@contember/engine-tenant-api 2.1.0-alpha.8 → 2.1.0-beta.1

package/dist/production/src/model/service/RolesManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"RolesManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { PatchIdentityGlobalRoles } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { TenantRole } from '../authorization'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(dbContext: DatabaseContext, identityId: string, addRoles: readonly string[], removeRoles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":["PatchIdentityGlobalRoles","ResponseError","ResponseOk","TenantRole"],"mappings":";;;;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAAA;AAAA,EAG9D,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAAA;AAAA,EAG9D,MAAc,iBAAiB,WAA4B,YAAoB,UAA6B,aAA+E;AACpL,UAAA,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AAClB,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAIA,yBAAAA,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAIC,SAAA,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAAA;AAE3E,WAAA,IAAIC,oBAAW,IAAI;AAAA,EAAA;AAAA,EAInB,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAOC,MAAU,UAAA,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAIF,SAAA,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MAAA;AAAA,IACrE;AAEM,WAAA;AAAA,EAAA;AAET;;"}
+{"version":3,"file":"RolesManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { PatchIdentityGlobalRoles } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { TenantRole } from '../authorization'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":["PatchIdentityGlobalRoles","ResponseError","ResponseOk","TenantRole"],"mappings":";;;;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAIA,yBAAAA,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAIC,SAAAA,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAOC,MAAAA,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAIF,SAAAA,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;;"}

package/dist/production/src/model/service/RolesManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"RolesManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { PatchIdentityGlobalRoles } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { TenantRole } from '../authorization'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(dbContext: DatabaseContext, identityId: string, addRoles: readonly string[], removeRoles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":[],"mappings":";;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAAA;AAAA,EAG9D,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAAA;AAAA,EAG9D,MAAc,iBAAiB,WAA4B,YAAoB,UAA6B,aAA+E;AACpL,UAAA,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AAClB,aAAA;AAAA,IAAA;AAEF,UAAA,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAAA;AAE3E,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAAA,EAInB,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAO,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAI,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MAAA;AAAA,IACrE;AAEM,WAAA;AAAA,EAAA;AAET;"}
+{"version":3,"file":"RolesManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { PatchIdentityGlobalRoles } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { TenantRole } from '../authorization'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":[],"mappings":";;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAO,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAI,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;"}

package/dist/production/src/model/service/SecretsManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SecretsManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { Providers } from '../providers'\nimport { ProjectSecretsQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: {key: string; value: Buffer}[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":["ProjectSecretsQuery","SetProjectSecretCommand","UpdateProjectCommand"],"mappings":";;;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAA;AAAA,EAEpB,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAG,CAAA,CAAC;AAAA,EAAA;AAAA,EAGjF,MAAa,YAAY,WAA4B,WAAoD;AAClG,UAAA,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,oBAAAA,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAM,OAAA,CAAC,GAAG,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC;AAAA,EAAA;AAAA,EAG1E,MAAc,WAAW,WAA4B,WAAmB,SAAwD;AAC3H,QAAA,QAAQ,WAAW,GAAG;AACzB;AAAA,IAAA;AAEK,UAAA,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAM,KAAK,SAAS;AAC/B,cAAA,GAAG,WAAW,QAAQ,IAAIC,wBAAA,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAAA;AAEtF,YAAA,GAAG,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IAAA,CACnE;AAAA,EAAA;AAEH;;"}
+{"version":3,"file":"SecretsManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { Providers } from '../providers'\nimport { ProjectSecretsQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":["ProjectSecretsQuery","SetProjectSecretCommand","UpdateProjectCommand"],"mappings":";;;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,oBAAAA,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;;"}

package/dist/production/src/model/service/SecretsManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecretsManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { Providers } from '../providers'\nimport { ProjectSecretsQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: {key: string; value: Buffer}[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAA;AAAA,EAEpB,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAG,CAAA,CAAC;AAAA,EAAA;AAAA,EAGjF,MAAa,YAAY,WAA4B,WAAoD;AAClG,UAAA,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAM,OAAA,CAAC,GAAG,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC;AAAA,EAAA;AAAA,EAG1E,MAAc,WAAW,WAA4B,WAAmB,SAAwD;AAC3H,QAAA,QAAQ,WAAW,GAAG;AACzB;AAAA,IAAA;AAEK,UAAA,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAM,KAAK,SAAS;AAC/B,cAAA,GAAG,WAAW,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAAA;AAEtF,YAAA,GAAG,WAAW,QAAQ,IAAI,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IAAA,CACnE;AAAA,EAAA;AAEH;"}
+{"version":3,"file":"SecretsManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { Providers } from '../providers'\nimport { ProjectSecretsQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAI,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;"}

