@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/development/src/model/commands/person/ResetPersonMfaCommand.cjs

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class ResetPersonMfaCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db }) {
+    await Database.UpdateBuilder.create().table("person_mfa").where({ person_id: this.personId }).values({
+      totp_secret: null,
+      totp_secret_version: null,
+      totp_activated_at: null,
+      totp_pending_secret: null,
+      totp_pending_version: null,
+      totp_pending_created_at: null,
+      email_otp_enabled: false
+    }).execute(db);
+    await Database.UpdateBuilder.create().table("person").where({ id: this.personId }).values({
+      mfa_grace_until: null
+    }).execute(db);
+  }
+}
+exports.ResetPersonMfaCommand = ResetPersonMfaCommand;
+//# sourceMappingURL=ResetPersonMfaCommand.cjs.map

package/dist/development/src/model/commands/person/ResetPersonMfaCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResetPersonMfaCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/ResetPersonMfaCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Admin recovery: clears all of a person's MFA factors so a locked-out user can\n * re-enroll. Clears the active and pending TOTP slots and disables email OTP in\n * `person_mfa`, and clears `person.mfa_grace_until`. Backup codes are deleted\n * separately (DeleteBackupCodesCommand).\n */\nexport class ResetPersonMfaCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person_mfa')\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.values({\n\t\t\t\ttotp_secret: null,\n\t\t\t\ttotp_secret_version: null,\n\t\t\t\ttotp_activated_at: null,\n\t\t\t\ttotp_pending_secret: null,\n\t\t\t\ttotp_pending_version: null,\n\t\t\t\ttotp_pending_created_at: null,\n\t\t\t\temail_otp_enabled: false,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.where({ id: this.personId })\n\t\t\t.values({\n\t\t\t\tmfa_grace_until: null,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AASO,MAAM,sBAA+C;AAAA,EAC3D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,uBAAc,SAClB,MAAM,YAAY,EAClB,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,OAAO;AAAA,MACP,aAAa;AAAA,MACb,qBAAqB;AAAA,MACrB,mBAAmB;AAAA,MACnB,qBAAqB;AAAA,MACrB,sBAAsB;AAAA,MACtB,yBAAyB;AAAA,MACzB,mBAAmB;AAAA,IAAA,CACnB,EACA,QAAQ,EAAE;AAEZ,UAAMA,uBAAc,SAClB,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,KAAK,SAAA,CAAU,EAC3B,OAAO;AAAA,MACP,iBAAiB;AAAA,IAAA,CACjB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/person/ResetPersonMfaCommand.js

@@ -0,0 +1,24 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class ResetPersonMfaCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db }) {
+    await UpdateBuilder$1.create().table("person_mfa").where({ person_id: this.personId }).values({
+      totp_secret: null,
+      totp_secret_version: null,
+      totp_activated_at: null,
+      totp_pending_secret: null,
+      totp_pending_version: null,
+      totp_pending_created_at: null,
+      email_otp_enabled: false
+    }).execute(db);
+    await UpdateBuilder$1.create().table("person").where({ id: this.personId }).values({
+      mfa_grace_until: null
+    }).execute(db);
+  }
+}
+export {
+  ResetPersonMfaCommand
+};
+//# sourceMappingURL=ResetPersonMfaCommand.js.map

package/dist/development/src/model/commands/person/ResetPersonMfaCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResetPersonMfaCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/ResetPersonMfaCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Admin recovery: clears all of a person's MFA factors so a locked-out user can\n * re-enroll. Clears the active and pending TOTP slots and disables email OTP in\n * `person_mfa`, and clears `person.mfa_grace_until`. Backup codes are deleted\n * separately (DeleteBackupCodesCommand).\n */\nexport class ResetPersonMfaCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person_mfa')\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.values({\n\t\t\t\ttotp_secret: null,\n\t\t\t\ttotp_secret_version: null,\n\t\t\t\ttotp_activated_at: null,\n\t\t\t\ttotp_pending_secret: null,\n\t\t\t\ttotp_pending_version: null,\n\t\t\t\ttotp_pending_created_at: null,\n\t\t\t\temail_otp_enabled: false,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.where({ id: this.personId })\n\t\t\t.values({\n\t\t\t\tmfa_grace_until: null,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AASO,MAAM,sBAA+C;AAAA,EAC3D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,gBAAc,SAClB,MAAM,YAAY,EAClB,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,OAAO;AAAA,MACP,aAAa;AAAA,MACb,qBAAqB;AAAA,MACrB,mBAAmB;AAAA,MACnB,qBAAqB;AAAA,MACrB,sBAAsB;AAAA,MACtB,yBAAyB;AAAA,MACzB,mBAAmB;AAAA,IAAA,CACnB,EACA,QAAQ,EAAE;AAEZ,UAAMA,gBAAc,SAClB,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,KAAK,SAAA,CAAU,EAC3B,OAAO;AAAA,MACP,iBAAiB;AAAA,IAAA,CACjB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/person/SetMfaGraceUntilCommand.cjs

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class SetMfaGraceUntilCommand {
+  constructor(personId, graceUntil) {
+    this.personId = personId;
+    this.graceUntil = graceUntil;
+  }
+  async execute({ db }) {
+    await Database.UpdateBuilder.create().table("person").where({ id: this.personId }).values({
+      mfa_grace_until: this.graceUntil
+    }).execute(db);
+  }
+}
+exports.SetMfaGraceUntilCommand = SetMfaGraceUntilCommand;
+//# sourceMappingURL=SetMfaGraceUntilCommand.cjs.map

package/dist/development/src/model/commands/person/SetMfaGraceUntilCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SetMfaGraceUntilCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/SetMfaGraceUntilCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/** Sets `person.mfa_grace_until` (the anchor for the MFA enrollment grace window). */\nexport class SetMfaGraceUntilCommand implements Command<void> {\n\tconstructor(private readonly personId: string, private readonly graceUntil: Date) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.where({ id: this.personId })\n\t\t\t.values({\n\t\t\t\tmfa_grace_until: this.graceUntil,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAIO,MAAM,wBAAiD;AAAA,EAC7D,YAA6B,UAAmC,YAAkB;AAArD,SAAA,WAAA;AAAmC,SAAA,aAAA;AAAA,EAAmB;AAAA,EAEnF,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,uBAAc,SAClB,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,KAAK,SAAA,CAAU,EAC3B,OAAO;AAAA,MACP,iBAAiB,KAAK;AAAA,IAAA,CACtB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/person/SetMfaGraceUntilCommand.js

