@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/development/src/model/commands/authPolicy/UpdateAuthPolicyCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateAuthPolicyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/UpdateAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { AuthPolicyScope } from '../../type/index.js'\n\n/**\n * Updates an existing `auth_policy` row. Only the supplied fields are written\n * (an `undefined` field is left untouched; an explicit `null` clears it).\n * `updated_at` is always bumped. Returns whether a row was affected.\n */\nexport class UpdateAuthPolicyCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly values: {\n\t\t\tscope?: AuthPolicyScope\n\t\t\tprojectId?: string | null\n\t\t\troles?: string[]\n\t\t\tmfaRequired?: boolean | null\n\t\t\ttokenExpiration?: string | null\n\t\t\tidleTimeout?: string | null\n\t\t\tgraceDuration?: string | null\n\t\t\trememberMeAllowed?: boolean | null\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('auth_policy')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\tscope: this.values.scope,\n\t\t\t\tproject_id: this.values.projectId,\n\t\t\t\troles: this.values.roles,\n\t\t\t\tmfa_required: this.values.mfaRequired,\n\t\t\t\ttoken_expiration: this.values.tokenExpiration,\n\t\t\t\tidle_timeout: this.values.idleTimeout,\n\t\t\t\tgrace_duration: this.values.graceDuration,\n\t\t\t\tremember_me_allowed: this.values.rememberMeAllowed,\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AASO,MAAM,wBAAoD;AAAA,EAChE,YACkB,IACA,QAUhB;AAXgB,SAAA,KAAA;AACA,SAAA,SAAA;AAAA,EAUf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,aAAa,EACnB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,OAAO,KAAK,OAAO;AAAA,MACnB,YAAY,KAAK,OAAO;AAAA,MACxB,OAAO,KAAK,OAAO;AAAA,MACnB,cAAc,KAAK,OAAO;AAAA,MAC1B,kBAAkB,KAAK,OAAO;AAAA,MAC9B,cAAc,KAAK,OAAO;AAAA,MAC1B,gBAAgB,KAAK,OAAO;AAAA,MAC5B,qBAAqB,KAAK,OAAO;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}

package/dist/development/src/model/commands/backupCode/ConsumeBackupCodeCommand.cjs

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class ConsumeBackupCodeCommand {
+  constructor(personId, codeHash) {
+    this.personId = personId;
+    this.codeHash = codeHash;
+  }
+  async execute({ db, providers }) {
+    const affected = await Database.UpdateBuilder.create().table("person_backup_code").values({
+      used_at: providers.now()
+    }).where({
+      person_id: this.personId,
+      code_hash: this.codeHash
+    }).where((expr) => expr.isNull("used_at")).execute(db);
+    return affected > 0;
+  }
+}
+exports.ConsumeBackupCodeCommand = ConsumeBackupCodeCommand;
+//# sourceMappingURL=ConsumeBackupCodeCommand.cjs.map

package/dist/development/src/model/commands/backupCode/ConsumeBackupCodeCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConsumeBackupCodeCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/ConsumeBackupCodeCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Atomically consumes an unused backup code matching the given hash.\n * Returns true if a code was consumed. Safe against double-spend: the\n * UPDATE only touches a row that is still unused, and we rely on the\n * affected-row count, so two concurrent attempts with the same code can\n * succeed at most once.\n */\nexport class ConsumeBackupCodeCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly codeHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst affected = await UpdateBuilder.create()\n\t\t\t.table('person_backup_code')\n\t\t\t.values({\n\t\t\t\tused_at: providers.now(),\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tperson_id: this.personId,\n\t\t\t\tcode_hash: this.codeHash,\n\t\t\t})\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.execute(db)\n\n\t\treturn affected > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAUO,MAAM,yBAAqD;AAAA,EACjE,YACkB,UACA,UAChB;AAFgB,SAAA,WAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,WAAW,MAAMA,uBAAc,OAAA,EACnC,MAAM,oBAAoB,EAC1B,OAAO;AAAA,MACP,SAAS,UAAU,IAAA;AAAA,IAAI,CACvB,EACA,MAAM;AAAA,MACN,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,IAAA,CAChB,EACA,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,QAAQ,EAAE;AAEZ,WAAO,WAAW;AAAA,EACnB;AACD;;"}

package/dist/development/src/model/commands/backupCode/ConsumeBackupCodeCommand.js

