@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/development/src/model/service/BackupCodeManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackupCodeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/BackupCodeManager.ts"],"sourcesContent":["import { Literal, SelectBuilder } from '@contember/database'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { ConsumeBackupCodeCommand, CreateBackupCodeCommand, DeleteBackupCodesCommand } from '../commands/index.js'\nimport { computeTokenHash } from '../utils/token.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonRow } from '../queries/index.js'\n\n/** Number of backup codes issued per generation. */\nconst BACKUP_CODE_COUNT = 10\n/** Number of significant characters per backup code (before formatting). */\nconst BACKUP_CODE_LENGTH = 10\n/**\n * Unambiguous lowercase alphabet, without the easily confused characters\n * 0/1/l/o. 32 symbols (base32-style).\n */\nconst ALPHABET = 'abcdefghijkmnpqrstuvwxyz23456789'\n\n/**\n * Manages MFA backup/recovery codes (the `person_backup_code` table).\n *\n * Codes only exist for a person who has enrolled TOTP. Behavior for everyone\n * else is unchanged. Plaintext codes are shown exactly once (on generation);\n * only their sha256 hashes are stored.\n */\nexport class BackupCodeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly providers: Pick<Providers, 'uuid' | 'now' | 'randomBytes'>,\n\t) {}\n\n\t/**\n\t * Replaces the whole set: deletes any existing codes for the person, issues\n\t * {@link BACKUP_CODE_COUNT} fresh ones, stores their hashes and returns the\n\t * formatted plaintext codes (to be shown once).\n\t */\n\tasync generate(dbContext: DatabaseContext, personId: string): Promise<string[]> {\n\t\tconst codes: string[] = []\n\t\tfor (let i = 0; i < BACKUP_CODE_COUNT; i++) {\n\t\t\tcodes.push(await this.generateCode())\n\t\t}\n\t\t// Replace the whole set atomically: a mid-flow failure must never leave the\n\t\t// person with a partial set that doesn't match the plaintext codes returned\n\t\t// to (and shown once to) the caller.\n\t\tawait dbContext.transaction(async tx => {\n\t\t\tawait tx.commandBus.execute(new DeleteBackupCodesCommand(personId))\n\t\t\tfor (const code of codes) {\n\t\t\t\t// Hash the normalized form so verification (which normalizes its input) matches.\n\t\t\t\tawait tx.commandBus.execute(new CreateBackupCodeCommand(personId, this.hash(this.normalize(code))))\n\t\t\t}\n\t\t})\n\t\treturn codes\n\t}\n\n\t/**\n\t * Normalizes the supplied code, then atomically consumes a single unused\n\t * matching code. Returns whether a code was actually consumed. Safe against\n\t * double-spend (see {@link ConsumeBackupCodeCommand}).\n\t */\n\tasync verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean> {\n\t\tconst normalized = this.normalize(code)\n\t\tif (normalized.length === 0) {\n\t\t\treturn false\n\t\t}\n\t\tconst consumed = await dbContext.commandBus.execute(new ConsumeBackupCodeCommand(person.id, this.hash(normalized)))\n\t\tif (consumed && (await this.countUnused(dbContext, person.id)) === 0) {\n\t\t\t// Best-effort: notify the person they have no backup codes left. A failed\n\t\t\t// email must never block or fail sign-in, so swallow any error.\n\t\t\ttry {\n\t\t\t\tawait this.mailer.sendBackupCodesExhaustedEmail(dbContext, { email: person.email ?? '' }, { projectId: null, variant: '' })\n\t\t\t} catch {\n\t\t\t\t// ignore\n\t\t\t}\n\t\t}\n\t\treturn consumed\n\t}\n\n\tasync deleteForPerson(dbContext: DatabaseContext, personId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DeleteBackupCodesCommand(personId))\n\t}\n\n\t/** Number of still-usable backup codes for the person. */\n\tasync countUnused(dbContext: DatabaseContext, personId: string): Promise<number> {\n\t\tconst rows = await SelectBuilder.create<{ count: string }>()\n\t\t\t.from('person_backup_code')\n\t\t\t.select(new Literal('count(*)::text as count'))\n\t\t\t.where({ person_id: personId })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.getResult(dbContext.client)\n\t\treturn Number(rows[0]?.count ?? '0')\n\t}\n\n\t/** Strips formatting (hyphens/whitespace) and lowercases — display formatting must not affect verification. */\n\tprivate normalize(code: string): string {\n\t\treturn code.replace(/[\\s-]/g, '').toLowerCase()\n\t}\n\n\tprivate hash(normalizedCode: string): string {\n\t\treturn computeTokenHash(normalizedCode)\n\t}\n\n\tprivate async generateCode(): Promise<string> {\n\t\tconst bytes = await this.providers.randomBytes(BACKUP_CODE_LENGTH)\n\t\tlet raw = ''\n\t\tfor (let i = 0; i < BACKUP_CODE_LENGTH; i++) {\n\t\t\traw += ALPHABET[bytes[i] % ALPHABET.length]\n\t\t}\n\t\t// Single hyphen in the middle for readability, e.g. \"abcde-fghij\".\n\t\tconst mid = Math.floor(BACKUP_CODE_LENGTH / 2)\n\t\treturn `${raw.slice(0, mid)}-${raw.slice(mid)}`\n\t}\n}\n"],"names":["DeleteBackupCodesCommand","CreateBackupCodeCommand","ConsumeBackupCodeCommand","SelectBuilder","Literal","computeTokenHash"],"mappings":";;;;;;;;AASA,MAAM,oBAAoB;AAE1B,MAAM,qBAAqB;AAK3B,MAAM,WAAW;AASV,MAAM,kBAAkB;AAAA,EAC9B,YACkB,QACA,WAChB;AAFgB,SAAA,SAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOH,MAAM,SAAS,WAA4B,UAAqC;AAC/E,UAAM,QAAkB,CAAA;AACxB,aAAS,IAAI,GAAG,IAAI,mBAAmB,KAAK;AAC3C,YAAM,KAAK,MAAM,KAAK,aAAA,CAAc;AAAA,IACrC;AAIA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,YAAM,GAAG,WAAW,QAAQ,IAAIA,yBAAAA,yBAAyB,QAAQ,CAAC;AAClE,iBAAW,QAAQ,OAAO;AAEzB,cAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,UAAU,KAAK,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC;AAAA,MACnG;AAAA,IACD,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBAAiB,WAA4B,QAAmB,MAAgC;AACrG,UAAM,aAAa,KAAK,UAAU,IAAI;AACtC,QAAI,WAAW,WAAW,GAAG;AAC5B,aAAO;AAAA,IACR;AACA,UAAM,WAAW,MAAM,UAAU,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,OAAO,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC;AAClH,QAAI,YAAa,MAAM,KAAK,YAAY,WAAW,OAAO,EAAE,MAAO,GAAG;AAGrE,UAAI;AACH,cAAM,KAAK,OAAO,8BAA8B,WAAW,EAAE,OAAO,OAAO,SAAS,GAAA,GAAM,EAAE,WAAW,MAAM,SAAS,IAAI;AAAA,MAC3H,QAAQ;AAAA,MAER;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,gBAAgB,WAA4B,UAAiC;AAClF,UAAM,UAAU,WAAW,QAAQ,IAAIF,yBAAAA,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AAAA;AAAA,EAGA,MAAM,YAAY,WAA4B,UAAmC;AAChF,UAAM,OAAO,MAAMG,uBAAc,OAAA,EAC/B,KAAK,oBAAoB,EACzB,OAAO,IAAIC,SAAAA,QAAQ,yBAAyB,CAAC,EAC7C,MAAM,EAAE,WAAW,SAAA,CAAU,EAC7B,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,UAAU,UAAU,MAAM;AAC5B,WAAO,OAAO,KAAK,CAAC,GAAG,SAAS,GAAG;AAAA,EACpC;AAAA;AAAA,EAGQ,UAAU,MAAsB;AACvC,WAAO,KAAK,QAAQ,UAAU,EAAE,EAAE,YAAA;AAAA,EACnC;AAAA,EAEQ,KAAK,gBAAgC;AAC5C,WAAOC,MAAAA,iBAAiB,cAAc;AAAA,EACvC;AAAA,EAEA,MAAc,eAAgC;AAC7C,UAAM,QAAQ,MAAM,KAAK,UAAU,YAAY,kBAAkB;AACjE,QAAI,MAAM;AACV,aAAS,IAAI,GAAG,IAAI,oBAAoB,KAAK;AAC5C,aAAO,SAAS,MAAM,CAAC,IAAI,SAAS,MAAM;AAAA,IAC3C;AAEA,UAAM,MAAM,KAAK,MAAM,qBAAqB,CAAC;AAC7C,WAAO,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC;AAAA,EAC9C;AACD;;"}

package/dist/development/src/model/service/BackupCodeManager.js

@@ -0,0 +1,80 @@
+import { SelectBuilder, Literal } from "@contember/database";
+import "../type/ApiKey.js";
+import { computeTokenHash } from "../utils/token.js";
+import { ConsumeBackupCodeCommand } from "../commands/backupCode/ConsumeBackupCodeCommand.js";
+import { CreateBackupCodeCommand } from "../commands/backupCode/CreateBackupCodeCommand.js";
+import { DeleteBackupCodesCommand } from "../commands/backupCode/DeleteBackupCodesCommand.js";
+const BACKUP_CODE_COUNT = 10;
+const BACKUP_CODE_LENGTH = 10;
+const ALPHABET = "abcdefghijkmnpqrstuvwxyz23456789";
+class BackupCodeManager {
+  constructor(mailer, providers) {
+    this.mailer = mailer;
+    this.providers = providers;
+  }
+  /**
+   * Replaces the whole set: deletes any existing codes for the person, issues
+   * {@link BACKUP_CODE_COUNT} fresh ones, stores their hashes and returns the
+   * formatted plaintext codes (to be shown once).