@@ -0,0 +1,16 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class SetMfaGraceUntilCommand {
+  constructor(personId, graceUntil) {
+    this.personId = personId;
+    this.graceUntil = graceUntil;
+  }
+  async execute({ db }) {
+    await UpdateBuilder$1.create().table("person").where({ id: this.personId }).values({
+      mfa_grace_until: this.graceUntil
+    }).execute(db);
+  }
+}
+export {
+  SetMfaGraceUntilCommand
+};
+//# sourceMappingURL=SetMfaGraceUntilCommand.js.map

package/dist/development/src/model/commands/person/SetMfaGraceUntilCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SetMfaGraceUntilCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/SetMfaGraceUntilCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/** Sets `person.mfa_grace_until` (the anchor for the MFA enrollment grace window). */\nexport class SetMfaGraceUntilCommand implements Command<void> {\n\tconstructor(private readonly personId: string, private readonly graceUntil: Date) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.where({ id: this.personId })\n\t\t\t.values({\n\t\t\t\tmfa_grace_until: this.graceUntil,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAIO,MAAM,wBAAiD;AAAA,EAC7D,YAA6B,UAAmC,YAAkB;AAArD,SAAA,WAAA;AAAmC,SAAA,aAAA;AAAA,EAAmB;AAAA,EAEnF,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,gBAAc,SAClB,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,KAAK,SAAA,CAAU,EAC3B,OAAO;AAAA,MACP,iBAAiB,KAAK;AAAA,IAAA,CACtB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/person/TogglePersonPasswordlessCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"TogglePersonPasswordlessCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/TogglePersonPasswordlessCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class TogglePersonPasswordlessCommand implements Command<void> {\n\tconstructor(private readonly personId: string, private readonly value: boolean | null) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.values({\n\t\t\t\tpasswordless_enabled: this.value,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.personId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,gCAAyD;AAAA,EACrE,YAA6B,UAAmC,OAAuB;AAA1D,SAAA,WAAA;AAAmC,SAAA,QAAA;AAAA,EAAwB;AAAA,EAExF,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM,QAAQ,EACd,OAAO;AAAA,MACP,sBAAsB,KAAK;AAAA,IAAA,CAC3B,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"TogglePersonPasswordlessCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/TogglePersonPasswordlessCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class TogglePersonPasswordlessCommand implements Command<void> {\n\tconstructor(private readonly personId: string, private readonly value: boolean | null) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.values({\n\t\t\t\tpasswordless_enabled: this.value,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.personId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,gCAAyD;AAAA,EACrE,YAA6B,UAAmC,OAAuB;AAA1D,SAAA,WAAA;AAAmC,SAAA,QAAA;AAAA,EAAwB;AAAA,EAExF,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM,QAAQ,EACd,OAAO;AAAA,MACP,sBAAsB,KAAK;AAAA,IAAA,CAC3B,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/person/TogglePersonPasswordlessCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"TogglePersonPasswordlessCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/TogglePersonPasswordlessCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class TogglePersonPasswordlessCommand implements Command<void> {\n\tconstructor(private readonly personId: string, private readonly value: boolean | null) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.values({\n\t\t\t\tpasswordless_enabled: this.value,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.personId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,gCAAyD;AAAA,EACrE,YAA6B,UAAmC,OAAuB;AAA1D,SAAA,WAAA;AAAmC,SAAA,QAAA;AAAA,EAAwB;AAAA,EAExF,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,gBAAc,OAAA,EAClB,MAAM,QAAQ,EACd,OAAO;AAAA,MACP,sBAAsB,KAAK;AAAA,IAAA,CAC3B,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"TogglePersonPasswordlessCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/TogglePersonPasswordlessCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class TogglePersonPasswordlessCommand implements Command<void> {\n\tconstructor(private readonly personId: string, private readonly value: boolean | null) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.values({\n\t\t\t\tpasswordless_enabled: this.value,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.personId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,gCAAyD;AAAA,EACrE,YAA6B,UAAmC,OAAuB;AAA1D,SAAA,WAAA;AAAmC,SAAA,QAAA;AAAA,EAAwB;AAAA,EAExF,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,gBAAc,OAAA,EAClB,MAAM,QAAQ,EACd,OAAO;AAAA,MACP,sBAAsB,KAAK;AAAA,IAAA,CAC3B,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/personToken/ActivateOtpCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ActivateOtpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ActivateOtpCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions'\n\nexport class ActivateOtpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly otpHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\totp_hash: this.otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder","ImplementationException"],"mappings":";;;;AAIO,MAAM,mBAA4C;AAAA,EACxD,YACkB,IACA,SAChB;AAFgB,SAAA,KAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,SAAAA,cAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,UAAU,KAAK;AAAA,IAAA,CACf,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAIC,WAAAA,wBAAA;AAAA,IACX;AAAA,EACD;AACD;;"}
+{"version":3,"file":"ActivateOtpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ActivateOtpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ActivateOtpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly otpHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\totp_hash: this.otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder","ImplementationException"],"mappings":";;;;AAIO,MAAM,mBAA4C;AAAA,EACxD,YACkB,IACA,SAChB;AAFgB,SAAA,KAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,SAAAA,cAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,UAAU,KAAK;AAAA,IAAA,CACf,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAIC,WAAAA,wBAAA;AAAA,IACX;AAAA,EACD;AACD;;"}

package/dist/development/src/model/commands/personToken/ActivateOtpCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"ActivateOtpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ActivateOtpCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions'\n\nexport class ActivateOtpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly otpHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\totp_hash: this.otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAIO,MAAM,mBAA4C;AAAA,EACxD,YACkB,IACA,SAChB;AAFgB,SAAA,KAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,gBAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,UAAU,KAAK;AAAA,IAAA,CACf,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAI,wBAAA;AAAA,IACX;AAAA,EACD;AACD;"}
+{"version":3,"file":"ActivateOtpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ActivateOtpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ActivateOtpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly otpHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\totp_hash: this.otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAIO,MAAM,mBAA4C;AAAA,EACxD,YACkB,IACA,SAChB;AAFgB,SAAA,KAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,gBAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,UAAU,KAAK;AAAA,IAAA,CACf,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAI,wBAAA;AAAA,IACX;AAAA,EACD;AACD;"}

package/dist/development/src/model/commands/personToken/ClaimOtpAttemptCommand.cjs

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class ClaimOtpAttemptCommand {
+  constructor(id, maxAttempts) {
+    this.id = id;
+    this.maxAttempts = maxAttempts;
+  }
+  async execute({ db }) {
+    const affected = await Database.UpdateBuilder.create().table("person_token").values({
+      otp_attempts: new Database.Literal("otp_attempts + 1")
+    }).where({ id: this.id }).where((expr) => expr.isNull("used_at")).where((expr) => expr.compare("otp_attempts", Database.Operator.lt, this.maxAttempts)).execute(db);
+    return affected > 0;
+  }
+}
+exports.ClaimOtpAttemptCommand = ClaimOtpAttemptCommand;
+//# sourceMappingURL=ClaimOtpAttemptCommand.cjs.map

