@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/development/src/model/commands/apiKey/ApiKeyHelper.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyHelper.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type'\nimport { Providers } from '../../providers'\nimport { plusMinutes } from '../../utils/time'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n}\n"],"names":["ApiKey","plusMinutes"],"mappings":";;;;AAIA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA,EACzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAOC,KAAAA,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAKD,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AACD;;"}
+{"version":3,"file":"ApiKeyHelper.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type/index.js'\nimport { Providers } from '../../providers.js'\nimport { plusMinutes } from '../../utils/time.js'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n}\n"],"names":["ApiKey","plusMinutes"],"mappings":";;;;AAIA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA,EACzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAOC,KAAAA,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAKD,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AACD;;"}

package/dist/development/src/model/commands/apiKey/ApiKeyHelper.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyHelper.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type'\nimport { Providers } from '../../providers'\nimport { plusMinutes } from '../../utils/time'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAIA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA,EACzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAK,OAAO,KAAK;AAChB,eAAO,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AACD;"}
+{"version":3,"file":"ApiKeyHelper.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type/index.js'\nimport { Providers } from '../../providers.js'\nimport { plusMinutes } from '../../utils/time.js'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAIA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA,EACzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAK,OAAO,KAAK;AAChB,eAAO,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AACD;"}

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.cjs

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ApiKey = require("../../type/ApiKey.cjs");
 const ApiKeyHelper = require("./ApiKeyHelper.cjs");
 const Database = require("@contember/database");
-require("../../type/ApiKey.cjs");
 const token = require("../../utils/token.cjs");
 class CreateApiKeyCommand {
   constructor(args) {
@@ -16,6 +16,12 @@ class CreateApiKeyCommand {
       token$1 = await token.generateToken(providers);
       tokenHash = token.computeTokenHash(token$1);
     }
+    const args = this.args;
+    const sessionPolicy = args.type === ApiKey.ApiKey.Type.SESSION ? {
+      issued_at: providers.now(),
+      idle_timeout: args.idleTimeout ?? null,
+      max_expires_at: args.maxExpiresAt ?? null
+    } : { issued_at: null, idle_timeout: null, max_expires_at: null };
     await Database.InsertBuilder.create().into("api_key").values({
       id: apiKeyId,
       token_hash: tokenHash,
@@ -24,7 +30,13 @@ class CreateApiKeyCommand {
       disabled_at: null,
       expires_at: ApiKeyHelper.ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),
       expiration: this.args.expiration || null,
-      created_at: providers.now()
+      created_at: providers.now(),
+      created_ip: this.args.requestInfo?.ip || null,
+      created_user_agent: this.args.requestInfo?.userAgent || null,
+      trust_forwarded_info: this.args.trustForwardedInfo ?? false,
+      issued_at: sessionPolicy.issued_at,
+      idle_timeout: sessionPolicy.idle_timeout,
+      max_expires_at: sessionPolicy.max_expires_at
     }).execute(db);
     return new CreateApiKeyCommandResult(apiKeyId, token$1);
   }

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["token","generateToken","computeTokenHash","InsertBuilder","ApiKeyHelper"],"mappings":";;;;;;AAwBO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAIA;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACfA,gBAAQ,MAAMC,MAAAA,cAAc,SAAS;AACrC,kBAAYC,MAAAA,iBAAiBF,OAAK;AAAA,IACnC;AAEA,UAAMG,SAAAA,cAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAYC,aAAAA,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAUJ,OAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4BA,QAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAAA;AAAA,EACxD;AACD;;;"}
+{"version":3,"file":"CreateApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from './ProlongApiKeyCommand.js'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n\t/**\n\t * A19 session-policy snapshot, fixed at sign-in. NULLs preserve today's\n\t * behavior (no idle timeout, no absolute cap on the sliding window).\n\t * `idleTimeout` is a Postgres interval literal (e.g. `'15 minutes'`).\n\t */\n\tidleTimeout?: string | null\n\tmaxExpiresAt?: Date | null\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\t// Session-policy snapshot (A19). Only session keys carry it; permanent/one-off\n\t\t// keys have no session policy → NULL (preserving today's behavior).\n\t\tconst args = this.args\n\t\tconst sessionPolicy = args.type === ApiKey.Type.SESSION\n\t\t\t? {\n\t\t\t\tissued_at: providers.now(),\n\t\t\t\tidle_timeout: args.idleTimeout ?? null,\n\t\t\t\tmax_expires_at: args.maxExpiresAt ?? null,\n\t\t\t}\n\t\t\t: { issued_at: null, idle_timeout: null, max_expires_at: null }\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tcreated_ip: this.args.requestInfo?.ip || null,\n\t\t\t\tcreated_user_agent: this.args.requestInfo?.userAgent || null,\n\t\t\t\ttrust_forwarded_info: this.args.trustForwardedInfo ?? false,\n\t\t\t\tissued_at: sessionPolicy.issued_at,\n\t\t\t\tidle_timeout: sessionPolicy.idle_timeout,\n\t\t\t\tmax_expires_at: sessionPolicy.max_expires_at,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["token","generateToken","computeTokenHash","ApiKey","InsertBuilder","ApiKeyHelper"],"mappings":";;;;;;AAoCO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAIA;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACfA,gBAAQ,MAAMC,MAAAA,cAAc,SAAS;AACrC,kBAAYC,MAAAA,iBAAiBF,OAAK;AAAA,IACnC;AAIA,UAAM,OAAO,KAAK;AAClB,UAAM,gBAAgB,KAAK,SAASG,OAAAA,OAAO,KAAK,UAC7C;AAAA,MACD,WAAW,UAAU,IAAA;AAAA,MACrB,cAAc,KAAK,eAAe;AAAA,MAClC,gBAAgB,KAAK,gBAAgB;AAAA,IAAA,IAEpC,EAAE,WAAW,MAAM,cAAc,MAAM,gBAAgB,KAAA;AAC1D,UAAMC,SAAAA,cAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAYC,aAAAA,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,KAAK,KAAK,aAAa,MAAM;AAAA,MACzC,oBAAoB,KAAK,KAAK,aAAa,aAAa;AAAA,MACxD,sBAAsB,KAAK,KAAK,sBAAsB;AAAA,MACtD,WAAW,cAAc;AAAA,MACzB,cAAc,cAAc;AAAA,MAC5B,gBAAgB,cAAc;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAUL,OAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4BA,QAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAAA;AAAA,EACxD;AACD;;;"}