+   */
+  async generate(dbContext, personId) {
+    const codes = [];
+    for (let i = 0; i < BACKUP_CODE_COUNT; i++) {
+      codes.push(await this.generateCode());
+    }
+    await dbContext.transaction(async (tx) => {
+      await tx.commandBus.execute(new DeleteBackupCodesCommand(personId));
+      for (const code of codes) {
+        await tx.commandBus.execute(new CreateBackupCodeCommand(personId, this.hash(this.normalize(code))));
+      }
+    });
+    return codes;
+  }
+  /**
+   * Normalizes the supplied code, then atomically consumes a single unused
+   * matching code. Returns whether a code was actually consumed. Safe against
+   * double-spend (see {@link ConsumeBackupCodeCommand}).
+   */
+  async verifyAndConsume(dbContext, person, code) {
+    const normalized = this.normalize(code);
+    if (normalized.length === 0) {
+      return false;
+    }
+    const consumed = await dbContext.commandBus.execute(new ConsumeBackupCodeCommand(person.id, this.hash(normalized)));
+    if (consumed && await this.countUnused(dbContext, person.id) === 0) {
+      try {
+        await this.mailer.sendBackupCodesExhaustedEmail(dbContext, { email: person.email ?? "" }, { projectId: null, variant: "" });
+      } catch {
+      }
+    }
+    return consumed;
+  }
+  async deleteForPerson(dbContext, personId) {
+    await dbContext.commandBus.execute(new DeleteBackupCodesCommand(personId));
+  }
+  /** Number of still-usable backup codes for the person. */
+  async countUnused(dbContext, personId) {
+    const rows = await SelectBuilder.create().from("person_backup_code").select(new Literal("count(*)::text as count")).where({ person_id: personId }).where((expr) => expr.isNull("used_at")).getResult(dbContext.client);
+    return Number(rows[0]?.count ?? "0");
+  }
+  /** Strips formatting (hyphens/whitespace) and lowercases — display formatting must not affect verification. */
+  normalize(code) {
+    return code.replace(/[\s-]/g, "").toLowerCase();
+  }
+  hash(normalizedCode) {
+    return computeTokenHash(normalizedCode);
+  }
+  async generateCode() {
+    const bytes = await this.providers.randomBytes(BACKUP_CODE_LENGTH);
+    let raw = "";
+    for (let i = 0; i < BACKUP_CODE_LENGTH; i++) {
+      raw += ALPHABET[bytes[i] % ALPHABET.length];
+    }
+    const mid = Math.floor(BACKUP_CODE_LENGTH / 2);
+    return `${raw.slice(0, mid)}-${raw.slice(mid)}`;
+  }
+}
+export {
+  BackupCodeManager
+};
+//# sourceMappingURL=BackupCodeManager.js.map

package/dist/development/src/model/service/BackupCodeManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackupCodeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/BackupCodeManager.ts"],"sourcesContent":["import { Literal, SelectBuilder } from '@contember/database'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { ConsumeBackupCodeCommand, CreateBackupCodeCommand, DeleteBackupCodesCommand } from '../commands/index.js'\nimport { computeTokenHash } from '../utils/token.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonRow } from '../queries/index.js'\n\n/** Number of backup codes issued per generation. */\nconst BACKUP_CODE_COUNT = 10\n/** Number of significant characters per backup code (before formatting). */\nconst BACKUP_CODE_LENGTH = 10\n/**\n * Unambiguous lowercase alphabet, without the easily confused characters\n * 0/1/l/o. 32 symbols (base32-style).\n */\nconst ALPHABET = 'abcdefghijkmnpqrstuvwxyz23456789'\n\n/**\n * Manages MFA backup/recovery codes (the `person_backup_code` table).\n *\n * Codes only exist for a person who has enrolled TOTP. Behavior for everyone\n * else is unchanged. Plaintext codes are shown exactly once (on generation);\n * only their sha256 hashes are stored.\n */\nexport class BackupCodeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly providers: Pick<Providers, 'uuid' | 'now' | 'randomBytes'>,\n\t) {}\n\n\t/**\n\t * Replaces the whole set: deletes any existing codes for the person, issues\n\t * {@link BACKUP_CODE_COUNT} fresh ones, stores their hashes and returns the\n\t * formatted plaintext codes (to be shown once).\n\t */\n\tasync generate(dbContext: DatabaseContext, personId: string): Promise<string[]> {\n\t\tconst codes: string[] = []\n\t\tfor (let i = 0; i < BACKUP_CODE_COUNT; i++) {\n\t\t\tcodes.push(await this.generateCode())\n\t\t}\n\t\t// Replace the whole set atomically: a mid-flow failure must never leave the\n\t\t// person with a partial set that doesn't match the plaintext codes returned\n\t\t// to (and shown once to) the caller.\n\t\tawait dbContext.transaction(async tx => {\n\t\t\tawait tx.commandBus.execute(new DeleteBackupCodesCommand(personId))\n\t\t\tfor (const code of codes) {\n\t\t\t\t// Hash the normalized form so verification (which normalizes its input) matches.\n\t\t\t\tawait tx.commandBus.execute(new CreateBackupCodeCommand(personId, this.hash(this.normalize(code))))\n\t\t\t}\n\t\t})\n\t\treturn codes\n\t}\n\n\t/**\n\t * Normalizes the supplied code, then atomically consumes a single unused\n\t * matching code. Returns whether a code was actually consumed. Safe against\n\t * double-spend (see {@link ConsumeBackupCodeCommand}).\n\t */\n\tasync verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean> {\n\t\tconst normalized = this.normalize(code)\n\t\tif (normalized.length === 0) {\n\t\t\treturn false\n\t\t}\n\t\tconst consumed = await dbContext.commandBus.execute(new ConsumeBackupCodeCommand(person.id, this.hash(normalized)))\n\t\tif (consumed && (await this.countUnused(dbContext, person.id)) === 0) {\n\t\t\t// Best-effort: notify the person they have no backup codes left. A failed\n\t\t\t// email must never block or fail sign-in, so swallow any error.\n\t\t\ttry {\n\t\t\t\tawait this.mailer.sendBackupCodesExhaustedEmail(dbContext, { email: person.email ?? '' }, { projectId: null, variant: '' })\n\t\t\t} catch {\n\t\t\t\t// ignore\n\t\t\t}\n\t\t}\n\t\treturn consumed\n\t}\n\n\tasync deleteForPerson(dbContext: DatabaseContext, personId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DeleteBackupCodesCommand(personId))\n\t}\n\n\t/** Number of still-usable backup codes for the person. */\n\tasync countUnused(dbContext: DatabaseContext, personId: string): Promise<number> {\n\t\tconst rows = await SelectBuilder.create<{ count: string }>()\n\t\t\t.from('person_backup_code')\n\t\t\t.select(new Literal('count(*)::text as count'))\n\t\t\t.where({ person_id: personId })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.getResult(dbContext.client)\n\t\treturn Number(rows[0]?.count ?? '0')\n\t}\n\n\t/** Strips formatting (hyphens/whitespace) and lowercases — display formatting must not affect verification. */\n\tprivate normalize(code: string): string {\n\t\treturn code.replace(/[\\s-]/g, '').toLowerCase()\n\t}\n\n\tprivate hash(normalizedCode: string): string {\n\t\treturn computeTokenHash(normalizedCode)\n\t}\n\n\tprivate async generateCode(): Promise<string> {\n\t\tconst bytes = await this.providers.randomBytes(BACKUP_CODE_LENGTH)\n\t\tlet raw = ''\n\t\tfor (let i = 0; i < BACKUP_CODE_LENGTH; i++) {\n\t\t\traw += ALPHABET[bytes[i] % ALPHABET.length]\n\t\t}\n\t\t// Single hyphen in the middle for readability, e.g. \"abcde-fghij\".