@@ -0,0 +1,20 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class ConsumeBackupCodeCommand {
+  constructor(personId, codeHash) {
+    this.personId = personId;
+    this.codeHash = codeHash;
+  }
+  async execute({ db, providers }) {
+    const affected = await UpdateBuilder$1.create().table("person_backup_code").values({
+      used_at: providers.now()
+    }).where({
+      person_id: this.personId,
+      code_hash: this.codeHash
+    }).where((expr) => expr.isNull("used_at")).execute(db);
+    return affected > 0;
+  }
+}
+export {
+  ConsumeBackupCodeCommand
+};
+//# sourceMappingURL=ConsumeBackupCodeCommand.js.map

package/dist/development/src/model/commands/backupCode/ConsumeBackupCodeCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConsumeBackupCodeCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/ConsumeBackupCodeCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Atomically consumes an unused backup code matching the given hash.\n * Returns true if a code was consumed. Safe against double-spend: the\n * UPDATE only touches a row that is still unused, and we rely on the\n * affected-row count, so two concurrent attempts with the same code can\n * succeed at most once.\n */\nexport class ConsumeBackupCodeCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly codeHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst affected = await UpdateBuilder.create()\n\t\t\t.table('person_backup_code')\n\t\t\t.values({\n\t\t\t\tused_at: providers.now(),\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tperson_id: this.personId,\n\t\t\t\tcode_hash: this.codeHash,\n\t\t\t})\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.execute(db)\n\n\t\treturn affected > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAUO,MAAM,yBAAqD;AAAA,EACjE,YACkB,UACA,UAChB;AAFgB,SAAA,WAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,WAAW,MAAMA,gBAAc,OAAA,EACnC,MAAM,oBAAoB,EAC1B,OAAO;AAAA,MACP,SAAS,UAAU,IAAA;AAAA,IAAI,CACvB,EACA,MAAM;AAAA,MACN,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,IAAA,CAChB,EACA,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,QAAQ,EAAE;AAEZ,WAAO,WAAW;AAAA,EACnB;AACD;"}

package/dist/development/src/model/commands/backupCode/CreateBackupCodeCommand.cjs

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class CreateBackupCodeCommand {
+  constructor(personId, codeHash) {
+    this.personId = personId;
+    this.codeHash = codeHash;
+  }
+  async execute({ db, providers }) {
+    await Database.InsertBuilder.create().into("person_backup_code").values({
+      id: providers.uuid(),
+      person_id: this.personId,
+      code_hash: this.codeHash,
+      created_at: providers.now()
+    }).execute(db);
+  }
+}
+exports.CreateBackupCodeCommand = CreateBackupCodeCommand;
+//# sourceMappingURL=CreateBackupCodeCommand.cjs.map

package/dist/development/src/model/commands/backupCode/CreateBackupCodeCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateBackupCodeCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/CreateBackupCodeCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\n/**\n * Inserts a single backup code (stored as a hash) for a person.\n */\nexport class CreateBackupCodeCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly codeHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_backup_code')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tperson_id: this.personId,\n\t\t\t\tcode_hash: this.codeHash,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAMO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,UACA,UAChB;AAFgB,SAAA,WAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,oBAAoB,EACzB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/backupCode/CreateBackupCodeCommand.js

@@ -0,0 +1,19 @@
+import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+class CreateBackupCodeCommand {
+  constructor(personId, codeHash) {
+    this.personId = personId;
+    this.codeHash = codeHash;
+  }
+  async execute({ db, providers }) {
+    await InsertBuilder$1.create().into("person_backup_code").values({
+      id: providers.uuid(),
+      person_id: this.personId,
+      code_hash: this.codeHash,
+      created_at: providers.now()
+    }).execute(db);
+  }
+}
+export {
+  CreateBackupCodeCommand
+};
+//# sourceMappingURL=CreateBackupCodeCommand.js.map

package/dist/development/src/model/commands/backupCode/CreateBackupCodeCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateBackupCodeCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/CreateBackupCodeCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\n/**\n * Inserts a single backup code (stored as a hash) for a person.\n */\nexport class CreateBackupCodeCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly codeHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_backup_code')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tperson_id: this.personId,\n\t\t\t\tcode_hash: this.codeHash,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAMO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,UACA,UAChB;AAFgB,SAAA,WAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,KAAK,oBAAoB,EACzB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/backupCode/DeleteBackupCodesCommand.cjs