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.js

@@ -1,6 +1,6 @@
+import { ApiKey } from "../../type/ApiKey.js";
 import { ApiKeyHelper } from "./ApiKeyHelper.js";
 import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
-import "../../type/ApiKey.js";
 import { generateToken, computeTokenHash } from "../../utils/token.js";
 class CreateApiKeyCommand {
   constructor(args) {
@@ -14,6 +14,12 @@ class CreateApiKeyCommand {
       token = await generateToken(providers);
       tokenHash = computeTokenHash(token);
     }
+    const args = this.args;
+    const sessionPolicy = args.type === ApiKey.Type.SESSION ? {
+      issued_at: providers.now(),
+      idle_timeout: args.idleTimeout ?? null,
+      max_expires_at: args.maxExpiresAt ?? null
+    } : { issued_at: null, idle_timeout: null, max_expires_at: null };
     await InsertBuilder$1.create().into("api_key").values({
       id: apiKeyId,
       token_hash: tokenHash,
@@ -22,7 +28,13 @@ class CreateApiKeyCommand {
       disabled_at: null,
       expires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),
       expiration: this.args.expiration || null,
-      created_at: providers.now()
+      created_at: providers.now(),
+      created_ip: this.args.requestInfo?.ip || null,
+      created_user_agent: this.args.requestInfo?.userAgent || null,
+      trust_forwarded_info: this.args.trustForwardedInfo ?? false,
+      issued_at: sessionPolicy.issued_at,
+      idle_timeout: sessionPolicy.idle_timeout,
+      max_expires_at: sessionPolicy.max_expires_at
     }).execute(db);
     return new CreateApiKeyCommandResult(apiKeyId, token);
   }

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;;AAwBO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAI;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACf,cAAQ,MAAM,cAAc,SAAS;AACrC,kBAAY,iBAAiB,KAAK;AAAA,IACnC;AAEA,UAAMA,gBAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAY,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAU,KAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4B,OAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAA;AAAA,EACxD;AACD;"}
+{"version":3,"file":"CreateApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from './ProlongApiKeyCommand.js'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n\t/**\n\t * A19 session-policy snapshot, fixed at sign-in. NULLs preserve today's\n\t * behavior (no idle timeout, no absolute cap on the sliding window).\n\t * `idleTimeout` is a Postgres interval literal (e.g. `'15 minutes'`).\n\t */\n\tidleTimeout?: string | null\n\tmaxExpiresAt?: Date | null\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\t// Session-policy snapshot (A19). Only session keys carry it; permanent/one-off\n\t\t// keys have no session policy → NULL (preserving today's behavior).\n\t\tconst args = this.args\n\t\tconst sessionPolicy = args.type === ApiKey.Type.SESSION\n\t\t\t? {\n\t\t\t\tissued_at: providers.now(),\n\t\t\t\tidle_timeout: args.idleTimeout ?? null,\n\t\t\t\tmax_expires_at: args.maxExpiresAt ?? null,\n\t\t\t}\n\t\t\t: { issued_at: null, idle_timeout: null, max_expires_at: null }\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tcreated_ip: this.args.requestInfo?.ip || null,\n\t\t\t\tcreated_user_agent: this.args.requestInfo?.userAgent || null,\n\t\t\t\ttrust_forwarded_info: this.args.trustForwardedInfo ?? false,\n\t\t\t\tissued_at: sessionPolicy.issued_at,\n\t\t\t\tidle_timeout: sessionPolicy.idle_timeout,\n\t\t\t\tmax_expires_at: sessionPolicy.max_expires_at,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;;AAoCO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAI;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACf,cAAQ,MAAM,cAAc,SAAS;AACrC,kBAAY,iBAAiB,KAAK;AAAA,IACnC;AAIA,UAAM,OAAO,KAAK;AAClB,UAAM,gBAAgB,KAAK,SAAS,OAAO,KAAK,UAC7C;AAAA,MACD,WAAW,UAAU,IAAA;AAAA,MACrB,cAAc,KAAK,eAAe;AAAA,MAClC,gBAAgB,KAAK,gBAAgB;AAAA,IAAA,IAEpC,EAAE,WAAW,MAAM,cAAc,MAAM,gBAAgB,KAAA;AAC1D,UAAMA,gBAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAY,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,KAAK,KAAK,aAAa,MAAM;AAAA,MACzC,oBAAoB,KAAK,KAAK,aAAa,aAAa;AAAA,MACxD,sBAAsB,KAAK,KAAK,sBAAsB;AAAA,MACtD,WAAW,cAAc;AAAA,MACzB,cAAc,cAAc;AAAA,MAC5B,gBAAgB,cAAc;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAU,KAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4B,OAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAA;AAAA,EACxD;AACD;"}

package/dist/development/src/model/commands/apiKey/DisableApiKeyCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisableApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableApiKeyCommand implements Command<boolean> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,qBAAiD;AAAA,EAC7D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;;"}
+{"version":3,"file":"DisableApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableApiKeyCommand implements Command<boolean> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,qBAAiD;AAAA,EAC7D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;;"}

package/dist/development/src/model/commands/apiKey/DisableApiKeyCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisableApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableApiKeyCommand implements Command<boolean> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,qBAAiD;AAAA,EAC7D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;"}
+{"version":3,"file":"DisableApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableApiKeyCommand implements Command<boolean> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,qBAAiD;AAAA,EAC7D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;"}

