@contember/engine-tenant-api 2.1.0-alpha.9 → 2.1.0-beta.1

package/dist/production/src/model/service/InviteManager.cjs

@@ -50,18 +50,24 @@ class InviteManager {
         const identityId = await trx.commandBus.execute(new CreateIdentityCommand.CreateIdentityCommand([Roles.TenantRole.PERSON]));
         generatedPassword = password ?? (method === "CREATE_PASSWORD" ? (await this.providers.randomBytes(9)).toString("base64") : null);
         const passwordWrapper = generatedPassword !== null ? new Password.PasswordPlain(generatedPassword) : Password.NoPassword;
-        person = await trx.commandBus.execute(new CreatePersonCommand.CreatePersonCommand({
-          identityId,
-          email: email$1,
-          name,
-          password: passwordWrapper
-        }));
+        person = await trx.commandBus.execute(
+          new CreatePersonCommand.CreatePersonCommand({
+            identityId,
+            email: email$1,
+            name,
+            password: passwordWrapper
+          })
+        );
         if (method === "RESET_PASSWORD") {
-          const result = await trx.commandBus.execute(CreatePersonTokenCommand.CreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug)));
+          const result = await trx.commandBus.execute(
+            CreatePersonTokenCommand.CreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug))
+          );
           resetToken = result.token;
         }
         if (passwordResetTokenHash) {
-          await trx.commandBus.execute(new SavePersonTokenCommand.SavePersonTokenCommand(person.id, passwordResetTokenHash, "password_reset", await this.getInviteExpiration(project.slug)));
+          await trx.commandBus.execute(
+            new SavePersonTokenCommand.SavePersonTokenCommand(person.id, passwordResetTokenHash, "password_reset", await this.getInviteExpiration(project.slug))
+          );
         }
       }
       for (const membershipUpdate of membershipUtils.createAppendMembershipVariables(memberships)) {