\n\t\tconst mid = Math.floor(BACKUP_CODE_LENGTH / 2)\n\t\treturn `${raw.slice(0, mid)}-${raw.slice(mid)}`\n\t}\n}\n"],"names":[],"mappings":";;;;;;AASA,MAAM,oBAAoB;AAE1B,MAAM,qBAAqB;AAK3B,MAAM,WAAW;AASV,MAAM,kBAAkB;AAAA,EAC9B,YACkB,QACA,WAChB;AAFgB,SAAA,SAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOH,MAAM,SAAS,WAA4B,UAAqC;AAC/E,UAAM,QAAkB,CAAA;AACxB,aAAS,IAAI,GAAG,IAAI,mBAAmB,KAAK;AAC3C,YAAM,KAAK,MAAM,KAAK,aAAA,CAAc;AAAA,IACrC;AAIA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,YAAM,GAAG,WAAW,QAAQ,IAAI,yBAAyB,QAAQ,CAAC;AAClE,iBAAW,QAAQ,OAAO;AAEzB,cAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,UAAU,KAAK,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC;AAAA,MACnG;AAAA,IACD,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBAAiB,WAA4B,QAAmB,MAAgC;AACrG,UAAM,aAAa,KAAK,UAAU,IAAI;AACtC,QAAI,WAAW,WAAW,GAAG;AAC5B,aAAO;AAAA,IACR;AACA,UAAM,WAAW,MAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,OAAO,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC;AAClH,QAAI,YAAa,MAAM,KAAK,YAAY,WAAW,OAAO,EAAE,MAAO,GAAG;AAGrE,UAAI;AACH,cAAM,KAAK,OAAO,8BAA8B,WAAW,EAAE,OAAO,OAAO,SAAS,GAAA,GAAM,EAAE,WAAW,MAAM,SAAS,IAAI;AAAA,MAC3H,QAAQ;AAAA,MAER;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,gBAAgB,WAA4B,UAAiC;AAClF,UAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AAAA;AAAA,EAGA,MAAM,YAAY,WAA4B,UAAmC;AAChF,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,KAAK,oBAAoB,EACzB,OAAO,IAAI,QAAQ,yBAAyB,CAAC,EAC7C,MAAM,EAAE,WAAW,SAAA,CAAU,EAC7B,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,UAAU,UAAU,MAAM;AAC5B,WAAO,OAAO,KAAK,CAAC,GAAG,SAAS,GAAG;AAAA,EACpC;AAAA;AAAA,EAGQ,UAAU,MAAsB;AACvC,WAAO,KAAK,QAAQ,UAAU,EAAE,EAAE,YAAA;AAAA,EACnC;AAAA,EAEQ,KAAK,gBAAgC;AAC5C,WAAO,iBAAiB,cAAc;AAAA,EACvC;AAAA,EAEA,MAAc,eAAgC;AAC7C,UAAM,QAAQ,MAAM,KAAK,UAAU,YAAY,kBAAkB;AACjE,QAAI,MAAM;AACV,aAAS,IAAI,GAAG,IAAI,oBAAoB,KAAK;AAC5C,aAAO,SAAS,MAAM,CAAC,IAAI,SAAS,MAAM;AAAA,IAC3C;AAEA,UAAM,MAAM,KAAK,MAAM,qBAAqB,CAAC;AAC7C,WAAO,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC;AAAA,EAC9C;AACD;"}

package/dist/development/src/model/service/ConfigurationManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ConfigurationManager.ts"],"sourcesContent":["import { ConfigInput, ConfigureErrorCode } from '../../schema'\nimport { Response, ResponseOk } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\nimport { UpdateConfigurationCommand } from '../commands'\n\nexport class ConfigurationManager {\n\tpublic async updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>> {\n\t\t// todo: validate configuration\n\n\t\tawait db.commandBus.execute(new UpdateConfigurationCommand(configuration))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\n"],"names":["UpdateConfigurationCommand","ResponseOk"],"mappings":";;;;;;;AAKO,MAAM,qBAAqB;AAAA,EACjC,MAAa,oBAAoB,IAAqB,eAAyE;AAG9H,UAAM,GAAG,WAAW,QAAQ,IAAIA,2BAAAA,2BAA2B,aAAa,CAAC;AAEzE,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}
+{"version":3,"file":"ConfigurationManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ConfigurationManager.ts"],"sourcesContent":["import { ConfigInput, ConfigureErrorCode } from '../../schema/index.js'\nimport { Response, ResponseOk } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { UpdateConfigurationCommand } from '../commands/index.js'\n\nexport class ConfigurationManager {\n\tpublic async updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>> {\n\t\t// todo: validate configuration\n\n\t\tawait db.commandBus.execute(new UpdateConfigurationCommand(configuration))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\n"],"names":["UpdateConfigurationCommand","ResponseOk"],"mappings":";;;;;;;AAKO,MAAM,qBAAqB;AAAA,EACjC,MAAa,oBAAoB,IAAqB,eAAyE;AAG9H,UAAM,GAAG,WAAW,QAAQ,IAAIA,2BAAAA,2BAA2B,aAAa,CAAC;AAEzE,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}

package/dist/development/src/model/service/ConfigurationManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ConfigurationManager.ts"],"sourcesContent":["import { ConfigInput, ConfigureErrorCode } from '../../schema'\nimport { Response, ResponseOk } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\nimport { UpdateConfigurationCommand } from '../commands'\n\nexport class ConfigurationManager {\n\tpublic async updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>> {\n\t\t// todo: validate configuration\n\n\t\tawait db.commandBus.execute(new UpdateConfigurationCommand(configuration))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\n"],"names":[],"mappings":";;;;;AAKO,MAAM,qBAAqB;AAAA,EACjC,MAAa,oBAAoB,IAAqB,eAAyE;AAG9H,UAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,aAAa,CAAC;AAEzE,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}
+{"version":3,"file":"ConfigurationManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ConfigurationManager.ts"],"sourcesContent":["import { ConfigInput, ConfigureErrorCode } from '../../schema/index.js'\nimport { Response, ResponseOk } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { UpdateConfigurationCommand } from '../commands/index.js'\n\nexport class ConfigurationManager {\n\tpublic async updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>> {\n\t\t// todo: validate configuration\n\n\t\tawait db.commandBus.execute(new UpdateConfigurationCommand(configuration))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\n"],"names":[],"mappings":";;;;;AAKO,MAAM,qBAAqB;AAAA,EACjC,MAAa,oBAAoB,IAAqB,eAAyE;AAG9H,UAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,aAAa,CAAC;AAEzE,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}

package/dist/development/src/model/service/EmailChangeManager.cjs

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Response = require("../utils/Response.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const Database = require("@contember/database");
+require("../type/ApiKey.cjs");
+const exceptions = require("../../exceptions.cjs");
+const PersonQuery = require("../queries/person/PersonQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+const getPreferredProject = require("./helpers/getPreferredProject.cjs");
+const token = require("../utils/token.cjs");
+const email = require("../utils/email.cjs");
+const MarkEmailVerifiedCommand = require("../commands/person/MarkEmailVerifiedCommand.cjs");
+const CreatePersonTokenCommand = require("../commands/personToken/CreatePersonTokenCommand.cjs");
+const InvalidateTokenCommand = require("../commands/personToken/InvalidateTokenCommand.cjs");
+const PersonTokenQuery = require("../queries/personToken/PersonTokenQuery.cjs");
+const NextMailAttemptQuery = require("../queries/authLog/NextMailAttemptQuery.cjs");
+const AuthLogService = require("./AuthLogService.cjs");
+class EmailChangeManager {
+  constructor(mailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory) {
+    this.mailer = mailer;
+    this.projectManager = projectManager;
+    this.emailValidator = emailValidator;
+    this.apiKeyManager = apiKeyManager;
+    this.permissionContextFactory = permissionContextFactory;
+  }
+  /**
+   * Request an e-mail change. Validation and rate-limiting run BEFORE any
+   * write, so a rejected request never leaves a half-applied profile (e.g. a
+   * persisted name change without the e-mail change going through). Any
+   * immediate side-changes the caller wants applied atomically with the token
+   * (the name change) are passed via `applyWithinTransaction`.
+   */
+  async requestEmailChange(dbContext, permissionContext, person, newEmail, mailOptions = {}, applyWithinTransaction) {
+    const normalizedNewEmail = email.normalizeEmail(newEmail);
+    const validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail);
+    if (validationError !== null) {
+      return new Response.ResponseError(validationError.error, validationError.errorMessage);
+    }
