@contember/engine-tenant-api 2.1.0-alpha.37 → 2.1.0-alpha.39

package/dist/production/src/model/service/PasswordStrengthValidator.cjs

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const blacklist = require("../utils/blacklist.cjs");
+const Response = require("../utils/Response.cjs");
+class PasswordStrengthValidator {
+  async verify(password, passwordConfig, errorCode) {
+    const failureReasons = [];
+    const developerMessage = [];
+    if (password.length < passwordConfig.minLength) {
+      failureReasons.push("TOO_SHORT");
+      developerMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`);
+    }
+    if (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {
+      failureReasons.push("MISSING_UPPERCASE");
+      developerMessage.push(
+        `Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? "s" : ""}.`
+      );
+    }
+    if (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {
+      failureReasons.push("MISSING_LOWERCASE");
+      developerMessage.push(
+        `Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? "s" : ""}.`
+      );
+    }
+    if (passwordConfig.requireDigit > 0 && (password.match(/\d/g) || []).length < passwordConfig.requireDigit) {
+      failureReasons.push("MISSING_DIGIT");
+      developerMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? "s" : ""}.`);
+    }
+    if (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {
+      failureReasons.push("MISSING_SPECIAL");
+      developerMessage.push(
+        `Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? "s" : ""}.`
+      );
+    }
+    if (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {
+      failureReasons.push("INVALID_PATTERN");
+      developerMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`);
+    }
+    if (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {
+      failureReasons.push("BLACKLISTED");
+      developerMessage.push(`Password is blacklisted.`);
+    }
+    if (failureReasons.length > 0) {
+      return new Response.ResponseError(errorCode, developerMessage.join(" "), {
+        weakPasswordReasons: failureReasons
+      });
+    }
+    return new Response.ResponseOk(null);
+  }
+  isBlacklisted(password) {
+    return blacklist.blacklist.has(password) || blacklist.blacklist.has(this.decodeLeetspeak(password));
+  }
+  decodeLeetspeak(input) {
+    const leetspeakMap = {
+      "@": "a",
+      "$": "s",
+      "0": "o",
+      "1": "l",
+      "3": "e",
+      "7": "t",
+      "!": "i"
+    };
+    return input.split("").map((char) => {
+      return leetspeakMap[char] || char;
+    }).join("");
+  }
+}
+exports.PasswordStrengthValidator = PasswordStrengthValidator;
+//# sourceMappingURL=PasswordStrengthValidator.cjs.map

package/dist/production/src/model/service/PasswordStrengthValidator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordStrengthValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordStrengthValidator.ts"],"sourcesContent":["import { Config } from '../type/Config'\nimport { blacklist } from '../utils/blacklist'\nimport { WeakPasswordReason } from '../../schema'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\n\nexport class PasswordStrengthValidator {\n\tpublic async verify<const Code extends string>(\n\t\tpassword: string,\n\t\tpasswordConfig: Config['password'],\n\t\terrorCode: Code,\n\t): Promise<\n\t\t| ResponseOk<null>\n\t\t| ResponseError<Code, {\n\t\t\tweakPasswordReasons: WeakPasswordReason[]\n\t\t}>\n\t> {\n\t\tconst failureReasons: WeakPasswordReason[] = []\n\t\tconst developerMessage: string[] = []\n\n\t\tif (password.length < passwordConfig.minLength) {\n\t\t\tfailureReasons.push('TOO_SHORT')\n\t\t\tdeveloperMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {\n\t\t\tfailureReasons.push('MISSING_UPPERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {\n\t\t\tfailureReasons.push('MISSING_LOWERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireDigit > 0 && (password.match(/\\d/g) || []).length < passwordConfig.requireDigit) {\n\t\t\tfailureReasons.push('MISSING_DIGIT')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?\":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {\n\t\t\tfailureReasons.push('MISSING_SPECIAL')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {\n\t\t\tfailureReasons.push('INVALID_PATTERN')\n\t\t\tdeveloperMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`)\n\t\t}\n\n\t\tif (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {\n\t\t\tfailureReasons.push('BLACKLISTED')\n\t\t\tdeveloperMessage.push(`Password is blacklisted.