package/dist/production/src/model/service/SignInManager.cjs

@@ -10,6 +10,7 @@ require("../authorization/PermissionContext.cjs");
 require("../authorization/PermissionsFactory.cjs");
 require("@contember/schema");
 const Response = require("../utils/Response.cjs");
+const AuthLogService = require("./AuthLogService.cjs");
 class SignInManager {
   constructor(apiKeyManager, providers, otpAuthenticator) {
     this.apiKeyManager = apiKeyManager;
@@ -17,55 +18,79 @@ class SignInManager {
     this.otpAuthenticator = otpAuthenticator;
   }
   async signIn(dbContext, email, password, expiration, otpCode) {
-    const personRow = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email));
-    if (personRow === null) {
-      return new Response.ResponseError("UNKNOWN_EMAIL", `Person with email ${email} not found`);
+    const person = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email));
+    if (person === null) {
+      return new Response.ResponseError("UNKNOWN_EMAIL", `Person with email ${email} not found`, {
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+          personInput: email
+        })
+      });
     }
-    if (!personRow.password_hash) {
-      return new Response.ResponseError("NO_PASSWORD_SET", `No password set`);
+    const authLogData = {
+      [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+        personInput: email,
+        personId: person.id
+      })
+    };
+    if (!person.password_hash) {
+      return new Response.ResponseError("NO_PASSWORD_SET", `No password set`, authLogData);
     }
-    if (personRow.disabled_at !== null) {
-      return new Response.ResponseError("PERSON_DISABLED", `Person is disabled`);
+    if (person.disabled_at !== null) {
+      return new Response.ResponseError("PERSON_DISABLED", `Person is disabled`, authLogData);
     }
-    const passwordValid = await this.providers.bcryptCompare(password, personRow.password_hash);
+    const passwordValid = await this.providers.bcryptCompare(password, person.password_hash);
     if (!passwordValid) {
-      return new Response.ResponseError("INVALID_PASSWORD", `Password does not match`);
+      return new Response.ResponseError("INVALID_PASSWORD", `Password does not match`, authLogData);
     }
-    if (personRow.otp_uri && personRow.otp_activated_at) {
+    if (person.otp_uri && person.otp_activated_at) {
       if (!otpCode) {
-        return new Response.ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`);
+        return new Response.ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, authLogData);
       }
-      if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, otpCode)) {
-        return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed");
+      if (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {
+        return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
       }
     }
-    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration);
-    return new Response.ResponseOk(new SignInResult(personRow, sessionToken));
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
+    return new Response.ResponseOk({ person, token: sessionToken, ...authLogData });
   }
   async createSessionToken(dbContext, personIdentifier, expiration, verifier) {
-    const personRow = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byUniqueIdentifier(personIdentifier));
-    if (personRow === null) {
+    const person = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byUniqueIdentifier(personIdentifier));
+    if (person === null) {
       if (personIdentifier.type === "email") {
-        return new Response.ResponseError("UNKNOWN_EMAIL", `Person with email ${personIdentifier.email} not found`);
+        return new Response.ResponseError("UNKNOWN_EMAIL", `Person with email ${personIdentifier.email} not found`, {
+          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+            personInput: personIdentifier.email
+          })
+        });
       } else if (personIdentifier.type === "id") {
-        return new Response.ResponseError("UNKNOWN_PERSON_ID", `Person with id ${personIdentifier.id} not found`);
+        return new Response.ResponseError("UNKNOWN_PERSON_ID", `Person with id ${personIdentifier.id} not found`, {
+          [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+            personInput: personIdentifier.id
+          })
+        });
       }
       throw new exceptions.ImplementationException();
     }
-    if (personRow.disabled_at !== null) {
-      return new Response.ResponseError("PERSON_DISABLED", `Person with id ${personRow.id} is disabled`);
+    const inputValue = personIdentifier.type === "email" ? personIdentifier.email : personIdentifier.id;
+    if (person.disabled_at !== null) {
+      return new Response.ResponseError("PERSON_DISABLED", `Person with id ${person.id} is disabled`, {
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+          personId: person.id,
+          personInput: inputValue
+        })
+      });
     }
-    await verifier?.(personRow);
-    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration);
-    return new Response.ResponseOk(new SignInResult(personRow, sessionToken));
-  }
-}
-class SignInResult {
-  constructor(person, token) {
-    this.person = person;
-    this.token = token;
+    await verifier?.(person);
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
+    return new Response.ResponseOk({
+      person,
+      token: sessionToken,
+      [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
+        personId: person.id,
+        personInput: inputValue
+      })
+    });
   }
 }
 exports.SignInManager = SignInManager;
-exports.SignInResult = SignInResult;
 //# sourceMappingURL=SignInManager.cjs.map

package/dist/production/src/model/service/SignInManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, SignInErrorCode } from '../../schema'\nimport { ApiKeyManager, OtpAuthenticator } from '../service'\nimport { PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ImplementationException } from '../../exceptions'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {\n\t\tconst personRow = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (personRow === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`)\n\t\t}\n\n\t\tif (!personRow.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`)\n\t\t}\n\n\t\tif (personRow.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, personRow.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`)\n\t\t}\n\n\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\tif (!otpCode) {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)\n\t\t\t}\n\n\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')\n\t\t\t}\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration)\n\n\t\treturn new ResponseOk(new SignInResult(personRow, sessionToken))\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst personRow = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (personRow === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`)\n\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`)\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tif (personRow.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${personRow.id} is disabled`)\n\t\t}\n\n\t\tawait verifier?.(personRow)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration)\n\t\treturn new ResponseOk(new SignInResult(personRow, sessionToken))\n\t}\n}\n\nexport class SignInResult {\n\tconstructor(\n\t\tpublic readonly person: PersonRow,\n\t\tpublic readonly token: string,\n\t) {}\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode>\n\nexport { SignInManager }\n"],"names":["PersonQuery","ResponseError","ResponseOk","ImplementationException"],"mappings":";;;;;;;;;;;;AAQA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,kBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,WAA4B,OAAe,UAAkB,YAAqB,SAA2C;AACnI,UAAA,YAAY,MAAM,UAAU,aAAa,MAAMA,wBAAY,QAAQ,KAAK,CAAC;AAE/E,QAAI,cAAc,MAAM;AACvB,aAAO,IAAIC,SAAA,cAAc,iBAAiB,qBAAqB,KAAK,YAAY;AAAA,IAAA;AAG7E,QAAA,CAAC,UAAU,eAAe;AACtB,aAAA,IAAIA,SAAc,cAAA,mBAAmB,iBAAiB;AAAA,IAAA;AAG1D,QAAA,UAAU,gBAAgB,MAAM;AAC5B,aAAA,IAAIA,SAAc,cAAA,mBAAmB,oBAAoB;AAAA,IAAA;AAGjE,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,UAAU,aAAa;AAE1F,QAAI,CAAC,eAAe;AACZ,aAAA,IAAIA,SAAc,cAAA,oBAAoB,yBAAyB;AAAA,IAAA;AAGnE,QAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,UAAI,CAAC,SAAS;AACN,eAAA,IAAIA,SAAc,cAAA,gBAAgB,uCAAuC;AAAA,MAAA;AAG7E,UAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,OAAO,GAAG;AAClE,eAAA,IAAIA,SAAAA,cAAc,qBAAqB,iCAAiC;AAAA,MAAA;AAAA,IAChF;AAGK,UAAA,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,UAAU,aAAa,UAAU;AAE9G,WAAO,IAAIC,SAAAA,WAAW,IAAI,aAAa,WAAW,YAAY,CAAC;AAAA,EAAA;AAAA,EAGhE,MAAM,mBACL,WACA,kBACA,YACA,UACsC;AAChC,UAAA,YAAY,MAAM,UAAU,aAAa,MAAMF,wBAAY,mBAAmB,gBAAgB,CAAC;AAErG,QAAI,cAAc,MAAM;AACnB,UAAA,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAIC,SAAc,cAAA,iBAAiB,qBAAqB,iBAAiB,KAAK,YAAY;AAAA,MAAA,WAEvF,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAIA,SAAc,cAAA,qBAAqB,kBAAkB,iBAAiB,EAAE,YAAY;AAAA,MAAA;AAGhG,YAAM,IAAIE,WAAAA,wBAAwB;AAAA,IAAA;AAG/B,QAAA,UAAU,gBAAgB,MAAM;AACnC,aAAO,IAAIF,SAAc,cAAA,mBAAmB,kBAAkB,UAAU,EAAE,cAAc;AAAA,IAAA;AAGzF,UAAM,WAAW,SAAS;AAEpB,UAAA,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,UAAU,aAAa,UAAU;AAC9G,WAAO,IAAIC,SAAAA,WAAW,IAAI,aAAa,WAAW,YAAY,CAAC;AAAA,EAAA;AAEjE;AAEO,MAAM,aAAa;AAAA,EACzB,YACiB,QACA,OACf;AAFe,SAAA,SAAA;AACA,SAAA,QAAA;AAAA,EAAA;AAElB;;;"}
+{"version":3,"file":"SignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, SignInErrorCode } from '../../schema'\nimport { ApiKeyManager, OtpAuthenticator } from '../service'\nimport { PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ImplementationException } from '../../exceptions'\nimport { AuthLogService } from './AuthLogService'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\tif (person.otp_uri && person.otp_activated_at) {\n\t\t\tif (!otpCode) {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\n\t\t\tif (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\n\t\treturn new ResponseOk({ person, token: sessionToken, ...authLogData })\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":["PersonQuery","ResponseError","AuthLogService","ResponseOk","ImplementationException"],"mappings":";;;;;;;;;;;;;AASA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,kBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,WAA4B,OAAe,UAAkB,YAAqB,SAA2C;AACzI,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMA,wBAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAACA,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAID,SAAAA,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIA,SAAAA,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAEA,QAAI,OAAO,WAAW,OAAO,kBAAkB;AAC9C,UAAI,CAAC,SAAS;AACb,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAEA,UAAI,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,OAAO,GAAG;AACtE,eAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AAAA,IACD;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAE3G,WAAO,IAAIE,SAAAA,WAAW,EAAE,QAAQ,OAAO,cAAc,GAAG,aAAa;AAAA,EACtE;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMH,wBAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAID,SAAAA,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAIE,WAAAA,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIH,SAAAA,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAC3G,WAAO,IAAIC,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAACD,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;;"}