+    const nextAllowed = await dbContext.queryHandler.fetch(
+      new NextMailAttemptQuery.NextMailAttemptQuery(normalizedNewEmail, "email_change_init", "email_change_complete")
+    );
+    if (nextAllowed > dbContext.providers.now()) {
+      return new Response.ResponseError("RATE_LIMIT_EXCEEDED", "Too many e-mail change requests for this address.");
+    }
+    const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+    const project = getPreferredProject.getPreferredProject(projects, mailOptions.project ?? null);
+    await dbContext.transaction(async (db) => {
+      if (applyWithinTransaction) {
+        await applyWithinTransaction(db);
+      }
+      const result = await db.commandBus.execute(
+        CreatePersonTokenCommand.CreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail)
+      );
+      await this.mailer.sendEmailChangeVerifyEmail(
+        db,
+        {
+          email: normalizedNewEmail,
+          token: result.token,
+          project: project?.name,
+          projectSlug: project?.slug
+        },
+        {
+          variant: mailOptions.mailVariant || "",
+          projectId: project?.id ?? null
+        }
+      );
+    });
+    return new Response.ResponseOk(null);
+  }
+  async confirmEmailChange(dbContext, token$1) {
+    const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byToken(token$1, "email_change"));
+    const validation = token.validateToken({ entry: tokenRow, token: token$1, now: dbContext.providers.now(), validationType: "token" });
+    if (!validation.ok) {
+      return new Response.ResponseError(validation.error, validation.errorMessage, {
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag(
+          tokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {}
+        )
+      });
+    }
+    const authLogData = new AuthLogService.AuthLogService.Bag({
+      personId: validation.result.person_id,
+      tokenId: validation.result.id
+    });
+    const newEmail = validation.result.meta?.email;
+    if (!newEmail) {
+      throw new exceptions.ImplementationException("email_change token is missing its email payload");
+    }
+    const person = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byId(validation.result.person_id));
+    if (!person) {
+      throw new exceptions.ImplementationException();
+    }
+    const validationError = await this.emailValidator.validateEmail(dbContext, newEmail);
+    if (validationError !== null) {
+      return new Response.ResponseError(validationError.error, validationError.errorMessage, {
+        [AuthLogService.AuthLogService.Key]: authLogData
+      });
+    }
+    const oldEmail = person.email;
+    try {
+      await dbContext.transaction(async (db) => {
+        await db.commandBus.execute(new InvalidateTokenCommand.InvalidateTokenCommand(validation.result.id));
+        await db.commandBus.execute(new MarkEmailVerifiedCommand.MarkEmailVerifiedCommand(person.id, newEmail));
+        await this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id);
+      });
+    } catch (e) {
+      if (e instanceof Database.UniqueViolationError) {
+        return new Response.ResponseError("EMAIL_ALREADY_EXISTS", `User with email ${newEmail} already exists`, {
+          [AuthLogService.AuthLogService.Key]: authLogData
+        });
+      }
+      throw e;
+    }
+    if (oldEmail) {
+      const permissionContext = this.permissionContextFactory.create(dbContext, {
+        id: person.identity_id,
+        roles: person.roles
+      });
+      const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+      const project = getPreferredProject.getPreferredProject(projects, null);
+      await this.mailer.sendEmailChangeNotifyEmail(
+        dbContext,
+        { email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },
+        { projectId: project?.id ?? null, variant: "" }
+      );
+    }
+    return new Response.ResponseOk({ personId: person.id, newEmail, [AuthLogService.AuthLogService.Key]: authLogData });
+  }
+}
+exports.EmailChangeManager = EmailChangeManager;
+//# sourceMappingURL=EmailChangeManager.cjs.map

package/dist/development/src/model/service/EmailChangeManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailChangeManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext, PermissionContextFactory } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { ApiKeyManager } from './apiKey/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { normalizeEmail } from '../utils/email.js'\nimport { PersonToken } from '../type/index.js'\nimport { UniqueViolationError } from '@contember/database'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailChangeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\t/**\n\t * Request an e-mail change. Validation and rate-limiting run BEFORE any\n\t * write, so a rejected request never leaves a half-applied profile (e.g. a\n\t * persisted name change without the e-mail change going through). Any\n\t * immediate side-changes the caller wants applied atomically with the token\n\t * (the name change) are passed via `applyWithinTransaction`.\n\t */\n\tpublic async requestEmailChange(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tnewEmail: string,\n\t\tmailOptions: MailOptions = {},\n\t\tapplyWithinTransaction?: (db: DatabaseContext) => Promise<void>,\n\t): Promise<RequestEmailChangeResponse> {\n\t\tconst normalizedNewEmail = normalizeEmail(newEmail)\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t}\n\n\t\t// Per-recipient exponential backoff: an authenticated user (or a hijacked\n\t\t// session) must not be able to flood an arbitrary address with\n\t\t// \"confirm your new e-mail\" mails. Keyed on the normalized NEW address so\n\t\t// the `email_change_init` auth-log entries (written with the same\n\t\t// normalized address) actually drive the backoff. Reuses login_* config.\n\t\tconst nextAllowed = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(normalizedNewEmail, 'email_change_init', 'email_change_complete'),\n\t\t)\n\t\tif (nextAllowed > dbContext.providers.now()) {\n\t\t\treturn new ResponseError('RATE_LIMIT_EXCEEDED', 'Too many e-mail change requests for this address.')\n\t\t}\n\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait dbContext.transaction(async db => {\n\t\t\tif (applyWithinTransaction) {\n\t\t\t\tawait applyWithinTransaction(db)\n\t\t\t}\n\t\t\tconst result = await db.commandBus.execute(\n\t\t\t\tCreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail),\n\t\t\t)\n\t\t\t// The verification link goes to the NEW address — clicking it proves\n\t\t\t// ownership of the address being switched to, which is the whole point.\n\t\t\tawait this.mailer.sendEmailChangeVerifyEmail(\n\t\t\t\tdb,\n\t\t\t\t{\n\t\t\t\t\temail: normalizedNewEmail,\n\t\t\t\t\ttoken: result.token,\n\t\t\t\t\tproject: project?.name,\n\t\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t\t},\n\t\t\t)\n\t\t})\n\t\treturn new ResponseOk(null)\n\t}\n\n\tpublic async confirmEmailChange(dbContext: DatabaseContext, token: string): Promise<ConfirmEmailChangeResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_change'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Tie the failure to a person/token in the audit log when we can, even\n\t\t\t// for an invalid/expired token (matches verifyEmail / password reset).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst newEmail = validation.result.meta?.email\n\t\tif (!newEmail) {\n\t\t\tthrow new ImplementationException('email_change token is missing its email payload')\n\t\t}\n\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Re-check uniqueness at confirmation time: another account may have\n\t\t// claimed the address between request and confirmation.