`)\n\t\t}\n\n\t\tif (failureReasons.length > 0) {\n\t\t\treturn new ResponseError(errorCode as any, developerMessage.join(' '), {\n\t\t\t\tweakPasswordReasons: failureReasons,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate isBlacklisted(password: string): boolean {\n\t\treturn blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password))\n\t}\n\n\tprivate decodeLeetspeak(input: string): string {\n\t\tconst leetspeakMap: { [key: string]: string } = {\n\t\t\t'@': 'a',\n\t\t\t'$': 's',\n\t\t\t'0': 'o',\n\t\t\t'1': 'l',\n\t\t\t'3': 'e',\n\t\t\t'7': 't',\n\t\t\t'!': 'i',\n\t\t}\n\t\treturn input\n\t\t\t.split('')\n\t\t\t.map(char => {\n\t\t\t\treturn leetspeakMap[char] || char\n\t\t\t})\n\t\t\t.join('')\n\t}\n}\n\nnamespace PasswordStrengthValidator {\n\texport type Result =\n\t\t| { ok: true }\n\t\t| { ok: false; reasons: WeakPasswordReason[]; message: string }\n}\n"],"names":["ResponseError","ResponseOk","blacklist"],"mappings":";;;;AAKO,MAAM,0BAA0B;AAAA,EACtC,MAAa,OACZ,UACA,gBACA,WAMC;AACD,UAAM,iBAAuC,CAAA;AAC7C,UAAM,mBAA6B,CAAA;AAEnC,QAAI,SAAS,SAAS,eAAe,WAAW;AAC/C,qBAAe,KAAK,WAAW;AAC/B,uBAAiB,KAAK,4CAA4C,eAAe,SAAS,GAAG;AAAA,IAC9F;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,eAAe,MAAM,SAAS,MAAM,KAAK,KAAK,CAAA,GAAI,SAAS,eAAe,cAAc;AAC1G,qBAAe,KAAK,eAAe;AACnC,uBAAiB,KAAK,kCAAkC,eAAe,YAAY,SAAS,eAAe,eAAe,IAAI,MAAM,EAAE,GAAG;AAAA,IAC1I;AAEA,QAAI,eAAe,iBAAiB,MAAM,SAAS,MAAM,yBAAyB,KAAK,CAAA,GAAI,SAAS,eAAe,gBAAgB;AAClI,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,cAAc,qBAAqB,eAAe,iBAAiB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAElI;AAEA,QAAI,eAAe,WAAW,CAAC,IAAI,OAAO,eAAe,OAAO,EAAE,KAAK,QAAQ,GAAG;AACjF,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB,KAAK,iDAAiD,eAAe,OAAO,GAAG;AAAA,IACjG;AAEA,QAAI,eAAe,kBAAkB,KAAK,cAAc,SAAS,YAAA,CAAa,GAAG;AAChF,qBAAe,KAAK,aAAa;AACjC,uBAAiB,KAAK,0BAA0B;AAAA,IACjD;AAEA,QAAI,eAAe,SAAS,GAAG;AAC9B,aAAO,IAAIA,SAAAA,cAAc,WAAkB,iBAAiB,KAAK,GAAG,GAAG;AAAA,QACtE,qBAAqB;AAAA,MAAA,CACrB;AAAA,IACF;AACA,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,UAA2B;AAChD,WAAOC,UAAAA,UAAU,IAAI,QAAQ,KAAKA,UAAAA,UAAU,IAAI,KAAK,gBAAgB,QAAQ,CAAC;AAAA,EAC/E;AAAA,EAEQ,gBAAgB,OAAuB;AAC9C,UAAM,eAA0C;AAAA,MAC/C,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,MACL,MAAM,EAAE,EACR,IAAI,CAAA,SAAQ;AACZ,aAAO,aAAa,IAAI,KAAK;AAAA,IAC9B,CAAC,EACA,KAAK,EAAE;AAAA,EACV;AACD;;"}

package/dist/production/src/model/service/PasswordStrengthValidator.js

@@ -0,0 +1,69 @@
+import { blacklist } from "../utils/blacklist.js";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+class PasswordStrengthValidator {
+  async verify(password, passwordConfig, errorCode) {
+    const failureReasons = [];
+    const developerMessage = [];
+    if (password.length < passwordConfig.minLength) {
+      failureReasons.push("TOO_SHORT");
+      developerMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`);
+    }
+    if (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {
+      failureReasons.push("MISSING_UPPERCASE");
+      developerMessage.push(
+        `Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? "s" : ""}.`
+      );
+    }
+    if (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {
+      failureReasons.push("MISSING_LOWERCASE");
+      developerMessage.push(
+        `Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? "s" : ""}.`
+      );
+    }
+    if (passwordConfig.requireDigit > 0 && (password.match(/\d/g) || []).length < passwordConfig.requireDigit) {
+      failureReasons.push("MISSING_DIGIT");
+      developerMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? "s" : ""}.`);
+    }
+    if (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {
+      failureReasons.push("MISSING_SPECIAL");
+      developerMessage.push(
+        `Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? "s" : ""}.`
+      );
+    }
+    if (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {
+      failureReasons.push("INVALID_PATTERN");
+      developerMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`);
+    }
+    if (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {
+      failureReasons.push("BLACKLISTED");
+      developerMessage.push(`Password is blacklisted.`);
+    }
+    if (failureReasons.length > 0) {
+      return new ResponseError(errorCode, developerMessage.join(" "), {
+        weakPasswordReasons: failureReasons
+      });
+    }
+    return new ResponseOk(null);
+  }
+  isBlacklisted(password) {
+    return blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password));
+  }
+  decodeLeetspeak(input) {
+    const leetspeakMap = {
+      "@": "a",
+      "$": "s",
+      "0": "o",
+      "1": "l",
+      "3": "e",
+      "7": "t",
+      "!": "i"
+    };
+    return input.split("").map((char) => {
+      return leetspeakMap[char] || char;
+    }).join("");
+  }
+}
+export {
+  PasswordStrengthValidator
+};
+//# sourceMappingURL=PasswordStrengthValidator.js.map

package/dist/production/src/model/service/PasswordStrengthValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordStrengthValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordStrengthValidator.ts"],"sourcesContent":["import { Config } from '../type/Config'\nimport { blacklist } from '../utils/blacklist'\nimport { WeakPasswordReason } from '../../schema'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\n\nexport class PasswordStrengthValidator {\n\tpublic async verify<const Code extends string>(\n\t\tpassword: string,\n\t\tpasswordConfig: Config['password'],\n\t\terrorCode: Code,\n\t): Promise<\n\t\t| ResponseOk<null>\n\t\t| ResponseError<Code, {\n\t\t\tweakPasswordReasons: WeakPasswordReason[]\n\t\t}>\n\t> {\n\t\tconst failureReasons: WeakPasswordReason[] = []\n\t\tconst developerMessage: string[] = []\n\n\t\tif (password.length < passwordConfig.minLength) {\n\t\t\tfailureReasons.push('TOO_SHORT')\n\t\t\tdeveloperMessage.push(`Password is too short. Minimum length is ${passwordConfig.minLength}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireUppercase > 0 && (password.match(/[A-Z]/g) || []).length < passwordConfig.requireUppercase) {\n\t\t\tfailureReasons.push('MISSING_UPPERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireUppercase} uppercase letter${passwordConfig.requireUppercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireLowercase > 0 && (password.match(/[a-z]/g) || []).length < passwordConfig.requireLowercase) {\n\t\t\tfailureReasons.push('MISSING_LOWERCASE')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireLowercase} lowercase letter${passwordConfig.requireLowercase > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.requireDigit > 0 && (password.match(/\\d/g) || []).length < passwordConfig.requireDigit) {\n\t\t\tfailureReasons.push('MISSING_DIGIT')\n\t\t\tdeveloperMessage.push(`Password must contain at least ${passwordConfig.requireDigit} digit${passwordConfig.requireDigit > 1 ? 's' : ''}.`)\n\t\t}\n\n\t\tif (passwordConfig.requireSpecial > 0 && (password.match(/[!@#$%^&*(),.?\":{}|<>]/g) || []).length < passwordConfig.requireSpecial) {\n\t\t\tfailureReasons.push('MISSING_SPECIAL')\n\t\t\tdeveloperMessage.push(\n\t\t\t\t`Password must contain at least ${passwordConfig.requireSpecial} special character${passwordConfig.requireSpecial > 1 ? 's' : ''}.`,\n\t\t\t)\n\t\t}\n\n\t\tif (passwordConfig.pattern && !new RegExp(passwordConfig.pattern).test(password)) {\n\t\t\tfailureReasons.push('INVALID_PATTERN')\n\t\t\tdeveloperMessage.push(`Password does not match the required pattern: ${passwordConfig.pattern}.`)\n\t\t}\n\n\t\tif (passwordConfig.checkBlacklist && this.isBlacklisted(password.toLowerCase())) {\n\t\t\tfailureReasons.push('BLACKLISTED')\n\t\t\tdeveloperMessage.push(`Password is blacklisted.`)\n\t\t}\n\n\t\tif (failureReasons.length > 0) {\n\t\t\treturn new ResponseError(errorCode as any, developerMessage.join(' '), {\n\t\t\t\tweakPasswordReasons: failureReasons,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate isBlacklisted(password: string): boolean {\n\t\treturn blacklist.has(password) || blacklist.has(this.decodeLeetspeak(password))\n\t}\n\n\tprivate decodeLeetspeak(input: string): string {\n\t\tconst leetspeakMap: { [key: string]: string } = {\n\t\t\t'@': 'a',\n\t\t\t'$': 's',\n\t\t\t'0': 'o',\n\t\t\t'1': 'l',\n\t\t\t'3': 'e',\n\t\t\t'7': 't',\n\t\t\t'!': 'i',\n\t\t}\n\t\treturn input\n\t\t\t.split('')\n\t\t\t.map(char => {\n\t\t\t\treturn leetspeakMap[char] || char\n\t\t\t})\n\t\t\t.join('')\n\t}\n}\n\nnamespace PasswordStrengthValidator {\n\texport type Result =\n\t\t| { ok: true }\n\t\t| { ok: false; reasons: WeakPasswordReason[]; message: string }\n}\n"],"names":[],"mappings":";;AAKO,MAAM,0BAA0B;AAAA,EACtC,MAAa,OACZ,UACA,gBACA,WAMC;AACD,UAAM,iBAAuC,CAAA;AAC7C,UAAM,mBAA6B,CAAA;AAEnC,QAAI,SAAS,SAAS,eAAe,WAAW;AAC/C,qBAAe,KAAK,WAAW;AAC/B,uBAAiB,KAAK,4CAA4C,eAAe,SAAS,GAAG;AAAA,IAC9F;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,mBAAmB,MAAM,SAAS,MAAM,QAAQ,KAAK,CAAA,GAAI,SAAS,eAAe,kBAAkB;AACrH,qBAAe,KAAK,mBAAmB;AACvC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,gBAAgB,oBAAoB,eAAe,mBAAmB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAErI;AAEA,QAAI,eAAe,eAAe,MAAM,SAAS,MAAM,KAAK,KAAK,CAAA,GAAI,SAAS,eAAe,cAAc;AAC1G,qBAAe,KAAK,eAAe;AACnC,uBAAiB,KAAK,kCAAkC,eAAe,YAAY,SAAS,eAAe,eAAe,IAAI,MAAM,EAAE,GAAG;AAAA,IAC1I;AAEA,QAAI,eAAe,iBAAiB,MAAM,SAAS,MAAM,yBAAyB,KAAK,CAAA,GAAI,SAAS,eAAe,gBAAgB;AAClI,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB;AAAA,QAChB,kCAAkC,eAAe,cAAc,qBAAqB,eAAe,iBAAiB,IAAI,MAAM,EAAE;AAAA,MAAA;AAAA,IAElI;AAEA,QAAI,eAAe,WAAW,CAAC,IAAI,OAAO,eAAe,OAAO,EAAE,KAAK,QAAQ,GAAG;AACjF,qBAAe,KAAK,iBAAiB;AACrC,uBAAiB,KAAK,iDAAiD,eAAe,OAAO,GAAG;AAAA,IACjG;AAEA,QAAI,eAAe,kBAAkB,KAAK,cAAc,SAAS,YAAA,CAAa,GAAG;AAChF,qBAAe,KAAK,aAAa;AACjC,uBAAiB,KAAK,0BAA0B;AAAA,IACjD;AAEA,QAAI,eAAe,SAAS,GAAG;AAC9B,aAAO,IAAI,cAAc,WAAkB,iBAAiB,KAAK,GAAG,GAAG;AAAA,QACtE,qBAAqB;AAAA,MAAA,CACrB;AAAA,IACF;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,UAA2B;AAChD,WAAO,UAAU,IAAI,QAAQ,KAAK,UAAU,IAAI,KAAK,gBAAgB,QAAQ,CAAC;AAAA,EAC/E;AAAA,EAEQ,gBAAgB,OAAuB;AAC9C,UAAM,eAA0C;AAAA,MAC/C,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,IAAA;AAEN,WAAO,MACL,MAAM,EAAE,EACR,IAAI,CAAA,SAAQ;AACZ,aAAO,aAAa,IAAI,KAAK;AAAA,IAC9B,CAAC,EACA,KAAK,EAAE;AAAA,EACV;AACD;"}

package/dist/production/src/model/service/PasswordlessSignInManager.cjs

@@ -0,0 +1,204 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
+require("@contember/database");
+const exceptions = require("../../exceptions.cjs");
+const PersonQuery = require("../queries/person/PersonQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+const Response = require("../utils/Response.cjs");
+require("../type/ApiKey.cjs");
+const ActivateOtpCommand = require("../commands/personToken/ActivateOtpCommand.cjs");
+const CreatePersonTokenCommand = require("../commands/personToken/CreatePersonTokenCommand.cjs");