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class DeleteBackupCodesCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db }) {
+    await Database.DeleteBuilder.create().from("person_backup_code").where({ person_id: this.personId }).execute(db);
+  }
+}
+exports.DeleteBackupCodesCommand = DeleteBackupCodesCommand;
+//# sourceMappingURL=DeleteBackupCodesCommand.cjs.map

package/dist/development/src/model/commands/backupCode/DeleteBackupCodesCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteBackupCodesCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/DeleteBackupCodesCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/**\n * Deletes all backup codes (used and unused) for a person.\n */\nexport class DeleteBackupCodesCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.from('person_backup_code')\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAMO,MAAM,yBAAkD;AAAA,EAC9D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,oBAAoB,EACzB,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/backupCode/DeleteBackupCodesCommand.js

@@ -0,0 +1,13 @@
+import { DeleteBuilder } from "@contember/database";
+class DeleteBackupCodesCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db }) {
+    await DeleteBuilder.create().from("person_backup_code").where({ person_id: this.personId }).execute(db);
+  }
+}
+export {
+  DeleteBackupCodesCommand
+};
+//# sourceMappingURL=DeleteBackupCodesCommand.js.map

package/dist/development/src/model/commands/backupCode/DeleteBackupCodesCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteBackupCodesCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/DeleteBackupCodesCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/**\n * Deletes all backup codes (used and unused) for a person.\n */\nexport class DeleteBackupCodesCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.from('person_backup_code')\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.execute(db)\n\t}\n}\n"],"names":[],"mappings":";AAMO,MAAM,yBAAkD;AAAA,EAC9D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,cAAc,OAAA,EAClB,KAAK,oBAAoB,EACzB,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.cjs

@@ -5,10 +5,26 @@ class UpdateConfigurationCommand {
   constructor(configuration) {
     this.configuration = configuration;
   }
-  async execute({ db }) {
+  async execute({ db, providers }) {
+    const captcha = this.configuration.captcha;
+    const rl = this.configuration.rateLimits;
+    let captchaSecretCol;
+    let captchaSecretVersionCol;
+    if (captcha?.secret !== void 0) {
+      if (captcha.secret === "" || captcha.secret === null) {
+        captchaSecretCol = null;
+        captchaSecretVersionCol = null;
+      } else {
+        const encrypted = await providers.encrypt(Buffer.from(captcha.secret, "utf8"));
+        captchaSecretCol = encrypted.value;
+        captchaSecretVersionCol = encrypted.version;
+      }
+    }
     const result = await Database.UpdateBuilder.create().table("config").where({ id: "singleton" }).values(
       {
         passwordless_enabled: this.configuration.passwordless?.enabled ?? void 0,
+        signup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? void 0,
+        require_email_change_verification: this.configuration.emailChange?.requireVerification ?? void 0,
         passwordless_url: this.configuration.passwordless?.url,
         passwordless_expiration: this.configuration.passwordless?.expiration ?? void 0,
         password_min_length: this.configuration.password?.minLength ?? void 0,
@@ -18,12 +34,39 @@ class UpdateConfigurationCommand {
         password_require_special: this.configuration.password?.requireSpecial ?? void 0,
         password_pattern: this.configuration.password?.pattern,
         password_check_blacklist: this.configuration.password?.checkBlacklist ?? void 0,
+        password_check_hibp: this.configuration.password?.checkHibp ?? void 0,
         login_base_backoff: this.configuration.login?.baseBackoff ?? void 0,
         login_max_backoff: this.configuration.login?.maxBackoff ?? void 0,
         login_attempt_window: this.configuration.login?.attemptWindow ?? void 0,
         login_reveal_user_exits: this.configuration.login?.revealUserExists ?? void 0,
+        login_reveal_login_method: this.configuration.login?.revealLoginMethod ?? void 0,
         login_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? void 0,
-        login_max_token_expiration: this.configuration.login?.maxTokenExpiration
+        login_max_token_expiration: this.configuration.login?.maxTokenExpiration,
+        login_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? void 0,
+        login_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? void 0,
+        login_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? void 0,
+        login_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? void 0,
+        login_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? void 0,
+        captcha_provider: captcha?.provider !== void 0 ? captcha.provider : void 0,
+        captcha_secret: captchaSecretCol,
+        captcha_secret_version: captchaSecretVersionCol,
+        captcha_threshold: captcha?.threshold !== void 0 ? captcha.threshold : void 0,
+        captcha_protect_sign_up: captcha?.protect?.signUp ?? void 0,
+        captcha_protect_password_reset: captcha?.protect?.passwordReset ?? void 0,
+        captcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? void 0,
+        captcha_protect_email_verification: captcha?.protect?.emailVerification ?? void 0,
+        rate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? void 0,
+        rate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? void 0,
+        rate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? void 0,
+        rate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? void 0,
+        rate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? void 0,
+        rate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? void 0,
+        rate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? void 0,
+        rate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? void 0,
+        rate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? void 0,
+        rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? void 0,
+        rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? void 0,
+        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0
       }
     ).execute(db);
     if (!result) {