\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, newEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\n\t\tconst oldEmail = person.email\n\t\ttry {\n\t\t\tawait dbContext.transaction(async db => {\n\t\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(person.id, newEmail))\n\t\t\t\t// An email change is a takeover-grade event: drop every existing\n\t\t\t\t// session so a stale attacker session cannot ride the new address.\n\t\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id)\n\t\t\t})\n\t\t} catch (e) {\n\t\t\t// The uniqueness re-check above narrows but cannot fully close the\n\t\t\t// window: another account may claim the address between the check and\n\t\t\t// this UPDATE. The unique index is the real guard — translate its\n\t\t\t// violation into a clean error instead of leaking a 500.\n\t\t\tif (e instanceof UniqueViolationError) {\n\t\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${newEmail} already exists`, {\n\t\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\n\t\tif (oldEmail) {\n\t\t\t// Resolve the person's preferred project so a per-project\n\t\t\t// EMAIL_CHANGE_NOTIFY template (and branding) is honoured, mirroring\n\t\t\t// requestEmailChange. The token carries no project, so derive it from the\n\t\t\t// person's own identity.\n\t\t\tconst permissionContext = this.permissionContextFactory.create(dbContext, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, null)\n\t\t\tawait this.mailer.sendEmailChangeNotifyEmail(\n\t\t\t\tdbContext,\n\t\t\t\t{ email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },\n\t\t\t\t{ projectId: project?.id ?? null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn new ResponseOk({ personId: person.id, newEmail, [AuthLogService.Key]: authLogData })\n\t}\n}\n\nexport type RequestEmailChangeResponse = Response<null, EmailValidatorError | 'RATE_LIMIT_EXCEEDED'>\n\nexport type ConfirmEmailChangeResponse = Response<\n\t{ personId: string; newEmail: string; [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError | EmailValidatorError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":["normalizeEmail","ResponseError","NextMailAttemptQuery","getPreferredProject","CreatePersonTokenCommand","ResponseOk","token","PersonTokenQuery","validateToken","AuthLogService","ImplementationException","PersonQuery","InvalidateTokenCommand","MarkEmailVerifiedCommand","UniqueViolationError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwBO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,QACA,gBACA,gBACA,eACA,0BAChB;AALgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,iBAAA;AACA,SAAA,gBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,mBACZ,WACA,mBACA,QACA,UACA,cAA2B,CAAA,GAC3B,wBACsC;AACtC,UAAM,qBAAqBA,MAAAA,eAAe,QAAQ;AAClD,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,kBAAkB;AAC7F,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAIC,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,IAC7E;AAOA,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAIC,qBAAAA,qBAAqB,oBAAoB,qBAAqB,uBAAuB;AAAA,IAAA;AAE1F,QAAI,cAAc,UAAU,UAAU,IAAA,GAAO;AAC5C,aAAO,IAAID,SAAAA,cAAc,uBAAuB,mDAAmD;AAAA,IACpG;AAEA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUE,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,UAAI,wBAAwB;AAC3B,cAAM,uBAAuB,EAAE;AAAA,MAChC;AACA,YAAM,SAAS,MAAM,GAAG,WAAW;AAAA,QAClCC,yBAAAA,yBAAyB,yBAAyB,OAAO,IAAI,kBAAkB;AAAA,MAAA;AAIhF,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA;AAAA,UACC,OAAO;AAAA,UACP,OAAO,OAAO;AAAA,UACd,SAAS,SAAS;AAAA,UAClB,aAAa,SAAS;AAAA,QAAA;AAAA,QAEvB;AAAA,UACC,SAAS,YAAY,eAAe;AAAA,UACpC,WAAW,SAAS,MAAM;AAAA,QAAA;AAAA,MAC3B;AAAA,IAEF,CAAC;AACD,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAa,mBAAmB,WAA4BC,SAAoD;AAC/G,UAAM,WAAW,MAAM,UAAU,aAAa,MAAMC,iBAAAA,iBAAiB,QAAQD,SAAO,cAAc,CAAC;AACnG,UAAM,aAAaE,MAAAA,cAAc,EAAE,OAAO,UAAA,OAAUF,SAAO,KAAK,UAAU,UAAU,IAAA,GAAO,gBAAgB,SAAS;AACpH,QAAI,CAAC,WAAW,IAAI;AAGnB,aAAO,IAAIL,SAAAA,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAACQ,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAIA,eAAAA,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,WAAW,OAAO,MAAM;AACzC,QAAI,CAAC,UAAU;AACd,YAAM,IAAIC,WAAAA,wBAAwB,iDAAiD;AAAA,IACpF;AAEA,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMC,wBAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAID,WAAAA,wBAAA;AAAA,IACX;AAIA,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,QAAQ;AACnF,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAIT,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,cAAc;AAAA,QAC7E,CAACQ,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AAEA,UAAM,WAAW,OAAO;AACxB,QAAI;AACH,YAAM,UAAU,YAAY,OAAM,OAAM;AACvC,cAAM,GAAG,WAAW,QAAQ,IAAIG,uBAAAA,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,cAAM,GAAG,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,OAAO,IAAI,QAAQ,CAAC;AAG7E,cAAM,KAAK,cAAc,uBAAuB,IAAI,OAAO,WAAW;AAAA,MACvE,CAAC;AAAA,IACF,SAAS,GAAG;AAKX,UAAI,aAAaC,SAAAA,sBAAsB;AACtC,eAAO,IAAIb,SAAAA,cAAc,wBAAwB,mBAAmB,QAAQ,mBAAmB;AAAA,UAC9F,CAACQ,eAAAA,eAAe,GAAG,GAAG;AAAA,QAAA,CACtB;AAAA,MACF;AACA,YAAM;AAAA,IACP;AAEA,QAAI,UAAU;AAKb,YAAM,oBAAoB,KAAK,yBAAyB,OAAO,WAAW;AAAA,QACzE,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,YAAM,UAAUN,oBAAAA,oBAAoB,UAAU,IAAI;AAClD,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA,EAAE,OAAO,UAAU,UAAU,SAAS,SAAS,MAAM,aAAa,SAAS,KAAA;AAAA,QAC3E,EAAE,WAAW,SAAS,MAAM,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEhD;AAEA,WAAO,IAAIE,SAAAA,WAAW,EAAE,UAAU,OAAO,IAAI,UAAU,CAACI,eAAAA,eAAe,GAAG,GAAG,aAAa;AAAA,EAC3F;AACD;;"}

package/dist/development/src/model/service/EmailChangeManager.js

@@ -0,0 +1,135 @@
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import { UniqueViolationError } from "@contember/database";
+import "../type/ApiKey.js";
+import { ImplementationException } from "../../exceptions.js";
+import { PersonQuery } from "../queries/person/PersonQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+import { getPreferredProject } from "./helpers/getPreferredProject.js";
+import { validateToken } from "../utils/token.js";
+import { normalizeEmail } from "../utils/email.js";
+import { MarkEmailVerifiedCommand } from "../commands/person/MarkEmailVerifiedCommand.js";
+import { CreatePersonTokenCommand } from "../commands/personToken/CreatePersonTokenCommand.js";
+import { InvalidateTokenCommand } from "../commands/personToken/InvalidateTokenCommand.js";
+import { PersonTokenQuery } from "../queries/personToken/PersonTokenQuery.js";
+import { NextMailAttemptQuery } from "../queries/authLog/NextMailAttemptQuery.js";
+import { AuthLogService } from "./AuthLogService.js";
+class EmailChangeManager {
+  constructor(mailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory) {
+    this.mailer = mailer;
+    this.projectManager = projectManager;
+    this.emailValidator = emailValidator;
+    this.apiKeyManager = apiKeyManager;
+    this.permissionContextFactory = permissionContextFactory;
+  }
+  /**
+   * Request an e-mail change. Validation and rate-limiting run BEFORE any
+   * write, so a rejected request never leaves a half-applied profile (e.g. a
+   * persisted name change without the e-mail change going through). Any
+   * immediate side-changes the caller wants applied atomically with the token
+   * (the name change) are passed via `applyWithinTransaction`.