+const InvalidateTokenCommand = require("../commands/personToken/InvalidateTokenCommand.cjs");
+const IncreaseOtpAttemptCommand = require("../commands/personToken/IncreaseOtpAttemptCommand.cjs");
+const PersonTokenQuery = require("../queries/personToken/PersonTokenQuery.cjs");
+const token = require("../utils/token.cjs");
+const getPreferredProject = require("./helpers/getPreferredProject.cjs");
+const AuthLogService = require("./AuthLogService.cjs");
+const interval = require("../utils/interval.cjs");
+class PasswordlessSignInManager {
+  constructor(apiKeyManager, mailer, projectManager, otpAuthenticator) {
+    this.apiKeyManager = apiKeyManager;
+    this.mailer = mailer;
+    this.projectManager = projectManager;
+    this.otpAuthenticator = otpAuthenticator;
+  }
+  async initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }) {
+    return db.transaction(async (db2) => {
+      const configuration = await db2.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+      if (configuration.passwordless.enabled === "never") {
+        return new Response.ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled", {
+          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({})
+        });
+      }
+      const person = await db2.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email));
+      if (!person) {
+        return new Response.ResponseError("PERSON_NOT_FOUND", `Person ${email} not found`, {
+          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+            personInput: email
+          })
+        });
+      }
+      if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
+        return new Response.ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person", {
+          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+            personInput: email,
+            personId: person.id
+          })
+        });
+      }
+      const createTokenCommand = CreatePersonTokenCommand.CreatePersonTokenCommand.createPasswordlessRequest(
+        person.id,
+        interval.intervalToSeconds(configuration.passwordless.expiration) / 60
+      );
+      const result = await db2.commandBus.execute(createTokenCommand);
+      const url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? void 0;
+      const projects = await this.projectManager.getProjectsByIdentity(db2, person.identity_id, permissionContext);
+      const project = getPreferredProject.getPreferredProject(projects, mailProject ?? null);
+      await this.mailer.sendPasswordlessEmail(db2, {
+        email,
+        token: result.token,
+        url,
+        project: project?.name,
+        projectSlug: project?.slug,
+        requestId: result.id
+      }, {
+        variant: mailVariant || "",
+        projectId: project?.id ?? null
+      });
+      return new Response.ResponseOk({
+        requestId: result.id,
+        expiresAt: result.expiresAt,
+        person,
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+          personInput: email,
+          personId: person.id,
+          tokenId: result.id
+        })
+      });
+    });
+  }
+  formatUrl(url, token2, requestId, email) {
+    if (!url) {
+      return null;
+    }
+    const urlObj = new URL(url);
+    urlObj.searchParams.set("token", token2);
+    urlObj.searchParams.set("request_id", requestId);
+    urlObj.searchParams.set("email", email);
+    return urlObj.toString();
+  }
+  async signInPasswordless({ db, expiration, token: token$1, requestId, mfaOtp, validationType }) {
+    return db.transaction(async (db2) => {
+      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byId(requestId, "passwordless"));
+      const tokenValidationResult = token.validateToken({
+        entry: tokenResult,
+        token: token$1,
+        now: db2.providers.now(),
+        validationType
+      });
+      if (!tokenValidationResult.ok) {
+        if (tokenValidationResult.error === "TOKEN_INVALID" && validationType === "otp") {
+          await db2.commandBus.execute(new IncreaseOtpAttemptCommand.IncreaseOtpAttemptCommand(tokenResult.id));
+        }
+        return new Response.ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
+          ...tokenValidationResult.metadata ?? {},
+          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+            personId: tokenResult?.person_id,
+            tokenId: tokenResult?.id
+          })
+        });
+      }
+      if (!tokenResult) {
+        throw new exceptions.ImplementationException();
+      }
+      const personRow = await db2.queryHandler.fetch(PersonQuery.PersonQuery.byId(tokenValidationResult.result.person_id));
+      if (!personRow) {
+        throw new exceptions.ImplementationException();
+      }
+      if (personRow.disabled_at !== null) {
+        return new Response.ResponseError("PERSON_DISABLED", `Person is disabled`, {
+          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+            personId: personRow.id,
+            tokenId: tokenResult?.id
+          })
+        });
+      }
+      if (personRow.otp_uri && personRow.otp_activated_at) {
+        if (!mfaOtp) {