package/dist/development/src/model/commands/apiKey/DisableIdentityApiKeysCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisableIdentityApiKeysCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableIdentityApiKeysCommand implements Command<void> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,8BAAuD;AAAA,EACnE,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}
+{"version":3,"file":"DisableIdentityApiKeysCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableIdentityApiKeysCommand implements Command<void> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,8BAAuD;AAAA,EACnE,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}

package/dist/development/src/model/commands/apiKey/DisableIdentityApiKeysCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisableIdentityApiKeysCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableIdentityApiKeysCommand implements Command<void> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,8BAAuD;AAAA,EACnE,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}
+{"version":3,"file":"DisableIdentityApiKeysCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableIdentityApiKeysCommand implements Command<void> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,8BAAuD;AAAA,EACnE,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}

package/dist/development/src/model/commands/apiKey/DisableOneOffApiKeyCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisableOneOffApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableOneOffApiKeyCommand implements Command<void> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t\ttype: ApiKey.Type.ONE_OFF,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder","ApiKey"],"mappings":";;;;AAIO,MAAM,2BAAoD;AAAA,EAChE,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,MACT,MAAMC,OAAAA,OAAO,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}
+{"version":3,"file":"DisableOneOffApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableOneOffApiKeyCommand implements Command<void> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t\ttype: ApiKey.Type.ONE_OFF,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder","ApiKey"],"mappings":";;;;AAIO,MAAM,2BAAoD;AAAA,EAChE,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,MACT,MAAMC,OAAAA,OAAO,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}

package/dist/development/src/model/commands/apiKey/DisableOneOffApiKeyCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisableOneOffApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableOneOffApiKeyCommand implements Command<void> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t\ttype: ApiKey.Type.ONE_OFF,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAIO,MAAM,2BAAoD;AAAA,EAChE,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,MACT,MAAM,OAAO,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}
+{"version":3,"file":"DisableOneOffApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableOneOffApiKeyCommand implements Command<void> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t\ttype: ApiKey.Type.ONE_OFF,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAIO,MAAM,2BAAoD;AAAA,EAChE,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,MACT,MAAM,OAAO,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.cjs

@@ -4,28 +4,60 @@ const ApiKeyHelper = require("./ApiKeyHelper.cjs");
 const Database = require("@contember/database");
 const PROLONG_THROTTLE_MS = 6e4;
 class ProlongApiKeyCommand {
-  constructor(id, type, expiration, currentExpiration) {
+  constructor(id, type, expiration, currentExpiration, requestInfo, tracking, maxExpiresAt) {
     this.id = id;
     this.type = type;
     this.expiration = expiration;
     this.currentExpiration = currentExpiration;
+    this.requestInfo = requestInfo;
+    this.tracking = tracking;
+    this.maxExpiresAt = maxExpiresAt;
   }
   async execute({ db, providers }) {
-    const newExpiration = ApiKeyHelper.ApiKeyHelper.getExpiration(providers, this.type, this.expiration);
-    if (newExpiration === null) {
-      return;
+    let newExpiration = ApiKeyHelper.ApiKeyHelper.getExpiration(providers, this.type, this.expiration);
+    if (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {
+      newExpiration = this.maxExpiresAt;
     }
-    if (this.currentExpiration) {
+    const now = providers.now();
+    let updateExpiration = newExpiration !== null;
+    if (updateExpiration && this.currentExpiration && newExpiration !== null) {
       const prolongMs = newExpiration.getTime() - this.currentExpiration.getTime();
       if (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {
-        return;
+        updateExpiration = false;
       }
     }
-    const qb = Database.UpdateBuilder.create().table("api_key").where({ id: this.id }).values({
-      expires_at: newExpiration
-    });
+    const requestIp = this.requestInfo?.ip || null;
+    const requestUserAgent = this.requestInfo?.userAgent || null;
+    const updateTracking = this.shouldUpdateTracking(now, requestIp, requestUserAgent);
+    if (!updateExpiration && !updateTracking) {
+      return;
+    }
+    const values = {};
+    if (updateExpiration && newExpiration !== null) {
+      values.expires_at = newExpiration;
+    }
+    if (updateTracking) {
+      values.last_ip = requestIp;
+      values.last_user_agent = requestUserAgent;
+      values.last_used_at = now;
+    }
+    const qb = Database.UpdateBuilder.create().table("api_key").where({ id: this.id }).values(values);
     await qb.execute(db);
   }
+  shouldUpdateTracking(now, requestIp, requestUserAgent) {
+    if (!this.requestInfo) {
+      return false;
+    }
+    const last = this.tracking;
+    if (!last || last.lastUsedAt === null) {
+      return true;
+    }
+    if (requestIp !== last.lastIp || requestUserAgent !== last.lastUserAgent) {
+      return true;
+    }
+    return now.getTime() - last.lastUsedAt.getTime() >= PROLONG_THROTTLE_MS;
+  }
 }
+exports.PROLONG_THROTTLE_MS = PROLONG_THROTTLE_MS;
 exports.ProlongApiKeyCommand = ProlongApiKeyCommand;
 //# sourceMappingURL=ProlongApiKeyCommand.cjs.map