package/dist/production/src/model/service/InviteManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"InviteManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/InviteManager.ts"],"sourcesContent":["import {\n\tCreateIdentityCommand,\n\tCreateOrUpdateProjectMembershipCommand,\n\tCreatePersonCommand,\n\tCreatePersonTokenCommand,\n\tSavePersonTokenCommand,\n} from '../commands'\nimport { Providers } from '../providers'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { Project, ProjectSchemaResolver } from '../type'\nimport { InviteErrorCode, InviteMethod } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { UserMailer } from '../mailing'\nimport { createAppendMembershipVariables } from './membershipUtils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DatabaseContext, TokenHash } from '../utils'\nimport { NoPassword, PasswordPlain } from '../dtos'\nimport { Acl } from '@contember/schema'\nimport { validateEmail } from '../utils/email'\nimport { INVITATION_RESET_TOKEN_EXPIRATION_MINUTES } from '../consts/expirations'\n\nexport interface InviteData {\n\temail: string\n\tname?: string\n\tproject: Project\n\tmemberships: readonly Acl.Membership[]\n\tnoEmail?: boolean\n\tpassword?: string\n\temailVariant?: string\n\tmethod?: InviteMethod\n\tpasswordResetTokenHash?: TokenHash\n}\n\nexport class InviteManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) { }\n\n\tasync invite(\n\t\tdbContext: DatabaseContext,\n\t\t{\n\t\t\temail,\n\t\t\tproject,\n\t\t\tname,\n\t\t\tmemberships,\n\t\t\tmethod,\n\t\t\temailVariant,\n\t\t\tnoEmail = false,\n\t\t\tpassword,\n\t\t\tpasswordResetTokenHash,\n\t\t}: InviteData,\n\t): Promise<InviteResponse> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tlet person: Omit<PersonRow, 'roles'> | null = await trx.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tconst isNew = !person\n\t\t\tlet generatedPassword: string | null = null\n\t\t\tlet resetToken: string | null = null\n\t\t\tif (!person) {\n\t\t\t\tconst identityId = await trx.commandBus.execute(new CreateIdentityCommand([TenantRole.PERSON]))\n\n\t\t\t\tgeneratedPassword = password ??\n\t\t\t\t\t(method === 'CREATE_PASSWORD' ? (await this.providers.randomBytes(9)).toString('base64') : null)\n\t\t\t\tconst passwordWrapper = generatedPassword !== null ? new PasswordPlain(generatedPassword) : NoPassword\n\n\t\t\t\tperson = await trx.commandBus.execute(new CreatePersonCommand({\n\t\t\t\t\tidentityId,\n\t\t\t\t\temail,\n\t\t\t\t\tname,\n\t\t\t\t\tpassword: passwordWrapper,\n\t\t\t\t}))\n\t\t\t\tif (method === 'RESET_PASSWORD') {\n\t\t\t\t\tconst result = await trx.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug)))\n\t\t\t\t\tresetToken = result.token\n\t\t\t\t}\n\t\t\t\tif (passwordResetTokenHash) {\n\t\t\t\t\tawait trx.commandBus.execute(new SavePersonTokenCommand(person.id, passwordResetTokenHash, 'password_reset', await this.getInviteExpiration(project.slug)))\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (const membershipUpdate of createAppendMembershipVariables(memberships)) {\n\t\t\t\tawait trx.commandBus.execute(new CreateOrUpdateProjectMembershipCommand(project.id, person.identity_id, membershipUpdate))\n\t\t\t}\n\t\t\tif (!noEmail) {\n\t\t\t\tconst customMailOptions = {\n\t\t\t\t\tprojectId: project.id,\n\t\t\t\t\tvariant: emailVariant ?? '',\n\t\t\t\t}\n\t\t\t\tif (isNew) {\n\t\t\t\t\tawait this.mailer.sendNewUserInvitedMail(\n\t\t\t\t\t\ttrx,\n\t\t\t\t\t\t{ email, project: project.name, projectSlug: project.slug, password: generatedPassword, token: resetToken, memberships },\n\t\t\t\t\t\tcustomMailOptions,\n\t\t\t\t\t)\n\t\t\t\t} else {\n\t\t\t\t\tawait this.mailer.sendExistingUserInvitedEmail(trx, { email, project: project.name, projectSlug: project.slug, memberships }, customMailOptions)\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn new ResponseOk(new InviteResult(person, isNew))\n\t\t})\n\t}\n\n\tprivate async getInviteExpiration(projectSlug: string): Promise<number> {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(projectSlug)\n\n\t\treturn schema?.settings.tenant?.inviteExpirationMinutes ?? INVITATION_RESET_TOKEN_EXPIRATION_MINUTES\n\t}\n}\n\nexport type InviteResponse = Response<InviteResult, InviteErrorCode>\n\nexport class InviteResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>, public readonly isNew: boolean) { }\n}\n"],"names":["email","validateEmail","ResponseError","PersonQuery","CreateIdentityCommand","TenantRole","PasswordPlain","NoPassword","CreatePersonCommand","CreatePersonTokenCommand","SavePersonTokenCommand","createAppendMembershipVariables","CreateOrUpdateProjectMembershipCommand","ResponseOk","INVITATION_RESET_TOKEN_EXPIRATION_MINUTES"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiCO,MAAM,cAAc;AAAA,EAC1B,YACkB,WACA,QACA,uBAChB;AAHgB,SAAA,YAAA;AACA,SAAA,SAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OACL,WACA;AAAA,IAAA,OACCA;AAAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EAAA,GAEyB;AAC1B,QAAI,CAACC,MAAA,cAAcD,QAAM,KAAM,CAAA,GAAG;AAC1B,aAAA,IAAIE,SAAAA,cAAc,wBAAwB,yCAAyC;AAAA,IAAA;AAG3F,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC3C,UAAA,SAA0C,MAAM,IAAI,aAAa,MAAMC,wBAAY,QAAQH,OAAK,CAAC;AACrG,YAAM,QAAQ,CAAC;AACf,UAAI,oBAAmC;AACvC,UAAI,aAA4B;AAChC,UAAI,CAAC,QAAQ;AACN,cAAA,aAAa,MAAM,IAAI,WAAW,QAAQ,IAAII,sBAAAA,sBAAsB,CAACC,MAAAA,WAAW,MAAM,CAAC,CAAC;AAE1E,4BAAA,aAClB,WAAW,qBAAqB,MAAM,KAAK,UAAU,YAAY,CAAC,GAAG,SAAS,QAAQ,IAAI;AAC5F,cAAM,kBAAkB,sBAAsB,OAAO,IAAIC,SAAA,cAAc,iBAAiB,IAAIC,SAAA;AAE5F,iBAAS,MAAM,IAAI,WAAW,QAAQ,IAAIC,oBAAAA,oBAAoB;AAAA,UAC7D;AAAA,UAAA,OACAR;AAAAA,UACA;AAAA,UACA,UAAU;AAAA,QAAA,CACV,CAAC;AACF,YAAI,WAAW,kBAAkB;AAChC,gBAAM,SAAS,MAAM,IAAI,WAAW,QAAQS,yBAAyB,yBAAA,2BAA2B,OAAO,IAAI,MAAM,KAAK,oBAAoB,QAAQ,IAAI,CAAC,CAAC;AACxJ,uBAAa,OAAO;AAAA,QAAA;AAErB,YAAI,wBAAwB;AAC3B,gBAAM,IAAI,WAAW,QAAQ,IAAIC,8CAAuB,OAAO,IAAI,wBAAwB,kBAAkB,MAAM,KAAK,oBAAoB,QAAQ,IAAI,CAAC,CAAC;AAAA,QAAA;AAAA,MAC3J;AAEU,iBAAA,oBAAoBC,gDAAgC,WAAW,GAAG;AACtE,cAAA,IAAI,WAAW,QAAQ,IAAIC,uCAAA,uCAAuC,QAAQ,IAAI,OAAO,aAAa,gBAAgB,CAAC;AAAA,MAAA;AAE1H,UAAI,CAAC,SAAS;AACb,cAAM,oBAAoB;AAAA,UACzB,WAAW,QAAQ;AAAA,UACnB,SAAS,gBAAgB;AAAA,QAC1B;AACA,YAAI,OAAO;AACV,gBAAM,KAAK,OAAO;AAAA,YACjB;AAAA,YACA,EAAA,OAAEZ,SAAO,SAAS,QAAQ,MAAM,aAAa,QAAQ,MAAM,UAAU,mBAAmB,OAAO,YAAY,YAAY;AAAA,YACvH;AAAA,UACD;AAAA,QAAA,OACM;AACN,gBAAM,KAAK,OAAO,6BAA6B,KAAK,EAAA,OAAEA,SAAO,SAAS,QAAQ,MAAM,aAAa,QAAQ,MAAM,YAAA,GAAe,iBAAiB;AAAA,QAAA;AAAA,MAChJ;AAED,aAAO,IAAIa,SAAAA,WAAW,IAAI,aAAa,QAAQ,KAAK,CAAC;AAAA,IAAA,CACrD;AAAA,EAAA;AAAA,EAGF,MAAc,oBAAoB,aAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,WAAW;AAE9D,WAAA,QAAQ,SAAS,QAAQ,2BAA2BC,YAAA;AAAA,EAAA;AAE7D;AAIO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkD,OAAgB;AAAlE,SAAA,SAAA;AAAkD,SAAA,QAAA;AAAA,EAAA;AAC/E;;;"}
+{"version":3,"file":"InviteManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/InviteManager.ts"],"sourcesContent":["import {\n\tCreateIdentityCommand,\n\tCreateOrUpdateProjectMembershipCommand,\n\tCreatePersonCommand,\n\tCreatePersonTokenCommand,\n\tSavePersonTokenCommand,\n} from '../commands'\nimport { Providers } from '../providers'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { Project, ProjectSchemaResolver } from '../type'\nimport { InviteErrorCode, InviteMethod } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { UserMailer } from '../mailing'\nimport { createAppendMembershipVariables } from './membershipUtils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DatabaseContext, TokenHash } from '../utils'\nimport { NoPassword, PasswordPlain } from '../dtos'\nimport { Acl } from '@contember/schema'\nimport { validateEmail } from '../utils/email'\nimport { INVITATION_RESET_TOKEN_EXPIRATION_MINUTES } from '../consts/expirations'\n\nexport interface InviteData {\n\temail: string\n\tname?: string\n\tproject: Project\n\tmemberships: readonly Acl.Membership[]\n\tnoEmail?: boolean\n\tpassword?: string\n\temailVariant?: string\n\tmethod?: InviteMethod\n\tpasswordResetTokenHash?: TokenHash\n}\n\nexport class InviteManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tasync invite(\n\t\tdbContext: DatabaseContext,\n\t\t{\n\t\t\temail,\n\t\t\tproject,\n\t\t\tname,\n\t\t\tmemberships,\n\t\t\tmethod,\n\t\t\temailVariant,\n\t\t\tnoEmail = false,\n\t\t\tpassword,\n\t\t\tpasswordResetTokenHash,\n\t\t}: InviteData,\n\t): Promise<InviteResponse> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tlet person: Omit<PersonRow, 'roles'> | null = await trx.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tconst isNew = !person\n\t\t\tlet generatedPassword: string | null = null\n\t\t\tlet resetToken: string | null = null\n\t\t\tif (!person) {\n\t\t\t\tconst identityId = await trx.commandBus.execute(new CreateIdentityCommand([TenantRole.PERSON]))\n\n\t\t\t\tgeneratedPassword = password\n\t\t\t\t\t?? (method === 'CREATE_PASSWORD' ? (await this.providers.randomBytes(9)).toString('base64') : null)\n\t\t\t\tconst passwordWrapper = generatedPassword !== null ? new PasswordPlain(generatedPassword) : NoPassword\n\n\t\t\t\tperson = await trx.commandBus.execute(\n\t\t\t\t\tnew CreatePersonCommand({\n\t\t\t\t\t\tidentityId,\n\t\t\t\t\t\temail,\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tpassword: passwordWrapper,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\tif (method === 'RESET_PASSWORD') {\n\t\t\t\t\tconst result = await trx.commandBus.execute(\n\t\t\t\t\t\tCreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug)),\n\t\t\t\t\t)\n\t\t\t\t\tresetToken = result.token\n\t\t\t\t}\n\t\t\t\tif (passwordResetTokenHash) {\n\t\t\t\t\tawait trx.commandBus.execute(\n\t\t\t\t\t\tnew SavePersonTokenCommand(person.id, passwordResetTokenHash, 'password_reset', await this.getInviteExpiration(project.slug)),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (const membershipUpdate of createAppendMembershipVariables(memberships)) {\n\t\t\t\tawait trx.commandBus.execute(new CreateOrUpdateProjectMembershipCommand(project.id, person.identity_id, membershipUpdate))\n\t\t\t}\n\t\t\tif (!noEmail) {\n\t\t\t\tconst customMailOptions = {\n\t\t\t\t\tprojectId: project.id,\n\t\t\t\t\tvariant: emailVariant ?? '',\n\t\t\t\t}\n\t\t\t\tif (isNew) {\n\t\t\t\t\tawait this.mailer.sendNewUserInvitedMail(\n\t\t\t\t\t\ttrx,\n\t\t\t\t\t\t{ email, project: project.name, projectSlug: project.slug, password: generatedPassword, token: resetToken, memberships },\n\t\t\t\t\t\tcustomMailOptions,\n\t\t\t\t\t)\n\t\t\t\t} else {\n\t\t\t\t\tawait this.mailer.sendExistingUserInvitedEmail(trx, { email, project: project.name, projectSlug: project.slug, memberships }, customMailOptions)\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn new ResponseOk(new InviteResult(person, isNew))\n\t\t})\n\t}\n\n\tprivate async getInviteExpiration(projectSlug: string): Promise<number> {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(projectSlug)\n\n\t\treturn schema?.settings.tenant?.inviteExpirationMinutes ?? INVITATION_RESET_TOKEN_EXPIRATION_MINUTES\n\t}\n}\n\nexport type InviteResponse = Response<InviteResult, InviteErrorCode>\n\nexport class InviteResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>, public readonly isNew: boolean) {}\n}\n"],"names":["email","validateEmail","ResponseError","PersonQuery","CreateIdentityCommand","TenantRole","PasswordPlain","NoPassword","CreatePersonCommand","CreatePersonTokenCommand","SavePersonTokenCommand","createAppendMembershipVariables","CreateOrUpdateProjectMembershipCommand","ResponseOk","INVITATION_RESET_TOKEN_EXPIRATION_MINUTES"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAiCO,MAAM,cAAc;AAAA,EAC1B,YACkB,WACA,QACA,uBAChB;AAHgB,SAAA,YAAA;AACA,SAAA,SAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,WACA;AAAA,IAAA,OACCA;AAAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EAAA,GAEyB;AAC1B,QAAI,CAACC,MAAAA,cAAcD,QAAM,KAAA,CAAM,GAAG;AACjC,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AAEA,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC/C,UAAI,SAA0C,MAAM,IAAI,aAAa,MAAMC,wBAAY,QAAQH,OAAK,CAAC;AACrG,YAAM,QAAQ,CAAC;AACf,UAAI,oBAAmC;AACvC,UAAI,aAA4B;AAChC,UAAI,CAAC,QAAQ;AACZ,cAAM,aAAa,MAAM,IAAI,WAAW,QAAQ,IAAII,sBAAAA,sBAAsB,CAACC,MAAAA,WAAW,MAAM,CAAC,CAAC;AAE9F,4BAAoB,aACf,WAAW,qBAAqB,MAAM,KAAK,UAAU,YAAY,CAAC,GAAG,SAAS,QAAQ,IAAI;AAC/F,cAAM,kBAAkB,sBAAsB,OAAO,IAAIC,SAAAA,cAAc,iBAAiB,IAAIC,SAAAA;AAE5F,iBAAS,MAAM,IAAI,WAAW;AAAA,UAC7B,IAAIC,wCAAoB;AAAA,YACvB;AAAA,YAAA,OACAR;AAAAA,YACA;AAAA,YACA,UAAU;AAAA,UAAA,CACV;AAAA,QAAA;AAEF,YAAI,WAAW,kBAAkB;AAChC,gBAAM,SAAS,MAAM,IAAI,WAAW;AAAA,YACnCS,kDAAyB,2BAA2B,OAAO,IAAI,MAAM,KAAK,oBAAoB,QAAQ,IAAI,CAAC;AAAA,UAAA;AAE5G,uBAAa,OAAO;AAAA,QACrB;AACA,YAAI,wBAAwB;AAC3B,gBAAM,IAAI,WAAW;AAAA,YACpB,IAAIC,uBAAAA,uBAAuB,OAAO,IAAI,wBAAwB,kBAAkB,MAAM,KAAK,oBAAoB,QAAQ,IAAI,CAAC;AAAA,UAAA;AAAA,QAE9H;AAAA,MACD;AACA,iBAAW,oBAAoBC,gDAAgC,WAAW,GAAG;AAC5E,cAAM,IAAI,WAAW,QAAQ,IAAIC,uCAAAA,uCAAuC,QAAQ,IAAI,OAAO,aAAa,gBAAgB,CAAC;AAAA,MAC1H;AACA,UAAI,CAAC,SAAS;AACb,cAAM,oBAAoB;AAAA,UACzB,WAAW,QAAQ;AAAA,UACnB,SAAS,gBAAgB;AAAA,QAAA;AAE1B,YAAI,OAAO;AACV,gBAAM,KAAK,OAAO;AAAA,YACjB;AAAA,YACA,EAAA,OAAEZ,SAAO,SAAS,QAAQ,MAAM,aAAa,QAAQ,MAAM,UAAU,mBAAmB,OAAO,YAAY,YAAA;AAAA,YAC3G;AAAA,UAAA;AAAA,QAEF,OAAO;AACN,gBAAM,KAAK,OAAO,6BAA6B,KAAK,EAAA,OAAEA,SAAO,SAAS,QAAQ,MAAM,aAAa,QAAQ,MAAM,YAAA,GAAe,iBAAiB;AAAA,QAChJ;AAAA,MACD;AACA,aAAO,IAAIa,SAAAA,WAAW,IAAI,aAAa,QAAQ,KAAK,CAAC;AAAA,IACtD,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,oBAAoB,aAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,WAAW;AAErE,WAAO,QAAQ,SAAS,QAAQ,2BAA2BC,YAAAA;AAAAA,EAC5D;AACD;AAIO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkD,OAAgB;AAAlE,SAAA,SAAA;AAAkD,SAAA,QAAA;AAAA,EAAiB;AAChG;;;"}