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateConfigurationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ConfigInput } from '../../../schema'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,MAAA;AAAA,IACvD,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;;"}
+{"version":3,"file":"UpdateConfigurationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// Encrypt captcha secret at rest. Empty string clears the value;\n\t\t// non-empty re-encrypts so we always rotate to the latest key version.\n\t\tlet captchaSecretCol: Buffer | null | undefined\n\t\tlet captchaSecretVersionCol: number | null | undefined\n\t\tif (captcha?.secret !== undefined) {\n\t\t\tif (captcha.secret === '' || captcha.secret === null) {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;AAI9B,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,QAAW;AAClC,UAAI,QAAQ,WAAW,MAAM,QAAQ,WAAW,MAAM;AACrD,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,MAAA;AAAA,IACpF,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;;"}

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.js

@@ -3,10 +3,26 @@ class UpdateConfigurationCommand {
   constructor(configuration) {
     this.configuration = configuration;
   }
-  async execute({ db }) {
+  async execute({ db, providers }) {
+    const captcha = this.configuration.captcha;
+    const rl = this.configuration.rateLimits;
+    let captchaSecretCol;
+    let captchaSecretVersionCol;
+    if (captcha?.secret !== void 0) {
+      if (captcha.secret === "" || captcha.secret === null) {
+        captchaSecretCol = null;
+        captchaSecretVersionCol = null;
+      } else {
+        const encrypted = await providers.encrypt(Buffer.from(captcha.secret, "utf8"));
+        captchaSecretCol = encrypted.value;
+        captchaSecretVersionCol = encrypted.version;
+      }
+    }
     const result = await UpdateBuilder$1.create().table("config").where({ id: "singleton" }).values(
       {
         passwordless_enabled: this.configuration.passwordless?.enabled ?? void 0,
+        signup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? void 0,
+        require_email_change_verification: this.configuration.emailChange?.requireVerification ?? void 0,
         passwordless_url: this.configuration.passwordless?.url,
         passwordless_expiration: this.configuration.passwordless?.expiration ?? void 0,
         password_min_length: this.configuration.password?.minLength ?? void 0,
@@ -16,12 +32,39 @@ class UpdateConfigurationCommand {
         password_require_special: this.configuration.password?.requireSpecial ?? void 0,
         password_pattern: this.configuration.password?.pattern,
         password_check_blacklist: this.configuration.password?.checkBlacklist ?? void 0,
+        password_check_hibp: this.configuration.password?.checkHibp ?? void 0,
         login_base_backoff: this.configuration.login?.baseBackoff ?? void 0,
         login_max_backoff: this.configuration.login?.maxBackoff ?? void 0,
         login_attempt_window: this.configuration.login?.attemptWindow ?? void 0,
         login_reveal_user_exits: this.configuration.login?.revealUserExists ?? void 0,
+        login_reveal_login_method: this.configuration.login?.revealLoginMethod ?? void 0,
         login_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? void 0,
-        login_max_token_expiration: this.configuration.login?.maxTokenExpiration
+        login_max_token_expiration: this.configuration.login?.maxTokenExpiration,
+        login_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? void 0,
+        login_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? void 0,
+        login_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? void 0,
+        login_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? void 0,
+        login_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? void 0,
+        captcha_provider: captcha?.provider !== void 0 ? captcha.provider : void 0,
+        captcha_secret: captchaSecretCol,
+        captcha_secret_version: captchaSecretVersionCol,
+        captcha_threshold: captcha?.threshold !== void 0 ? captcha.threshold : void 0,
+        captcha_protect_sign_up: captcha?.protect?.signUp ?? void 0,
+        captcha_protect_password_reset: captcha?.protect?.passwordReset ?? void 0,
+        captcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? void 0,
+        captcha_protect_email_verification: captcha?.protect?.emailVerification ?? void 0,
+        rate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? void 0,
+        rate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? void 0,
+        rate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? void 0,
+        rate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? void 0,
+        rate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? void 0,
+        rate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? void 0,
+        rate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? void 0,
+        rate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? void 0,
+        rate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? void 0,
+        rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? void 0,
+        rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? void 0,
+        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0
       }
     ).execute(db);
     if (!result) {