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProlongApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { UpdateBuilder } from '@contember/database'\n\nconst PROLONG_THROTTLE_MS = 60_000\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\tif (newExpiration === null) {\n\t\t\treturn\n\t\t}\n\n\t\tif (this.currentExpiration) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\texpires_at: newExpiration,\n\t\t\t})\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["ApiKeyHelper","UpdateBuilder"],"mappings":";;;;AAKA,MAAM,sBAAsB;AAErB,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBAChB;AAJgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,gBAAgBA,aAAAA,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AACtF,QAAI,kBAAkB,MAAM;AAC3B;AAAA,IACD;AAEA,QAAI,KAAK,mBAAmB;AAC3B,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD;AAAA,MACD;AAAA,IACD;AAEA,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,YAAY;AAAA,IAAA,CACZ;AACF,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}
+{"version":3,"file":"ProlongApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { QueryBuilder, UpdateBuilder } from '@contember/database'\n\n/**\n * Tracking writes (`last_used_at`) are throttled to at most once per this window, so\n * an idle check must add this slack to avoid prematurely expiring an active session\n * whose `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).\n */\nexport const PROLONG_THROTTLE_MS = 60_000\n\nexport interface ApiKeyRequestInfo {\n\tip?: string\n\tuserAgent?: string\n}\n\nexport interface ApiKeyTrackingState {\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tlastUsedAt: Date | null\n}\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t\tprivate readonly requestInfo?: ApiKeyRequestInfo,\n\t\tprivate readonly tracking?: ApiKeyTrackingState,\n\t\tprivate readonly maxExpiresAt?: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tlet newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\t// A19: clamp the sliding window at the absolute cap snapshotted at sign-in.\n\t\t// NULL maxExpiresAt = today's uncapped sliding window.\n\t\tif (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {\n\t\t\tnewExpiration = this.maxExpiresAt\n\t\t}\n\t\tconst now = providers.now()\n\n\t\tlet updateExpiration = newExpiration !== null\n\t\tif (updateExpiration && this.currentExpiration && newExpiration !== null) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\tupdateExpiration = false\n\t\t\t}\n\t\t}\n\n\t\tconst requestIp = this.requestInfo?.ip || null\n\t\tconst requestUserAgent = this.requestInfo?.userAgent || null\n\t\tconst updateTracking = this.shouldUpdateTracking(now, requestIp, requestUserAgent)\n\n\t\tif (!updateExpiration && !updateTracking) {\n\t\t\treturn\n\t\t}\n\n\t\tconst values: QueryBuilder.Values = {}\n\t\tif (updateExpiration && newExpiration !== null) {\n\t\t\tvalues.expires_at = newExpiration\n\t\t}\n\t\tif (updateTracking) {\n\t\t\tvalues.last_ip = requestIp\n\t\t\tvalues.last_user_agent = requestUserAgent\n\t\t\tvalues.last_used_at = now\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values(values)\n\t\tawait qb.execute(db)\n\t}\n\n\tprivate shouldUpdateTracking(now: Date, requestIp: string | null, requestUserAgent: string | null): boolean {\n\t\tif (!this.requestInfo) {\n\t\t\treturn false\n\t\t}\n\t\tconst last = this.tracking\n\t\tif (!last || last.lastUsedAt === null) {\n\t\t\treturn true\n\t\t}\n\t\tif (requestIp !== last.lastIp || requestUserAgent !== last.lastUserAgent) {\n\t\t\treturn true\n\t\t}\n\t\treturn now.getTime() - last.lastUsedAt.getTime() >= PROLONG_THROTTLE_MS\n\t}\n}\n"],"names":["ApiKeyHelper","UpdateBuilder"],"mappings":";;;;AAUO,MAAM,sBAAsB;AAa5B,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBACA,aACA,UACA,cAChB;AAPgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,cAAA;AACA,SAAA,WAAA;AACA,SAAA,eAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,QAAI,gBAAgBA,aAAAA,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AAGpF,QAAI,kBAAkB,QAAQ,KAAK,gBAAgB,cAAc,YAAY,KAAK,aAAa,WAAW;AACzG,sBAAgB,KAAK;AAAA,IACtB;AACA,UAAM,MAAM,UAAU,IAAA;AAEtB,QAAI,mBAAmB,kBAAkB;AACzC,QAAI,oBAAoB,KAAK,qBAAqB,kBAAkB,MAAM;AACzE,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD,2BAAmB;AAAA,MACpB;AAAA,IACD;AAEA,UAAM,YAAY,KAAK,aAAa,MAAM;AAC1C,UAAM,mBAAmB,KAAK,aAAa,aAAa;AACxD,UAAM,iBAAiB,KAAK,qBAAqB,KAAK,WAAW,gBAAgB;AAEjF,QAAI,CAAC,oBAAoB,CAAC,gBAAgB;AACzC;AAAA,IACD;AAEA,UAAM,SAA8B,CAAA;AACpC,QAAI,oBAAoB,kBAAkB,MAAM;AAC/C,aAAO,aAAa;AAAA,IACrB;AACA,QAAI,gBAAgB;AACnB,aAAO,UAAU;AACjB,aAAO,kBAAkB;AACzB,aAAO,eAAe;AAAA,IACvB;AAEA,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO,MAAM;AACf,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AAAA,EAEQ,qBAAqB,KAAW,WAA0B,kBAA0C;AAC3G,QAAI,CAAC,KAAK,aAAa;AACtB,aAAO;AAAA,IACR;AACA,UAAM,OAAO,KAAK;AAClB,QAAI,CAAC,QAAQ,KAAK,eAAe,MAAM;AACtC,aAAO;AAAA,IACR;AACA,QAAI,cAAc,KAAK,UAAU,qBAAqB,KAAK,eAAe;AACzE,aAAO;AAAA,IACR;AACA,WAAO,IAAI,QAAA,IAAY,KAAK,WAAW,aAAa;AAAA,EACrD;AACD;;;"}