package/dist/production/src/model/service/InviteManager.js

@@ -48,18 +48,24 @@ class InviteManager {
         const identityId = await trx.commandBus.execute(new CreateIdentityCommand([TenantRole.PERSON]));
         generatedPassword = password ?? (method === "CREATE_PASSWORD" ? (await this.providers.randomBytes(9)).toString("base64") : null);
         const passwordWrapper = generatedPassword !== null ? new PasswordPlain(generatedPassword) : NoPassword;
-        person = await trx.commandBus.execute(new CreatePersonCommand({
-          identityId,
-          email,
-          name,
-          password: passwordWrapper
-        }));
+        person = await trx.commandBus.execute(
+          new CreatePersonCommand({
+            identityId,
+            email,
+            name,
+            password: passwordWrapper
+          })
+        );
         if (method === "RESET_PASSWORD") {
-          const result = await trx.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug)));
+          const result = await trx.commandBus.execute(
+            CreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug))
+          );
           resetToken = result.token;
         }
         if (passwordResetTokenHash) {
-          await trx.commandBus.execute(new SavePersonTokenCommand(person.id, passwordResetTokenHash, "password_reset", await this.getInviteExpiration(project.slug)));
+          await trx.commandBus.execute(
+            new SavePersonTokenCommand(person.id, passwordResetTokenHash, "password_reset", await this.getInviteExpiration(project.slug))
+          );
         }
       }
       for (const membershipUpdate of createAppendMembershipVariables(memberships)) {