package/dist/production/src/model/service/SignInManager.js

@@ -8,6 +8,7 @@ import "../authorization/PermissionContext.js";
 import "../authorization/PermissionsFactory.js";
 import "@contember/schema";
 import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { AuthLogService } from "./AuthLogService.js";
 class SignInManager {
   constructor(apiKeyManager, providers, otpAuthenticator) {
     this.apiKeyManager = apiKeyManager;
@@ -15,57 +16,81 @@ class SignInManager {
     this.otpAuthenticator = otpAuthenticator;
   }
   async signIn(dbContext, email, password, expiration, otpCode) {
-    const personRow = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email));
-    if (personRow === null) {
-      return new ResponseError("UNKNOWN_EMAIL", `Person with email ${email} not found`);
+    const person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email));
+    if (person === null) {
+      return new ResponseError("UNKNOWN_EMAIL", `Person with email ${email} not found`, {
+        [AuthLogService.Key]: new AuthLogService.Bag({
+          personInput: email
+        })
+      });
     }
-    if (!personRow.password_hash) {
-      return new ResponseError("NO_PASSWORD_SET", `No password set`);
+    const authLogData = {
+      [AuthLogService.Key]: new AuthLogService.Bag({
+        personInput: email,
+        personId: person.id
+      })
+    };
+    if (!person.password_hash) {
+      return new ResponseError("NO_PASSWORD_SET", `No password set`, authLogData);
     }
-    if (personRow.disabled_at !== null) {
-      return new ResponseError("PERSON_DISABLED", `Person is disabled`);
+    if (person.disabled_at !== null) {
+      return new ResponseError("PERSON_DISABLED", `Person is disabled`, authLogData);
     }
-    const passwordValid = await this.providers.bcryptCompare(password, personRow.password_hash);
+    const passwordValid = await this.providers.bcryptCompare(password, person.password_hash);
     if (!passwordValid) {
-      return new ResponseError("INVALID_PASSWORD", `Password does not match`);
+      return new ResponseError("INVALID_PASSWORD", `Password does not match`, authLogData);
     }
-    if (personRow.otp_uri && personRow.otp_activated_at) {
+    if (person.otp_uri && person.otp_activated_at) {
       if (!otpCode) {
-        return new ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`);
+        return new ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, authLogData);
       }
-      if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, otpCode)) {
-        return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed");
+      if (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {
+        return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
       }
     }
-    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration);
-    return new ResponseOk(new SignInResult(personRow, sessionToken));
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
+    return new ResponseOk({ person, token: sessionToken, ...authLogData });
   }
   async createSessionToken(dbContext, personIdentifier, expiration, verifier) {
-    const personRow = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier));
-    if (personRow === null) {
+    const person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier));
+    if (person === null) {
       if (personIdentifier.type === "email") {
-        return new ResponseError("UNKNOWN_EMAIL", `Person with email ${personIdentifier.email} not found`);
+        return new ResponseError("UNKNOWN_EMAIL", `Person with email ${personIdentifier.email} not found`, {
+          [AuthLogService.Key]: new AuthLogService.Bag({
+            personInput: personIdentifier.email
+          })
+        });
       } else if (personIdentifier.type === "id") {
-        return new ResponseError("UNKNOWN_PERSON_ID", `Person with id ${personIdentifier.id} not found`);
+        return new ResponseError("UNKNOWN_PERSON_ID", `Person with id ${personIdentifier.id} not found`, {
+          [AuthLogService.Key]: new AuthLogService.Bag({
+            personInput: personIdentifier.id
+          })
+        });
       }
       throw new ImplementationException();
     }
-    if (personRow.disabled_at !== null) {
-      return new ResponseError("PERSON_DISABLED", `Person with id ${personRow.id} is disabled`);
+    const inputValue = personIdentifier.type === "email" ? personIdentifier.email : personIdentifier.id;
+    if (person.disabled_at !== null) {
+      return new ResponseError("PERSON_DISABLED", `Person with id ${person.id} is disabled`, {
+        [AuthLogService.Key]: new AuthLogService.Bag({
+          personId: person.id,
+          personInput: inputValue
+        })
+      });
     }
-    await verifier?.(personRow);
-    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration);
-    return new ResponseOk(new SignInResult(personRow, sessionToken));
-  }
-}
-class SignInResult {
-  constructor(person, token) {
-    this.person = person;
-    this.token = token;
+    await verifier?.(person);
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
+    return new ResponseOk({
+      person,
+      token: sessionToken,
+      [AuthLogService.Key]: new AuthLogService.Bag({
+        personId: person.id,
+        personInput: inputValue
+      })
+    });
   }
 }
 export {
-  SignInManager,
-  SignInResult
+  SignInManager
 };
 //# sourceMappingURL=SignInManager.js.map