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateConfigurationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ConfigInput } from '../../../schema'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,MAAA;AAAA,IACvD,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;"}
+{"version":3,"file":"UpdateConfigurationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// Encrypt captcha secret at rest. Empty string clears the value;\n\t\t// non-empty re-encrypts so we always rotate to the latest key version.\n\t\tlet captchaSecretCol: Buffer | null | undefined\n\t\tlet captchaSecretVersionCol: number | null | undefined\n\t\tif (captcha?.secret !== undefined) {\n\t\t\tif (captcha.secret === '' || captcha.secret === null) {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;AAI9B,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,QAAW;AAClC,UAAI,QAAQ,WAAW,MAAM,QAAQ,WAAW,MAAM;AACrD,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,MAAA;AAAA,IACpF,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;"}

package/dist/development/src/model/commands/identity/CreateIdentityCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdentityCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/CreateIdentityCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\n\nexport class CreateIdentityCommand implements Command<string> {\n\tconstructor(private readonly roles: readonly string[], private readonly description?: string) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst identityId = providers.uuid()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity')\n\t\t\t.values({\n\t\t\t\tid: identityId,\n\t\t\t\tparent_id: null,\n\t\t\t\troles: JSON.stringify(this.roles),\n\t\t\t\tdescription: this.description || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn identityId\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAGO,MAAM,sBAAiD;AAAA,EAC7D,YAA6B,OAA2C,aAAsB;AAAjE,SAAA,QAAA;AAA2C,SAAA,cAAA;AAAA,EAAuB;AAAA,EAE/F,MAAa,QAAQ,EAAE,IAAI,aAA4C;AACtE,UAAM,aAAa,UAAU,KAAA;AAC7B,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,UAAU,EACf,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,WAAW;AAAA,MACX,OAAO,KAAK,UAAU,KAAK,KAAK;AAAA,MAChC,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"CreateIdentityCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/CreateIdentityCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\nexport class CreateIdentityCommand implements Command<string> {\n\tconstructor(private readonly roles: readonly string[], private readonly description?: string) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst identityId = providers.uuid()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity')\n\t\t\t.values({\n\t\t\t\tid: identityId,\n\t\t\t\tparent_id: null,\n\t\t\t\troles: JSON.stringify(this.roles),\n\t\t\t\tdescription: this.description || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn identityId\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAGO,MAAM,sBAAiD;AAAA,EAC7D,YAA6B,OAA2C,aAAsB;AAAjE,SAAA,QAAA;AAA2C,SAAA,cAAA;AAAA,EAAuB;AAAA,EAE/F,MAAa,QAAQ,EAAE,IAAI,aAA4C;AACtE,UAAM,aAAa,UAAU,KAAA;AAC7B,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,UAAU,EACf,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,WAAW;AAAA,MACX,OAAO,KAAK,UAAU,KAAK,KAAK;AAAA,MAChC,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/commands/identity/CreateIdentityCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdentityCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/CreateIdentityCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\n\nexport class CreateIdentityCommand implements Command<string> {\n\tconstructor(private readonly roles: readonly string[], private readonly description?: string) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst identityId = providers.uuid()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity')\n\t\t\t.values({\n\t\t\t\tid: identityId,\n\t\t\t\tparent_id: null,\n\t\t\t\troles: JSON.stringify(this.roles),\n\t\t\t\tdescription: this.description || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn identityId\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAGO,MAAM,sBAAiD;AAAA,EAC7D,YAA6B,OAA2C,aAAsB;AAAjE,SAAA,QAAA;AAA2C,SAAA,cAAA;AAAA,EAAuB;AAAA,EAE/F,MAAa,QAAQ,EAAE,IAAI,aAA4C;AACtE,UAAM,aAAa,UAAU,KAAA;AAC7B,UAAMA,gBAAc,OAAA,EAClB,KAAK,UAAU,EACf,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,WAAW;AAAA,MACX,OAAO,KAAK,UAAU,KAAK,KAAK;AAAA,MAChC,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"CreateIdentityCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/CreateIdentityCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\nexport class CreateIdentityCommand implements Command<string> {\n\tconstructor(private readonly roles: readonly string[], private readonly description?: string) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst identityId = providers.uuid()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity')\n\t\t\t.values({\n\t\t\t\tid: identityId,\n\t\t\t\tparent_id: null,\n\t\t\t\troles: JSON.stringify(this.roles),\n\t\t\t\tdescription: this.description || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn identityId\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAGO,MAAM,sBAAiD;AAAA,EAC7D,YAA6B,OAA2C,aAAsB;AAAjE,SAAA,QAAA;AAA2C,SAAA,cAAA;AAAA,EAAuB;AAAA,EAE/F,MAAa,QAAQ,EAAE,IAAI,aAA4C;AACtE,UAAM,aAAa,UAAU,KAAA;AAC7B,UAAMA,gBAAc,OAAA,EAClB,KAAK,UAAU,EACf,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,WAAW;AAAA,MACX,OAAO,KAAK,UAAU,KAAK,KAAK;AAAA,MAChC,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/commands/identity/PatchIdentityGlobalRoles.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PatchIdentityGlobalRoles.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT JSONB_AGG(DISTINCT out_role)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}
+{"version":3,"file":"PatchIdentityGlobalRoles.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT JSONB_AGG(DISTINCT out_role)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}

package/dist/development/src/model/commands/identity/PatchIdentityGlobalRoles.js.map