package/dist/development/src/model/commands/personToken/ClaimOtpAttemptCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimOtpAttemptCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ClaimOtpAttemptCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { Literal, Operator, UpdateBuilder } from '@contember/database'\n\n/**\n * Atomically reserves one OTP guess slot for a `person_token`: increments\n * `otp_attempts` only while the token is still unused and below `maxAttempts`,\n * and reports whether a slot was actually reserved (affected-row count).\n *\n * Unlike a read-then-increment, the conditional UPDATE serializes concurrent\n * writers on the row (under READ COMMITTED), so parallel guesses can never\n * collectively exceed `maxAttempts`. A `false` result means the token was already\n * used/replaced or the per-code attempt cap is exhausted.\n */\nexport class ClaimOtpAttemptCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly maxAttempts: number,\n\t) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst affected = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.values({\n\t\t\t\totp_attempts: new Literal('otp_attempts + 1'),\n\t\t\t})\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.where(expr => expr.compare('otp_attempts', Operator.lt, this.maxAttempts))\n\t\t\t.execute(db)\n\n\t\treturn affected > 0\n\t}\n}\n"],"names":["UpdateBuilder","Literal","Operator"],"mappings":";;;AAaO,MAAM,uBAAmD;AAAA,EAC/D,YACkB,IACA,aAChB;AAFgB,SAAA,KAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,WAAW,MAAMA,uBAAc,OAAA,EACnC,MAAM,cAAc,EACpB,OAAO;AAAA,MACP,cAAc,IAAIC,SAAAA,QAAQ,kBAAkB;AAAA,IAAA,CAC5C,EACA,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,MAAM,CAAA,SAAQ,KAAK,QAAQ,gBAAgBC,SAAAA,SAAS,IAAI,KAAK,WAAW,CAAC,EACzE,QAAQ,EAAE;AAEZ,WAAO,WAAW;AAAA,EACnB;AACD;;"}

package/dist/development/src/model/commands/personToken/ClaimOtpAttemptCommand.js

@@ -0,0 +1,17 @@
+import { UpdateBuilder as UpdateBuilder$1, Literal, Operator } from "@contember/database";
+class ClaimOtpAttemptCommand {
+  constructor(id, maxAttempts) {
+    this.id = id;
+    this.maxAttempts = maxAttempts;
+  }
+  async execute({ db }) {
+    const affected = await UpdateBuilder$1.create().table("person_token").values({
+      otp_attempts: new Literal("otp_attempts + 1")
+    }).where({ id: this.id }).where((expr) => expr.isNull("used_at")).where((expr) => expr.compare("otp_attempts", Operator.lt, this.maxAttempts)).execute(db);
+    return affected > 0;
+  }
+}
+export {
+  ClaimOtpAttemptCommand
+};
+//# sourceMappingURL=ClaimOtpAttemptCommand.js.map

package/dist/development/src/model/commands/personToken/ClaimOtpAttemptCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimOtpAttemptCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ClaimOtpAttemptCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { Literal, Operator, UpdateBuilder } from '@contember/database'\n\n/**\n * Atomically reserves one OTP guess slot for a `person_token`: increments\n * `otp_attempts` only while the token is still unused and below `maxAttempts`,\n * and reports whether a slot was actually reserved (affected-row count).\n *\n * Unlike a read-then-increment, the conditional UPDATE serializes concurrent\n * writers on the row (under READ COMMITTED), so parallel guesses can never\n * collectively exceed `maxAttempts`. A `false` result means the token was already\n * used/replaced or the per-code attempt cap is exhausted.\n */\nexport class ClaimOtpAttemptCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly maxAttempts: number,\n\t) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst affected = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.values({\n\t\t\t\totp_attempts: new Literal('otp_attempts + 1'),\n\t\t\t})\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.where(expr => expr.compare('otp_attempts', Operator.lt, this.maxAttempts))\n\t\t\t.execute(db)\n\n\t\treturn affected > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAaO,MAAM,uBAAmD;AAAA,EAC/D,YACkB,IACA,aAChB;AAFgB,SAAA,KAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,WAAW,MAAMA,gBAAc,OAAA,EACnC,MAAM,cAAc,EACpB,OAAO;AAAA,MACP,cAAc,IAAI,QAAQ,kBAAkB;AAAA,IAAA,CAC5C,EACA,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,MAAM,CAAA,SAAQ,KAAK,QAAQ,gBAAgB,SAAS,IAAI,KAAK,WAAW,CAAC,EACzE,QAAQ,EAAE;AAEZ,WAAO,WAAW;AAAA,EACnB;AACD;"}

package/dist/development/src/model/commands/personToken/CreatePersonTokenCommand.cjs

@@ -6,10 +6,11 @@ const SavePersonTokenCommand = require("./SavePersonTokenCommand.cjs");
 const expirations = require("../../consts/expirations.cjs");
 const token = require("../../utils/token.cjs");
 class CreatePersonTokenCommand {
-  constructor(personId, type, expirationMinutes) {
+  constructor(personId, type, expirationMinutes, meta = null) {
     this.personId = personId;
     this.type = type;
     this.expirationMinutes = expirationMinutes;
+    this.meta = meta;
   }
   static createPasswordResetRequest(personId, expirationMinutes = expirations.PASSWORD_RESET_EXPIRATION_MINUTES) {
     return new CreatePersonTokenCommand(personId, "password_reset", expirationMinutes);
@@ -17,6 +18,12 @@ class CreatePersonTokenCommand {
   static createPasswordlessRequest(personId, expirationMinutes) {
     return new CreatePersonTokenCommand(personId, "passwordless", expirationMinutes);
   }
+  static createEmailVerificationRequest(personId, email, expirationMinutes = expirations.EMAIL_VERIFICATION_EXPIRATION_MINUTES) {
+    return new CreatePersonTokenCommand(personId, "email_verification", expirationMinutes, { email });
+  }
+  static createEmailChangeRequest(personId, newEmail, expirationMinutes = expirations.EMAIL_CHANGE_EXPIRATION_MINUTES) {
+    return new CreatePersonTokenCommand(personId, "email_change", expirationMinutes, { email: newEmail });
+  }
   async execute({ db, providers, bus }) {
     const token$1 = await token.generateToken(providers);
     const tokenHash = token.computeTokenHash(token$1);
@@ -25,7 +32,8 @@ class CreatePersonTokenCommand {
         this.personId,
         tokenHash,
         this.type,
-        this.expirationMinutes
+        this.expirationMinutes,
+        this.meta
       )
     );
     return { ...result, token: token$1 };