package/dist/production/src/model/service/InviteManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"InviteManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/InviteManager.ts"],"sourcesContent":["import {\n\tCreateIdentityCommand,\n\tCreateOrUpdateProjectMembershipCommand,\n\tCreatePersonCommand,\n\tCreatePersonTokenCommand,\n\tSavePersonTokenCommand,\n} from '../commands'\nimport { Providers } from '../providers'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { Project, ProjectSchemaResolver } from '../type'\nimport { InviteErrorCode, InviteMethod } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { UserMailer } from '../mailing'\nimport { createAppendMembershipVariables } from './membershipUtils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DatabaseContext, TokenHash } from '../utils'\nimport { NoPassword, PasswordPlain } from '../dtos'\nimport { Acl } from '@contember/schema'\nimport { validateEmail } from '../utils/email'\nimport { INVITATION_RESET_TOKEN_EXPIRATION_MINUTES } from '../consts/expirations'\n\nexport interface InviteData {\n\temail: string\n\tname?: string\n\tproject: Project\n\tmemberships: readonly Acl.Membership[]\n\tnoEmail?: boolean\n\tpassword?: string\n\temailVariant?: string\n\tmethod?: InviteMethod\n\tpasswordResetTokenHash?: TokenHash\n}\n\nexport class InviteManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) { }\n\n\tasync invite(\n\t\tdbContext: DatabaseContext,\n\t\t{\n\t\t\temail,\n\t\t\tproject,\n\t\t\tname,\n\t\t\tmemberships,\n\t\t\tmethod,\n\t\t\temailVariant,\n\t\t\tnoEmail = false,\n\t\t\tpassword,\n\t\t\tpasswordResetTokenHash,\n\t\t}: InviteData,\n\t): Promise<InviteResponse> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tlet person: Omit<PersonRow, 'roles'> | null = await trx.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tconst isNew = !person\n\t\t\tlet generatedPassword: string | null = null\n\t\t\tlet resetToken: string | null = null\n\t\t\tif (!person) {\n\t\t\t\tconst identityId = await trx.commandBus.execute(new CreateIdentityCommand([TenantRole.PERSON]))\n\n\t\t\t\tgeneratedPassword = password ??\n\t\t\t\t\t(method === 'CREATE_PASSWORD' ? (await this.providers.randomBytes(9)).toString('base64') : null)\n\t\t\t\tconst passwordWrapper = generatedPassword !== null ? new PasswordPlain(generatedPassword) : NoPassword\n\n\t\t\t\tperson = await trx.commandBus.execute(new CreatePersonCommand({\n\t\t\t\t\tidentityId,\n\t\t\t\t\temail,\n\t\t\t\t\tname,\n\t\t\t\t\tpassword: passwordWrapper,\n\t\t\t\t}))\n\t\t\t\tif (method === 'RESET_PASSWORD') {\n\t\t\t\t\tconst result = await trx.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug)))\n\t\t\t\t\tresetToken = result.token\n\t\t\t\t}\n\t\t\t\tif (passwordResetTokenHash) {\n\t\t\t\t\tawait trx.commandBus.execute(new SavePersonTokenCommand(person.id, passwordResetTokenHash, 'password_reset', await this.getInviteExpiration(project.slug)))\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (const membershipUpdate of createAppendMembershipVariables(memberships)) {\n\t\t\t\tawait trx.commandBus.execute(new CreateOrUpdateProjectMembershipCommand(project.id, person.identity_id, membershipUpdate))\n\t\t\t}\n\t\t\tif (!noEmail) {\n\t\t\t\tconst customMailOptions = {\n\t\t\t\t\tprojectId: project.id,\n\t\t\t\t\tvariant: emailVariant ?? '',\n\t\t\t\t}\n\t\t\t\tif (isNew) {\n\t\t\t\t\tawait this.mailer.sendNewUserInvitedMail(\n\t\t\t\t\t\ttrx,\n\t\t\t\t\t\t{ email, project: project.name, projectSlug: project.slug, password: generatedPassword, token: resetToken, memberships },\n\t\t\t\t\t\tcustomMailOptions,\n\t\t\t\t\t)\n\t\t\t\t} else {\n\t\t\t\t\tawait this.mailer.sendExistingUserInvitedEmail(trx, { email, project: project.name, projectSlug: project.slug, memberships }, customMailOptions)\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn new ResponseOk(new InviteResult(person, isNew))\n\t\t})\n\t}\n\n\tprivate async getInviteExpiration(projectSlug: string): Promise<number> {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(projectSlug)\n\n\t\treturn schema?.settings.tenant?.inviteExpirationMinutes ?? INVITATION_RESET_TOKEN_EXPIRATION_MINUTES\n\t}\n}\n\nexport type InviteResponse = Response<InviteResult, InviteErrorCode>\n\nexport class InviteResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>, public readonly isNew: boolean) { }\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiCO,MAAM,cAAc;AAAA,EAC1B,YACkB,WACA,QACA,uBAChB;AAHgB,SAAA,YAAA;AACA,SAAA,SAAA;AACA,SAAA,wBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,OACL,WACA;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EAAA,GAEyB;AAC1B,QAAI,CAAC,cAAc,MAAM,KAAM,CAAA,GAAG;AAC1B,aAAA,IAAI,cAAc,wBAAwB,yCAAyC;AAAA,IAAA;AAG3F,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC3C,UAAA,SAA0C,MAAM,IAAI,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrG,YAAM,QAAQ,CAAC;AACf,UAAI,oBAAmC;AACvC,UAAI,aAA4B;AAChC,UAAI,CAAC,QAAQ;AACN,cAAA,aAAa,MAAM,IAAI,WAAW,QAAQ,IAAI,sBAAsB,CAAC,WAAW,MAAM,CAAC,CAAC;AAE1E,4BAAA,aAClB,WAAW,qBAAqB,MAAM,KAAK,UAAU,YAAY,CAAC,GAAG,SAAS,QAAQ,IAAI;AAC5F,cAAM,kBAAkB,sBAAsB,OAAO,IAAI,cAAc,iBAAiB,IAAI;AAE5F,iBAAS,MAAM,IAAI,WAAW,QAAQ,IAAI,oBAAoB;AAAA,UAC7D;AAAA,UACA;AAAA,UACA;AAAA,UACA,UAAU;AAAA,QAAA,CACV,CAAC;AACF,YAAI,WAAW,kBAAkB;AAChC,gBAAM,SAAS,MAAM,IAAI,WAAW,QAAQ,yBAAyB,2BAA2B,OAAO,IAAI,MAAM,KAAK,oBAAoB,QAAQ,IAAI,CAAC,CAAC;AACxJ,uBAAa,OAAO;AAAA,QAAA;AAErB,YAAI,wBAAwB;AAC3B,gBAAM,IAAI,WAAW,QAAQ,IAAI,uBAAuB,OAAO,IAAI,wBAAwB,kBAAkB,MAAM,KAAK,oBAAoB,QAAQ,IAAI,CAAC,CAAC;AAAA,QAAA;AAAA,MAC3J;AAEU,iBAAA,oBAAoB,gCAAgC,WAAW,GAAG;AACtE,cAAA,IAAI,WAAW,QAAQ,IAAI,uCAAuC,QAAQ,IAAI,OAAO,aAAa,gBAAgB,CAAC;AAAA,MAAA;AAE1H,UAAI,CAAC,SAAS;AACb,cAAM,oBAAoB;AAAA,UACzB,WAAW,QAAQ;AAAA,UACnB,SAAS,gBAAgB;AAAA,QAC1B;AACA,YAAI,OAAO;AACV,gBAAM,KAAK,OAAO;AAAA,YACjB;AAAA,YACA,EAAE,OAAO,SAAS,QAAQ,MAAM,aAAa,QAAQ,MAAM,UAAU,mBAAmB,OAAO,YAAY,YAAY;AAAA,YACvH;AAAA,UACD;AAAA,QAAA,OACM;AACN,gBAAM,KAAK,OAAO,6BAA6B,KAAK,EAAE,OAAO,SAAS,QAAQ,MAAM,aAAa,QAAQ,MAAM,YAAA,GAAe,iBAAiB;AAAA,QAAA;AAAA,MAChJ;AAED,aAAO,IAAI,WAAW,IAAI,aAAa,QAAQ,KAAK,CAAC;AAAA,IAAA,CACrD;AAAA,EAAA;AAAA,EAGF,MAAc,oBAAoB,aAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,WAAW;AAE9D,WAAA,QAAQ,SAAS,QAAQ,2BAA2B;AAAA,EAAA;AAE7D;AAIO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkD,OAAgB;AAAlE,SAAA,SAAA;AAAkD,SAAA,QAAA;AAAA,EAAA;AAC/E;"}
+{"version":3,"file":"InviteManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/InviteManager.ts"],"sourcesContent":["import {\n\tCreateIdentityCommand,\n\tCreateOrUpdateProjectMembershipCommand,\n\tCreatePersonCommand,\n\tCreatePersonTokenCommand,\n\tSavePersonTokenCommand,\n} from '../commands'\nimport { Providers } from '../providers'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { Project, ProjectSchemaResolver } from '../type'\nimport { InviteErrorCode, InviteMethod } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { UserMailer } from '../mailing'\nimport { createAppendMembershipVariables } from './membershipUtils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DatabaseContext, TokenHash } from '../utils'\nimport { NoPassword, PasswordPlain } from '../dtos'\nimport { Acl } from '@contember/schema'\nimport { validateEmail } from '../utils/email'\nimport { INVITATION_RESET_TOKEN_EXPIRATION_MINUTES } from '../consts/expirations'\n\nexport interface InviteData {\n\temail: string\n\tname?: string\n\tproject: Project\n\tmemberships: readonly Acl.Membership[]\n\tnoEmail?: boolean\n\tpassword?: string\n\temailVariant?: string\n\tmethod?: InviteMethod\n\tpasswordResetTokenHash?: TokenHash\n}\n\nexport class InviteManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectSchemaResolver: ProjectSchemaResolver,\n\t) {}\n\n\tasync invite(\n\t\tdbContext: DatabaseContext,\n\t\t{\n\t\t\temail,\n\t\t\tproject,\n\t\t\tname,\n\t\t\tmemberships,\n\t\t\tmethod,\n\t\t\temailVariant,\n\t\t\tnoEmail = false,\n\t\t\tpassword,\n\t\t\tpasswordResetTokenHash,\n\t\t}: InviteData,\n\t): Promise<InviteResponse> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tlet person: Omit<PersonRow, 'roles'> | null = await trx.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tconst isNew = !person\n\t\t\tlet generatedPassword: string | null = null\n\t\t\tlet resetToken: string | null = null\n\t\t\tif (!person) {\n\t\t\t\tconst identityId = await trx.commandBus.execute(new CreateIdentityCommand([TenantRole.PERSON]))\n\n\t\t\t\tgeneratedPassword = password\n\t\t\t\t\t?? (method === 'CREATE_PASSWORD' ? (await this.providers.randomBytes(9)).toString('base64') : null)\n\t\t\t\tconst passwordWrapper = generatedPassword !== null ? new PasswordPlain(generatedPassword) : NoPassword\n\n\t\t\t\tperson = await trx.commandBus.execute(\n\t\t\t\t\tnew CreatePersonCommand({\n\t\t\t\t\t\tidentityId,\n\t\t\t\t\t\temail,\n\t\t\t\t\t\tname,\n\t\t\t\t\t\tpassword: passwordWrapper,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t\tif (method === 'RESET_PASSWORD') {\n\t\t\t\t\tconst result = await trx.commandBus.execute(\n\t\t\t\t\t\tCreatePersonTokenCommand.createPasswordResetRequest(person.id, await this.getInviteExpiration(project.slug)),\n\t\t\t\t\t)\n\t\t\t\t\tresetToken = result.token\n\t\t\t\t}\n\t\t\t\tif (passwordResetTokenHash) {\n\t\t\t\t\tawait trx.commandBus.execute(\n\t\t\t\t\t\tnew SavePersonTokenCommand(person.id, passwordResetTokenHash, 'password_reset', await this.getInviteExpiration(project.slug)),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\t\t\tfor (const membershipUpdate of createAppendMembershipVariables(memberships)) {\n\t\t\t\tawait trx.commandBus.execute(new CreateOrUpdateProjectMembershipCommand(project.id, person.identity_id, membershipUpdate))\n\t\t\t}\n\t\t\tif (!noEmail) {\n\t\t\t\tconst customMailOptions = {\n\t\t\t\t\tprojectId: project.id,\n\t\t\t\t\tvariant: emailVariant ?? '',\n\t\t\t\t}\n\t\t\t\tif (isNew) {\n\t\t\t\t\tawait this.mailer.sendNewUserInvitedMail(\n\t\t\t\t\t\ttrx,\n\t\t\t\t\t\t{ email, project: project.name, projectSlug: project.slug, password: generatedPassword, token: resetToken, memberships },\n\t\t\t\t\t\tcustomMailOptions,\n\t\t\t\t\t)\n\t\t\t\t} else {\n\t\t\t\t\tawait this.mailer.sendExistingUserInvitedEmail(trx, { email, project: project.name, projectSlug: project.slug, memberships }, customMailOptions)\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn new ResponseOk(new InviteResult(person, isNew))\n\t\t})\n\t}\n\n\tprivate async getInviteExpiration(projectSlug: string): Promise<number> {\n\t\tconst schema = await this.projectSchemaResolver.getSchema(projectSlug)\n\n\t\treturn schema?.settings.tenant?.inviteExpirationMinutes ?? INVITATION_RESET_TOKEN_EXPIRATION_MINUTES\n\t}\n}\n\nexport type InviteResponse = Response<InviteResult, InviteErrorCode>\n\nexport class InviteResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>, public readonly isNew: boolean) {}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiCO,MAAM,cAAc;AAAA,EAC1B,YACkB,WACA,QACA,uBAChB;AAHgB,SAAA,YAAA;AACA,SAAA,SAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,WACA;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,IACA;AAAA,EAAA,GAEyB;AAC1B,QAAI,CAAC,cAAc,MAAM,KAAA,CAAM,GAAG;AACjC,aAAO,IAAI,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AAEA,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC/C,UAAI,SAA0C,MAAM,IAAI,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrG,YAAM,QAAQ,CAAC;AACf,UAAI,oBAAmC;AACvC,UAAI,aAA4B;AAChC,UAAI,CAAC,QAAQ;AACZ,cAAM,aAAa,MAAM,IAAI,WAAW,QAAQ,IAAI,sBAAsB,CAAC,WAAW,MAAM,CAAC,CAAC;AAE9F,4BAAoB,aACf,WAAW,qBAAqB,MAAM,KAAK,UAAU,YAAY,CAAC,GAAG,SAAS,QAAQ,IAAI;AAC/F,cAAM,kBAAkB,sBAAsB,OAAO,IAAI,cAAc,iBAAiB,IAAI;AAE5F,iBAAS,MAAM,IAAI,WAAW;AAAA,UAC7B,IAAI,oBAAoB;AAAA,YACvB;AAAA,YACA;AAAA,YACA;AAAA,YACA,UAAU;AAAA,UAAA,CACV;AAAA,QAAA;AAEF,YAAI,WAAW,kBAAkB;AAChC,gBAAM,SAAS,MAAM,IAAI,WAAW;AAAA,YACnC,yBAAyB,2BAA2B,OAAO,IAAI,MAAM,KAAK,oBAAoB,QAAQ,IAAI,CAAC;AAAA,UAAA;AAE5G,uBAAa,OAAO;AAAA,QACrB;AACA,YAAI,wBAAwB;AAC3B,gBAAM,IAAI,WAAW;AAAA,YACpB,IAAI,uBAAuB,OAAO,IAAI,wBAAwB,kBAAkB,MAAM,KAAK,oBAAoB,QAAQ,IAAI,CAAC;AAAA,UAAA;AAAA,QAE9H;AAAA,MACD;AACA,iBAAW,oBAAoB,gCAAgC,WAAW,GAAG;AAC5E,cAAM,IAAI,WAAW,QAAQ,IAAI,uCAAuC,QAAQ,IAAI,OAAO,aAAa,gBAAgB,CAAC;AAAA,MAC1H;AACA,UAAI,CAAC,SAAS;AACb,cAAM,oBAAoB;AAAA,UACzB,WAAW,QAAQ;AAAA,UACnB,SAAS,gBAAgB;AAAA,QAAA;AAE1B,YAAI,OAAO;AACV,gBAAM,KAAK,OAAO;AAAA,YACjB;AAAA,YACA,EAAE,OAAO,SAAS,QAAQ,MAAM,aAAa,QAAQ,MAAM,UAAU,mBAAmB,OAAO,YAAY,YAAA;AAAA,YAC3G;AAAA,UAAA;AAAA,QAEF,OAAO;AACN,gBAAM,KAAK,OAAO,6BAA6B,KAAK,EAAE,OAAO,SAAS,QAAQ,MAAM,aAAa,QAAQ,MAAM,YAAA,GAAe,iBAAiB;AAAA,QAChJ;AAAA,MACD;AACA,aAAO,IAAI,WAAW,IAAI,aAAa,QAAQ,KAAK,CAAC;AAAA,IACtD,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,oBAAoB,aAAsC;AACvE,UAAM,SAAS,MAAM,KAAK,sBAAsB,UAAU,WAAW;AAErE,WAAO,QAAQ,SAAS,QAAQ,2BAA2B;AAAA,EAC5D;AACD;AAIO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkD,OAAgB;AAAlE,SAAA,SAAA;AAAkD,SAAA,QAAA;AAAA,EAAiB;AAChG;"}