package/dist/production/src/model/service/SignInManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, SignInErrorCode } from '../../schema'\nimport { ApiKeyManager, OtpAuthenticator } from '../service'\nimport { PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ImplementationException } from '../../exceptions'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {\n\t\tconst personRow = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (personRow === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`)\n\t\t}\n\n\t\tif (!personRow.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`)\n\t\t}\n\n\t\tif (personRow.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, personRow.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`)\n\t\t}\n\n\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\tif (!otpCode) {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`)\n\t\t\t}\n\n\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed')\n\t\t\t}\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration)\n\n\t\treturn new ResponseOk(new SignInResult(personRow, sessionToken))\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst personRow = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (personRow === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`)\n\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`)\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tif (personRow.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${personRow.id} is disabled`)\n\t\t}\n\n\t\tawait verifier?.(personRow)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, personRow.identity_id, expiration)\n\t\treturn new ResponseOk(new SignInResult(personRow, sessionToken))\n\t}\n}\n\nexport class SignInResult {\n\tconstructor(\n\t\tpublic readonly person: PersonRow,\n\t\tpublic readonly token: string,\n\t) {}\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode>\n\nexport { SignInManager }\n"],"names":[],"mappings":";;;;;;;;;;AAQA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,kBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OAAO,WAA4B,OAAe,UAAkB,YAAqB,SAA2C;AACnI,UAAA,YAAY,MAAM,UAAU,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAE/E,QAAI,cAAc,MAAM;AACvB,aAAO,IAAI,cAAc,iBAAiB,qBAAqB,KAAK,YAAY;AAAA,IAAA;AAG7E,QAAA,CAAC,UAAU,eAAe;AACtB,aAAA,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,IAAA;AAG1D,QAAA,UAAU,gBAAgB,MAAM;AAC5B,aAAA,IAAI,cAAc,mBAAmB,oBAAoB;AAAA,IAAA;AAGjE,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,UAAU,aAAa;AAE1F,QAAI,CAAC,eAAe;AACZ,aAAA,IAAI,cAAc,oBAAoB,yBAAyB;AAAA,IAAA;AAGnE,QAAA,UAAU,WAAW,UAAU,kBAAkB;AACpD,UAAI,CAAC,SAAS;AACN,eAAA,IAAI,cAAc,gBAAgB,uCAAuC;AAAA,MAAA;AAG7E,UAAA,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,OAAO,GAAG;AAClE,eAAA,IAAI,cAAc,qBAAqB,iCAAiC;AAAA,MAAA;AAAA,IAChF;AAGK,UAAA,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,UAAU,aAAa,UAAU;AAE9G,WAAO,IAAI,WAAW,IAAI,aAAa,WAAW,YAAY,CAAC;AAAA,EAAA;AAAA,EAGhE,MAAM,mBACL,WACA,kBACA,YACA,UACsC;AAChC,UAAA,YAAY,MAAM,UAAU,aAAa,MAAM,YAAY,mBAAmB,gBAAgB,CAAC;AAErG,QAAI,cAAc,MAAM;AACnB,UAAA,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAI,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,YAAY;AAAA,MAAA,WAEvF,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAI,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,YAAY;AAAA,MAAA;AAGhG,YAAM,IAAI,wBAAwB;AAAA,IAAA;AAG/B,QAAA,UAAU,gBAAgB,MAAM;AACnC,aAAO,IAAI,cAAc,mBAAmB,kBAAkB,UAAU,EAAE,cAAc;AAAA,IAAA;AAGzF,UAAM,WAAW,SAAS;AAEpB,UAAA,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,UAAU,aAAa,UAAU;AAC9G,WAAO,IAAI,WAAW,IAAI,aAAa,WAAW,YAAY,CAAC;AAAA,EAAA;AAEjE;AAEO,MAAM,aAAa;AAAA,EACzB,YACiB,QACA,OACf;AAFe,SAAA,SAAA;AACA,SAAA,QAAA;AAAA,EAAA;AAElB;"}
+{"version":3,"file":"SignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, SignInErrorCode } from '../../schema'\nimport { ApiKeyManager, OtpAuthenticator } from '../service'\nimport { PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ImplementationException } from '../../exceptions'\nimport { AuthLogService } from './AuthLogService'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\tif (person.otp_uri && person.otp_activated_at) {\n\t\t\tif (!otpCode) {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\n\t\t\tif (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\n\t\treturn new ResponseOk({ person, token: sessionToken, ...authLogData })\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":[],"mappings":";;;;;;;;;;;AASA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,kBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,WAA4B,OAAe,UAAkB,YAAqB,SAA2C;AACzI,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAI,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAI,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAI,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAEA,QAAI,OAAO,WAAW,OAAO,kBAAkB;AAC9C,UAAI,CAAC,SAAS;AACb,eAAO,IAAI,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAEA,UAAI,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,OAAO,GAAG;AACtE,eAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AAAA,IACD;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAE3G,WAAO,IAAI,WAAW,EAAE,QAAQ,OAAO,cAAc,GAAG,aAAa;AAAA,EACtE;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAI,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAI,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAI,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAC3G,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;"}

package/dist/production/src/model/service/SignUpManager.cjs

@@ -6,30 +6,35 @@ require("node:crypto");
 const Response = require("../utils/Response.cjs");
 const CreatePersonCommand = require("../commands/person/CreatePersonCommand.cjs");
 const CreateIdentityCommand = require("../commands/identity/CreateIdentityCommand.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
 const Roles = require("../authorization/Roles.cjs");
 require("../authorization/PermissionContext.cjs");
 require("../authorization/PermissionsFactory.cjs");
 require("@contember/schema");
-const password = require("../utils/password.cjs");
 class SignUpManager {
-  constructor(emailValidator) {
+  constructor(emailValidator, passwordStrengthValidator) {
     this.emailValidator = emailValidator;
+    this.passwordStrengthValidator = passwordStrengthValidator;
   }
-  async signUp(dbContext, { email, password: password$1, roles = [] }) {
+  async signUp(dbContext, { email, password, roles = [] }) {
     const validationError = await this.emailValidator.validateEmail(dbContext, email);
     if (validationError !== null) {
       return validationError;
     }
-    const plainPassword = password$1.getPlain();
-    const weakPassword = plainPassword ? password.getPasswordWeaknessMessage(plainPassword) : null;
-    if (weakPassword) {
-      return new Response.ResponseError("TOO_WEAK", weakPassword);
+    const plainPassword = password.getPlain();
+    if (plainPassword) {
+      const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+      const passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, "TOO_WEAK");
+      if (!passwordVerifyResult.ok) {
+        return passwordVerifyResult;
+      }
     }
     const person = await dbContext.transaction(async (db) => {
       const identityId = await db.commandBus.execute(new CreateIdentityCommand.CreateIdentityCommand([...roles, Roles.TenantRole.PERSON]));
-      return await db.commandBus.execute(new CreatePersonCommand.CreatePersonCommand({ identityId, email, password: password$1 }));
+      return await db.commandBus.execute(new CreatePersonCommand.CreatePersonCommand({ identityId, email, password }));
     });
     return new Response.ResponseOk(new SignUpResult(person));
   }