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.js

@@ -2,30 +2,62 @@ import { ApiKeyHelper } from "./ApiKeyHelper.js";
 import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
 const PROLONG_THROTTLE_MS = 6e4;
 class ProlongApiKeyCommand {
-  constructor(id, type, expiration, currentExpiration) {
+  constructor(id, type, expiration, currentExpiration, requestInfo, tracking, maxExpiresAt) {
     this.id = id;
     this.type = type;
     this.expiration = expiration;
     this.currentExpiration = currentExpiration;
+    this.requestInfo = requestInfo;
+    this.tracking = tracking;
+    this.maxExpiresAt = maxExpiresAt;
   }
   async execute({ db, providers }) {
-    const newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration);
-    if (newExpiration === null) {
-      return;
+    let newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration);
+    if (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {
+      newExpiration = this.maxExpiresAt;
     }
-    if (this.currentExpiration) {
+    const now = providers.now();
+    let updateExpiration = newExpiration !== null;
+    if (updateExpiration && this.currentExpiration && newExpiration !== null) {
       const prolongMs = newExpiration.getTime() - this.currentExpiration.getTime();
       if (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {
-        return;
+        updateExpiration = false;
       }
     }
-    const qb = UpdateBuilder$1.create().table("api_key").where({ id: this.id }).values({
-      expires_at: newExpiration
-    });
+    const requestIp = this.requestInfo?.ip || null;
+    const requestUserAgent = this.requestInfo?.userAgent || null;
+    const updateTracking = this.shouldUpdateTracking(now, requestIp, requestUserAgent);
+    if (!updateExpiration && !updateTracking) {
+      return;
+    }
+    const values = {};
+    if (updateExpiration && newExpiration !== null) {
+      values.expires_at = newExpiration;
+    }
+    if (updateTracking) {
+      values.last_ip = requestIp;
+      values.last_user_agent = requestUserAgent;
+      values.last_used_at = now;
+    }
+    const qb = UpdateBuilder$1.create().table("api_key").where({ id: this.id }).values(values);
     await qb.execute(db);
   }
+  shouldUpdateTracking(now, requestIp, requestUserAgent) {
+    if (!this.requestInfo) {
+      return false;
+    }
+    const last = this.tracking;
+    if (!last || last.lastUsedAt === null) {
+      return true;
+    }
+    if (requestIp !== last.lastIp || requestUserAgent !== last.lastUserAgent) {
+      return true;
+    }
+    return now.getTime() - last.lastUsedAt.getTime() >= PROLONG_THROTTLE_MS;
+  }
 }
 export {
+  PROLONG_THROTTLE_MS,
   ProlongApiKeyCommand
 };
 //# sourceMappingURL=ProlongApiKeyCommand.js.map

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProlongApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { UpdateBuilder } from '@contember/database'\n\nconst PROLONG_THROTTLE_MS = 60_000\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\tif (newExpiration === null) {\n\t\t\treturn\n\t\t}\n\n\t\tif (this.currentExpiration) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\texpires_at: newExpiration,\n\t\t\t})\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAKA,MAAM,sBAAsB;AAErB,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBAChB;AAJgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,gBAAgB,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AACtF,QAAI,kBAAkB,MAAM;AAC3B;AAAA,IACD;AAEA,QAAI,KAAK,mBAAmB;AAC3B,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD;AAAA,MACD;AAAA,IACD;AAEA,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,YAAY;AAAA,IAAA,CACZ;AACF,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}
+{"version":3,"file":"ProlongApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { QueryBuilder, UpdateBuilder } from '@contember/database'\n\n/**\n * Tracking writes (`last_used_at`) are throttled to at most once per this window, so\n * an idle check must add this slack to avoid prematurely expiring an active session\n * whose `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).\n */\nexport const PROLONG_THROTTLE_MS = 60_000\n\nexport interface ApiKeyRequestInfo {\n\tip?: string\n\tuserAgent?: string\n}\n\nexport interface ApiKeyTrackingState {\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tlastUsedAt: Date | null\n}\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t\tprivate readonly requestInfo?: ApiKeyRequestInfo,\n\t\tprivate readonly tracking?: ApiKeyTrackingState,\n\t\tprivate readonly maxExpiresAt?: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tlet newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\t// A19: clamp the sliding window at the absolute cap snapshotted at sign-in.\n\t\t// NULL maxExpiresAt = today's uncapped sliding window.\n\t\tif (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {\n\t\t\tnewExpiration = this.maxExpiresAt\n\t\t}\n\t\tconst now = providers.now()\n\n\t\tlet updateExpiration = newExpiration !== null\n\t\tif (updateExpiration && this.currentExpiration && newExpiration !== null) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\tupdateExpiration = false\n\t\t\t}\n\t\t}\n\n\t\tconst requestIp = this.requestInfo?.ip || null\n\t\tconst requestUserAgent = this.requestInfo?.userAgent || null\n\t\tconst updateTracking = this.shouldUpdateTracking(now, requestIp, requestUserAgent)\n\n\t\tif (!updateExpiration && !updateTracking) {\n\t\t\treturn\n\t\t}\n\n\t\tconst values: QueryBuilder.Values = {}\n\t\tif (updateExpiration && newExpiration !== null) {\n\t\t\tvalues.expires_at = newExpiration\n\t\t}\n\t\tif (updateTracking) {\n\t\t\tvalues.last_ip = requestIp\n\t\t\tvalues.last_user_agent = requestUserAgent\n\t\t\tvalues.last_used_at = now\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values(values)\n\t\tawait qb.execute(db)\n\t}\n\n\tprivate shouldUpdateTracking(now: Date, requestIp: string | null, requestUserAgent: string | null): boolean {\n\t\tif (!this.requestInfo) {\n\t\t\treturn false\n\t\t}\n\t\tconst last = this.tracking\n\t\tif (!last || last.lastUsedAt === null) {\n\t\t\treturn true\n\t\t}\n\t\tif (requestIp !== last.lastIp || requestUserAgent !== last.lastUserAgent) {\n\t\t\treturn true\n\t\t}\n\t\treturn now.getTime() - last.lastUsedAt.getTime() >= PROLONG_THROTTLE_MS\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAUO,MAAM,sBAAsB;AAa5B,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBACA,aACA,UACA,cAChB;AAPgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,cAAA;AACA,SAAA,WAAA;AACA,SAAA,eAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,QAAI,gBAAgB,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AAGpF,QAAI,kBAAkB,QAAQ,KAAK,gBAAgB,cAAc,YAAY,KAAK,aAAa,WAAW;AACzG,sBAAgB,KAAK;AAAA,IACtB;AACA,UAAM,MAAM,UAAU,IAAA;AAEtB,QAAI,mBAAmB,kBAAkB;AACzC,QAAI,oBAAoB,KAAK,qBAAqB,kBAAkB,MAAM;AACzE,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD,2BAAmB;AAAA,MACpB;AAAA,IACD;AAEA,UAAM,YAAY,KAAK,aAAa,MAAM;AAC1C,UAAM,mBAAmB,KAAK,aAAa,aAAa;AACxD,UAAM,iBAAiB,KAAK,qBAAqB,KAAK,WAAW,gBAAgB;AAEjF,QAAI,CAAC,oBAAoB,CAAC,gBAAgB;AACzC;AAAA,IACD;AAEA,UAAM,SAA8B,CAAA;AACpC,QAAI,oBAAoB,kBAAkB,MAAM;AAC/C,aAAO,aAAa;AAAA,IACrB;AACA,QAAI,gBAAgB;AACnB,aAAO,UAAU;AACjB,aAAO,kBAAkB;AACzB,aAAO,eAAe;AAAA,IACvB;AAEA,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO,MAAM;AACf,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AAAA,EAEQ,qBAAqB,KAAW,WAA0B,kBAA0C;AAC3G,QAAI,CAAC,KAAK,aAAa;AACtB,aAAO;AAAA,IACR;AACA,UAAM,OAAO,KAAK;AAClB,QAAI,CAAC,QAAQ,KAAK,eAAe,MAAM;AACtC,aAAO;AAAA,IACR;AACA,QAAI,cAAc,KAAK,UAAU,qBAAqB,KAAK,eAAe;AACzE,aAAO;AAAA,IACR;AACA,WAAO,IAAI,QAAA,IAAY,KAAK,WAAW,aAAa;AAAA,EACrD;AACD;"}