+          return new Response.ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, {
+            [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+              personId: personRow.id,
+              tokenId: tokenResult?.id
+            })
+          });
+        }
+        if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", {
+            [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+              personId: personRow.id,
+              tokenId: tokenResult?.id
+            })
+          });
+        }
+      }
+      await db2.commandBus.execute(new InvalidateTokenCommand.InvalidateTokenCommand(tokenValidationResult.result.id));
+      const sessionToken = await this.apiKeyManager.createSessionApiKey(db2, personRow.identity_id, expiration);
+      return new Response.ResponseOk({
+        person: personRow,
+        token: sessionToken,
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+          personId: personRow.id,
+          tokenId: tokenResult?.id
+        })
+      });
+    });
+  }
+  async activatePasswordlessOtp({ db, token: token$1, requestId, otpHash }) {
+    return db.transaction(async (db2) => {
+      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byId(requestId, "passwordless"));
+      const tokenValidationResult = token.validateToken({
+        entry: tokenResult,
+        token: token$1,
+        now: db2.providers.now(),
+        validationType: "token"
+      });
+      if (!tokenValidationResult.ok) {
+        return new Response.ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
+          ...tokenValidationResult.metadata ?? {},
+          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+            personId: tokenResult?.person_id,
+            tokenId: tokenResult?.id
+          })
+        });
+      }
+      await db2.commandBus.execute(new ActivateOtpCommand.ActivateOtpCommand(tokenValidationResult.result.id, otpHash));
+      return new Response.ResponseOk({
+        person: tokenResult?.person_id,
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+          personId: tokenResult?.person_id,
+          tokenId: tokenResult?.id
+        })
+      });
+    });
+  }
+  isEnabled(globalValue, personValue) {
+    switch (globalValue) {
+      case "always":
+        return true;
+      case "never":
+        return false;
+      case "optIn":
+        return personValue === true;
+      case "optOut":
+        return personValue !== false;
+    }
+  }
+}
+exports.PasswordlessSignInManager = PasswordlessSignInManager;
+//# sourceMappingURL=PasswordlessSignInManager.cjs.map

package/dist/production/src/model/service/PasswordlessSignInManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordlessSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport {\n\tActivatePasswordlessOtpErrorCode,\n\tConfigPolicy,\n\tInitSignInPasswordlessErrorCode,\n\tInitSignInPasswordlessResult,\n\tSignInPasswordlessErrorCode,\n} from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(\n\t\t\t\tperson.id,\n\t\t\t\tintervalToSeconds(configuration.passwordless.expiration) / 60,\n\t\t\t)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\trequestId: result.id,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string | null, token: string, requestId: string, email: string): string | null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean | null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<\n\t\tInitSignInPasswordlessResult & {\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t},\n\t\tInitSignInPasswordlessErrorCode,\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}\n\t>\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t},\n\t\tActivatePasswordlessOtpErrorCode,\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}\n\t>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db","ConfigurationQuery","ResponseError","AuthLogService","PersonQuery","CreatePersonTokenCommand","intervalToSeconds","getPreferredProject","ResponseOk","token","PersonTokenQuery","validateToken","IncreaseOtpAttemptCommand","ImplementationException","InvalidateTokenCommand","ActivateOtpCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAChB;AAJgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AACrE,WAAO,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAC1E,UAAI,cAAc,aAAa,YAAY,SAAS;AACnD,eAAO,IAAIC,SAAAA,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAACC,eAAAA,eAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI,CAAA,CAAE;AAAA,QAAA,CAC/C;AAAA,MACF;AAEA,YAAM,SAAS,MAAMH,IAAG,aAAa,MAAMI,wBAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAIF,SAAAA,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UAAA,CACb;AAAA,QAAA,CACD;AAAA,MACF;AACA,UAAI,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AACrF,eAAO,IAAID,SAAAA,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UAAA,CACjB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,qBAAqBE,yBAAAA,yBAAyB;AAAA,QACnD,OAAO;AAAA,QACPC,SAAAA,kBAAkB,cAAc,aAAa,UAAU,IAAI;AAAA,MAAA;AAE5D,YAAM,SAAS,MAAMN,IAAG,WAAW,QAAQ,kBAAkB;AAE7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEtG,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAUO,oBAAAA,oBAAoB,UAAU,eAAe,IAAI;AAEjE,YAAM,KAAK,OAAO,sBAAsBP,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,QACtB,WAAW,OAAO;AAAA,MAAA,GAChB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAAA,CAChB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEQ,UAAU,KAAoBM,QAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACT,aAAO;AAAA,IACR;AACA,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,WAAO,aAAa,IAAI,SAASA,MAAK;AACtC,WAAO,aAAa,IAAI,cAAc,SAAS;AAC/C,WAAO,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAA;AAAA,EACf;AAAA,EAEA,MAAM,mBAAmB,EAAE,IAAI,mBAAYA,SAAO,WAAW,QAAQ,kBAOH;AACjE,WAAO,GAAG,YAAY,OAAOT,QAAsE;AAClG,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAA;AAAA,QAClB;AAAA,MAAA,CACA;AACD,UAAI,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAIY,0BAAAA,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAC3E;AACA,eAAO,IAAIV,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAA;AAAA,UACrC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AACjB,cAAM,IAAIU,WAAAA,wBAAA;AAAA,MACX;AACA,YAAM,YAAY,MAAMb,IAAG,aAAa,MAAMI,wBAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAIS,WAAAA,wBAAA;AAAA,MACX;AACA,UAAI,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAIX,SAAAA,cAAc,mBAAmB,sBAAsB;AAAA,UACjE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,UAAI,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACZ,iBAAO,IAAID,SAAAA,cAAc,gBAAgB,yCAAyC;AAAA,YACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YAAA,CACtB;AAAA,UAAA,CACD;AAAA,QACF;AAEA,YAAI,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACxE,iBAAO,IAAID,SAAAA,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YAAA,CACtB;AAAA,UAAA,CACD;AAAA,QACF;AAAA,MACD;AAEA,YAAMH,IAAG,WAAW,QAAQ,IAAIc,uBAAAA,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACvF,YAAM,eAAe,MAAM,KAAK,cAAc,oBAAoBd,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAIQ,SAAAA,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QAAA,CACtB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,EAAE,WAAIM,SAAO,WAAW,WAKiB;AACtE,WAAO,GAAG,YAAY,OAAOT,QAA2E;AACvG,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAMU,iBAAAA,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwBC,MAAAA,cAAc;AAAA,QAC3C,OAAO;AAAA,QAAA,OACPF;AAAAA,QACA,KAAKT,IAAG,UAAU,IAAA;AAAA,QAClB,gBAAgB;AAAA,MAAA,CAChB;AACD,UAAI,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAIE,SAAAA,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAA;AAAA,UACrC,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAMH,IAAG,WAAW,QAAQ,IAAIe,mBAAAA,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAIP,SAAAA,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QAAA,CACtB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEQ,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAA;AAAA,MACP,KAAK;AACJ,eAAO;AAAA,MACR,KAAK;AACJ,eAAO;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EAE1B;AACD;;"}

package/dist/production/src/model/service/PasswordlessSignInManager.js

@@ -0,0 +1,204 @@
+import "../queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
+import "@contember/database";
+import { ImplementationException } from "../../exceptions.js";
+import { PersonQuery } from "../queries/person/PersonQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import "../type/ApiKey.js";
+import { ActivateOtpCommand } from "../commands/personToken/ActivateOtpCommand.js";
+import { CreatePersonTokenCommand } from "../commands/personToken/CreatePersonTokenCommand.js";
+import { InvalidateTokenCommand } from "../commands/personToken/InvalidateTokenCommand.js";
+import { IncreaseOtpAttemptCommand } from "../commands/personToken/IncreaseOtpAttemptCommand.js";
+import { PersonTokenQuery } from "../queries/personToken/PersonTokenQuery.js";
+import { validateToken } from "../utils/token.js";
+import { getPreferredProject } from "./helpers/getPreferredProject.js";
+import { AuthLogService } from "./AuthLogService.js";
+import { intervalToSeconds } from "../utils/interval.js";
+class PasswordlessSignInManager {
+  constructor(apiKeyManager, mailer, projectManager, otpAuthenticator) {
+    this.apiKeyManager = apiKeyManager;
+    this.mailer = mailer;
+    this.projectManager = projectManager;
+    this.otpAuthenticator = otpAuthenticator;
+  }
+  async initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }) {
+    return db.transaction(async (db2) => {
+      const configuration = await db2.queryHandler.fetch(new ConfigurationQuery());
+      if (configuration.passwordless.enabled === "never") {
+        return new ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled", {
+          [AuthLogService.Key]: new AuthLogService.Bag({})
+        });
+      }
+      const person = await db2.queryHandler.fetch(PersonQuery.byEmail(email));
+      if (!person) {
+        return new ResponseError("PERSON_NOT_FOUND", `Person ${email} not found`, {
+          [AuthLogService.Key]: new AuthLogService.Bag({
+            personInput: email
+          })
+        });
+      }
+      if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
+        return new ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person", {