+   */
+  async requestEmailChange(dbContext, permissionContext, person, newEmail, mailOptions = {}, applyWithinTransaction) {
+    const normalizedNewEmail = normalizeEmail(newEmail);
+    const validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail);
+    if (validationError !== null) {
+      return new ResponseError(validationError.error, validationError.errorMessage);
+    }
+    const nextAllowed = await dbContext.queryHandler.fetch(
+      new NextMailAttemptQuery(normalizedNewEmail, "email_change_init", "email_change_complete")
+    );
+    if (nextAllowed > dbContext.providers.now()) {
+      return new ResponseError("RATE_LIMIT_EXCEEDED", "Too many e-mail change requests for this address.");
+    }
+    const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+    const project = getPreferredProject(projects, mailOptions.project ?? null);
+    await dbContext.transaction(async (db) => {
+      if (applyWithinTransaction) {
+        await applyWithinTransaction(db);
+      }
+      const result = await db.commandBus.execute(
+        CreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail)
+      );
+      await this.mailer.sendEmailChangeVerifyEmail(
+        db,
+        {
+          email: normalizedNewEmail,
+          token: result.token,
+          project: project?.name,
+          projectSlug: project?.slug
+        },
+        {
+          variant: mailOptions.mailVariant || "",
+          projectId: project?.id ?? null
+        }
+      );
+    });
+    return new ResponseOk(null);
+  }
+  async confirmEmailChange(dbContext, token) {
+    const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, "email_change"));
+    const validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: "token" });
+    if (!validation.ok) {
+      return new ResponseError(validation.error, validation.errorMessage, {
+        [AuthLogService.Key]: new AuthLogService.Bag(
+          tokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {}
+        )
+      });
+    }
+    const authLogData = new AuthLogService.Bag({
+      personId: validation.result.person_id,
+      tokenId: validation.result.id
+    });
+    const newEmail = validation.result.meta?.email;
+    if (!newEmail) {
+      throw new ImplementationException("email_change token is missing its email payload");
+    }
+    const person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id));
+    if (!person) {
+      throw new ImplementationException();
+    }
+    const validationError = await this.emailValidator.validateEmail(dbContext, newEmail);
+    if (validationError !== null) {
+      return new ResponseError(validationError.error, validationError.errorMessage, {
+        [AuthLogService.Key]: authLogData
+      });
+    }
+    const oldEmail = person.email;
+    try {
+      await dbContext.transaction(async (db) => {
+        await db.commandBus.execute(new InvalidateTokenCommand(validation.result.id));
+        await db.commandBus.execute(new MarkEmailVerifiedCommand(person.id, newEmail));
+        await this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id);
+      });
+    } catch (e) {
+      if (e instanceof UniqueViolationError) {
+        return new ResponseError("EMAIL_ALREADY_EXISTS", `User with email ${newEmail} already exists`, {
+          [AuthLogService.Key]: authLogData
+        });
+      }
+      throw e;
+    }
+    if (oldEmail) {
+      const permissionContext = this.permissionContextFactory.create(dbContext, {
+        id: person.identity_id,
+        roles: person.roles
+      });
+      const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+      const project = getPreferredProject(projects, null);
+      await this.mailer.sendEmailChangeNotifyEmail(
+        dbContext,
+        { email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },
+        { projectId: project?.id ?? null, variant: "" }
+      );
+    }
+    return new ResponseOk({ personId: person.id, newEmail, [AuthLogService.Key]: authLogData });
+  }
+}
+export {
+  EmailChangeManager
+};
+//# sourceMappingURL=EmailChangeManager.js.map

package/dist/development/src/model/service/EmailChangeManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailChangeManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext, PermissionContextFactory } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { ApiKeyManager } from './apiKey/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { normalizeEmail } from '../utils/email.js'\nimport { PersonToken } from '../type/index.js'\nimport { UniqueViolationError } from '@contember/database'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailChangeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\t/**\n\t * Request an e-mail change. Validation and rate-limiting run BEFORE any\n\t * write, so a rejected request never leaves a half-applied profile (e.g. a\n\t * persisted name change without the e-mail change going through). Any\n\t * immediate side-changes the caller wants applied atomically with the token\n\t * (the name change) are passed via `applyWithinTransaction`.\n\t */\n\tpublic async requestEmailChange(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tnewEmail: string,\n\t\tmailOptions: MailOptions = {},\n\t\tapplyWithinTransaction?: (db: DatabaseContext) => Promise<void>,\n\t): Promise<RequestEmailChangeResponse> {\n\t\tconst normalizedNewEmail = normalizeEmail(newEmail)\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t}\n\n\t\t// Per-recipient exponential backoff: an authenticated user (or a hijacked\n\t\t// session) must not be able to flood an arbitrary address with\n\t\t// \"confirm your new e-mail\" mails. Keyed on the normalized NEW address so\n\t\t// the `email_change_init` auth-log entries (written with the same\n\t\t// normalized address) actually drive the backoff. Reuses login_* config.\n\t\tconst nextAllowed = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(normalizedNewEmail, 'email_change_init', 'email_change_complete'),\n\t\t)\n\t\tif (nextAllowed > dbContext.providers.now()) {\n\t\t\treturn new ResponseError('RATE_LIMIT_EXCEEDED', 'Too many e-mail change requests for this address.')\n\t\t}\n\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait dbContext.transaction(async db => {\n\t\t\tif (applyWithinTransaction) {\n\t\t\t\tawait applyWithinTransaction(db)\n\t\t\t}\n\t\t\tconst result = await db.commandBus.execute(\n\t\t\t\tCreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail),\n\t\t\t)\n\t\t\t// The verification link goes to the NEW address — clicking it proves\n\t\t\t// ownership of the address being switched to, which is the whole point.