package/dist/production/src/model/service/SignUpManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { SignUpErrorCode } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\nimport { MaybePassword } from '../dtos'\nimport { EmailValidator } from './EmailValidator'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, { email, password, roles = [] }: SignUpUser): Promise<SignUpResponse> {\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, email)\n\t\tif (validationError !== null) {\n\t\t\treturn validationError\n\t\t}\n\t\tconst plainPassword = password.getPlain()\n\t\tconst weakPassword = plainPassword ? getPasswordWeaknessMessage(plainPassword) : null\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tconst person = await dbContext.transaction(async db => {\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\treturn await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password }))\n\t\t})\n\t\treturn new ResponseOk(new SignUpResult(person))\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>) {}\n}\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode>\n"],"names":["password","getPasswordWeaknessMessage","ResponseError","CreateIdentityCommand","TenantRole","CreatePersonCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;AAiBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,OAAO,WAA4B,EAAE,OAAOA,UAAAA,YAAU,QAAQ,CAAA,KAA2C;AAC9G,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK;AAChF,QAAI,oBAAoB,MAAM;AACtB,aAAA;AAAA,IAAA;AAEF,UAAA,gBAAgBA,WAAS,SAAS;AACxC,UAAM,eAAe,gBAAgBC,oCAA2B,aAAa,IAAI;AACjF,QAAI,cAAc;AACV,aAAA,IAAIC,SAAAA,cAAc,YAAY,YAAY;AAAA,IAAA;AAElD,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,OAAM;AACtD,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIC,4CAAsB,CAAC,GAAG,OAAOC,iBAAW,MAAM,CAAC,CAAC;AAChG,aAAA,MAAM,GAAG,WAAW,QAAQ,IAAIC,wCAAoB,EAAE,YAAY,iBAAOL,WAAS,CAAC,CAAC;AAAA,IAAA,CAC3F;AACD,WAAO,IAAIM,SAAA,WAAW,IAAI,aAAa,MAAM,CAAC;AAAA,EAAA;AAEhD;AAEO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkC;AAAlC,SAAA,SAAA;AAAA,EAAA;AAC7B;;;"}
+{"version":3,"file":"SignUpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { SignUpErrorCode, WeakPasswordReason } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { Response, ResponseOk } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\nimport { MaybePassword } from '../dtos'\nimport { EmailValidator } from './EmailValidator'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, { email, password, roles = [] }: SignUpUser): Promise<SignUpResponse> {\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, email)\n\t\tif (validationError !== null) {\n\t\t\treturn validationError\n\t\t}\n\t\tconst plainPassword = password.getPlain()\n\n\t\tif (plainPassword) {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tconst passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')\n\t\t\tif (!passwordVerifyResult.ok) {\n\t\t\t\treturn passwordVerifyResult\n\t\t\t}\n\t\t}\n\n\t\tconst person = await dbContext.transaction(async db => {\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\treturn await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password }))\n\t\t})\n\t\treturn new ResponseOk(new SignUpResult(person))\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>) {}\n}\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n}>\n"],"names":["ConfigurationQuery","CreateIdentityCommand","TenantRole","CreatePersonCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;AAiBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBACA,2BAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EAElB;AAAA,EAEA,MAAM,OAAO,WAA4B,EAAE,OAAO,UAAU,QAAQ,CAAA,KAA2C;AAC9G,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK;AAChF,QAAI,oBAAoB,MAAM;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,gBAAgB,SAAS,SAAA;AAE/B,QAAI,eAAe;AAClB,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,mBAAAA,oBAAoB;AAC1E,YAAM,uBAAuB,MAAM,KAAK,0BAA0B,OAAO,eAAe,OAAO,UAAU,UAAU;AACnH,UAAI,CAAC,qBAAqB,IAAI;AAC7B,eAAO;AAAA,MACR;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,OAAM;AACtD,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIC,4CAAsB,CAAC,GAAG,OAAOC,iBAAW,MAAM,CAAC,CAAC;AACvG,aAAO,MAAM,GAAG,WAAW,QAAQ,IAAIC,wCAAoB,EAAE,YAAY,OAAO,SAAA,CAAU,CAAC;AAAA,IAC5F,CAAC;AACD,WAAO,IAAIC,SAAAA,WAAW,IAAI,aAAa,MAAM,CAAC;AAAA,EAC/C;AACD;AAEO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkC;AAAlC,SAAA,SAAA;AAAA,EAAmC;AAChE;;;"}

package/dist/production/src/model/service/SignUpManager.js

@@ -1,19 +1,21 @@
 import "../type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
-import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { ResponseOk } from "../utils/Response.js";
 import { CreatePersonCommand } from "../commands/person/CreatePersonCommand.js";
 import { CreateIdentityCommand } from "../commands/identity/CreateIdentityCommand.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
 import { TenantRole } from "../authorization/Roles.js";
 import "../authorization/PermissionContext.js";
 import "../authorization/PermissionsFactory.js";
 import "@contember/schema";
-import { getPasswordWeaknessMessage } from "../utils/password.js";
 class SignUpManager {
-  constructor(emailValidator) {
+  constructor(emailValidator, passwordStrengthValidator) {
     this.emailValidator = emailValidator;
+    this.passwordStrengthValidator = passwordStrengthValidator;
   }
   async signUp(dbContext, { email, password, roles = [] }) {
     const validationError = await this.emailValidator.validateEmail(dbContext, email);
@@ -21,9 +23,12 @@ class SignUpManager {
       return validationError;
     }
     const plainPassword = password.getPlain();
-    const weakPassword = plainPassword ? getPasswordWeaknessMessage(plainPassword) : null;
-    if (weakPassword) {
-      return new ResponseError("TOO_WEAK", weakPassword);
+    if (plainPassword) {
+      const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+      const passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, "TOO_WEAK");
+      if (!passwordVerifyResult.ok) {
+        return passwordVerifyResult;
+      }
     }
     const person = await dbContext.transaction(async (db) => {
       const identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]));

package/dist/production/src/model/service/SignUpManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { SignUpErrorCode } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\nimport { MaybePassword } from '../dtos'\nimport { EmailValidator } from './EmailValidator'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, { email, password, roles = [] }: SignUpUser): Promise<SignUpResponse> {\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, email)\n\t\tif (validationError !== null) {\n\t\t\treturn validationError\n\t\t}\n\t\tconst plainPassword = password.getPlain()\n\t\tconst weakPassword = plainPassword ? getPasswordWeaknessMessage(plainPassword) : null\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tconst person = await dbContext.transaction(async db => {\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\treturn await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password }))\n\t\t})\n\t\treturn new ResponseOk(new SignUpResult(person))\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>) {}\n}\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode>\n"],"names":[],"mappings":";;;;;;;;;;;;;AAiBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAAA;AAAA,EAIlB,MAAM,OAAO,WAA4B,EAAE,OAAO,UAAU,QAAQ,CAAA,KAA2C;AAC9G,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK;AAChF,QAAI,oBAAoB,MAAM;AACtB,aAAA;AAAA,IAAA;AAEF,UAAA,gBAAgB,SAAS,SAAS;AACxC,UAAM,eAAe,gBAAgB,2BAA2B,aAAa,IAAI;AACjF,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,YAAY,YAAY;AAAA,IAAA;AAElD,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,OAAM;AACtD,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAI,sBAAsB,CAAC,GAAG,OAAO,WAAW,MAAM,CAAC,CAAC;AAChG,aAAA,MAAM,GAAG,WAAW,QAAQ,IAAI,oBAAoB,EAAE,YAAY,OAAO,SAAS,CAAC,CAAC;AAAA,IAAA,CAC3F;AACD,WAAO,IAAI,WAAW,IAAI,aAAa,MAAM,CAAC;AAAA,EAAA;AAEhD;AAEO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkC;AAAlC,SAAA,SAAA;AAAA,EAAA;AAC7B;"}
+{"version":3,"file":"SignUpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { SignUpErrorCode, WeakPasswordReason } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { Response, ResponseOk } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\nimport { MaybePassword } from '../dtos'\nimport { EmailValidator } from './EmailValidator'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, { email, password, roles = [] }: SignUpUser): Promise<SignUpResponse> {\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, email)\n\t\tif (validationError !== null) {\n\t\t\treturn validationError\n\t\t}\n\t\tconst plainPassword = password.getPlain()\n\n\t\tif (plainPassword) {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tconst passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')\n\t\t\tif (!passwordVerifyResult.ok) {\n\t\t\t\treturn passwordVerifyResult\n\t\t\t}\n\t\t}\n\n\t\tconst person = await dbContext.transaction(async db => {\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\treturn await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password }))\n\t\t})\n\t\treturn new ResponseOk(new SignUpResult(person))\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>) {}\n}\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n}>\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAiBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBACA,2BAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EAElB;AAAA,EAEA,MAAM,OAAO,WAA4B,EAAE,OAAO,UAAU,QAAQ,CAAA,KAA2C;AAC9G,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK;AAChF,QAAI,oBAAoB,MAAM;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,gBAAgB,SAAS,SAAA;AAE/B,QAAI,eAAe;AAClB,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AAC1E,YAAM,uBAAuB,MAAM,KAAK,0BAA0B,OAAO,eAAe,OAAO,UAAU,UAAU;AACnH,UAAI,CAAC,qBAAqB,IAAI;AAC7B,eAAO;AAAA,MACR;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,OAAM;AACtD,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAI,sBAAsB,CAAC,GAAG,OAAO,WAAW,MAAM,CAAC,CAAC;AACvG,aAAO,MAAM,GAAG,WAAW,QAAQ,IAAI,oBAAoB,EAAE,YAAY,OAAO,SAAA,CAAU,CAAC;AAAA,IAC5F,CAAC;AACD,WAAO,IAAI,WAAW,IAAI,aAAa,MAAM,CAAC;AAAA,EAC/C;AACD;AAEO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkC;AAAlC,SAAA,SAAA;AAAA,EAAmC;AAChE;"}