@@ -1 +1 @@
-{"version":3,"file":"PatchIdentityGlobalRoles.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT JSONB_AGG(DISTINCT out_role)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}
+{"version":3,"file":"PatchIdentityGlobalRoles.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT JSONB_AGG(DISTINCT out_role)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}

package/dist/development/src/model/commands/idp/ClaimIdpRevalidationCommand.cjs

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class ClaimIdpRevalidationCommand {
+  constructor(id, interval) {
+    this.id = id;
+    this.interval = interval;
+  }
+  async execute({ db }) {
+    const result = await db.query(
+      `UPDATE "idp_session"
+			 SET "last_validated_at" = now()
+			 WHERE "id" = ? AND "last_validated_at" <= now() - ?::interval`,
+      [this.id, this.interval]
+    );
+    return (result.rowCount ?? 0) > 0;
+  }
+}
+exports.ClaimIdpRevalidationCommand = ClaimIdpRevalidationCommand;
+//# sourceMappingURL=ClaimIdpRevalidationCommand.cjs.map

package/dist/development/src/model/commands/idp/ClaimIdpRevalidationCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimIdpRevalidationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\n\n/**\n * Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n *\n * This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await db.query(\n\t\t\t`UPDATE \"idp_session\"\n\t\t\t SET \"last_validated_at\" = now()\n\t\t\t WHERE \"id\" = ? AND \"last_validated_at\" <= now() - ?::interval`,\n\t\t\t[this.id, this.interval],\n\t\t)\n\t\treturn (result.rowCount ?? 0) > 0\n\t}\n}\n"],"names":[],"mappings":";;AAWO,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAM,GAAG;AAAA,MACvB;AAAA;AAAA;AAAA,MAGA,CAAC,KAAK,IAAI,KAAK,QAAQ;AAAA,IAAA;AAExB,YAAQ,OAAO,YAAY,KAAK;AAAA,EACjC;AACD;;"}

package/dist/development/src/model/commands/idp/ClaimIdpRevalidationCommand.js

@@ -0,0 +1,19 @@
+class ClaimIdpRevalidationCommand {
+  constructor(id, interval) {
+    this.id = id;
+    this.interval = interval;
+  }
+  async execute({ db }) {
+    const result = await db.query(
+      `UPDATE "idp_session"
+			 SET "last_validated_at" = now()
+			 WHERE "id" = ? AND "last_validated_at" <= now() - ?::interval`,
+      [this.id, this.interval]
+    );
+    return (result.rowCount ?? 0) > 0;
+  }
+}
+export {
+  ClaimIdpRevalidationCommand
+};
+//# sourceMappingURL=ClaimIdpRevalidationCommand.js.map

package/dist/development/src/model/commands/idp/ClaimIdpRevalidationCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimIdpRevalidationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\n\n/**\n * Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n *\n * This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await db.query(\n\t\t\t`UPDATE \"idp_session\"\n\t\t\t SET \"last_validated_at\" = now()\n\t\t\t WHERE \"id\" = ? AND \"last_validated_at\" <= now() - ?::interval`,\n\t\t\t[this.id, this.interval],\n\t\t)\n\t\treturn (result.rowCount ?? 0) > 0\n\t}\n}\n"],"names":[],"mappings":"AAWO,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAM,GAAG;AAAA,MACvB;AAAA;AAAA;AAAA,MAGA,CAAC,KAAK,IAAI,KAAK,QAAQ;AAAA,IAAA;AAExB,YAAQ,OAAO,YAAY,KAAK;AAAA,EACjC;AACD;"}