package/dist/development/src/model/commands/personToken/CreatePersonTokenCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreatePersonTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/CreatePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { computeTokenHash, generateToken } from '../../utils'\nimport { SavePersonTokenCommand } from './SavePersonTokenCommand'\nimport { PersonToken } from '../../type'\nimport { PASSWORD_RESET_EXPIRATION_MINUTES } from '../../consts/expirations'\n\nexport class CreatePersonTokenCommand implements Command<CreatePersonTokenCommand.Result> {\n\tprivate constructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tstatic createPasswordResetRequest(personId: string, expirationMinutes: number = PASSWORD_RESET_EXPIRATION_MINUTES): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'password_reset', expirationMinutes)\n\t}\n\n\tstatic createPasswordlessRequest(personId: string, expirationMinutes: number): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'passwordless', expirationMinutes)\n\t}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<CreatePersonTokenCommand.Result> {\n\t\tconst token = await generateToken(providers)\n\t\tconst tokenHash = computeTokenHash(token)\n\t\tconst result = await bus.execute(\n\t\t\tnew SavePersonTokenCommand(\n\t\t\t\tthis.personId,\n\t\t\t\ttokenHash,\n\t\t\t\tthis.type,\n\t\t\t\tthis.expirationMinutes,\n\t\t\t),\n\t\t)\n\n\t\treturn { ...result, token }\n\t}\n}\n\nnamespace CreatePersonTokenCommand {\n\texport interface Result {\n\t\treadonly id: string\n\t\treadonly token: string\n\t\treadonly expiresAt: Date\n\t}\n}\n"],"names":["PASSWORD_RESET_EXPIRATION_MINUTES","token","generateToken","computeTokenHash","SavePersonTokenCommand"],"mappings":";;;;;;;AAMO,MAAM,yBAA6E;AAAA,EACjF,YACU,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,OAAO,2BAA2B,UAAkB,oBAA4BA,+CAA6D;AAC5I,WAAO,IAAI,yBAAyB,UAAU,kBAAkB,iBAAiB;AAAA,EAClF;AAAA,EAEA,OAAO,0BAA0B,UAAkB,mBAAqD;AACvG,WAAO,IAAI,yBAAyB,UAAU,gBAAgB,iBAAiB;AAAA,EAChF;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA+D;AAC7F,UAAMC,UAAQ,MAAMC,MAAAA,cAAc,SAAS;AAC3C,UAAM,YAAYC,MAAAA,iBAAiBF,OAAK;AACxC,UAAM,SAAS,MAAM,IAAI;AAAA,MACxB,IAAIG,uBAAAA;AAAAA,QACH,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,QACL,KAAK;AAAA,MAAA;AAAA,IACN;AAGD,WAAO,EAAE,GAAG,QAAA,OAAQH,QAAA;AAAA,EACrB;AACD;;"}
+{"version":3,"file":"CreatePersonTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/CreatePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { computeTokenHash, generateToken } from '../../utils/index.js'\nimport { SavePersonTokenCommand } from './SavePersonTokenCommand.js'\nimport { PersonToken } from '../../type/index.js'\nimport { JSONValue } from '@contember/schema'\nimport {\n\tEMAIL_CHANGE_EXPIRATION_MINUTES,\n\tEMAIL_VERIFICATION_EXPIRATION_MINUTES,\n\tPASSWORD_RESET_EXPIRATION_MINUTES,\n} from '../../consts/expirations.js'\n\nexport class CreatePersonTokenCommand implements Command<CreatePersonTokenCommand.Result> {\n\tprivate constructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t\tprivate readonly meta: JSONValue | null = null,\n\t) {}\n\n\tstatic createPasswordResetRequest(personId: string, expirationMinutes: number = PASSWORD_RESET_EXPIRATION_MINUTES): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'password_reset', expirationMinutes)\n\t}\n\n\tstatic createPasswordlessRequest(personId: string, expirationMinutes: number): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'passwordless', expirationMinutes)\n\t}\n\n\tstatic createEmailVerificationRequest(\n\t\tpersonId: string,\n\t\temail: string,\n\t\texpirationMinutes: number = EMAIL_VERIFICATION_EXPIRATION_MINUTES,\n\t): CreatePersonTokenCommand {\n\t\t// Bind the token to the address it was issued for, so it can only verify\n\t\t// that exact e-mail — not whatever the person's current address happens to\n\t\t// be when the link is finally clicked (see EmailVerificationManager.verifyEmail).\n\t\treturn new CreatePersonTokenCommand(personId, 'email_verification', expirationMinutes, { email })\n\t}\n\n\tstatic createEmailChangeRequest(\n\t\tpersonId: string,\n\t\tnewEmail: string,\n\t\texpirationMinutes: number = EMAIL_CHANGE_EXPIRATION_MINUTES,\n\t): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'email_change', expirationMinutes, { email: newEmail })\n\t}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<CreatePersonTokenCommand.Result> {\n\t\tconst token = await generateToken(providers)\n\t\tconst tokenHash = computeTokenHash(token)\n\t\tconst result = await bus.execute(\n\t\t\tnew SavePersonTokenCommand(\n\t\t\t\tthis.personId,\n\t\t\t\ttokenHash,\n\t\t\t\tthis.type,\n\t\t\t\tthis.expirationMinutes,\n\t\t\t\tthis.meta,\n\t\t\t),\n\t\t)\n\n\t\treturn { ...result, token }\n\t}\n}\n\nnamespace CreatePersonTokenCommand {\n\texport interface Result {\n\t\treadonly id: string\n\t\treadonly token: string\n\t\treadonly expiresAt: Date\n\t}\n}\n"],"names":["PASSWORD_RESET_EXPIRATION_MINUTES","EMAIL_VERIFICATION_EXPIRATION_MINUTES","EMAIL_CHANGE_EXPIRATION_MINUTES","token","generateToken","computeTokenHash","SavePersonTokenCommand"],"mappings":";;;;;;;AAWO,MAAM,yBAA6E;AAAA,EACjF,YACU,UACA,MACA,mBACA,OAAyB,MACzC;AAJgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AACA,SAAA,OAAA;AAAA,EACf;AAAA,EAEH,OAAO,2BAA2B,UAAkB,oBAA4BA,+CAA6D;AAC5I,WAAO,IAAI,yBAAyB,UAAU,kBAAkB,iBAAiB;AAAA,EAClF;AAAA,EAEA,OAAO,0BAA0B,UAAkB,mBAAqD;AACvG,WAAO,IAAI,yBAAyB,UAAU,gBAAgB,iBAAiB;AAAA,EAChF;AAAA,EAEA,OAAO,+BACN,UACA,OACA,oBAA4BC,YAAAA,uCACD;AAI3B,WAAO,IAAI,yBAAyB,UAAU,sBAAsB,mBAAmB,EAAE,OAAO;AAAA,EACjG;AAAA,EAEA,OAAO,yBACN,UACA,UACA,oBAA4BC,YAAAA,iCACD;AAC3B,WAAO,IAAI,yBAAyB,UAAU,gBAAgB,mBAAmB,EAAE,OAAO,UAAU;AAAA,EACrG;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA+D;AAC7F,UAAMC,UAAQ,MAAMC,MAAAA,cAAc,SAAS;AAC3C,UAAM,YAAYC,MAAAA,iBAAiBF,OAAK;AACxC,UAAM,SAAS,MAAM,IAAI;AAAA,MACxB,IAAIG,uBAAAA;AAAAA,QACH,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,MAAA;AAAA,IACN;AAGD,WAAO,EAAE,GAAG,QAAA,OAAQH,QAAA;AAAA,EACrB;AACD;;"}

package/dist/development/src/model/commands/personToken/CreatePersonTokenCommand.js