\n\t\t\tawait this.mailer.sendEmailChangeVerifyEmail(\n\t\t\t\tdb,\n\t\t\t\t{\n\t\t\t\t\temail: normalizedNewEmail,\n\t\t\t\t\ttoken: result.token,\n\t\t\t\t\tproject: project?.name,\n\t\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t\t},\n\t\t\t)\n\t\t})\n\t\treturn new ResponseOk(null)\n\t}\n\n\tpublic async confirmEmailChange(dbContext: DatabaseContext, token: string): Promise<ConfirmEmailChangeResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_change'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Tie the failure to a person/token in the audit log when we can, even\n\t\t\t// for an invalid/expired token (matches verifyEmail / password reset).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst newEmail = validation.result.meta?.email\n\t\tif (!newEmail) {\n\t\t\tthrow new ImplementationException('email_change token is missing its email payload')\n\t\t}\n\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Re-check uniqueness at confirmation time: another account may have\n\t\t// claimed the address between request and confirmation.\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, newEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\n\t\tconst oldEmail = person.email\n\t\ttry {\n\t\t\tawait dbContext.transaction(async db => {\n\t\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(person.id, newEmail))\n\t\t\t\t// An email change is a takeover-grade event: drop every existing\n\t\t\t\t// session so a stale attacker session cannot ride the new address.\n\t\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id)\n\t\t\t})\n\t\t} catch (e) {\n\t\t\t// The uniqueness re-check above narrows but cannot fully close the\n\t\t\t// window: another account may claim the address between the check and\n\t\t\t// this UPDATE. The unique index is the real guard — translate its\n\t\t\t// violation into a clean error instead of leaking a 500.\n\t\t\tif (e instanceof UniqueViolationError) {\n\t\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${newEmail} already exists`, {\n\t\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\n\t\tif (oldEmail) {\n\t\t\t// Resolve the person's preferred project so a per-project\n\t\t\t// EMAIL_CHANGE_NOTIFY template (and branding) is honoured, mirroring\n\t\t\t// requestEmailChange. The token carries no project, so derive it from the\n\t\t\t// person's own identity.\n\t\t\tconst permissionContext = this.permissionContextFactory.create(dbContext, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, null)\n\t\t\tawait this.mailer.sendEmailChangeNotifyEmail(\n\t\t\t\tdbContext,\n\t\t\t\t{ email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },\n\t\t\t\t{ projectId: project?.id ?? null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn new ResponseOk({ personId: person.id, newEmail, [AuthLogService.Key]: authLogData })\n\t}\n}\n\nexport type RequestEmailChangeResponse = Response<null, EmailValidatorError | 'RATE_LIMIT_EXCEEDED'>\n\nexport type ConfirmEmailChangeResponse = Response<\n\t{ personId: string; newEmail: string; [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError | EmailValidatorError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAwBO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,QACA,gBACA,gBACA,eACA,0BAChB;AALgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,iBAAA;AACA,SAAA,gBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,mBACZ,WACA,mBACA,QACA,UACA,cAA2B,CAAA,GAC3B,wBACsC;AACtC,UAAM,qBAAqB,eAAe,QAAQ;AAClD,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,kBAAkB;AAC7F,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,IAC7E;AAOA,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAI,qBAAqB,oBAAoB,qBAAqB,uBAAuB;AAAA,IAAA;AAE1F,QAAI,cAAc,UAAU,UAAU,IAAA,GAAO;AAC5C,aAAO,IAAI,cAAc,uBAAuB,mDAAmD;AAAA,IACpG;AAEA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,UAAI,wBAAwB;AAC3B,cAAM,uBAAuB,EAAE;AAAA,MAChC;AACA,YAAM,SAAS,MAAM,GAAG,WAAW;AAAA,QAClC,yBAAyB,yBAAyB,OAAO,IAAI,kBAAkB;AAAA,MAAA;AAIhF,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA;AAAA,UACC,OAAO;AAAA,UACP,OAAO,OAAO;AAAA,UACd,SAAS,SAAS;AAAA,UAClB,aAAa,SAAS;AAAA,QAAA;AAAA,QAEvB;AAAA,UACC,SAAS,YAAY,eAAe;AAAA,UACpC,WAAW,SAAS,MAAM;AAAA,QAAA;AAAA,MAC3B;AAAA,IAEF,CAAC;AACD,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAa,mBAAmB,WAA4B,OAAoD;AAC/G,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,iBAAiB,QAAQ,OAAO,cAAc,CAAC;AACnG,UAAM,aAAa,cAAc,EAAE,OAAO,UAAU,OAAO,KAAK,UAAU,UAAU,IAAA,GAAO,gBAAgB,SAAS;AACpH,QAAI,CAAC,WAAW,IAAI;AAGnB,aAAO,IAAI,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAI,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,WAAW,OAAO,MAAM;AACzC,QAAI,CAAC,UAAU;AACd,YAAM,IAAI,wBAAwB,iDAAiD;AAAA,IACpF;AAEA,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAA;AAAA,IACX;AAIA,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,QAAQ;AACnF,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,cAAc;AAAA,QAC7E,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AAEA,UAAM,WAAW,OAAO;AACxB,QAAI;AACH,YAAM,UAAU,YAAY,OAAM,OAAM;AACvC,cAAM,GAAG,WAAW,QAAQ,IAAI,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,cAAM,GAAG,WAAW,QAAQ,IAAI,yBAAyB,OAAO,IAAI,QAAQ,CAAC;AAG7E,cAAM,KAAK,cAAc,uBAAuB,IAAI,OAAO,WAAW;AAAA,MACvE,CAAC;AAAA,IACF,SAAS,GAAG;AAKX,UAAI,aAAa,sBAAsB;AACtC,eAAO,IAAI,cAAc,wBAAwB,mBAAmB,QAAQ,mBAAmB;AAAA,UAC9F,CAAC,eAAe,GAAG,GAAG;AAAA,QAAA,CACtB;AAAA,MACF;AACA,YAAM;AAAA,IACP;AAEA,QAAI,UAAU;AAKb,YAAM,oBAAoB,KAAK,yBAAyB,OAAO,WAAW;AAAA,QACzE,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,YAAM,UAAU,oBAAoB,UAAU,IAAI;AAClD,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA,EAAE,OAAO,UAAU,UAAU,SAAS,SAAS,MAAM,aAAa,SAAS,KAAA;AAAA,QAC3E,EAAE,WAAW,SAAS,MAAM,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEhD;AAEA,WAAO,IAAI,WAAW,EAAE,UAAU,OAAO,IAAI,UAAU,CAAC,eAAe,GAAG,GAAG,aAAa;AAAA,EAC3F;AACD;"}

package/dist/development/src/model/service/EmailOtpManager.cjs

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("@contember/database");
+require("../type/ApiKey.cjs");
+const InvalidateTokenCommand = require("../commands/personToken/InvalidateTokenCommand.cjs");
+const InvalidateEmailOtpTokensCommand = require("../commands/personToken/InvalidateEmailOtpTokensCommand.cjs");
+const ClaimOtpAttemptCommand = require("../commands/personToken/ClaimOtpAttemptCommand.cjs");
+const PersonTokenQuery = require("../queries/personToken/PersonTokenQuery.cjs");
+const SaveEmailOtpTokenCommand = require("../commands/personToken/SaveEmailOtpTokenCommand.cjs");
+const token = require("../utils/token.cjs");
+const RateLimit = require("../type/RateLimit.cjs");
+const EMAIL_OTP_EXPIRATION_MINUTES = 10;
+const EMAIL_OTP_DIGITS = 6;
+class EmailOtpManager {
+  constructor(mailer, providers, rateLimiter) {
+    this.mailer = mailer;
+    this.providers = providers;
+    this.rateLimiter = rateLimiter;
+  }
+  /**
+   * Generates a fresh code, invalidates any prior unused email-OTP tokens for the
+   * person, persists the new one and emails the code. Must run inside the request's
+   * db context (it issues commands + sends mail).