package/dist/development/src/model/commands/idp/CreateIdpCommand.cjs

@@ -6,7 +6,7 @@ class CreateIdpCommand {
     this.data = data;
   }
   async execute({ db, providers }) {
-    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig }, slug, type } = this.data;
+    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data;
     await Database.InsertBuilder.create().into("identity_provider").values({
       id: providers.uuid(),
       configuration,
@@ -14,7 +14,9 @@ class CreateIdpCommand {
       type,
       auto_sign_up: autoSignUp,
       exclusive,
-      init_returns_config: initReturnsConfig
+      init_returns_config: initReturnsConfig,
+      require_verified_email: requireVerifiedEmail,
+      assume_email_verified: assumeEmailVerified
     }).execute(db);
   }
 }

package/dist/development/src/model/commands/idp/CreateIdpCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst { configuration, options: { autoSignUp, exclusive, initReturnsConfig }, slug, type } = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,EAAE,eAAe,SAAS,EAAE,YAAY,WAAW,kBAAA,GAAqB,MAAM,KAAA,IAAS,KAAK;AAClG,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,IAAA,CACrB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"CreateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,EAAE,eAAe,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,oBAAA,GAAuB,MAAM,KAAA,IAAS,KAAK;AAC7I,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,IAAA,CACvB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/idp/CreateIdpCommand.js

@@ -4,7 +4,7 @@ class CreateIdpCommand {
     this.data = data;
   }
   async execute({ db, providers }) {
-    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig }, slug, type } = this.data;
+    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data;
     await InsertBuilder$1.create().into("identity_provider").values({
       id: providers.uuid(),
       configuration,
@@ -12,7 +12,9 @@ class CreateIdpCommand {
       type,
       auto_sign_up: autoSignUp,
       exclusive,
-      init_returns_config: initReturnsConfig
+      init_returns_config: initReturnsConfig,
+      require_verified_email: requireVerifiedEmail,
+      assume_email_verified: assumeEmailVerified
     }).execute(db);
   }
 }

package/dist/development/src/model/commands/idp/CreateIdpCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst { configuration, options: { autoSignUp, exclusive, initReturnsConfig }, slug, type } = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,EAAE,eAAe,SAAS,EAAE,YAAY,WAAW,kBAAA,GAAqB,MAAM,KAAA,IAAS,KAAK;AAClG,UAAMA,gBAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,IAAA,CACrB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"CreateIdpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,EAAE,eAAe,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,oBAAA,GAAuB,MAAM,KAAA,IAAS,KAAK;AAC7I,UAAMA,gBAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,IAAA,CACvB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/idp/CreateIdpSessionCommand.cjs

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class CreateIdpSessionCommand {
+  constructor(apiKeyId, identityProviderId, session) {
+    this.apiKeyId = apiKeyId;
+    this.identityProviderId = identityProviderId;
+    this.session = session;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const tokens = this.session.tokens ? await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), "utf8")) : null;
+    await Database.InsertBuilder.create().into("idp_session").values({
+      id,
+      api_key_id: this.apiKeyId,
+      identity_provider_id: this.identityProviderId,
+      idp_session_id: this.session.sessionId ?? null,
+      tokens: tokens?.value ?? null,
+      tokens_version: tokens?.version ?? null,
+      idp_expires_at: this.session.expiresAt ?? null,
+      token_obtained_at: providers.now(),
+      last_validated_at: providers.now()
+    }).execute(db);
+  }
+}
+exports.CreateIdpSessionCommand = CreateIdpSessionCommand;
+//# sourceMappingURL=CreateIdpSessionCommand.cjs.map

package/dist/development/src/model/commands/idp/CreateIdpSessionCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateIdpSessionCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpSessionCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport type { IDPSessionState } from '../../service/idp/index.js'\n\n/**\n * Persist the federated-session state for a freshly created session API key, so it can be\n * re-validated against the IdP later. The `tokens` blob is encrypted at rest via\n * `providers.encrypt` (same pattern as project secrets).\n */\nexport class CreateIdpSessionCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly apiKeyId: string,\n\t\tprivate readonly identityProviderId: string,\n\t\tprivate readonly session: IDPSessionState,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst id = providers.uuid()\n\t\tconst tokens = this.session.tokens\n\t\t\t? await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), 'utf8'))\n\t\t\t: null\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('idp_session')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tapi_key_id: this.apiKeyId,\n\t\t\t\tidentity_provider_id: this.identityProviderId,\n\t\t\t\tidp_session_id: this.session.sessionId ?? null,\n\t\t\t\ttokens: tokens?.value ?? null,\n\t\t\t\ttokens_version: tokens?.version ?? null,\n\t\t\t\tidp_expires_at: this.session.expiresAt ?? null,\n\t\t\t\ttoken_obtained_at: providers.now(),\n\t\t\t\tlast_validated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AASO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,UACA,oBACA,SAChB;AAHgB,SAAA,WAAA;AACA,SAAA,qBAAA;AACA,SAAA,UAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,KAAK,QAAQ,SACzB,MAAM,UAAU,QAAQ,OAAO,KAAK,KAAK,UAAU,KAAK,QAAQ,MAAM,GAAG,MAAM,CAAC,IAChF;AAEH,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,sBAAsB,KAAK;AAAA,MAC3B,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,QAAQ,QAAQ,SAAS;AAAA,MACzB,gBAAgB,QAAQ,WAAW;AAAA,MACnC,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,mBAAmB,UAAU,IAAA;AAAA,MAC7B,mBAAmB,UAAU,IAAA;AAAA,IAAI,CACjC,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/idp/CreateIdpSessionCommand.js