package/dist/production/src/model/service/MailTemplateManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MailTemplateManager.ts"],"sourcesContent":["import { AddMailTemplateCommand, RemoveMailTemplateCommand } from '../commands'\nimport { MailTemplate, MailTemplateIdentifier } from '../mailing'\nimport { DatabaseContext } from '../utils'\n\nexport class MailTemplateManager {\n\tpublic async addMailTemplate(dbContext: DatabaseContext, mailTemplate: MailTemplate): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new AddMailTemplateCommand(mailTemplate))\n\t}\n\n\tpublic async removeMailTemplate(dbContext: DatabaseContext, mailTemplateId: MailTemplateIdentifier): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new RemoveMailTemplateCommand(mailTemplateId))\n\t}\n}\n"],"names":["AddMailTemplateCommand","RemoveMailTemplateCommand"],"mappings":";;;;;;;AAIO,MAAM,oBAAoB;AAAA,EAChC,MAAa,gBAAgB,WAA4B,cAA2C;AACnG,UAAM,UAAU,WAAW,QAAQ,IAAIA,uBAAA,uBAAuB,YAAY,CAAC;AAAA,EAAA;AAAA,EAG5E,MAAa,mBAAmB,WAA4B,gBAA0D;AACrH,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAIC,0BAAAA,0BAA0B,cAAc,CAAC;AAAA,EAAA;AAEzF;;"}
+{"version":3,"file":"MailTemplateManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MailTemplateManager.ts"],"sourcesContent":["import { AddMailTemplateCommand, RemoveMailTemplateCommand } from '../commands'\nimport { MailTemplate, MailTemplateIdentifier } from '../mailing'\nimport { DatabaseContext } from '../utils'\n\nexport class MailTemplateManager {\n\tpublic async addMailTemplate(dbContext: DatabaseContext, mailTemplate: MailTemplate): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new AddMailTemplateCommand(mailTemplate))\n\t}\n\n\tpublic async removeMailTemplate(dbContext: DatabaseContext, mailTemplateId: MailTemplateIdentifier): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new RemoveMailTemplateCommand(mailTemplateId))\n\t}\n}\n"],"names":["AddMailTemplateCommand","RemoveMailTemplateCommand"],"mappings":";;;;;;;AAIO,MAAM,oBAAoB;AAAA,EAChC,MAAa,gBAAgB,WAA4B,cAA2C;AACnG,UAAM,UAAU,WAAW,QAAQ,IAAIA,uBAAAA,uBAAuB,YAAY,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAa,mBAAmB,WAA4B,gBAA0D;AACrH,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAIC,0BAAAA,0BAA0B,cAAc,CAAC;AAAA,EACxF;AACD;;"}

package/dist/production/src/model/service/MailTemplateManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MailTemplateManager.ts"],"sourcesContent":["import { AddMailTemplateCommand, RemoveMailTemplateCommand } from '../commands'\nimport { MailTemplate, MailTemplateIdentifier } from '../mailing'\nimport { DatabaseContext } from '../utils'\n\nexport class MailTemplateManager {\n\tpublic async addMailTemplate(dbContext: DatabaseContext, mailTemplate: MailTemplate): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new AddMailTemplateCommand(mailTemplate))\n\t}\n\n\tpublic async removeMailTemplate(dbContext: DatabaseContext, mailTemplateId: MailTemplateIdentifier): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new RemoveMailTemplateCommand(mailTemplateId))\n\t}\n}\n"],"names":[],"mappings":";;;;;AAIO,MAAM,oBAAoB;AAAA,EAChC,MAAa,gBAAgB,WAA4B,cAA2C;AACnG,UAAM,UAAU,WAAW,QAAQ,IAAI,uBAAuB,YAAY,CAAC;AAAA,EAAA;AAAA,EAG5E,MAAa,mBAAmB,WAA4B,gBAA0D;AACrH,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAI,0BAA0B,cAAc,CAAC;AAAA,EAAA;AAEzF;"}
+{"version":3,"file":"MailTemplateManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MailTemplateManager.ts"],"sourcesContent":["import { AddMailTemplateCommand, RemoveMailTemplateCommand } from '../commands'\nimport { MailTemplate, MailTemplateIdentifier } from '../mailing'\nimport { DatabaseContext } from '../utils'\n\nexport class MailTemplateManager {\n\tpublic async addMailTemplate(dbContext: DatabaseContext, mailTemplate: MailTemplate): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new AddMailTemplateCommand(mailTemplate))\n\t}\n\n\tpublic async removeMailTemplate(dbContext: DatabaseContext, mailTemplateId: MailTemplateIdentifier): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new RemoveMailTemplateCommand(mailTemplateId))\n\t}\n}\n"],"names":[],"mappings":";;;;;AAIO,MAAM,oBAAoB;AAAA,EAChC,MAAa,gBAAgB,WAA4B,cAA2C;AACnG,UAAM,UAAU,WAAW,QAAQ,IAAI,uBAAuB,YAAY,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAa,mBAAmB,WAA4B,gBAA0D;AACrH,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAI,0BAA0B,cAAc,CAAC;AAAA,EACxF;AACD;"}

package/dist/production/src/model/service/MembershipValidator.cjs

@@ -11,7 +11,7 @@ class MembershipValidator {
     if (!schema) {
       throw new Error();
     }
-    return this.resolver.resolve(schema.acl, memberships, schemaUtils.MembershipResolver.UnknownIdentity).errors;
+    return this.resolver.resolve(schema.acl, memberships, schemaUtils.MembershipResolver.UnknownIdentity, false).errors;
   }
 }
 Object.defineProperty(exports, "MembershipValidationError", {

package/dist/production/src/model/service/MembershipValidator.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type'\nimport { MembershipValidationError, MembershipValidationErrorType, MembershipResolver } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":["MembershipResolver"],"mappings":";;;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAIA,kCACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM;AAAA,IAAA;AAEV,WAAA,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAaA,YAAAA,mBAAmB,eAAe,EAAE;AAAA,EAAA;AAE5F;;;;;;;;;;"}
+{"version":3,"file":"MembershipValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type'\nimport { MembershipResolver, MembershipValidationError, MembershipValidationErrorType } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity, false).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":["MembershipResolver"],"mappings":";;;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAIA,YAAAA,sBACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAA;AAAA,IACX;AACA,WAAO,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAaA,+BAAmB,iBAAiB,KAAK,EAAE;AAAA,EAClG;AACD;;;;;;;;;;"}

package/dist/production/src/model/service/MembershipValidator.js

@@ -10,7 +10,7 @@ class MembershipValidator {
     if (!schema) {
       throw new Error();
     }
-    return this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity).errors;
+    return this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity, false).errors;
   }
 }
 export {

package/dist/production/src/model/service/MembershipValidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type'\nimport { MembershipValidationError, MembershipValidationErrorType, MembershipResolver } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":[],"mappings":";;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAI,sBACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM;AAAA,IAAA;AAEV,WAAA,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAa,mBAAmB,eAAe,EAAE;AAAA,EAAA;AAE5F;"}
+{"version":3,"file":"MembershipValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type'\nimport { MembershipResolver, MembershipValidationError, MembershipValidationErrorType } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity, false).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":[],"mappings":";;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAI,sBACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAA;AAAA,IACX;AACA,WAAO,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAa,mBAAmB,iBAAiB,KAAK,EAAE;AAAA,EAClG;AACD;"}

package/dist/production/src/model/service/OtpAuthenticator.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OtpAuthenticator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpAuthenticator.ts"],"sourcesContent":["import { Providers } from '../providers'\nimport { Secret, TOTP, URI } from 'otpauth'\n\nexport interface OtpData {\n\tsecret: string\n\turi: string\n}\n\nconst digits = 6\n\nexport class OtpAuthenticator {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'now' | 'randomBytes'>,\n\t) {\n\t}\n\n\tpublic validate(secret: SecretLike, token: string): boolean {\n\t\tconst result = TOTP.validate({\n\t\t\ttoken,\n\t\t\tdigits,\n\t\t\tsecret: getSecret(secret),\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t\treturn result !== null\n\t}\n\n\tpublic generate(secret: SecretLike): string {\n\t\treturn TOTP.generate({\n\t\t\tsecret: getSecret(secret),\n\t\t\tdigits,\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t}\n\n\tpublic async create(user: string, label: string): Promise<OtpData> {\n\t\tconst secret = new Secret({ buffer: (await this.providers.randomBytes(20)) as any })\n\t\tconst totp = new TOTP({\n\t\t\tlabel: user,\n\t\t\tissuer: label,\n\t\t\tsecret,\n\t\t})\n\t\treturn {\n\t\t\tsecret: secret.base32,\n\t\t\turi: totp.toString(),\n\t\t}\n\t}\n}\n\ntype SecretLike = { uri: string } | { secret: string }\nconst getSecret = function (otp: SecretLike): Secret {\n\treturn 'uri' in otp ? (URI.parse(otp.uri).secret) : Secret.fromBase32(otp.secret)\n}\n"],"names":["TOTP","Secret","URI"],"mappings":";;;AAQA,MAAM,SAAS;AAER,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAAA;AAAA,EAIX,SAAS,QAAoB,OAAwB;AACrD,UAAA,SAASA,aAAK,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,QAAQ,UAAU,MAAM;AAAA,MACxB,WAAW,KAAK,UAAU,MAAM,QAAQ;AAAA,IAAA,CACxC;AACD,WAAO,WAAW;AAAA,EAAA;AAAA,EAGZ,SAAS,QAA4B;AAC3C,WAAOA,QAAAA,KAAK,SAAS;AAAA,MACpB,QAAQ,UAAU,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,KAAK,UAAU,MAAM,QAAQ;AAAA,IAAA,CACxC;AAAA,EAAA;AAAA,EAGF,MAAa,OAAO,MAAc,OAAiC;AAC5D,UAAA,SAAS,IAAIC,QAAA,OAAO,EAAE,QAAS,MAAM,KAAK,UAAU,YAAY,EAAE,GAAW;AAC7E,UAAA,OAAO,IAAID,aAAK;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,IAAA,CACA;AACM,WAAA;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,KAAK,KAAK,SAAS;AAAA,IACpB;AAAA,EAAA;AAEF;AAGA,MAAM,YAAY,SAAU,KAAyB;AAC7C,SAAA,SAAS,MAAOE,QAAA,IAAI,MAAM,IAAI,GAAG,EAAE,SAAUD,QAAA,OAAO,WAAW,IAAI,MAAM;AACjF;;"}
+{"version":3,"file":"OtpAuthenticator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpAuthenticator.ts"],"sourcesContent":["import { Providers } from '../providers'\nimport { Secret, TOTP, URI } from 'otpauth'\n\nexport interface OtpData {\n\tsecret: string\n\turi: string\n}\n\nconst digits = 6\n\nexport class OtpAuthenticator {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'now' | 'randomBytes'>,\n\t) {\n\t}\n\n\tpublic validate(secret: SecretLike, token: string): boolean {\n\t\tconst result = TOTP.validate({\n\t\t\ttoken,\n\t\t\tdigits,\n\t\t\tsecret: getSecret(secret),\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t\treturn result !== null\n\t}\n\n\tpublic generate(secret: SecretLike): string {\n\t\treturn TOTP.generate({\n\t\t\tsecret: getSecret(secret),\n\t\t\tdigits,\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t}\n\n\tpublic async create(user: string, label: string): Promise<OtpData> {\n\t\tconst secret = new Secret({ buffer: (await this.providers.randomBytes(20)) as any })\n\t\tconst totp = new TOTP({\n\t\t\tlabel: user,\n\t\t\tissuer: label,\n\t\t\tsecret,\n\t\t})\n\t\treturn {\n\t\t\tsecret: secret.base32,\n\t\t\turi: totp.toString(),\n\t\t}\n\t}\n}\n\ntype SecretLike = { uri: string } | { secret: string }\nconst getSecret = function(otp: SecretLike): Secret {\n\treturn 'uri' in otp ? (URI.parse(otp.uri).secret) : Secret.fromBase32(otp.secret)\n}\n"],"names":["TOTP","Secret","URI"],"mappings":";;;AAQA,MAAM,SAAS;AAER,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEO,SAAS,QAAoB,OAAwB;AAC3D,UAAM,SAASA,QAAAA,KAAK,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,QAAQ,UAAU,MAAM;AAAA,MACxB,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AACD,WAAO,WAAW;AAAA,EACnB;AAAA,EAEO,SAAS,QAA4B;AAC3C,WAAOA,QAAAA,KAAK,SAAS;AAAA,MACpB,QAAQ,UAAU,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AAAA,EACF;AAAA,EAEA,MAAa,OAAO,MAAc,OAAiC;AAClE,UAAM,SAAS,IAAIC,QAAAA,OAAO,EAAE,QAAS,MAAM,KAAK,UAAU,YAAY,EAAE,GAAW;AACnF,UAAM,OAAO,IAAID,aAAK;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,IAAA,CACA;AACD,WAAO;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,KAAK,KAAK,SAAA;AAAA,IAAS;AAAA,EAErB;AACD;AAGA,MAAM,YAAY,SAAS,KAAyB;AACnD,SAAO,SAAS,MAAOE,QAAAA,IAAI,MAAM,IAAI,GAAG,EAAE,SAAUD,QAAAA,OAAO,WAAW,IAAI,MAAM;AACjF;;"}

