @@
+import { escapeValue } from "@contember/database-migrations";
+const createCredentials = async (builder, args) => {
+  const credentials = await args.getCredentials();
+  if (credentials.loginTokenHash) {
+    const tokenHash = credentials.loginTokenHash;
+    builder.sql(`
+			WITH identity AS (
+			    INSERT INTO identity(id, parent_id, roles, description, created_at)
+				VALUES (${escapeValue(args.providers.uuid())}, NULL, '["login"]'::JSONB, 'Login key', now()) RETURNING id
+			)
+			INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
+			SELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
+			FROM identity
+			`);
+  }
+  if (!credentials.rootTokenHash) {
+    throw "Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.";
+  }
+  if (credentials.rootEmail && !credentials.rootPasswordBcrypted) {
+    throw "Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.";
+  }
+  const rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || "root@localhost" : null;
+  const rootPasswordHash = credentials.rootPasswordBcrypted || null;
+  const rootTokenHash = credentials.rootTokenHash;
+  builder.sql(`
+			WITH identity AS (
+				INSERT INTO identity(id, parent_id, roles, description, created_at)
+				VALUES (
+						${escapeValue(args.providers.uuid())},
+						NULL,
+						'["super_admin"]'::JSONB
+							|| (CASE WHEN ${escapeValue(rootEmail)} IS NOT NULL THEN '["person"]'::JSONB ELSE '[]'::JSONB END),
+						'Superadmin',
+						now()
+					) RETURNING id
+			),
+			person AS (
+				INSERT INTO person(id, email, password_hash, identity_id)
+				SELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootEmail)}, ${escapeValue(rootPasswordHash)}, identity.id
+				FROM identity
+				WHERE ${escapeValue(rootEmail)} IS NOT NULL
+			    RETURNING id
+			),
+			api_key AS (
+				INSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)
+				SELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()
+				FROM identity WHERE ${escapeValue(rootTokenHash)} IS NOT NULL
+			    RETURNING id
+			)
+			SELECT * FROM person, api_key
+		`);
+};
+export {
+  createCredentials
+};
+//# sourceMappingURL=tenantCredentials.js.map

package/dist/production/src/migrations/tenantCredentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenantCredentials.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/tenantCredentials.ts"],"sourcesContent":["import { escapeValue, MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\n\nexport const createCredentials = async (builder: MigrationBuilder, args: TenantMigrationArgs) => {\n\tconst credentials = await args.getCredentials()\n\tif (credentials.loginTokenHash) {\n\t\tconst tokenHash = credentials.loginTokenHash\n\t\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t    INSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (${escapeValue(args.providers.uuid())}, NULL, '[\"login\"]'::JSONB, 'Login key', now()) RETURNING id\n\t\t\t)\n\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\tFROM identity\n\t\t\t`)\n\t}\n\n\tif (!credentials.rootTokenHash) {\n\t\tthrow 'Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.'\n\t}\n\n\tif (credentials.rootEmail && !credentials.rootPasswordBcrypted) {\n\t\tthrow 'Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.'\n\t}\n\tconst rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || 'root@localhost' : null\n\tconst rootPasswordHash = credentials.rootPasswordBcrypted || null\n\n\tconst rootTokenHash = credentials.rootTokenHash\n\n\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t\tINSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (\n\t\t\t\t\t\t${escapeValue(args.providers.uuid())},\n\t\t\t\t\t\tNULL,\n\t\t\t\t\t\t'[\"super_admin\"]'::JSONB\n\t\t\t\t\t\t\t|| (CASE WHEN ${escapeValue(rootEmail)} IS NOT NULL THEN '[\"person\"]'::JSONB ELSE '[]'::JSONB END),\n\t\t\t\t\t\t'Superadmin',\n\t\t\t\t\t\tnow()\n\t\t\t\t\t) RETURNING id\n\t\t\t),\n\t\t\tperson AS (\n\t\t\t\tINSERT INTO person(id, email, password_hash, identity_id)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootEmail)}, ${escapeValue(rootPasswordHash)}, identity.id\n\t\t\t\tFROM identity\n\t\t\t\tWHERE ${escapeValue(rootEmail)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t),\n\t\t\tapi_key AS (\n\t\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\t\tFROM identity WHERE ${escapeValue(rootTokenHash)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t)\n\t\t\tSELECT * FROM person, api_key\n\t\t`)\n}\n"],"names":[],"mappings":";AAGO,MAAM,oBAAoB,OAAO,SAA2B,SAA8B;AAChG,QAAM,cAAc,MAAM,KAAK,eAAA;AAC/B,MAAI,YAAY,gBAAgB;AAC/B,UAAM,YAAY,YAAY;AAC9B,YAAQ,IAAI;AAAA;AAAA;AAAA,cAGA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,YAGpC,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAK,YAAY,SAAS,CAAC;AAAA;AAAA,IAErE;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,eAAe;AAC/B,UAAM;AAAA,EACP;AAEA,MAAI,YAAY,aAAa,CAAC,YAAY,sBAAsB;AAC/D,UAAM;AAAA,EACP;AACA,QAAM,YAAY,YAAY,uBAAuB,YAAY,aAAa,mBAAmB;AACjG,QAAM,mBAAmB,YAAY,wBAAwB;AAE7D,QAAM,gBAAgB,YAAY;AAElC,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,QAIL,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,uBAGnB,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAOhC,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAK,YAAY,SAAS,CAAC,KAAK,YAAY,gBAAgB,CAAC;AAAA;AAAA,YAEhG,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,aAKrB,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAK,YAAY,aAAa,CAAC;AAAA,0BACpD,YAAY,aAAa,CAAC;AAAA;AAAA;AAAA;AAAA,GAIjD;AACH;"}