@@ -1,13 +1,14 @@
 import "@contember/database";
 import "../../type/ApiKey.js";
 import { SavePersonTokenCommand } from "./SavePersonTokenCommand.js";
-import { PASSWORD_RESET_EXPIRATION_MINUTES } from "../../consts/expirations.js";
+import { PASSWORD_RESET_EXPIRATION_MINUTES, EMAIL_VERIFICATION_EXPIRATION_MINUTES, EMAIL_CHANGE_EXPIRATION_MINUTES } from "../../consts/expirations.js";
 import { generateToken, computeTokenHash } from "../../utils/token.js";
 class CreatePersonTokenCommand {
-  constructor(personId, type, expirationMinutes) {
+  constructor(personId, type, expirationMinutes, meta = null) {
     this.personId = personId;
     this.type = type;
     this.expirationMinutes = expirationMinutes;
+    this.meta = meta;
   }
   static createPasswordResetRequest(personId, expirationMinutes = PASSWORD_RESET_EXPIRATION_MINUTES) {
     return new CreatePersonTokenCommand(personId, "password_reset", expirationMinutes);
@@ -15,6 +16,12 @@ class CreatePersonTokenCommand {
   static createPasswordlessRequest(personId, expirationMinutes) {
     return new CreatePersonTokenCommand(personId, "passwordless", expirationMinutes);
   }
+  static createEmailVerificationRequest(personId, email, expirationMinutes = EMAIL_VERIFICATION_EXPIRATION_MINUTES) {
+    return new CreatePersonTokenCommand(personId, "email_verification", expirationMinutes, { email });
+  }
+  static createEmailChangeRequest(personId, newEmail, expirationMinutes = EMAIL_CHANGE_EXPIRATION_MINUTES) {
+    return new CreatePersonTokenCommand(personId, "email_change", expirationMinutes, { email: newEmail });
+  }
   async execute({ db, providers, bus }) {
     const token = await generateToken(providers);
     const tokenHash = computeTokenHash(token);
@@ -23,7 +30,8 @@ class CreatePersonTokenCommand {
         this.personId,
         tokenHash,
         this.type,
-        this.expirationMinutes
+        this.expirationMinutes,
+        this.meta
       )
     );
     return { ...result, token };

package/dist/development/src/model/commands/personToken/CreatePersonTokenCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreatePersonTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/CreatePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { computeTokenHash, generateToken } from '../../utils'\nimport { SavePersonTokenCommand } from './SavePersonTokenCommand'\nimport { PersonToken } from '../../type'\nimport { PASSWORD_RESET_EXPIRATION_MINUTES } from '../../consts/expirations'\n\nexport class CreatePersonTokenCommand implements Command<CreatePersonTokenCommand.Result> {\n\tprivate constructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tstatic createPasswordResetRequest(personId: string, expirationMinutes: number = PASSWORD_RESET_EXPIRATION_MINUTES): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'password_reset', expirationMinutes)\n\t}\n\n\tstatic createPasswordlessRequest(personId: string, expirationMinutes: number): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'passwordless', expirationMinutes)\n\t}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<CreatePersonTokenCommand.Result> {\n\t\tconst token = await generateToken(providers)\n\t\tconst tokenHash = computeTokenHash(token)\n\t\tconst result = await bus.execute(\n\t\t\tnew SavePersonTokenCommand(\n\t\t\t\tthis.personId,\n\t\t\t\ttokenHash,\n\t\t\t\tthis.type,\n\t\t\t\tthis.expirationMinutes,\n\t\t\t),\n\t\t)\n\n\t\treturn { ...result, token }\n\t}\n}\n\nnamespace CreatePersonTokenCommand {\n\texport interface Result {\n\t\treadonly id: string\n\t\treadonly token: string\n\t\treadonly expiresAt: Date\n\t}\n}\n"],"names":[],"mappings":";;;;;AAMO,MAAM,yBAA6E;AAAA,EACjF,YACU,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,OAAO,2BAA2B,UAAkB,oBAA4B,mCAA6D;AAC5I,WAAO,IAAI,yBAAyB,UAAU,kBAAkB,iBAAiB;AAAA,EAClF;AAAA,EAEA,OAAO,0BAA0B,UAAkB,mBAAqD;AACvG,WAAO,IAAI,yBAAyB,UAAU,gBAAgB,iBAAiB;AAAA,EAChF;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA+D;AAC7F,UAAM,QAAQ,MAAM,cAAc,SAAS;AAC3C,UAAM,YAAY,iBAAiB,KAAK;AACxC,UAAM,SAAS,MAAM,IAAI;AAAA,MACxB,IAAI;AAAA,QACH,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,QACL,KAAK;AAAA,MAAA;AAAA,IACN;AAGD,WAAO,EAAE,GAAG,QAAQ,MAAA;AAAA,EACrB;AACD;"}
+{"version":3,"file":"CreatePersonTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/CreatePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { computeTokenHash, generateToken } from '../../utils/index.js'\nimport { SavePersonTokenCommand } from './SavePersonTokenCommand.js'\nimport { PersonToken } from '../../type/index.js'\nimport { JSONValue } from '@contember/schema'\nimport {\n\tEMAIL_CHANGE_EXPIRATION_MINUTES,\n\tEMAIL_VERIFICATION_EXPIRATION_MINUTES,\n\tPASSWORD_RESET_EXPIRATION_MINUTES,\n} from '../../consts/expirations.js'\n\nexport class CreatePersonTokenCommand implements Command<CreatePersonTokenCommand.Result> {\n\tprivate constructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t\tprivate readonly meta: JSONValue | null = null,\n\t) {}\n\n\tstatic createPasswordResetRequest(personId: string, expirationMinutes: number = PASSWORD_RESET_EXPIRATION_MINUTES): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'password_reset', expirationMinutes)\n\t}\n\n\tstatic createPasswordlessRequest(personId: string, expirationMinutes: number): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'passwordless', expirationMinutes)\n\t}\n\n\tstatic createEmailVerificationRequest(\n\t\tpersonId: string,\n\t\temail: string,\n\t\texpirationMinutes: number = EMAIL_VERIFICATION_EXPIRATION_MINUTES,\n\t): CreatePersonTokenCommand {\n\t\t// Bind the token to the address it was issued for, so it can only verify\n\t\t// that exact e-mail — not whatever the person's current address happens to\n\t\t// be when the link is finally clicked (see EmailVerificationManager.verifyEmail).\n\t\treturn new CreatePersonTokenCommand(personId, 'email_verification', expirationMinutes, { email })\n\t}\n\n\tstatic createEmailChangeRequest(\n\t\tpersonId: string,\n\t\tnewEmail: string,\n\t\texpirationMinutes: number = EMAIL_CHANGE_EXPIRATION_MINUTES,\n\t): CreatePersonTokenCommand {\n\t\treturn new CreatePersonTokenCommand(personId, 'email_change', expirationMinutes, { email: newEmail })\n\t}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<CreatePersonTokenCommand.Result> {\n\t\tconst token = await generateToken(providers)\n\t\tconst tokenHash = computeTokenHash(token)\n\t\tconst result = await bus.execute(\n\t\t\tnew SavePersonTokenCommand(\n\t\t\t\tthis.personId,\n\t\t\t\ttokenHash,\n\t\t\t\tthis.type,\n\t\t\t\tthis.expirationMinutes,\n\t\t\t\tthis.meta,\n\t\t\t),\n\t\t)\n\n\t\treturn { ...result, token }\n\t}\n}\n\nnamespace CreatePersonTokenCommand {\n\texport interface Result {\n\t\treadonly id: string\n\t\treadonly token: string\n\t\treadonly expiresAt: Date\n\t}\n}\n"],"names":[],"mappings":";;;;;AAWO,MAAM,yBAA6E;AAAA,EACjF,YACU,UACA,MACA,mBACA,OAAyB,MACzC;AAJgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AACA,SAAA,OAAA;AAAA,EACf;AAAA,EAEH,OAAO,2BAA2B,UAAkB,oBAA4B,mCAA6D;AAC5I,WAAO,IAAI,yBAAyB,UAAU,kBAAkB,iBAAiB;AAAA,EAClF;AAAA,EAEA,OAAO,0BAA0B,UAAkB,mBAAqD;AACvG,WAAO,IAAI,yBAAyB,UAAU,gBAAgB,iBAAiB;AAAA,EAChF;AAAA,EAEA,OAAO,+BACN,UACA,OACA,oBAA4B,uCACD;AAI3B,WAAO,IAAI,yBAAyB,UAAU,sBAAsB,mBAAmB,EAAE,OAAO;AAAA,EACjG;AAAA,EAEA,OAAO,yBACN,UACA,UACA,oBAA4B,iCACD;AAC3B,WAAO,IAAI,yBAAyB,UAAU,gBAAgB,mBAAmB,EAAE,OAAO,UAAU;AAAA,EACrG;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA+D;AAC7F,UAAM,QAAQ,MAAM,cAAc,SAAS;AAC3C,UAAM,YAAY,iBAAiB,KAAK;AACxC,UAAM,SAAS,MAAM,IAAI;AAAA,MACxB,IAAI;AAAA,QACH,KAAK;AAAA,QACL;AAAA,QACA,KAAK;AAAA,QACL,KAAK;AAAA,QACL,KAAK;AAAA,MAAA;AAAA,IACN;AAGD,WAAO,EAAE,GAAG,QAAQ,MAAA;AAAA,EACrB;AACD;"}