package/dist/production/src/model/service/OtpAuthenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpAuthenticator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpAuthenticator.ts"],"sourcesContent":["import { Providers } from '../providers'\nimport { Secret, TOTP, URI } from 'otpauth'\n\nexport interface OtpData {\n\tsecret: string\n\turi: string\n}\n\nconst digits = 6\n\nexport class OtpAuthenticator {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'now' | 'randomBytes'>,\n\t) {\n\t}\n\n\tpublic validate(secret: SecretLike, token: string): boolean {\n\t\tconst result = TOTP.validate({\n\t\t\ttoken,\n\t\t\tdigits,\n\t\t\tsecret: getSecret(secret),\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t\treturn result !== null\n\t}\n\n\tpublic generate(secret: SecretLike): string {\n\t\treturn TOTP.generate({\n\t\t\tsecret: getSecret(secret),\n\t\t\tdigits,\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t}\n\n\tpublic async create(user: string, label: string): Promise<OtpData> {\n\t\tconst secret = new Secret({ buffer: (await this.providers.randomBytes(20)) as any })\n\t\tconst totp = new TOTP({\n\t\t\tlabel: user,\n\t\t\tissuer: label,\n\t\t\tsecret,\n\t\t})\n\t\treturn {\n\t\t\tsecret: secret.base32,\n\t\t\turi: totp.toString(),\n\t\t}\n\t}\n}\n\ntype SecretLike = { uri: string } | { secret: string }\nconst getSecret = function (otp: SecretLike): Secret {\n\treturn 'uri' in otp ? (URI.parse(otp.uri).secret) : Secret.fromBase32(otp.secret)\n}\n"],"names":[],"mappings":";AAQA,MAAM,SAAS;AAER,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAAA;AAAA,EAIX,SAAS,QAAoB,OAAwB;AACrD,UAAA,SAAS,KAAK,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,QAAQ,UAAU,MAAM;AAAA,MACxB,WAAW,KAAK,UAAU,MAAM,QAAQ;AAAA,IAAA,CACxC;AACD,WAAO,WAAW;AAAA,EAAA;AAAA,EAGZ,SAAS,QAA4B;AAC3C,WAAO,KAAK,SAAS;AAAA,MACpB,QAAQ,UAAU,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,KAAK,UAAU,MAAM,QAAQ;AAAA,IAAA,CACxC;AAAA,EAAA;AAAA,EAGF,MAAa,OAAO,MAAc,OAAiC;AAC5D,UAAA,SAAS,IAAI,OAAO,EAAE,QAAS,MAAM,KAAK,UAAU,YAAY,EAAE,GAAW;AAC7E,UAAA,OAAO,IAAI,KAAK;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,IAAA,CACA;AACM,WAAA;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,KAAK,KAAK,SAAS;AAAA,IACpB;AAAA,EAAA;AAEF;AAGA,MAAM,YAAY,SAAU,KAAyB;AAC7C,SAAA,SAAS,MAAO,IAAI,MAAM,IAAI,GAAG,EAAE,SAAU,OAAO,WAAW,IAAI,MAAM;AACjF;"}
+{"version":3,"file":"OtpAuthenticator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpAuthenticator.ts"],"sourcesContent":["import { Providers } from '../providers'\nimport { Secret, TOTP, URI } from 'otpauth'\n\nexport interface OtpData {\n\tsecret: string\n\turi: string\n}\n\nconst digits = 6\n\nexport class OtpAuthenticator {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'now' | 'randomBytes'>,\n\t) {\n\t}\n\n\tpublic validate(secret: SecretLike, token: string): boolean {\n\t\tconst result = TOTP.validate({\n\t\t\ttoken,\n\t\t\tdigits,\n\t\t\tsecret: getSecret(secret),\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t\treturn result !== null\n\t}\n\n\tpublic generate(secret: SecretLike): string {\n\t\treturn TOTP.generate({\n\t\t\tsecret: getSecret(secret),\n\t\t\tdigits,\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t}\n\n\tpublic async create(user: string, label: string): Promise<OtpData> {\n\t\tconst secret = new Secret({ buffer: (await this.providers.randomBytes(20)) as any })\n\t\tconst totp = new TOTP({\n\t\t\tlabel: user,\n\t\t\tissuer: label,\n\t\t\tsecret,\n\t\t})\n\t\treturn {\n\t\t\tsecret: secret.base32,\n\t\t\turi: totp.toString(),\n\t\t}\n\t}\n}\n\ntype SecretLike = { uri: string } | { secret: string }\nconst getSecret = function(otp: SecretLike): Secret {\n\treturn 'uri' in otp ? (URI.parse(otp.uri).secret) : Secret.fromBase32(otp.secret)\n}\n"],"names":[],"mappings":";AAQA,MAAM,SAAS;AAER,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEO,SAAS,QAAoB,OAAwB;AAC3D,UAAM,SAAS,KAAK,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,QAAQ,UAAU,MAAM;AAAA,MACxB,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AACD,WAAO,WAAW;AAAA,EACnB;AAAA,EAEO,SAAS,QAA4B;AAC3C,WAAO,KAAK,SAAS;AAAA,MACpB,QAAQ,UAAU,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AAAA,EACF;AAAA,EAEA,MAAa,OAAO,MAAc,OAAiC;AAClE,UAAM,SAAS,IAAI,OAAO,EAAE,QAAS,MAAM,KAAK,UAAU,YAAY,EAAE,GAAW;AACnF,UAAM,OAAO,IAAI,KAAK;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,IAAA,CACA;AACD,WAAO;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,KAAK,KAAK,SAAA;AAAA,IAAS;AAAA,EAErB;AACD;AAGA,MAAM,YAAY,SAAS,KAAyB;AACnD,SAAO,SAAS,MAAO,IAAI,MAAM,IAAI,GAAG,EAAE,SAAU,OAAO,WAAW,IAAI,MAAM;AACjF;"}

package/dist/production/src/model/service/OtpManager.cjs

@@ -29,9 +29,6 @@ class OtpManager {
   }
 }
 class OtpError extends Error {
-  constructor(message) {
-    super(message);
-  }
 }
 exports.OtpError = OtpError;
 exports.OtpManager = OtpManager;

package/dist/production/src/model/service/OtpManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OtpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand } from '../commands'\nimport { DatabaseContext } from '../utils'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator'\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri))\n\t\treturn otp\n\t}\n\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\tverifyOtp(person: PersonRow, token: string): boolean {\n\t\tif (!person.otp_uri) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\treturn this.otpAuthenticator.validate({ uri: person.otp_uri }, token)\n\t}\n}\n\nexport class OtpError extends Error {\n\tconstructor(message?: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":["PrepareOtpCommand","ConfirmOtpCommand","DisableOtpCommand"],"mappings":";;;;;;;;AAKO,MAAM,WAAW;AAAA,EACvB,YACkB,kBAChB;AADgB,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAC1F,UAAA,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AACxF,UAAA,UAAU,WAAW,QAAQ,IAAIA,kBAAAA,kBAAkB,OAAO,IAAI,IAAI,GAAG,CAAC;AACrE,WAAA;AAAA,EAAA;AAAA,EAGR,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAIC,kBAAAA,kBAAkB,OAAO,EAAE,CAAC;AAAA,EAAA;AAAA,EAGpE,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAIC,kBAAAA,kBAAkB,OAAO,EAAE,CAAC;AAAA,EAAA;AAAA,EAGpE,UAAU,QAAmB,OAAwB;AAChD,QAAA,CAAC,OAAO,SAAS;AACd,YAAA,IAAI,SAAS,gBAAgB;AAAA,IAAA;AAE7B,WAAA,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,KAAK;AAAA,EAAA;AAEtE;AAEO,MAAM,iBAAiB,MAAM;AAAA,EACnC,YAAY,SAAkB;AAC7B,UAAM,OAAO;AAAA,EAAA;AAEf;;;"}
+{"version":3,"file":"OtpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand } from '../commands'\nimport { DatabaseContext } from '../utils'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator'\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri))\n\t\treturn otp\n\t}\n\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\tverifyOtp(person: PersonRow, token: string): boolean {\n\t\tif (!person.otp_uri) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\treturn this.otpAuthenticator.validate({ uri: person.otp_uri }, token)\n\t}\n}\n\nexport class OtpError extends Error {\n}\n"],"names":["PrepareOtpCommand","ConfirmOtpCommand","DisableOtpCommand"],"mappings":";;;;;;;;AAKO,MAAM,WAAW;AAAA,EACvB,YACkB,kBAChB;AADgB,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAChG,UAAM,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AAC9F,UAAM,UAAU,WAAW,QAAQ,IAAIA,kBAAAA,kBAAkB,OAAO,IAAI,IAAI,GAAG,CAAC;AAC5E,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAIC,kBAAAA,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAIC,kBAAAA,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,UAAU,QAAmB,OAAwB;AACpD,QAAI,CAAC,OAAO,SAAS;AACpB,YAAM,IAAI,SAAS,gBAAgB;AAAA,IACpC;AACA,WAAO,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,QAAA,GAAW,KAAK;AAAA,EACrE;AACD;AAEO,MAAM,iBAAiB,MAAM;AACpC;;;"}