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.cjs

@@ -19,7 +19,11 @@ class CreateAuthLogEntryCommand {
       ip_address: this.data.ipAddress,
       user_agent: this.data.userAgent,
       identity_provider_id: this.data.identityProviderId,
-      metadata: this.data.metadata ?? {}
+      metadata: this.data.metadata ?? {},
+      target_person_id: this.data.targetPersonId,
+      event_data: this.data.eventData,
+      geo_country: this.data.geoCountry,
+      device_fingerprint: this.data.deviceFingerprint
     }).execute(db);
   }
 }

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateAuthLogEntryCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { AuthActionType } from '../../type/AuthLog'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\tinvokedById: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,IAAC,CACjC,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"CreateAuthLogEntryCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { AuthActionType } from '../../type/AuthLog.js'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t\ttarget_person_id: this.data.targetPersonId,\n\t\t\t\tevent_data: this.data.eventData,\n\t\t\t\tgeo_country: this.data.geoCountry,\n\t\t\t\tdevice_fingerprint: this.data.deviceFingerprint,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\t/** The identity that initiated the action. Omit (→ NULL) when there is no acting identity, e.g. an IdP-initiated back-channel logout. */\n\t\tinvokedById?: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t\ttargetPersonId?: string\n\t\teventData?: JSONValue\n\t\t/** A03: country derived from the trusted reverse-proxy geo header, when present. */\n\t\tgeoCountry?: string\n\t\t/** A03: hash of the client user-agent (never the raw UA). */\n\t\tdeviceFingerprint?: string\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,MAChC,kBAAkB,KAAK,KAAK;AAAA,MAC5B,YAAY,KAAK,KAAK;AAAA,MACtB,aAAa,KAAK,KAAK;AAAA,MACvB,oBAAoB,KAAK,KAAK;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.js

@@ -17,7 +17,11 @@ class CreateAuthLogEntryCommand {
       ip_address: this.data.ipAddress,
       user_agent: this.data.userAgent,
       identity_provider_id: this.data.identityProviderId,
-      metadata: this.data.metadata ?? {}
+      metadata: this.data.metadata ?? {},
+      target_person_id: this.data.targetPersonId,
+      event_data: this.data.eventData,
+      geo_country: this.data.geoCountry,
+      device_fingerprint: this.data.deviceFingerprint
     }).execute(db);
   }
 }

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateAuthLogEntryCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { AuthActionType } from '../../type/AuthLog'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\tinvokedById: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,IAAC,CACjC,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"CreateAuthLogEntryCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { AuthActionType } from '../../type/AuthLog.js'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t\ttarget_person_id: this.data.targetPersonId,\n\t\t\t\tevent_data: this.data.eventData,\n\t\t\t\tgeo_country: this.data.geoCountry,\n\t\t\t\tdevice_fingerprint: this.data.deviceFingerprint,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\t/** The identity that initiated the action. Omit (→ NULL) when there is no acting identity, e.g. an IdP-initiated back-channel logout. */\n\t\tinvokedById?: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t\ttargetPersonId?: string\n\t\teventData?: JSONValue\n\t\t/** A03: country derived from the trusted reverse-proxy geo header, when present. */\n\t\tgeoCountry?: string\n\t\t/** A03: hash of the client user-agent (never the raw UA). */\n\t\tdeviceFingerprint?: string\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,MAChC,kBAAkB,KAAK,KAAK;AAAA,MAC5B,YAAY,KAAK,KAAK;AAAA,MACtB,aAAa,KAAK,KAAK;AAAA,MACvB,oBAAoB,KAAK,KAAK;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/authPolicy/CreateAuthPolicyCommand.cjs

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class CreateAuthPolicyCommand {
+  constructor(values) {
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const now = providers.now();
+    await Database.InsertBuilder.create().into("auth_policy").values({
+      id,
+      scope: this.values.scope,
+      project_id: this.values.projectId,
+      roles: this.values.roles,
+      mfa_required: this.values.mfaRequired,
+      token_expiration: this.values.tokenExpiration,
+      idle_timeout: this.values.idleTimeout,
+      grace_duration: this.values.graceDuration,
+      remember_me_allowed: this.values.rememberMeAllowed,
+      created_at: now,
+      updated_at: now
+    }).execute(db);
+    return id;
+  }
+}
+exports.CreateAuthPolicyCommand = CreateAuthPolicyCommand;
+//# sourceMappingURL=CreateAuthPolicyCommand.cjs.map