@@ -0,0 +1,27 @@
+import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+class CreateIdpSessionCommand {
+  constructor(apiKeyId, identityProviderId, session) {
+    this.apiKeyId = apiKeyId;
+    this.identityProviderId = identityProviderId;
+    this.session = session;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const tokens = this.session.tokens ? await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), "utf8")) : null;
+    await InsertBuilder$1.create().into("idp_session").values({
+      id,
+      api_key_id: this.apiKeyId,
+      identity_provider_id: this.identityProviderId,
+      idp_session_id: this.session.sessionId ?? null,
+      tokens: tokens?.value ?? null,
+      tokens_version: tokens?.version ?? null,
+      idp_expires_at: this.session.expiresAt ?? null,
+      token_obtained_at: providers.now(),
+      last_validated_at: providers.now()
+    }).execute(db);
+  }
+}
+export {
+  CreateIdpSessionCommand
+};
+//# sourceMappingURL=CreateIdpSessionCommand.js.map

package/dist/development/src/model/commands/idp/CreateIdpSessionCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateIdpSessionCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpSessionCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport type { IDPSessionState } from '../../service/idp/index.js'\n\n/**\n * Persist the federated-session state for a freshly created session API key, so it can be\n * re-validated against the IdP later. The `tokens` blob is encrypted at rest via\n * `providers.encrypt` (same pattern as project secrets).\n */\nexport class CreateIdpSessionCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly apiKeyId: string,\n\t\tprivate readonly identityProviderId: string,\n\t\tprivate readonly session: IDPSessionState,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst id = providers.uuid()\n\t\tconst tokens = this.session.tokens\n\t\t\t? await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), 'utf8'))\n\t\t\t: null\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('idp_session')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tapi_key_id: this.apiKeyId,\n\t\t\t\tidentity_provider_id: this.identityProviderId,\n\t\t\t\tidp_session_id: this.session.sessionId ?? null,\n\t\t\t\ttokens: tokens?.value ?? null,\n\t\t\t\ttokens_version: tokens?.version ?? null,\n\t\t\t\tidp_expires_at: this.session.expiresAt ?? null,\n\t\t\t\ttoken_obtained_at: providers.now(),\n\t\t\t\tlast_validated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AASO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,UACA,oBACA,SAChB;AAHgB,SAAA,WAAA;AACA,SAAA,qBAAA;AACA,SAAA,UAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,KAAK,QAAQ,SACzB,MAAM,UAAU,QAAQ,OAAO,KAAK,KAAK,UAAU,KAAK,QAAQ,MAAM,GAAG,MAAM,CAAC,IAChF;AAEH,UAAMA,gBAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,sBAAsB,KAAK;AAAA,MAC3B,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,QAAQ,QAAQ,SAAS;AAAA,MACzB,gBAAgB,QAAQ,WAAW;AAAA,MACnC,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,mBAAmB,UAAU,IAAA;AAAA,MAC7B,mBAAmB,UAAU,IAAA;AAAA,IAAI,CACjC,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/idp/DisableIdpCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisableIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/DisableIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate id: string,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('identity_provider')\n\t\t\t.values({\n\t\t\t\tdisabled_at: providers.now(),\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,kBAA2C;AAAA,EACvD,YACS,IACP;AADO,SAAA,KAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM,mBAAmB,EACzB,OAAO;AAAA,MACP,aAAa,UAAU,IAAA;AAAA,IAAI,CAC3B,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"DisableIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/DisableIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate id: string,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('identity_provider')\n\t\t\t.values({\n\t\t\t\tdisabled_at: providers.now(),\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,kBAA2C;AAAA,EACvD,YACS,IACP;AADO,SAAA,KAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM,mBAAmB,EACzB,OAAO;AAAA,MACP,aAAa,UAAU,IAAA;AAAA,IAAI,CAC3B,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}