package/dist/production/src/model/service/OtpManager.js

@@ -27,9 +27,6 @@ class OtpManager {
   }
 }
 class OtpError extends Error {
-  constructor(message) {
-    super(message);
-  }
 }
 export {
   OtpError,

package/dist/production/src/model/service/OtpManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand } from '../commands'\nimport { DatabaseContext } from '../utils'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator'\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri))\n\t\treturn otp\n\t}\n\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\tverifyOtp(person: PersonRow, token: string): boolean {\n\t\tif (!person.otp_uri) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\treturn this.otpAuthenticator.validate({ uri: person.otp_uri }, token)\n\t}\n}\n\nexport class OtpError extends Error {\n\tconstructor(message?: string) {\n\t\tsuper(message)\n\t}\n}\n"],"names":[],"mappings":";;;;;;AAKO,MAAM,WAAW;AAAA,EACvB,YACkB,kBAChB;AADgB,SAAA,mBAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAC1F,UAAA,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AACxF,UAAA,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,IAAI,IAAI,GAAG,CAAC;AACrE,WAAA;AAAA,EAAA;AAAA,EAGR,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EAAA;AAAA,EAGpE,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EAAA;AAAA,EAGpE,UAAU,QAAmB,OAAwB;AAChD,QAAA,CAAC,OAAO,SAAS;AACd,YAAA,IAAI,SAAS,gBAAgB;AAAA,IAAA;AAE7B,WAAA,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,KAAK;AAAA,EAAA;AAEtE;AAEO,MAAM,iBAAiB,MAAM;AAAA,EACnC,YAAY,SAAkB;AAC7B,UAAM,OAAO;AAAA,EAAA;AAEf;"}
+{"version":3,"file":"OtpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand } from '../commands'\nimport { DatabaseContext } from '../utils'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator'\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri))\n\t\treturn otp\n\t}\n\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\tverifyOtp(person: PersonRow, token: string): boolean {\n\t\tif (!person.otp_uri) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\treturn this.otpAuthenticator.validate({ uri: person.otp_uri }, token)\n\t}\n}\n\nexport class OtpError extends Error {\n}\n"],"names":[],"mappings":";;;;;;AAKO,MAAM,WAAW;AAAA,EACvB,YACkB,kBAChB;AADgB,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAChG,UAAM,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AAC9F,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,IAAI,IAAI,GAAG,CAAC;AAC5E,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,UAAU,QAAmB,OAAwB;AACpD,QAAI,CAAC,OAAO,SAAS;AACpB,YAAM,IAAI,SAAS,gBAAgB;AAAA,IACpC;AACA,WAAO,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,QAAA,GAAW,KAAK;AAAA,EACrE;AACD;AAEO,MAAM,iBAAiB,MAAM;AACpC;"}

package/dist/production/src/model/service/PasswordChangeManager.cjs

@@ -5,23 +5,32 @@ require("@contember/database");
 require("node:crypto");
 const Response = require("../utils/Response.cjs");
 const ChangePasswordCommand = require("../commands/person/ChangePasswordCommand.cjs");
-const password = require("../utils/password.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
 class PasswordChangeManager {
-  constructor(providers) {
+  constructor(providers, passwordStrengthVerifier) {
     this.providers = providers;
+    this.passwordStrengthVerifier = passwordStrengthVerifier;
   }
-  async changePassword(dbContext, personId, password$1) {
-    const weakPassword = password.getPasswordWeaknessMessage(password$1);
-    if (weakPassword) {
-      return new Response.ResponseError("TOO_WEAK", weakPassword);
+  async changePassword(dbContext, person, password) {
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
+    if (!passwordVerifyResult.ok) {
+      return passwordVerifyResult;
     }
-    await dbContext.commandBus.execute(new ChangePasswordCommand.ChangePasswordCommand(personId, password$1));
+    await dbContext.commandBus.execute(new ChangePasswordCommand.ChangePasswordCommand(person.id, password));
     return new Response.ResponseOk(null);
   }
-  async changeMyPassword(dbContext, person, currentPassword, password$1) {
-    const weakPassword = password.getPasswordWeaknessMessage(password$1);
-    if (weakPassword) {
-      return new Response.ResponseError("TOO_WEAK", weakPassword);
+  async changeMyPassword(dbContext, person, currentPassword, password) {
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
+    if (!passwordVerifyResult.ok) {
+      return passwordVerifyResult;
     }
     if (!person.password_hash) {
       return new Response.ResponseError("NO_PASSWORD_SET", "No password set");
@@ -29,7 +38,7 @@ class PasswordChangeManager {
     if (!await this.providers.bcryptCompare(currentPassword, person.password_hash)) {
       return new Response.ResponseError("INVALID_PASSWORD", "Password does not match");
     }
-    await dbContext.commandBus.execute(new ChangePasswordCommand.ChangePasswordCommand(person.id, password$1));
+    await dbContext.commandBus.execute(new ChangePasswordCommand.ChangePasswordCommand(person.id, password));
     return new Response.ResponseOk(null);
   }
 }

package/dist/production/src/model/service/PasswordChangeManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tasync changePassword(dbContext: DatabaseContext, personId: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(personId, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T>\n}\n\nexport { PasswordChangeManager }\n"],"names":["password","getPasswordWeaknessMessage","ResponseError","ChangePasswordCommand","ResponseOk"],"mappings":";;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,eAAe,WAA4B,UAAkBA,YAAkG;AAC9J,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAAA,cAAc,YAAY,YAAY;AAAA,IAAA;AAElD,UAAM,UAAU,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,UAAUH,UAAQ,CAAC;AACzE,WAAA,IAAII,oBAAW,IAAI;AAAA,EAAA;AAAA,EAG3B,MAAM,iBAAiB,WAA4B,QAAmB,iBAAyBJ,YAAoG;AAC5L,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAAA,cAAc,YAAY,YAAY;AAAA,IAAA;AAE9C,QAAA,CAAC,OAAO,eAAe;AACnB,aAAA,IAAIA,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,IAAA;AAE1D,QAAA,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AAC1E,aAAA,IAAIA,SAAAA,cAAc,oBAAoB,yBAAyB;AAAA,IAAA;AAGjE,UAAA,UAAU,WAAW,QAAQ,IAAIC,4CAAsB,OAAO,IAAIH,UAAQ,CAAC;AAC1E,WAAA,IAAII,oBAAW,IAAI;AAAA,EAAA;AAE5B;;"}
+{"version":3,"file":"PasswordChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tcurrentPassword: string,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":["ConfigurationQuery","ChangePasswordCommand","ResponseOk","ResponseError"],"mappings":";;;;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,WACA,QACA,UACiF;AACjF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,mBAAAA,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBACL,WACA,QACA,iBACA,UACmF;AACnF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIF,mBAAAA,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAIG,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,IAC9D;AACA,QAAI,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AACjF,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,yBAAyB;AAAA,IACvE;AAEA,UAAM,UAAU,WAAW,QAAQ,IAAIF,sBAAAA,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}

package/dist/production/src/model/service/PasswordChangeManager.js

@@ -1,25 +1,34 @@
 import "../type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
-import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { ResponseOk, ResponseError } from "../utils/Response.js";
 import { ChangePasswordCommand } from "../commands/person/ChangePasswordCommand.js";
-import { getPasswordWeaknessMessage } from "../utils/password.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
 class PasswordChangeManager {
-  constructor(providers) {
+  constructor(providers, passwordStrengthVerifier) {
     this.providers = providers;
+    this.passwordStrengthVerifier = passwordStrengthVerifier;
   }
-  async changePassword(dbContext, personId, password) {
-    const weakPassword = getPasswordWeaknessMessage(password);
-    if (weakPassword) {
-      return new ResponseError("TOO_WEAK", weakPassword);
+  async changePassword(dbContext, person, password) {
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+    const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
+    if (!passwordVerifyResult.ok) {
+      return passwordVerifyResult;
     }
-    await dbContext.commandBus.execute(new ChangePasswordCommand(personId, password));
+    await dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password));
     return new ResponseOk(null);
   }
   async changeMyPassword(dbContext, person, currentPassword, password) {
-    const weakPassword = getPasswordWeaknessMessage(password);
-    if (weakPassword) {
-      return new ResponseError("TOO_WEAK", weakPassword);
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+    const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
+    if (!passwordVerifyResult.ok) {
+      return passwordVerifyResult;
     }
     if (!person.password_hash) {
       return new ResponseError("NO_PASSWORD_SET", "No password set");

package/dist/production/src/model/service/PasswordChangeManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t) {}\n\n\tasync changePassword(dbContext: DatabaseContext, personId: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(personId, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(dbContext: DatabaseContext, person: PersonRow, currentPassword: string, password: string): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('TOO_WEAK', weakPassword)\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T>\n}\n\nexport { PasswordChangeManager }\n"],"names":[],"mappings":";;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAAA;AAAA,EAGlB,MAAM,eAAe,WAA4B,UAAkB,UAAkG;AAC9J,UAAA,eAAe,2BAA2B,QAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,YAAY,YAAY;AAAA,IAAA;AAElD,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,UAAU,QAAQ,CAAC;AACzE,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAAA,EAG3B,MAAM,iBAAiB,WAA4B,QAAmB,iBAAyB,UAAoG;AAC5L,UAAA,eAAe,2BAA2B,QAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAI,cAAc,YAAY,YAAY;AAAA,IAAA;AAE9C,QAAA,CAAC,OAAO,eAAe;AACnB,aAAA,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,IAAA;AAE1D,QAAA,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AAC1E,aAAA,IAAI,cAAc,oBAAoB,yBAAyB;AAAA,IAAA;AAGjE,UAAA,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAC1E,WAAA,IAAI,WAAW,IAAI;AAAA,EAAA;AAE5B;"}
+{"version":3,"file":"PasswordChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tcurrentPassword: string,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":[],"mappings":";;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,WACA,QACA,UACiF;AACjF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBACL,WACA,QACA,iBACA,UACmF;AACnF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,IAC9D;AACA,QAAI,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AACjF,aAAO,IAAI,cAAc,oBAAoB,yBAAyB;AAAA,IACvE;AAEA,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}