+          [AuthLogService.Key]: new AuthLogService.Bag({
+            personInput: email,
+            personId: person.id
+          })
+        });
+      }
+      const createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(
+        person.id,
+        intervalToSeconds(configuration.passwordless.expiration) / 60
+      );
+      const result = await db2.commandBus.execute(createTokenCommand);
+      const url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? void 0;
+      const projects = await this.projectManager.getProjectsByIdentity(db2, person.identity_id, permissionContext);
+      const project = getPreferredProject(projects, mailProject ?? null);
+      await this.mailer.sendPasswordlessEmail(db2, {
+        email,
+        token: result.token,
+        url,
+        project: project?.name,
+        projectSlug: project?.slug,
+        requestId: result.id
+      }, {
+        variant: mailVariant || "",
+        projectId: project?.id ?? null
+      });
+      return new ResponseOk({
+        requestId: result.id,
+        expiresAt: result.expiresAt,
+        person,
+        [AuthLogService.Key]: new AuthLogService.Bag({
+          personInput: email,
+          personId: person.id,
+          tokenId: result.id
+        })
+      });
+    });
+  }
+  formatUrl(url, token, requestId, email) {
+    if (!url) {
+      return null;
+    }
+    const urlObj = new URL(url);
+    urlObj.searchParams.set("token", token);
+    urlObj.searchParams.set("request_id", requestId);
+    urlObj.searchParams.set("email", email);
+    return urlObj.toString();
+  }
+  async signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }) {
+    return db.transaction(async (db2) => {
+      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.byId(requestId, "passwordless"));
+      const tokenValidationResult = validateToken({
+        entry: tokenResult,
+        token,
+        now: db2.providers.now(),
+        validationType
+      });
+      if (!tokenValidationResult.ok) {
+        if (tokenValidationResult.error === "TOKEN_INVALID" && validationType === "otp") {
+          await db2.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult.id));
+        }
+        return new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
+          ...tokenValidationResult.metadata ?? {},
+          [AuthLogService.Key]: new AuthLogService.Bag({
+            personId: tokenResult?.person_id,
+            tokenId: tokenResult?.id
+          })
+        });
+      }
+      if (!tokenResult) {
+        throw new ImplementationException();
+      }
+      const personRow = await db2.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id));
+      if (!personRow) {
+        throw new ImplementationException();
+      }
+      if (personRow.disabled_at !== null) {
+        return new ResponseError("PERSON_DISABLED", `Person is disabled`, {
+          [AuthLogService.Key]: new AuthLogService.Bag({
+            personId: personRow.id,
+            tokenId: tokenResult?.id
+          })
+        });
+      }
+      if (personRow.otp_uri && personRow.otp_activated_at) {
+        if (!mfaOtp) {
+          return new ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, {
+            [AuthLogService.Key]: new AuthLogService.Bag({
+              personId: personRow.id,
+              tokenId: tokenResult?.id
+            })
+          });
+        }
+        if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
+          return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", {
+            [AuthLogService.Key]: new AuthLogService.Bag({
+              personId: personRow.id,
+              tokenId: tokenResult?.id
+            })
+          });
+        }
+      }
+      await db2.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id));
+      const sessionToken = await this.apiKeyManager.createSessionApiKey(db2, personRow.identity_id, expiration);
+      return new ResponseOk({
+        person: personRow,
+        token: sessionToken,
+        [AuthLogService.Key]: new AuthLogService.Bag({
+          personId: personRow.id,
+          tokenId: tokenResult?.id
+        })
+      });
+    });
+  }
+  async activatePasswordlessOtp({ db, token, requestId, otpHash }) {
+    return db.transaction(async (db2) => {
+      const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.byId(requestId, "passwordless"));
+      const tokenValidationResult = validateToken({
+        entry: tokenResult,
+        token,
+        now: db2.providers.now(),
+        validationType: "token"
+      });
+      if (!tokenValidationResult.ok) {
+        return new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {
+          ...tokenValidationResult.metadata ?? {},
+          [AuthLogService.Key]: new AuthLogService.Bag({
+            personId: tokenResult?.person_id,
+            tokenId: tokenResult?.id
+          })
+        });
+      }
+      await db2.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash));
+      return new ResponseOk({
+        person: tokenResult?.person_id,
+        [AuthLogService.Key]: new AuthLogService.Bag({