package/dist/development/src/model/commands/personToken/IncreaseOtpAttemptCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IncreaseOtpAttemptCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/IncreaseOtpAttemptCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { Literal, UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions'\n\nexport class IncreaseOtpAttemptCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\totp_attempts: new Literal('otp_attempts + 1'),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder","Literal","ImplementationException"],"mappings":";;;;AAIO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,IAChB;AADgB,SAAA,KAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,SAAAA,cAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,cAAc,IAAIC,SAAAA,QAAQ,kBAAkB;AAAA,IAAA,CAC5C,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAIC,WAAAA,wBAAA;AAAA,IACX;AAAA,EACD;AACD;;"}
+{"version":3,"file":"IncreaseOtpAttemptCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/IncreaseOtpAttemptCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { Literal, UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class IncreaseOtpAttemptCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\totp_attempts: new Literal('otp_attempts + 1'),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder","Literal","ImplementationException"],"mappings":";;;;AAIO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,IAChB;AADgB,SAAA,KAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,SAAAA,cAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,cAAc,IAAIC,SAAAA,QAAQ,kBAAkB;AAAA,IAAA,CAC5C,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAIC,WAAAA,wBAAA;AAAA,IACX;AAAA,EACD;AACD;;"}

package/dist/development/src/model/commands/personToken/IncreaseOtpAttemptCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"IncreaseOtpAttemptCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/IncreaseOtpAttemptCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { Literal, UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions'\n\nexport class IncreaseOtpAttemptCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\totp_attempts: new Literal('otp_attempts + 1'),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAIO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,IAChB;AADgB,SAAA,KAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,gBAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,cAAc,IAAI,QAAQ,kBAAkB;AAAA,IAAA,CAC5C,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAI,wBAAA;AAAA,IACX;AAAA,EACD;AACD;"}
+{"version":3,"file":"IncreaseOtpAttemptCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/IncreaseOtpAttemptCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { Literal, UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class IncreaseOtpAttemptCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\totp_attempts: new Literal('otp_attempts + 1'),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAIO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,IAChB;AADgB,SAAA,KAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,gBAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,cAAc,IAAI,QAAQ,kBAAkB;AAAA,IAAA,CAC5C,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAI,wBAAA;AAAA,IACX;AAAA,EACD;AACD;"}

package/dist/development/src/model/commands/personToken/InvalidateEmailOtpTokensCommand.cjs

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class InvalidateEmailOtpTokensCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db, providers }) {
+    await Database.UpdateBuilder.create().table("person_token").where({ person_id: this.personId, type: "mfa_email_otp" }).where((expr) => expr.isNull("used_at")).values({
+      used_at: providers.now()
+    }).execute(db);
+  }
+}
+exports.InvalidateEmailOtpTokensCommand = InvalidateEmailOtpTokensCommand;
+//# sourceMappingURL=InvalidateEmailOtpTokensCommand.cjs.map

package/dist/development/src/model/commands/personToken/InvalidateEmailOtpTokensCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"InvalidateEmailOtpTokensCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/InvalidateEmailOtpTokensCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Marks all still-unused `mfa_email_otp` tokens of a person as used. Called before\n * issuing a fresh code so only the latest emailed code can ever verify.\n */\nexport class InvalidateEmailOtpTokensCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ person_id: this.personId, type: 'mfa_email_otp' })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.values({\n\t\t\t\tused_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAOO,MAAM,gCAAyD;AAAA,EACrE,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,SAClB,MAAM,cAAc,EACpB,MAAM,EAAE,WAAW,KAAK,UAAU,MAAM,gBAAA,CAAiB,EACzD,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,OAAO;AAAA,MACP,SAAS,UAAU,IAAA;AAAA,IAAI,CACvB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/personToken/InvalidateEmailOtpTokensCommand.js

@@ -0,0 +1,15 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class InvalidateEmailOtpTokensCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db, providers }) {
+    await UpdateBuilder$1.create().table("person_token").where({ person_id: this.personId, type: "mfa_email_otp" }).where((expr) => expr.isNull("used_at")).values({
+      used_at: providers.now()
+    }).execute(db);
+  }
+}
+export {
+  InvalidateEmailOtpTokensCommand
+};
+//# sourceMappingURL=InvalidateEmailOtpTokensCommand.js.map

package/dist/development/src/model/commands/personToken/InvalidateEmailOtpTokensCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InvalidateEmailOtpTokensCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/InvalidateEmailOtpTokensCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Marks all still-unused `mfa_email_otp` tokens of a person as used. Called before\n * issuing a fresh code so only the latest emailed code can ever verify.\n */\nexport class InvalidateEmailOtpTokensCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ person_id: this.personId, type: 'mfa_email_otp' })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.values({\n\t\t\t\tused_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAOO,MAAM,gCAAyD;AAAA,EACrE,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,SAClB,MAAM,cAAc,EACpB,MAAM,EAAE,WAAW,KAAK,UAAU,MAAM,gBAAA,CAAiB,EACzD,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,OAAO;AAAA,MACP,SAAS,UAAU,IAAA;AAAA,IAAI,CACvB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/personToken/InvalidateTokenCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"InvalidateTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/InvalidateTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions'\n\nexport class InvalidateTokenCommand implements Command<void> {\n\tconstructor(private readonly id: string) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.values({\n\t\t\t\tused_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder","ImplementationException"],"mappings":";;;;AAIO,MAAM,uBAAgD;AAAA,EAC5D,YAA6B,IAAY;AAAZ,SAAA,KAAA;AAAA,EAAa;AAAA,EAE1C,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,SAAAA,cAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,OAAO;AAAA,MACP,SAAS,UAAU,IAAA;AAAA,IAAI,CACvB,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAIC,WAAAA,wBAAA;AAAA,IACX;AAAA,EACD;AACD;;"}
+{"version":3,"file":"InvalidateTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/InvalidateTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class InvalidateTokenCommand implements Command<void> {\n\tconstructor(private readonly id: string) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.values({\n\t\t\t\tused_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder","ImplementationException"],"mappings":";;;;AAIO,MAAM,uBAAgD;AAAA,EAC5D,YAA6B,IAAY;AAAZ,SAAA,KAAA;AAAA,EAAa;AAAA,EAE1C,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,SAAAA,cAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,OAAO;AAAA,MACP,SAAS,UAAU,IAAA;AAAA,IAAI,CACvB,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAIC,WAAAA,wBAAA;AAAA,IACX;AAAA,EACD;AACD;;"}