package/dist/production/src/model/service/PasswordResetManager.cjs

@@ -1,16 +1,25 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Response = require("../utils/Response.cjs");
-const password = require("../utils/password.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
+require("@contember/database");
 const exceptions = require("../../exceptions.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
 const getPreferredProject = require("./helpers/getPreferredProject.cjs");
-require("@contember/database");
 const CreatePersonTokenCommand = require("../commands/personToken/CreatePersonTokenCommand.cjs");
 const ResetPasswordCommand = require("../commands/personToken/ResetPasswordCommand.cjs");
+const PersonTokenQuery = require("../queries/personToken/PersonTokenQuery.cjs");
+const AuthLogService = require("./AuthLogService.cjs");
 class PasswordResetManager {
-  constructor(mailer, projectManager) {
+  constructor(mailer, projectManager, passwordStrengthValidator) {
     this.mailer = mailer;
     this.projectManager = projectManager;
+    this.passwordStrengthValidator = passwordStrengthValidator;
   }
   async createPasswordResetRequest(dbContext, permissionContext, person, mailOptions = {}) {
     const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.CreatePersonTokenCommand.createPasswordResetRequest(person.id));
@@ -33,12 +42,35 @@ class PasswordResetManager {
       }
     );
   }
-  async resetPassword(dbContext, token, password$1) {
-    const weakPassword = password.getPasswordWeaknessMessage(password$1);
-    if (weakPassword) {
-      return new Response.ResponseError("PASSWORD_TOO_WEAK", weakPassword);
+  async resetPassword(dbContext, token, password) {
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byToken(token, "password_reset"));
+    if (!tokenRow) {
+      return new Response.ResponseError("TOKEN_NOT_FOUND", "Token not found", {
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({})
+      });
+    }
+    const authLogData = new AuthLogService.AuthLogService.Bag({
+      personId: tokenRow.person_id,
+      tokenId: tokenRow.id
+    });
+    const weakPassword = await this.passwordStrengthValidator.verify(password, config.password, "PASSWORD_TOO_WEAK");
+    if (!weakPassword.ok) {
+      return new Response.ResponseError(weakPassword.error, weakPassword.errorMessage, {
+        ...weakPassword.metadata ?? {},
+        [AuthLogService.AuthLogService.Key]: authLogData
+      });
+    }
+    const resetPasswordResult = await dbContext.commandBus.execute(new ResetPasswordCommand.ResetPasswordCommand(token, password));
+    if (!resetPasswordResult.ok) {
+      return new Response.ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {
+        ...resetPasswordResult.metadata ?? {},
+        [AuthLogService.AuthLogService.Key]: authLogData
+      });
     }
-    return await dbContext.commandBus.execute(new ResetPasswordCommand.ResetPasswordCommand(token, password$1));
+    return new Response.ResponseOk({
+      [AuthLogService.AuthLogService.Key]: authLogData
+    });
   }
 }
 exports.PasswordResetManager = PasswordResetManager;

package/dist/production/src/model/service/PasswordResetManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError } from '../utils/Response'\nimport { getPasswordWeaknessMessage } from '../utils/password'\nimport { UserMailer } from '../mailing'\nimport { PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { CreatePersonTokenCommand, ResetPasswordCommand, ResetPasswordCommandErrorCode } from '../commands/personToken'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) { }\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst weakPassword = getPasswordWeaknessMessage(password)\n\t\tif (weakPassword) {\n\t\t\treturn new ResponseError('PASSWORD_TOO_WEAK', weakPassword)\n\t\t}\n\t\treturn await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t}\n}\n\nexport type ResetPasswordErrorCode = 'PASSWORD_TOO_WEAK'\n\nexport type ResetPasswordResponse = Response<null, ResetPasswordErrorCode | ResetPasswordCommandErrorCode>\n"],"names":["CreatePersonTokenCommand","getPreferredProject","ImplementationException","password","getPasswordWeaknessMessage","ResponseError","ResetPasswordCommand"],"mappings":";;;;;;;;;AAgBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EAAA;AAAA,EAGlB,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AACV,UAAA,SAAS,MAAM,UAAU,WAAW,QAAQA,yBAAAA,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAC1G,UAAA,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUC,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AACrE,QAAA,CAAC,OAAO,OAAO;AAClB,YAAM,IAAIC,WAAAA,wBAAwB;AAAA,IAAA;AAGnC,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MACvB;AAAA,MACA;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAE5B;AAAA,EAAA;AAAA,EAGD,MAAa,cAAc,WAA4B,OAAeC,YAAkD;AACjH,UAAA,eAAeC,oCAA2BD,UAAQ;AACxD,QAAI,cAAc;AACV,aAAA,IAAIE,SAAAA,cAAc,qBAAqB,YAAY;AAAA,IAAA;AAEpD,WAAA,MAAM,UAAU,WAAW,QAAQ,IAAIC,0CAAqB,OAAOH,UAAQ,CAAC;AAAA,EAAA;AAErF;;"}
+{"version":3,"file":"PasswordResetManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordResetManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { UserMailer } from '../mailing'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { PermissionContext } from '../authorization'\nimport { ProjectManager } from './ProjectManager'\nimport { DatabaseContext } from '../utils'\nimport { ImplementationException } from '../../exceptions'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { CreatePersonTokenCommand, ResetPasswordCommand } from '../commands/personToken'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\nimport { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { AuthLogService } from './AuthLogService'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class PasswordResetManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {}\n\n\tpublic async createPasswordResetRequest(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<void> {\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createPasswordResetRequest(person.id))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tawait this.mailer.sendPasswordResetEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t}\n\n\tpublic async resetPassword(dbContext: DatabaseContext, token: string, password: string): Promise<ResetPasswordResponse> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'password_reset'))\n\t\tif (!tokenRow) {\n\t\t\treturn new ResponseError('TOKEN_NOT_FOUND', 'Token not found', {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: tokenRow.person_id,\n\t\t\ttokenId: tokenRow.id,\n\t\t})\n\t\tconst weakPassword = await this.passwordStrengthValidator.verify(password, config.password, 'PASSWORD_TOO_WEAK')\n\t\tif (!weakPassword.ok) {\n\t\t\treturn new ResponseError(weakPassword.error, weakPassword.errorMessage, {\n\t\t\t\t...weakPassword.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\tconst resetPasswordResult = await dbContext.commandBus.execute(new ResetPasswordCommand(token, password))\n\t\tif (!resetPasswordResult.ok) {\n\t\t\treturn new ResponseError(resetPasswordResult.error, resetPasswordResult.errorMessage, {\n\t\t\t\t...resetPasswordResult.metadata ?? {},\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn new ResponseOk({\n\t\t\t[AuthLogService.Key]: authLogData,\n\t\t})\n\t}\n}\n\nexport type ResetPasswordResponse = Response<\n\t{\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t},\n\tResetPasswordErrorCode,\n\t{\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n>\n"],"names":["CreatePersonTokenCommand","getPreferredProject","ImplementationException","ConfigurationQuery","PersonTokenQuery","ResponseError","AuthLogService","ResetPasswordCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;AAmBO,MAAM,qBAAqB;AAAA,EACjC,YACkB,QACA,gBACA,2BAChB;AAHgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EACf;AAAA,EAEH,MAAa,2BACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACX;AAChB,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQA,yBAAAA,yBAAyB,2BAA2B,OAAO,EAAE,CAAC;AAChH,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUC,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AACzE,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,IAAIC,WAAAA,wBAAA;AAAA,IACX;AAEA,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA;AAAA,MAEvB;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAC3B;AAAA,EAEF;AAAA,EAEA,MAAa,cAAc,WAA4B,OAAe,UAAkD;AACvH,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIC,mBAAAA,oBAAoB;AAC1E,UAAM,WAAW,MAAM,UAAU,aAAa,MAAMC,iBAAAA,iBAAiB,QAAQ,OAAO,gBAAgB,CAAC;AACrG,QAAI,CAAC,UAAU;AACd,aAAO,IAAIC,SAAAA,cAAc,mBAAmB,mBAAmB;AAAA,QAC9D,CAACC,eAAAA,eAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI,CAAA,CAAE;AAAA,MAAA,CAC/C;AAAA,IACF;AAEA,UAAM,cAAc,IAAIA,eAAAA,eAAe,IAAI;AAAA,MAC1C,UAAU,SAAS;AAAA,MACnB,SAAS,SAAS;AAAA,IAAA,CAClB;AACD,UAAM,eAAe,MAAM,KAAK,0BAA0B,OAAO,UAAU,OAAO,UAAU,mBAAmB;AAC/G,QAAI,CAAC,aAAa,IAAI;AACrB,aAAO,IAAID,SAAAA,cAAc,aAAa,OAAO,aAAa,cAAc;AAAA,QACvE,GAAG,aAAa,YAAY,CAAA;AAAA,QAC5B,CAACC,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,UAAM,sBAAsB,MAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,OAAO,QAAQ,CAAC;AACxG,QAAI,CAAC,oBAAoB,IAAI;AAC5B,aAAO,IAAIF,SAAAA,cAAc,oBAAoB,OAAO,oBAAoB,cAAc;AAAA,QACrF,GAAG,oBAAoB,YAAY,CAAA;AAAA,QACnC,CAACC,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,WAAO,IAAIE,SAAAA,WAAW;AAAA,MACrB,CAACF,eAAAA,eAAe,GAAG,GAAG;AAAA,IAAA,CACtB;AAAA,EACF;AACD;;"}