+          personId: tokenResult?.person_id,
+          tokenId: tokenResult?.id
+        })
+      });
+    });
+  }
+  isEnabled(globalValue, personValue) {
+    switch (globalValue) {
+      case "always":
+        return true;
+      case "never":
+        return false;
+      case "optIn":
+        return personValue === true;
+      case "optOut":
+        return personValue !== false;
+    }
+  }
+}
+export {
+  PasswordlessSignInManager
+};
+//# sourceMappingURL=PasswordlessSignInManager.js.map

package/dist/production/src/model/service/PasswordlessSignInManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PasswordlessSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport {\n\tActivatePasswordlessOtpErrorCode,\n\tConfigPolicy,\n\tInitSignInPasswordlessErrorCode,\n\tInitSignInPasswordlessResult,\n\tSignInPasswordlessErrorCode,\n} from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(\n\t\t\t\tperson.id,\n\t\t\t\tintervalToSeconds(configuration.passwordless.expiration) / 60,\n\t\t\t)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\trequestId: result.id,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string | null, token: string, requestId: string, email: string): string | null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean | null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<\n\t\tInitSignInPasswordlessResult & {\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t},\n\t\tInitSignInPasswordlessErrorCode,\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}\n\t>\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t},\n\t\tActivatePasswordlessOtpErrorCode,\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}\n\t>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAChB;AAJgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AACrE,WAAO,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAI,oBAAoB;AAC1E,UAAI,cAAc,aAAa,YAAY,SAAS;AACnD,eAAO,IAAI,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI,CAAA,CAAE;AAAA,QAAA,CAC/C;AAAA,MACF;AAEA,YAAM,SAAS,MAAMA,IAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAI,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UAAA,CACb;AAAA,QAAA,CACD;AAAA,MACF;AACA,UAAI,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AACrF,eAAO,IAAI,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UAAA,CACjB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,qBAAqB,yBAAyB;AAAA,QACnD,OAAO;AAAA,QACP,kBAAkB,cAAc,aAAa,UAAU,IAAI;AAAA,MAAA;AAE5D,YAAM,SAAS,MAAMA,IAAG,WAAW,QAAQ,kBAAkB;AAE7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEtG,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAU,oBAAoB,UAAU,eAAe,IAAI;AAEjE,YAAM,KAAK,OAAO,sBAAsBA,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,QACtB,WAAW,OAAO;AAAA,MAAA,GAChB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAI,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAAA,CAChB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEQ,UAAU,KAAoB,OAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACT,aAAO;AAAA,IACR;AACA,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,WAAO,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,aAAa,IAAI,cAAc,SAAS;AAC/C,WAAO,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAA;AAAA,EACf;AAAA,EAEA,MAAM,mBAAmB,EAAE,IAAI,YAAY,OAAO,WAAW,QAAQ,kBAOH;AACjE,WAAO,GAAG,YAAY,OAAOA,QAAsE;AAClG,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAA;AAAA,QAClB;AAAA,MAAA,CACA;AACD,UAAI,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAI,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAC3E;AACA,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAA;AAAA,UACrC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AACjB,cAAM,IAAI,wBAAA;AAAA,MACX;AACA,YAAM,YAAY,MAAMA,IAAG,aAAa,MAAM,YAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAI,wBAAA;AAAA,MACX;AACA,UAAI,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAI,cAAc,mBAAmB,sBAAsB;AAAA,UACjE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,UAAI,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACZ,iBAAO,IAAI,cAAc,gBAAgB,yCAAyC;AAAA,YACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YAAA,CACtB;AAAA,UAAA,CACD;AAAA,QACF;AAEA,YAAI,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACxE,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YAAA,CACtB;AAAA,UAAA,CACD;AAAA,QACF;AAAA,MACD;AAEA,YAAMA,IAAG,WAAW,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACvF,YAAM,eAAe,MAAM,KAAK,cAAc,oBAAoBA,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QAAA,CACtB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,EAAE,IAAI,OAAO,WAAW,WAKiB;AACtE,WAAO,GAAG,YAAY,OAAOA,QAA2E;AACvG,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAA;AAAA,QAClB,gBAAgB;AAAA,MAAA,CAChB;AACD,UAAI,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAA;AAAA,UACrC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAMA,IAAG,WAAW,QAAQ,IAAI,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QAAA,CACtB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEQ,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAA;AAAA,MACP,KAAK;AACJ,eAAO;AAAA,MACR,KAAK;AACJ,eAAO;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EAE1B;AACD;"}