package/dist/production/src/model/service/apiKey/ApiKeyManager.cjs

@@ -11,11 +11,13 @@ require("node:crypto");
 const ApiKey = require("../../type/ApiKey.cjs");
 const assert = require("node:assert");
 const ApiKeyQuery = require("../../queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../../queries/configuration/ConfigurationQuery.cjs");
 require("../../authorization/PermissionActions.cjs");
 require("@contember/authorization");
 require("../../authorization/PermissionContext.cjs");
 require("../../authorization/PermissionsFactory.cjs");
 require("@contember/schema");
+const interval = require("../../utils/interval.cjs");
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
@@ -51,7 +53,10 @@ class ApiKeyManager {
     return new Response.ResponseOk(new VerifyResult(apiKeyRow.identity_id, apiKeyRow.id, apiKeyRow.roles, apiKeyRow.person_id));
   }
   async createSessionApiKey(dbContext, identityId, expiration) {
-    const command = new CreateApiKeyCommand.CreateApiKeyCommand({ type: ApiKey.ApiKey.Type.SESSION, identityId, expiration });
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const expirationResolved = expiration ?? interval.intervalToSeconds(config.login.defaultTokenExpiration) / 60;
+    const expirationCapped = config.login.maxTokenExpiration ? Math.min(expirationResolved, interval.intervalToSeconds(config.login.maxTokenExpiration) / 60) : expirationResolved;
+    const command = new CreateApiKeyCommand.CreateApiKeyCommand({ type: ApiKey.ApiKey.Type.SESSION, identityId, expiration: expirationCapped });
     const token = (await dbContext.commandBus.execute(command)).token;
     assert(token !== void 0);
     return token;