package/dist/development/src/model/commands/personToken/InvalidateTokenCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"InvalidateTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/InvalidateTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions'\n\nexport class InvalidateTokenCommand implements Command<void> {\n\tconstructor(private readonly id: string) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.values({\n\t\t\t\tused_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAIO,MAAM,uBAAgD;AAAA,EAC5D,YAA6B,IAAY;AAAZ,SAAA,KAAA;AAAA,EAAa;AAAA,EAE1C,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,gBAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,OAAO;AAAA,MACP,SAAS,UAAU,IAAA;AAAA,IAAI,CACvB,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAI,wBAAA;AAAA,IACX;AAAA,EACD;AACD;"}
+{"version":3,"file":"InvalidateTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/InvalidateTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class InvalidateTokenCommand implements Command<void> {\n\tconstructor(private readonly id: string) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst count = await UpdateBuilder.create()\n\t\t\t.table('person_token')\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.values({\n\t\t\t\tused_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\tif (count === 0) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAIO,MAAM,uBAAgD;AAAA,EAC5D,YAA6B,IAAY;AAAZ,SAAA,KAAA;AAAA,EAAa;AAAA,EAE1C,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,QAAQ,MAAMA,gBAAc,OAAA,EAChC,MAAM,cAAc,EACpB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,OAAO;AAAA,MACP,SAAS,UAAU,IAAA;AAAA,IAAI,CACvB,EACA,QAAQ,EAAE;AAEZ,QAAI,UAAU,GAAG;AAChB,YAAM,IAAI,wBAAA;AAAA,IACX;AAAA,EACD;AACD;"}

package/dist/development/src/model/commands/personToken/ResetPasswordCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand'\nimport { Response, ResponseOk } from '../../utils/Response'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand'\nimport { validateToken } from '../../utils'\nimport { PersonToken } from '../../type'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst now = providers.now()\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode = PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":["token","PersonTokenQuery","validateToken","InvalidateTokenCommand","ChangePasswordCommand","ResponseOk"],"mappings":";;;;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6BA,QAAgC,UAAkB;AAAlD,SAAA,QAAAA;AAAgC,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhF,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA4D;AAC1F,UAAM,MAAM,UAAU,IAAA;AACtB,UAAMA,UAAQ,MAAM,GAAG,qBAAqB,MAAMC,iBAAAA,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AACxG,UAAM,wBAAwBC,MAAAA,cAAc,EAAE,OAAOF,SAAO,OAAO,KAAK,OAAO,KAAK,gBAAgB,QAAA,CAAS;AAC7G,QAAI,CAAC,sBAAsB,IAAI;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,IAAI,QAAQ,IAAIG,uBAAAA,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AAC7E,UAAM,IAAI,QAAQ,IAAIC,4CAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAElG,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}
+{"version":3,"file":"ResetPasswordCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand.js'\nimport { Response, ResponseOk } from '../../utils/Response.js'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery.js'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand.js'\nimport { validateToken } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst now = providers.now()\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode = PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":["token","PersonTokenQuery","validateToken","InvalidateTokenCommand","ChangePasswordCommand","ResponseOk"],"mappings":";;;;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6BA,QAAgC,UAAkB;AAAlD,SAAA,QAAAA;AAAgC,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhF,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA4D;AAC1F,UAAM,MAAM,UAAU,IAAA;AACtB,UAAMA,UAAQ,MAAM,GAAG,qBAAqB,MAAMC,iBAAAA,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AACxG,UAAM,wBAAwBC,MAAAA,cAAc,EAAE,OAAOF,SAAO,OAAO,KAAK,OAAO,KAAK,gBAAgB,QAAA,CAAS;AAC7G,QAAI,CAAC,sBAAsB,IAAI;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,IAAI,QAAQ,IAAIG,uBAAAA,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AAC7E,UAAM,IAAI,QAAQ,IAAIC,4CAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAElG,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}

package/dist/development/src/model/commands/personToken/ResetPasswordCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand'\nimport { Response, ResponseOk } from '../../utils/Response'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand'\nimport { validateToken } from '../../utils'\nimport { PersonToken } from '../../type'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst now = providers.now()\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode = PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":[],"mappings":";;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6B,OAAgC,UAAkB;AAAlD,SAAA,QAAA;AAAgC,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhF,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA4D;AAC1F,UAAM,MAAM,UAAU,IAAA;AACtB,UAAM,QAAQ,MAAM,GAAG,qBAAqB,MAAM,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AACxG,UAAM,wBAAwB,cAAc,EAAE,OAAO,OAAO,OAAO,KAAK,OAAO,KAAK,gBAAgB,QAAA,CAAS;AAC7G,QAAI,CAAC,sBAAsB,IAAI;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,IAAI,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AAC7E,UAAM,IAAI,QAAQ,IAAI,sBAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAElG,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}
+{"version":3,"file":"ResetPasswordCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand.js'\nimport { Response, ResponseOk } from '../../utils/Response.js'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery.js'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand.js'\nimport { validateToken } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst now = providers.now()\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode = PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":[],"mappings":";;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6B,OAAgC,UAAkB;AAAlD,SAAA,QAAA;AAAgC,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhF,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA4D;AAC1F,UAAM,MAAM,UAAU,IAAA;AACtB,UAAM,QAAQ,MAAM,GAAG,qBAAqB,MAAM,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AACxG,UAAM,wBAAwB,cAAc,EAAE,OAAO,OAAO,OAAO,KAAK,OAAO,KAAK,gBAAgB,QAAA,CAAS;AAC7G,QAAI,CAAC,sBAAsB,IAAI;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,IAAI,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AAC7E,UAAM,IAAI,QAAQ,IAAI,sBAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAElG,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}

package/dist/development/src/model/commands/personToken/SaveEmailOtpTokenCommand.cjs