package/dist/production/src/model/authorization/AclSchemaAccessNodeFactory.cjs

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const PermissionActions = require("./PermissionActions.cjs");
+const MembershipMatcher = require("./MembershipMatcher.cjs");
+const DirectPermissionsAccessNode = require("./DirectPermissionsAccessNode.cjs");
+class AclSchemaAccessNodeFactory {
+  create(schema, memberships) {
+    const createVerifier = (getRule) => {
+      const membershipMatcher = new MembershipMatcher.MembershipMatcher(memberships.map((it) => ({
+        ...it,
+        matchRule: getRule(schema.roles[it.role]?.tenant ?? {})
+      })));
+      return ({ memberships: memberships2 }) => {
+        return memberships2.every((it) => membershipMatcher.matches(it));
+      };
+    };
+    const membershipRoles = memberships.map((it) => schema.roles[it.role]).filter((it) => !!it);
+    const node = new DirectPermissionsAccessNode.DirectPermissionsAccessNode();
+    if (membershipRoles.some((it) => it.tenant?.invite)) {
+      const verifier = createVerifier((it) => it.invite && it.invite !== true ? it.invite : it.manage ?? {});
+      node.allow(PermissionActions.PermissionActions.PERSON_INVITE([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.unmanagedInvite)) {
+      const verifier = createVerifier((it) => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {});
+      node.allow(PermissionActions.PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.manage)) {
+      const verifier = createVerifier((it) => it.manage ?? {});
+      node.allow(PermissionActions.PermissionActions.PROJECT_ADD_MEMBER([]), verifier);
+      node.allow(PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
+      node.allow(PermissionActions.PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier);
+      node.allow(PermissionActions.PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.view)) {
+      const verifier = createVerifier((it) => it.view ?? {});
+      node.allow(PermissionActions.PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
+    }
+    return node;
+  }
+}
+exports.AclSchemaAccessNodeFactory = AclSchemaAccessNodeFactory;
+//# sourceMappingURL=AclSchemaAccessNodeFactory.cjs.map

package/dist/production/src/model/authorization/AclSchemaAccessNodeFactory.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AclSchemaAccessNodeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["MembershipMatcher","memberships","DirectPermissionsAccessNode","PermissionActions"],"mappings":";;;;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAC9E,UAAM,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAIA,kBAAAA,kBAAkB,YAAY,IAAI,CAAA,QAAO;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA,CAAE;AAAA,MAAA,EACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAC,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE;AACtF,UAAM,OAAO,IAAIC,wDAAA;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAMC,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAMA,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAMA,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,GAAG,QAAQ;AAC7D,WAAK,MAAMA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAC9D,WAAK,MAAMA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAChE,WAAK,MAAMA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAMA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAAA,IAC/D;AAEA,WAAO;AAAA,EACR;AACD;;"}