package/dist/production/src/model/service/apiKey/ApiKeyManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/ApiKeyManager.ts"],"sourcesContent":["import {\n\tCreateApiKeyCommand,\n\tDisableApiKeyCommand,\n\tDisableIdentityApiKeysCommand,\n\tDisableOneOffApiKeyCommand,\n\tProlongApiKeyCommand,\n} from '../../commands'\nimport { ApiKey } from '../../type'\n\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response'\nimport { DatabaseContext, TokenHash } from '../../utils'\nimport { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService'\nimport assert from 'node:assert'\nimport { Acl } from '@contember/schema'\nimport { ApiKeyByIdQuery, ApiKeyByTokenQuery, ApiKeyRow } from '../../queries'\n\nexport class ApiKeyManager {\n\tconstructor(\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tasync verifyAndProlong(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\ttoken: string,\n\t): Promise<VerifyResponse> {\n\t\tconst apiKeyRow = await readDbContext.queryHandler.fetch(new ApiKeyByTokenQuery(token))\n\t\tif (apiKeyRow === null) {\n\t\t\treturn new ResponseError(VerifyErrorCode.NOT_FOUND, 'API key was not found')\n\t\t}\n\n\t\tif (apiKeyRow.disabled_at !== null) {\n\t\t\treturn new ResponseError(\n\t\t\t\tVerifyErrorCode.DISABLED,\n\t\t\t\t`API key was disabled at ${apiKeyRow.disabled_at.toISOString()}`,\n\t\t\t)\n\t\t}\n\n\t\tconst now = new Date()\n\t\tif (apiKeyRow.expires_at !== null && apiKeyRow.expires_at <= now) {\n\t\t\treturn new ResponseError(VerifyErrorCode.DISABLED, `API key expired at ${apiKeyRow.expires_at.toISOString()}`)\n\t\t}\n\n\t\tsetImmediate(async () => {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew ProlongApiKeyCommand(\n\t\t\t\t\tapiKeyRow.id,\n\t\t\t\t\tapiKeyRow.type,\n\t\t\t\t\tapiKeyRow.expiration,\n\t\t\t\t\tapiKeyRow.expires_at,\n\t\t\t\t),\n\t\t\t)\n\t\t})\n\n\t\treturn new ResponseOk(new VerifyResult(apiKeyRow.identity_id, apiKeyRow.id, apiKeyRow.roles, apiKeyRow.person_id))\n\t}\n\n\tasync createSessionApiKey(dbContext: DatabaseContext, identityId: string, expiration?: number): Promise<string> {\n\t\tconst command = new CreateApiKeyCommand({ type: ApiKey.Type.SESSION, identityId, expiration })\n\t\tconst token = (await dbContext.commandBus.execute(command)).token\n\t\tassert(token !== undefined)\n\t\treturn token\n\t}\n\n\n\tasync findApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<ApiKeyRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tnew ApiKeyByIdQuery(apiKeyId),\n\t\t)\n\t}\n\n\tasync disableOneOffApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOneOffApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableIdentityApiKeys(dbContext: DatabaseContext, identityId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableIdentityApiKeysCommand(identityId))\n\t}\n\n\tasync createGlobalPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tdescription: string,\n\t\troles: readonly string[],\n\t\ttokenHash?: TokenHash,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createPermanentApiKey(db, description, roles, tokenHash)\n\t\t})\n\t}\n\n\tasync createProjectPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tdescription: string,\n\t\ttokenHash?: TokenHash,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createProjectPermanentApiKey(db, projectId, memberships, description, tokenHash)\n\t\t})\n\t}\n\n}\n\nexport type VerifyResponse = Response<VerifyResult, VerifyErrorCode>\n\nexport class VerifyResult {\n\treadonly valid = true\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly apiKeyId: string,\n\t\tpublic readonly roles: string[],\n\t\tpublic readonly personId: string | null,\n\t) {}\n}\n\nexport const enum VerifyErrorCode {\n\tNOT_FOUND = 'not_found',\n\tDISABLED = 'disabled',\n\tEXPIRED = 'expired',\n\tNO_AUTH_HEADER = 'no_auth_header',\n\tINVALID_AUTH_HEADER = 'invalid_auth_header',\n}\n"],"names":["ApiKeyByTokenQuery","ResponseError","ProlongApiKeyCommand","ResponseOk","CreateApiKeyCommand","ApiKey","ApiKeyByIdQuery","DisableOneOffApiKeyCommand","DisableApiKeyCommand","DisableIdentityApiKeysCommand","VerifyErrorCode"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAgBO,MAAM,cAAc;AAAA,EAC1B,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,iBACL,WACA,eACA,OAC0B;AACpB,UAAA,YAAY,MAAM,cAAc,aAAa,MAAM,IAAIA,YAAAA,mBAAmB,KAAK,CAAC;AACtF,QAAI,cAAc,MAAM;AAChB,aAAA,IAAIC,SAAAA,cAAc,aAA2B,uBAAuB;AAAA,IAAA;AAGxE,QAAA,UAAU,gBAAgB,MAAM;AACnC,aAAO,IAAIA,SAAA;AAAA,QACV;AAAA,QACA,2BAA2B,UAAU,YAAY,YAAA,CAAa;AAAA,MAC/D;AAAA,IAAA;AAGK,UAAA,0BAAU,KAAK;AACrB,QAAI,UAAU,eAAe,QAAQ,UAAU,cAAc,KAAK;AAC1D,aAAA,IAAIA,SAAAA,cAAc,YAA0B,sBAAsB,UAAU,WAAW,YAAa,CAAA,EAAE;AAAA,IAAA;AAG9G,iBAAa,YAAY;AACxB,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAIC,qBAAA;AAAA,UACH,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,QAAA;AAAA,MAEZ;AAAA,IAAA,CACA;AAED,WAAO,IAAIC,SAAA,WAAW,IAAI,aAAa,UAAU,aAAa,UAAU,IAAI,UAAU,OAAO,UAAU,SAAS,CAAC;AAAA,EAAA;AAAA,EAGlH,MAAM,oBAAoB,WAA4B,YAAoB,YAAsC;AACzG,UAAA,UAAU,IAAIC,oBAAA,oBAAoB,EAAE,MAAMC,cAAO,KAAK,SAAS,YAAY,YAAY;AAC7F,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,OAAO,GAAG;AAC5D,WAAO,UAAU,MAAS;AACnB,WAAA;AAAA,EAAA;AAAA,EAIR,MAAM,WAAW,WAA4B,UAA6C;AAClF,WAAA,MAAM,UAAU,aAAa;AAAA,MACnC,IAAIC,4BAAgB,QAAQ;AAAA,IAC7B;AAAA,EAAA;AAAA,EAGD,MAAM,oBAAoB,WAA4B,UAAiC;AACtF,UAAM,UAAU,WAAW,QAAQ,IAAIC,2BAAA,2BAA2B,QAAQ,CAAC;AAAA,EAAA;AAAA,EAG5E,MAAM,cAAc,WAA4B,UAAoC;AACnF,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,QAAQ,CAAC;AAAA,EAAA;AAAA,EAG7E,MAAM,uBAAuB,WAA4B,YAAmC;AAC3F,UAAM,UAAU,WAAW,QAAQ,IAAIC,8BAAA,8BAA8B,UAAU,CAAC;AAAA,EAAA;AAAA,EAGjF,MAAM,4BACL,WACA,aACA,OACA,WACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,KAAK,cAAc,sBAAsB,IAAI,aAAa,OAAO,SAAS;AAAA,IAAA,CACvF;AAAA,EAAA;AAAA,EAGF,MAAM,6BACL,WACA,WACA,aACA,aACA,WACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AACvC,aAAA,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,aAAa,aAAa,SAAS;AAAA,IAAA,CAC/G;AAAA,EAAA;AAGH;AAIO,MAAM,aAAa;AAAA,EAGzB,YACiB,YACA,UACA,OACA,UACf;AAJe,SAAA,aAAA;AACA,SAAA,WAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AANjB,kBAAA,MAAS,SAAQ,IAAA;AAAA,EAAA;AAQlB;AAEkB,IAAA,oCAAAC,qBAAX;AACNA,mBAAA,WAAY,IAAA;AACZA,mBAAA,UAAW,IAAA;AACXA,mBAAA,SAAU,IAAA;AACVA,mBAAA,gBAAiB,IAAA;AACjBA,mBAAA,qBAAsB,IAAA;AALLA,SAAAA;AAAA,GAAA,mBAAA,CAAA,CAAA;;;;"}