package/dist/development/src/model/commands/authPolicy/CreateAuthPolicyCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateAuthPolicyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/CreateAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { AuthPolicyScope } from '../../type/index.js'\n\nexport type AuthPolicyWriteValues = {\n\tscope: AuthPolicyScope\n\tprojectId: string | null\n\troles: string[]\n\tmfaRequired: boolean | null\n\ttokenExpiration: string | null\n\tidleTimeout: string | null\n\tgraceDuration: string | null\n\trememberMeAllowed: boolean | null\n}\n\n/** Inserts a new `auth_policy` row. Returns the generated id. */\nexport class CreateAuthPolicyCommand implements Command<string> {\n\tconstructor(private readonly values: AuthPolicyWriteValues) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst id = providers.uuid()\n\t\tconst now = providers.now()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('auth_policy')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tscope: this.values.scope,\n\t\t\t\tproject_id: this.values.projectId,\n\t\t\t\troles: this.values.roles,\n\t\t\t\tmfa_required: this.values.mfaRequired,\n\t\t\t\ttoken_expiration: this.values.tokenExpiration,\n\t\t\t\tidle_timeout: this.values.idleTimeout,\n\t\t\t\tgrace_duration: this.values.graceDuration,\n\t\t\t\tremember_me_allowed: this.values.rememberMeAllowed,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn id\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAgBO,MAAM,wBAAmD;AAAA,EAC/D,YAA6B,QAA+B;AAA/B,SAAA,SAAA;AAAA,EAAgC;AAAA,EAE7D,MAAM,QAAQ,EAAE,IAAI,aAA4C;AAC/D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,MAAM,UAAU,IAAA;AACtB,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,OAAO,KAAK,OAAO;AAAA,MACnB,YAAY,KAAK,OAAO;AAAA,MACxB,OAAO,KAAK,OAAO;AAAA,MACnB,cAAc,KAAK,OAAO;AAAA,MAC1B,kBAAkB,KAAK,OAAO;AAAA,MAC9B,cAAc,KAAK,OAAO;AAAA,MAC1B,gBAAgB,KAAK,OAAO;AAAA,MAC5B,qBAAqB,KAAK,OAAO;AAAA,MACjC,YAAY;AAAA,MACZ,YAAY;AAAA,IAAA,CACZ,EACA,QAAQ,EAAE;AACZ,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/commands/authPolicy/CreateAuthPolicyCommand.js

@@ -0,0 +1,28 @@
+import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+class CreateAuthPolicyCommand {
+  constructor(values) {
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const now = providers.now();
+    await InsertBuilder$1.create().into("auth_policy").values({
+      id,
+      scope: this.values.scope,
+      project_id: this.values.projectId,
+      roles: this.values.roles,
+      mfa_required: this.values.mfaRequired,
+      token_expiration: this.values.tokenExpiration,
+      idle_timeout: this.values.idleTimeout,
+      grace_duration: this.values.graceDuration,
+      remember_me_allowed: this.values.rememberMeAllowed,
+      created_at: now,
+      updated_at: now
+    }).execute(db);
+    return id;
+  }
+}
+export {
+  CreateAuthPolicyCommand
+};
+//# sourceMappingURL=CreateAuthPolicyCommand.js.map

package/dist/development/src/model/commands/authPolicy/CreateAuthPolicyCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateAuthPolicyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/CreateAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { AuthPolicyScope } from '../../type/index.js'\n\nexport type AuthPolicyWriteValues = {\n\tscope: AuthPolicyScope\n\tprojectId: string | null\n\troles: string[]\n\tmfaRequired: boolean | null\n\ttokenExpiration: string | null\n\tidleTimeout: string | null\n\tgraceDuration: string | null\n\trememberMeAllowed: boolean | null\n}\n\n/** Inserts a new `auth_policy` row. Returns the generated id. */\nexport class CreateAuthPolicyCommand implements Command<string> {\n\tconstructor(private readonly values: AuthPolicyWriteValues) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst id = providers.uuid()\n\t\tconst now = providers.now()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('auth_policy')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tscope: this.values.scope,\n\t\t\t\tproject_id: this.values.projectId,\n\t\t\t\troles: this.values.roles,\n\t\t\t\tmfa_required: this.values.mfaRequired,\n\t\t\t\ttoken_expiration: this.values.tokenExpiration,\n\t\t\t\tidle_timeout: this.values.idleTimeout,\n\t\t\t\tgrace_duration: this.values.graceDuration,\n\t\t\t\tremember_me_allowed: this.values.rememberMeAllowed,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn id\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAgBO,MAAM,wBAAmD;AAAA,EAC/D,YAA6B,QAA+B;AAA/B,SAAA,SAAA;AAAA,EAAgC;AAAA,EAE7D,MAAM,QAAQ,EAAE,IAAI,aAA4C;AAC/D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,MAAM,UAAU,IAAA;AACtB,UAAMA,gBAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,OAAO,KAAK,OAAO;AAAA,MACnB,YAAY,KAAK,OAAO;AAAA,MACxB,OAAO,KAAK,OAAO;AAAA,MACnB,cAAc,KAAK,OAAO;AAAA,MAC1B,kBAAkB,KAAK,OAAO;AAAA,MAC9B,cAAc,KAAK,OAAO;AAAA,MAC1B,gBAAgB,KAAK,OAAO;AAAA,MAC5B,qBAAqB,KAAK,OAAO;AAAA,MACjC,YAAY;AAAA,MACZ,YAAY;AAAA,IAAA,CACZ,EACA,QAAQ,EAAE;AACZ,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/commands/authPolicy/DeleteAuthPolicyCommand.cjs