package/dist/production/src/model/authorization/AclSchemaAccessNodeFactory.js

@@ -0,0 +1,42 @@
+import { PermissionActions } from "./PermissionActions.js";
+import { MembershipMatcher } from "./MembershipMatcher.js";
+import { DirectPermissionsAccessNode } from "./DirectPermissionsAccessNode.js";
+class AclSchemaAccessNodeFactory {
+  create(schema, memberships) {
+    const createVerifier = (getRule) => {
+      const membershipMatcher = new MembershipMatcher(memberships.map((it) => ({
+        ...it,
+        matchRule: getRule(schema.roles[it.role]?.tenant ?? {})
+      })));
+      return ({ memberships: memberships2 }) => {
+        return memberships2.every((it) => membershipMatcher.matches(it));
+      };
+    };
+    const membershipRoles = memberships.map((it) => schema.roles[it.role]).filter((it) => !!it);
+    const node = new DirectPermissionsAccessNode();
+    if (membershipRoles.some((it) => it.tenant?.invite)) {
+      const verifier = createVerifier((it) => it.invite && it.invite !== true ? it.invite : it.manage ?? {});
+      node.allow(PermissionActions.PERSON_INVITE([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.unmanagedInvite)) {
+      const verifier = createVerifier((it) => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {});
+      node.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.manage)) {
+      const verifier = createVerifier((it) => it.manage ?? {});
+      node.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier);
+      node.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
+      node.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier);
+      node.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier);
+    }
+    if (membershipRoles.some((it) => it.tenant?.view)) {
+      const verifier = createVerifier((it) => it.view ?? {});
+      node.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier);
+    }
+    return node;
+  }
+}
+export {
+  AclSchemaAccessNodeFactory
+};
+//# sourceMappingURL=AclSchemaAccessNodeFactory.js.map

package/dist/production/src/model/authorization/AclSchemaAccessNodeFactory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AclSchemaAccessNodeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["memberships"],"mappings":";;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAC9E,UAAM,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAI,kBAAkB,YAAY,IAAI,CAAA,QAAO;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA,CAAE;AAAA,MAAA,EACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAA,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE;AACtF,UAAM,OAAO,IAAI,4BAAA;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAM,kBAAkB,cAAc,CAAA,CAAE,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAM,kBAAkB,wBAAwB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAM,kBAAkB,mBAAmB,CAAA,CAAE,GAAG,QAAQ;AAC7D,WAAK,MAAM,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAC9D,WAAK,MAAM,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAChE,WAAK,MAAM,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAM,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAAA,IAC/D;AAEA,WAAO;AAAA,EACR;AACD;"}

package/dist/production/src/model/authorization/DirectPermissionsAccessNode.cjs

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class DirectPermissionsAccessNode {
+  constructor() {
+    __publicField(this, "permissions", {});
+  }
+  allow({ resource, privilege }, verifier = () => true) {
+    var _a;
+    (_a = this.permissions)[resource] ?? (_a[resource] = {});
+    this.permissions[resource][privilege] = verifier;
+  }
+  isAllowed(accessEvaluator, { resource, meta, privilege }) {
+    return Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true);
+  }
+}
+exports.DirectPermissionsAccessNode = DirectPermissionsAccessNode;
+//# sourceMappingURL=DirectPermissionsAccessNode.cjs.map