+{"version":3,"file":"ApiKeyManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/ApiKeyManager.ts"],"sourcesContent":["import {\n\tCreateApiKeyCommand,\n\tDisableApiKeyCommand,\n\tDisableIdentityApiKeysCommand,\n\tDisableOneOffApiKeyCommand,\n\tProlongApiKeyCommand,\n} from '../../commands'\nimport { ApiKey } from '../../type'\n\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response'\nimport { DatabaseContext, TokenHash } from '../../utils'\nimport { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService'\nimport assert from 'node:assert'\nimport { Acl } from '@contember/schema'\nimport { ApiKeyByIdQuery, ApiKeyByTokenQuery, ApiKeyRow, ConfigurationQuery } from '../../queries'\nimport PostgresInterval from 'postgres-interval'\nimport { Config } from '../../type/Config'\nimport { intervalToSeconds } from '../../utils/interval'\n\nexport class ApiKeyManager {\n\tconstructor(\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tasync verifyAndProlong(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\ttoken: string,\n\t): Promise<VerifyResponse> {\n\t\tconst apiKeyRow = await readDbContext.queryHandler.fetch(new ApiKeyByTokenQuery(token))\n\t\tif (apiKeyRow === null) {\n\t\t\treturn new ResponseError(VerifyErrorCode.NOT_FOUND, 'API key was not found')\n\t\t}\n\n\t\tif (apiKeyRow.disabled_at !== null) {\n\t\t\treturn new ResponseError(\n\t\t\t\tVerifyErrorCode.DISABLED,\n\t\t\t\t`API key was disabled at ${apiKeyRow.disabled_at.toISOString()}`,\n\t\t\t)\n\t\t}\n\n\t\tconst now = new Date()\n\t\tif (apiKeyRow.expires_at !== null && apiKeyRow.expires_at <= now) {\n\t\t\treturn new ResponseError(VerifyErrorCode.DISABLED, `API key expired at ${apiKeyRow.expires_at.toISOString()}`)\n\t\t}\n\n\t\tsetImmediate(async () => {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew ProlongApiKeyCommand(\n\t\t\t\t\tapiKeyRow.id,\n\t\t\t\t\tapiKeyRow.type,\n\t\t\t\t\tapiKeyRow.expiration,\n\t\t\t\t\tapiKeyRow.expires_at,\n\t\t\t\t),\n\t\t\t)\n\t\t})\n\n\t\treturn new ResponseOk(new VerifyResult(apiKeyRow.identity_id, apiKeyRow.id, apiKeyRow.roles, apiKeyRow.person_id))\n\t}\n\n\tasync createSessionApiKey(dbContext: DatabaseContext, identityId: string, expiration?: number): Promise<string> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst expirationResolved = expiration ?? (intervalToSeconds(config.login.defaultTokenExpiration) / 60)\n\t\tconst expirationCapped = config.login.maxTokenExpiration\n\t\t\t? Math.min(expirationResolved, intervalToSeconds(config.login.maxTokenExpiration) / 60)\n\t\t\t: expirationResolved\n\t\tconst command = new CreateApiKeyCommand({ type: ApiKey.Type.SESSION, identityId, expiration: expirationCapped })\n\t\tconst token = (await dbContext.commandBus.execute(command)).token\n\t\tassert(token !== undefined)\n\t\treturn token\n\t}\n\n\tasync findApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<ApiKeyRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tnew ApiKeyByIdQuery(apiKeyId),\n\t\t)\n\t}\n\n\tasync disableOneOffApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOneOffApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableIdentityApiKeys(dbContext: DatabaseContext, identityId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableIdentityApiKeysCommand(identityId))\n\t}\n\n\tasync createGlobalPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tdescription: string,\n\t\troles: readonly string[],\n\t\ttokenHash?: TokenHash,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createPermanentApiKey(db, description, roles, tokenHash)\n\t\t})\n\t}\n\n\tasync createProjectPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tdescription: string,\n\t\ttokenHash?: TokenHash,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createProjectPermanentApiKey(db, projectId, memberships, description, tokenHash)\n\t\t})\n\t}\n}\n\nexport type VerifyResponse = Response<VerifyResult, VerifyErrorCode>\n\nexport class VerifyResult {\n\treadonly valid = true\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly apiKeyId: string,\n\t\tpublic readonly roles: string[],\n\t\tpublic readonly personId: string | null,\n\t) {}\n}\n\nexport enum VerifyErrorCode {\n\tNOT_FOUND = 'not_found',\n\tDISABLED = 'disabled',\n\tEXPIRED = 'expired',\n\tNO_AUTH_HEADER = 'no_auth_header',\n\tINVALID_AUTH_HEADER = 'invalid_auth_header',\n}\n"],"names":["ApiKeyByTokenQuery","ResponseError","ProlongApiKeyCommand","ResponseOk","ConfigurationQuery","intervalToSeconds","CreateApiKeyCommand","ApiKey","ApiKeyByIdQuery","DisableOneOffApiKeyCommand","DisableApiKeyCommand","DisableIdentityApiKeysCommand","VerifyErrorCode"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmBO,MAAM,cAAc;AAAA,EAC1B,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBACL,WACA,eACA,OAC0B;AAC1B,UAAM,YAAY,MAAM,cAAc,aAAa,MAAM,IAAIA,YAAAA,mBAAmB,KAAK,CAAC;AACtF,QAAI,cAAc,MAAM;AACvB,aAAO,IAAIC,SAAAA,cAAc,aAA2B,uBAAuB;AAAA,IAC5E;AAEA,QAAI,UAAU,gBAAgB,MAAM;AACnC,aAAO,IAAIA,SAAAA;AAAAA,QACV;AAAA,QACA,2BAA2B,UAAU,YAAY,YAAA,CAAa;AAAA,MAAA;AAAA,IAEhE;AAEA,UAAM,0BAAU,KAAA;AAChB,QAAI,UAAU,eAAe,QAAQ,UAAU,cAAc,KAAK;AACjE,aAAO,IAAIA,SAAAA,cAAc,YAA0B,sBAAsB,UAAU,WAAW,YAAA,CAAa,EAAE;AAAA,IAC9G;AAEA,iBAAa,YAAY;AACxB,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAIC,qBAAAA;AAAAA,UACH,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,QAAA;AAAA,MACX;AAAA,IAEF,CAAC;AAED,WAAO,IAAIC,SAAAA,WAAW,IAAI,aAAa,UAAU,aAAa,UAAU,IAAI,UAAU,OAAO,UAAU,SAAS,CAAC;AAAA,EAClH;AAAA,EAEA,MAAM,oBAAoB,WAA4B,YAAoB,YAAsC;AAC/G,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAC1E,UAAM,qBAAqB,cAAeC,SAAAA,kBAAkB,OAAO,MAAM,sBAAsB,IAAI;AACnG,UAAM,mBAAmB,OAAO,MAAM,qBACnC,KAAK,IAAI,oBAAoBA,SAAAA,kBAAkB,OAAO,MAAM,kBAAkB,IAAI,EAAE,IACpF;AACH,UAAM,UAAU,IAAIC,wCAAoB,EAAE,MAAMC,OAAAA,OAAO,KAAK,SAAS,YAAY,YAAY,iBAAA,CAAkB;AAC/G,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,OAAO,GAAG;AAC5D,WAAO,UAAU,MAAS;AAC1B,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,WAA4B,UAA6C;AACzF,WAAO,MAAM,UAAU,aAAa;AAAA,MACnC,IAAIC,YAAAA,gBAAgB,QAAQ;AAAA,IAAA;AAAA,EAE9B;AAAA,EAEA,MAAM,oBAAoB,WAA4B,UAAiC;AACtF,UAAM,UAAU,WAAW,QAAQ,IAAIC,2BAAAA,2BAA2B,QAAQ,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAM,cAAc,WAA4B,UAAoC;AACnF,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,QAAQ,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,uBAAuB,WAA4B,YAAmC;AAC3F,UAAM,UAAU,WAAW,QAAQ,IAAIC,8BAAAA,8BAA8B,UAAU,CAAC;AAAA,EACjF;AAAA,EAEA,MAAM,4BACL,WACA,aACA,OACA,WACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,KAAK,cAAc,sBAAsB,IAAI,aAAa,OAAO,SAAS;AAAA,IACxF,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,6BACL,WACA,WACA,aACA,aACA,WACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,aAAa,aAAa,SAAS;AAAA,IAChH,CAAC;AAAA,EACF;AACD;AAIO,MAAM,aAAa;AAAA,EAGzB,YACiB,YACA,UACA,OACA,UACf;AAJe,SAAA,aAAA;AACA,SAAA,WAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AANjB,kBAAA,MAAS,SAAQ,IAAA;AAAA,EAOd;AACJ;AAEO,IAAK,oCAAAC,qBAAL;AACNA,mBAAA,WAAA,IAAY;AACZA,mBAAA,UAAA,IAAW;AACXA,mBAAA,SAAA,IAAU;AACVA,mBAAA,gBAAA,IAAiB;AACjBA,mBAAA,qBAAA,IAAsB;AALX,SAAAA;AAAA,GAAA,mBAAA,CAAA,CAAA;;;;"}