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+const time = require("../../utils/time.cjs");
+require("../../type/ApiKey.cjs");
+const token = require("../../utils/token.cjs");
+class SaveEmailOtpTokenCommand {
+  constructor(personId, code, expirationMinutes) {
+    this.personId = personId;
+    this.code = code;
+    this.expirationMinutes = expirationMinutes;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const expiresAt = time.plusMinutes(providers.now(), this.expirationMinutes);
+    const tokenHash = token.computeTokenHash(await token.generateToken(providers));
+    const otpHash = token.computeTokenHash(this.code);
+    await Database.InsertBuilder.create().into("person_token").values({
+      id,
+      token_hash: tokenHash,
+      person_id: this.personId,
+      expires_at: expiresAt,
+      created_at: providers.now(),
+      used_at: null,
+      type: "mfa_email_otp",
+      otp_hash: otpHash
+    }).execute(db);
+    return { id, expiresAt };
+  }
+}
+exports.SaveEmailOtpTokenCommand = SaveEmailOtpTokenCommand;
+//# sourceMappingURL=SaveEmailOtpTokenCommand.cjs.map

package/dist/development/src/model/commands/personToken/SaveEmailOtpTokenCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SaveEmailOtpTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SaveEmailOtpTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\n\n/**\n * Creates an `mfa_email_otp` person_token carrying a 6-digit code in `otp_hash`.\n *\n * Unlike the passwordless flow there is no magic-link step, so the code itself is\n * the only secret — it is validated via {@link validateToken}'s `'otp'` path. The\n * `token_hash` column is NOT NULL and UNIQUE, so we still fill it with a random,\n * never-used token hash to satisfy the schema.\n */\nexport class SaveEmailOtpTokenCommand implements Command<SaveEmailOtpTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly code: string,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SaveEmailOtpTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tconst tokenHash: TokenHash = computeTokenHash(await generateToken(providers))\n\t\tconst otpHash = computeTokenHash(this.code)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: 'mfa_email_otp',\n\t\t\t\totp_hash: otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SaveEmailOtpTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n"],"names":["plusMinutes","computeTokenHash","generateToken","InsertBuilder"],"mappings":";;;;;;AAaO,MAAM,yBAA6E;AAAA,EACzF,YACkB,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAqE;AACxF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAYA,KAAAA,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAM,YAAuBC,MAAAA,iBAAiB,MAAMC,MAAAA,cAAc,SAAS,CAAC;AAC5E,UAAM,UAAUD,MAAAA,iBAAiB,KAAK,IAAI;AAC1C,UAAME,SAAAA,cAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/model/commands/personToken/SaveEmailOtpTokenCommand.js

@@ -0,0 +1,32 @@
+import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+import { plusMinutes } from "../../utils/time.js";
+import "../../type/ApiKey.js";
+import { computeTokenHash, generateToken } from "../../utils/token.js";
+class SaveEmailOtpTokenCommand {
+  constructor(personId, code, expirationMinutes) {
+    this.personId = personId;
+    this.code = code;
+    this.expirationMinutes = expirationMinutes;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const expiresAt = plusMinutes(providers.now(), this.expirationMinutes);
+    const tokenHash = computeTokenHash(await generateToken(providers));
+    const otpHash = computeTokenHash(this.code);
+    await InsertBuilder$1.create().into("person_token").values({
+      id,
+      token_hash: tokenHash,
+      person_id: this.personId,
+      expires_at: expiresAt,
+      created_at: providers.now(),
+      used_at: null,
+      type: "mfa_email_otp",
+      otp_hash: otpHash
+    }).execute(db);
+    return { id, expiresAt };
+  }
+}
+export {
+  SaveEmailOtpTokenCommand
+};
+//# sourceMappingURL=SaveEmailOtpTokenCommand.js.map

package/dist/development/src/model/commands/personToken/SaveEmailOtpTokenCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SaveEmailOtpTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SaveEmailOtpTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\n\n/**\n * Creates an `mfa_email_otp` person_token carrying a 6-digit code in `otp_hash`.\n *\n * Unlike the passwordless flow there is no magic-link step, so the code itself is\n * the only secret — it is validated via {@link validateToken}'s `'otp'` path. The\n * `token_hash` column is NOT NULL and UNIQUE, so we still fill it with a random,\n * never-used token hash to satisfy the schema.\n */\nexport class SaveEmailOtpTokenCommand implements Command<SaveEmailOtpTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly code: string,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SaveEmailOtpTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tconst tokenHash: TokenHash = computeTokenHash(await generateToken(providers))\n\t\tconst otpHash = computeTokenHash(this.code)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: 'mfa_email_otp',\n\t\t\t\totp_hash: otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SaveEmailOtpTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;;AAaO,MAAM,yBAA6E;AAAA,EACzF,YACkB,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAqE;AACxF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAY,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAM,YAAuB,iBAAiB,MAAM,cAAc,SAAS,CAAC;AAC5E,UAAM,UAAU,iBAAiB,KAAK,IAAI;AAC1C,UAAMA,gBAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;"}

package/dist/development/src/model/commands/personToken/SavePersonTokenCommand.cjs

@@ -3,11 +3,12 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
 const time = require("../../utils/time.cjs");
 class SavePersonTokenCommand {
-  constructor(personId, tokenHash, type, expirationMinutes) {
+  constructor(personId, tokenHash, type, expirationMinutes, meta = null) {
     this.personId = personId;
     this.tokenHash = tokenHash;
     this.type = type;
     this.expirationMinutes = expirationMinutes;
+    this.meta = meta;
   }
   async execute({ db, providers }) {
     const id = providers.uuid();
@@ -19,7 +20,8 @@ class SavePersonTokenCommand {
       expires_at: expiresAt,
       created_at: providers.now(),
       used_at: null,
-      type: this.type
+      type: this.type,
+      meta: this.meta
     }).execute(db);
     return { id, expiresAt };
   }

package/dist/development/src/model/commands/personToken/SavePersonTokenCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SavePersonTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time'\nimport { TokenHash } from '../../utils'\nimport { PersonToken } from '../../type'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["plusMinutes","InsertBuilder"],"mappings":";;;;AAMA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBAChB;AAJgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAYA,KAAAA,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAMC,SAAAA,cAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,IAAA,CACX,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"SavePersonTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { TokenHash } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\nimport { JSONValue } from '@contember/schema'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t\tprivate readonly meta: JSONValue | null = null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t\tmeta: this.meta,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["plusMinutes","InsertBuilder"],"mappings":";;;;AAOA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBACA,OAAyB,MACzC;AALgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AACA,SAAA,OAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAYA,KAAAA,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAMC,SAAAA,cAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,IAAA,CACX,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;;"}

package/dist/development/src/model/commands/personToken/SavePersonTokenCommand.js

@@ -1,11 +1,12 @@
 import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
 import { plusMinutes } from "../../utils/time.js";
 class SavePersonTokenCommand {
-  constructor(personId, tokenHash, type, expirationMinutes) {
+  constructor(personId, tokenHash, type, expirationMinutes, meta = null) {
     this.personId = personId;
     this.tokenHash = tokenHash;
     this.type = type;
     this.expirationMinutes = expirationMinutes;
+    this.meta = meta;
   }
   async execute({ db, providers }) {
     const id = providers.uuid();
@@ -17,7 +18,8 @@ class SavePersonTokenCommand {
       expires_at: expiresAt,
       created_at: providers.now(),
       used_at: null,
-      type: this.type
+      type: this.type,
+      meta: this.meta
     }).execute(db);
     return { id, expiresAt };
   }

package/dist/development/src/model/commands/personToken/SavePersonTokenCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"SavePersonTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time'\nimport { TokenHash } from '../../utils'\nimport { PersonToken } from '../../type'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["InsertBuilder"],"mappings":";;AAMA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBAChB;AAJgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAY,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAMA,gBAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,IAAA,CACX,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"SavePersonTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { TokenHash } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\nimport { JSONValue } from '@contember/schema'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t\tprivate readonly meta: JSONValue | null = null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t\tmeta: this.meta,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["InsertBuilder"],"mappings":";;AAOA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBACA,OAAyB,MACzC;AALgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AACA,SAAA,OAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAY,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAMA,gBAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,IAAA,CACX,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;"}