package/dist/production/src/model/authorization/DirectPermissionsAccessNode.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectPermissionsAccessNode.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/DirectPermissionsAccessNode.ts"],"sourcesContent":["import { AccessEvaluator, AccessNode, Authorizator } from '@contember/authorization'\n\ntype PermissionsMap = {\n\t[resource: string]: {\n\t\t[privilege: string]: (meta: any) => boolean\n\t}\n}\n\nexport class DirectPermissionsAccessNode implements AccessNode {\n\tprivate permissions: PermissionsMap = {}\n\n\tpublic allow<Meta extends {} | undefined = undefined>(\n\t\t{ resource, privilege }: Authorizator.Action<Meta>,\n\t\tverifier: (meta: Meta) => boolean = () => true,\n\t) {\n\t\tthis.permissions[resource] ??= {}\n\t\tthis.permissions[resource][privilege] = verifier\n\t}\n\n\tisAllowed(accessEvaluator: AccessEvaluator, { resource, meta, privilege }: Authorizator.Action): Promise<boolean> {\n\t\treturn Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true)\n\t}\n}\n"],"names":[],"mappings":";;;;;AAQO,MAAM,4BAAkD;AAAA,EAAxD,cAAA;AACN,kBAAA,MAAQ,eAA8B,EAAC;AAAA,EAAA;AAAA,EAEhC,MACN,EAAE,UAAU,aACZ,WAAoC,MAAM,MACzC;AAdH,QAAA;AAeE,KAAA,KAAA,KAAK,aAAL,6BAA+B;AAC/B,SAAK,YAAY,QAAQ,EAAE,SAAS,IAAI;AAAA,EACzC;AAAA,EAEA,UAAU,iBAAkC,EAAE,UAAU,MAAM,aAAoD;AACjH,WAAO,QAAQ,QAAQ,KAAK,YAAY,QAAQ,IAAI,SAAS,IAAI,IAAI,MAAM,IAAI;AAAA,EAChF;AACD;;"}

package/dist/production/src/model/authorization/DirectPermissionsAccessNode.js

@@ -0,0 +1,20 @@
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class DirectPermissionsAccessNode {
+  constructor() {
+    __publicField(this, "permissions", {});
+  }
+  allow({ resource, privilege }, verifier = () => true) {
+    var _a;
+    (_a = this.permissions)[resource] ?? (_a[resource] = {});
+    this.permissions[resource][privilege] = verifier;
+  }
+  isAllowed(accessEvaluator, { resource, meta, privilege }) {
+    return Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true);
+  }
+}
+export {
+  DirectPermissionsAccessNode
+};
+//# sourceMappingURL=DirectPermissionsAccessNode.js.map

package/dist/production/src/model/authorization/DirectPermissionsAccessNode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DirectPermissionsAccessNode.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/DirectPermissionsAccessNode.ts"],"sourcesContent":["import { AccessEvaluator, AccessNode, Authorizator } from '@contember/authorization'\n\ntype PermissionsMap = {\n\t[resource: string]: {\n\t\t[privilege: string]: (meta: any) => boolean\n\t}\n}\n\nexport class DirectPermissionsAccessNode implements AccessNode {\n\tprivate permissions: PermissionsMap = {}\n\n\tpublic allow<Meta extends {} | undefined = undefined>(\n\t\t{ resource, privilege }: Authorizator.Action<Meta>,\n\t\tverifier: (meta: Meta) => boolean = () => true,\n\t) {\n\t\tthis.permissions[resource] ??= {}\n\t\tthis.permissions[resource][privilege] = verifier\n\t}\n\n\tisAllowed(accessEvaluator: AccessEvaluator, { resource, meta, privilege }: Authorizator.Action): Promise<boolean> {\n\t\treturn Promise.resolve(this.permissions[resource]?.[privilege]?.(meta) === true)\n\t}\n}\n"],"names":[],"mappings":";;;AAQO,MAAM,4BAAkD;AAAA,EAAxD,cAAA;AACN,kBAAA,MAAQ,eAA8B,EAAC;AAAA,EAAA;AAAA,EAEhC,MACN,EAAE,UAAU,aACZ,WAAoC,MAAM,MACzC;AAdH,QAAA;AAeE,KAAA,KAAA,KAAK,aAAL,6BAA+B;AAC/B,SAAK,YAAY,QAAQ,EAAE,SAAS,IAAI;AAAA,EACzC;AAAA,EAEA,UAAU,iBAAkC,EAAE,UAAU,MAAM,aAAoD;AACjH,WAAO,QAAQ,QAAQ,KAAK,YAAY,QAAQ,IAAI,SAAS,IAAI,IAAI,MAAM,IAAI;AAAA,EAChF;AACD;"}