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class DeleteAuthPolicyCommand {
+  constructor(id) {
+    this.id = id;
+  }
+  async execute({ db }) {
+    const result = await Database.DeleteBuilder.create().from("auth_policy").where({ id: this.id }).execute(db);
+    return result > 0;
+  }
+}
+exports.DeleteAuthPolicyCommand = DeleteAuthPolicyCommand;
+//# sourceMappingURL=DeleteAuthPolicyCommand.cjs.map

package/dist/development/src/model/commands/authPolicy/DeleteAuthPolicyCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteAuthPolicyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/DeleteAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/** Deletes an `auth_policy` row by id. Returns whether a row was removed. */\nexport class DeleteAuthPolicyCommand implements Command<boolean> {\n\tconstructor(private readonly id: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await DeleteBuilder.create()\n\t\t\t.from('auth_policy')\n\t\t\t.where({ id: this.id })\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAIO,MAAM,wBAAoD;AAAA,EAChE,YAA6B,IAAY;AAAZ,SAAA,KAAA;AAAA,EAAa;AAAA,EAE1C,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAMA,SAAAA,cAAc,OAAA,EACjC,KAAK,aAAa,EAClB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}

package/dist/development/src/model/commands/authPolicy/DeleteAuthPolicyCommand.js

@@ -0,0 +1,14 @@
+import { DeleteBuilder } from "@contember/database";
+class DeleteAuthPolicyCommand {
+  constructor(id) {
+    this.id = id;
+  }
+  async execute({ db }) {
+    const result = await DeleteBuilder.create().from("auth_policy").where({ id: this.id }).execute(db);
+    return result > 0;
+  }
+}
+export {
+  DeleteAuthPolicyCommand
+};
+//# sourceMappingURL=DeleteAuthPolicyCommand.js.map

package/dist/development/src/model/commands/authPolicy/DeleteAuthPolicyCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteAuthPolicyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/DeleteAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/** Deletes an `auth_policy` row by id. Returns whether a row was removed. */\nexport class DeleteAuthPolicyCommand implements Command<boolean> {\n\tconstructor(private readonly id: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await DeleteBuilder.create()\n\t\t\t.from('auth_policy')\n\t\t\t.where({ id: this.id })\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,wBAAoD;AAAA,EAChE,YAA6B,IAAY;AAAZ,SAAA,KAAA;AAAA,EAAa;AAAA,EAE1C,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAM,cAAc,OAAA,EACjC,KAAK,aAAa,EAClB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}

package/dist/development/src/model/commands/authPolicy/UpdateAuthPolicyCommand.cjs

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class UpdateAuthPolicyCommand {
+  constructor(id, values) {
+    this.id = id;
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const result = await Database.UpdateBuilder.create().table("auth_policy").where({ id: this.id }).values({
+      scope: this.values.scope,
+      project_id: this.values.projectId,
+      roles: this.values.roles,
+      mfa_required: this.values.mfaRequired,
+      token_expiration: this.values.tokenExpiration,
+      idle_timeout: this.values.idleTimeout,
+      grace_duration: this.values.graceDuration,
+      remember_me_allowed: this.values.rememberMeAllowed,
+      updated_at: providers.now()
+    }).execute(db);
+    return result > 0;
+  }
+}
+exports.UpdateAuthPolicyCommand = UpdateAuthPolicyCommand;
+//# sourceMappingURL=UpdateAuthPolicyCommand.cjs.map

package/dist/development/src/model/commands/authPolicy/UpdateAuthPolicyCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateAuthPolicyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/UpdateAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { AuthPolicyScope } from '../../type/index.js'\n\n/**\n * Updates an existing `auth_policy` row. Only the supplied fields are written\n * (an `undefined` field is left untouched; an explicit `null` clears it).\n * `updated_at` is always bumped. Returns whether a row was affected.\n */\nexport class UpdateAuthPolicyCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly values: {\n\t\t\tscope?: AuthPolicyScope\n\t\t\tprojectId?: string | null\n\t\t\troles?: string[]\n\t\t\tmfaRequired?: boolean | null\n\t\t\ttokenExpiration?: string | null\n\t\t\tidleTimeout?: string | null\n\t\t\tgraceDuration?: string | null\n\t\t\trememberMeAllowed?: boolean | null\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('auth_policy')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\tscope: this.values.scope,\n\t\t\t\tproject_id: this.values.projectId,\n\t\t\t\troles: this.values.roles,\n\t\t\t\tmfa_required: this.values.mfaRequired,\n\t\t\t\ttoken_expiration: this.values.tokenExpiration,\n\t\t\t\tidle_timeout: this.values.idleTimeout,\n\t\t\t\tgrace_duration: this.values.graceDuration,\n\t\t\t\tremember_me_allowed: this.values.rememberMeAllowed,\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AASO,MAAM,wBAAoD;AAAA,EAChE,YACkB,IACA,QAUhB;AAXgB,SAAA,KAAA;AACA,SAAA,SAAA;AAAA,EAUf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,SAAS,MAAMA,SAAAA,cAAc,OAAA,EACjC,MAAM,aAAa,EACnB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,OAAO,KAAK,OAAO;AAAA,MACnB,YAAY,KAAK,OAAO;AAAA,MACxB,OAAO,KAAK,OAAO;AAAA,MACnB,cAAc,KAAK,OAAO;AAAA,MAC1B,kBAAkB,KAAK,OAAO;AAAA,MAC9B,cAAc,KAAK,OAAO;AAAA,MAC1B,gBAAgB,KAAK,OAAO;AAAA,MAC5B,qBAAqB,KAAK,OAAO;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}

package/dist/development/src/model/commands/authPolicy/UpdateAuthPolicyCommand.js

@@ -0,0 +1,25 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class UpdateAuthPolicyCommand {
+  constructor(id, values) {
+    this.id = id;
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const result = await UpdateBuilder$1.create().table("auth_policy").where({ id: this.id }).values({
+      scope: this.values.scope,
+      project_id: this.values.projectId,
+      roles: this.values.roles,
+      mfa_required: this.values.mfaRequired,
+      token_expiration: this.values.tokenExpiration,
+      idle_timeout: this.values.idleTimeout,
+      grace_duration: this.values.graceDuration,
+      remember_me_allowed: this.values.rememberMeAllowed,
+      updated_at: providers.now()
+    }).execute(db);
+    return result > 0;
+  }
+}
+export {
+  UpdateAuthPolicyCommand
+};
+//# sourceMappingURL=UpdateAuthPolicyCommand.js.map