+   *
+   * Gated by the per-person `email_otp_per_person` rate limit so an attacker who
+   * knows the password cannot re-issue codes to reset the per-code 3-attempt
+   * counter, nor email-bomb a person. When the limit is hit nothing is sent and
+   * the returned decision is `ok: false` (the caller decides how to surface it);
+   * a previously emailed, still-valid code remains usable.
+   */
+  async sendCode(dbContext, person, config) {
+    const decision = await this.rateLimiter.consume(dbContext, RateLimit.RateLimitScopes.emailOtpPerPerson, person.id, config);
+    if (!decision.ok) {
+      return decision;
+    }
+    const code = await this.generateCode();
+    await dbContext.commandBus.execute(new InvalidateEmailOtpTokensCommand.InvalidateEmailOtpTokensCommand(person.id));
+    await dbContext.commandBus.execute(new SaveEmailOtpTokenCommand.SaveEmailOtpTokenCommand(person.id, code, EMAIL_OTP_EXPIRATION_MINUTES));
+    await this.mailer.sendEmailOtpEmail(dbContext, {
+      email: person.email ?? "",
+      code
+    }, {
+      variant: "",
+      projectId: null
+    });
+    return decision;
+  }
+  /**
+   * Fetches the latest unused email-OTP token for the person and validates the
+   * supplied code via the shared `'otp'` path; on success, consumes (invalidates)
+   * the token. Returns whether the code was accepted.
+   *
+   * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}
+   * — a single conditional UPDATE that increments `otp_attempts` only while it is
+   * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent
+   * writers on the row, N parallel guesses can never collectively exceed the cap;
+   * a plain read-then-increment let them all pass with a stale counter.
+   */
+  async verifyAndConsume(dbContext, person, code) {
+    const tokenResult = await dbContext.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.latestUnusedByPerson(person.id, "mfa_email_otp"));
+    if (!tokenResult) {
+      return false;
+    }
+    const reserved = await dbContext.commandBus.execute(new ClaimOtpAttemptCommand.ClaimOtpAttemptCommand(tokenResult.id, token.MAX_OTP_ATTEMPTS));
+    if (!reserved) {
+      return false;
+    }
+    const validation = token.validateToken({
+      entry: tokenResult,
+      token: code,
+      now: this.providers.now(),
+      validationType: "otp"
+    });
+    if (!validation.ok) {
+      return false;
+    }
+    await dbContext.commandBus.execute(new InvalidateTokenCommand.InvalidateTokenCommand(validation.result.id));
+    return true;
+  }
+  async generateCode() {
+    const bytes = await this.providers.randomBytes(EMAIL_OTP_DIGITS);
+    let code = "";
+    for (let i = 0; i < EMAIL_OTP_DIGITS; i++) {
+      code += (bytes[i] % 10).toString();
+    }
+    return code;
+  }
+}
+exports.EmailOtpManager = EmailOtpManager;
+//# sourceMappingURL=EmailOtpManager.cjs.map

package/dist/development/src/model/service/EmailOtpManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailOtpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailOtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries/index.js'\nimport { DatabaseContext, MAX_OTP_ATTEMPTS, validateToken } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ClaimOtpAttemptCommand, InvalidateEmailOtpTokensCommand, InvalidateTokenCommand, SaveEmailOtpTokenCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { RateLimitDecision, RateLimiter } from './RateLimiter.js'\nimport { RateLimitScopes } from '../type/RateLimit.js'\nimport { Config } from '../type/Config.js'\n\n/** Email-OTP codes are short-lived numeric codes delivered by email. */\nconst EMAIL_OTP_EXPIRATION_MINUTES = 10\nconst EMAIL_OTP_DIGITS = 6\n\n/**\n * Email OTP as a second factor (A05). Opt-in per person via\n * `person_mfa.email_otp_enabled`. The emitted code is a 6-digit numeric code,\n * transported through a short-lived `mfa_email_otp` person_token (the code's hash\n * lives in `otp_hash`), validated through the shared `'otp'` token path (max 3\n * attempts). Behavior for anyone who hasn't enabled it is unchanged.\n */\nexport class EmailOtpManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly providers: Pick<Providers, 'randomBytes' | 'now' | 'uuid'>,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\t/**\n\t * Generates a fresh code, invalidates any prior unused email-OTP tokens for the\n\t * person, persists the new one and emails the code. Must run inside the request's\n\t * db context (it issues commands + sends mail).\n\t *\n\t * Gated by the per-person `email_otp_per_person` rate limit so an attacker who\n\t * knows the password cannot re-issue codes to reset the per-code 3-attempt\n\t * counter, nor email-bomb a person. When the limit is hit nothing is sent and\n\t * the returned decision is `ok: false` (the caller decides how to surface it);\n\t * a previously emailed, still-valid code remains usable.\n\t */\n\tasync sendCode(dbContext: DatabaseContext, person: PersonRow, config: Config): Promise<RateLimitDecision> {\n\t\tconst decision = await this.rateLimiter.consume(dbContext, RateLimitScopes.emailOtpPerPerson, person.id, config)\n\t\tif (!decision.ok) {\n\t\t\treturn decision\n\t\t}\n\t\tconst code = await this.generateCode()\n\t\t// Only the latest emailed code may ever verify.\n\t\tawait dbContext.commandBus.execute(new InvalidateEmailOtpTokensCommand(person.id))\n\t\tawait dbContext.commandBus.execute(new SaveEmailOtpTokenCommand(person.id, code, EMAIL_OTP_EXPIRATION_MINUTES))\n\t\tawait this.mailer.sendEmailOtpEmail(dbContext, {\n\t\t\temail: person.email ?? '',\n\t\t\tcode,\n\t\t}, {\n\t\t\tvariant: '',\n\t\t\tprojectId: null,\n\t\t})\n\t\treturn decision\n\t}\n\n\t/**\n\t * Fetches the latest unused email-OTP token for the person and validates the\n\t * supplied code via the shared `'otp'` path; on success, consumes (invalidates)\n\t * the token. Returns whether the code was accepted.\n\t *\n\t * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}\n\t * — a single conditional UPDATE that increments `otp_attempts` only while it is\n\t * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent\n\t * writers on the row, N parallel guesses can never collectively exceed the cap;\n\t * a plain read-then-increment let them all pass with a stale counter.\n\t */\n\tasync verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean> {\n\t\tconst tokenResult = await dbContext.queryHandler.fetch(PersonTokenQuery.latestUnusedByPerson(person.id, 'mfa_email_otp'))\n\t\tif (!tokenResult) {\n\t\t\treturn false\n\t\t}\n\t\t// Atomically reserve a guess slot before comparing the code. A false result\n\t\t// means the token was already used/replaced or the attempt cap is exhausted.\n\t\tconst reserved = await dbContext.commandBus.execute(new ClaimOtpAttemptCommand(tokenResult.id, MAX_OTP_ATTEMPTS))\n\t\tif (!reserved) {\n\t\t\treturn false\n\t\t}\n\t\t// otp_hash and expires_at are immutable for a token, so validating against the\n\t\t// pre-claim snapshot is correct; the attempt has already been counted.\n\t\tconst validation = validateToken({\n\t\t\tentry: tokenResult,\n\t\t\ttoken: code,\n\t\t\tnow: this.providers.now(),\n\t\t\tvalidationType: 'otp',\n\t\t})\n\t\tif (!validation.ok) {\n\t\t\treturn false\n\t\t}\n\t\tawait dbContext.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\treturn true\n\t}\n\n\tprivate async generateCode(): Promise<string> {\n\t\t// Rejection-free uniform-ish digits is acceptable here: this is a second factor\n\t\t// behind a valid password, short-lived, and capped at 3 attempts.\n\t\tconst bytes = await this.providers.randomBytes(EMAIL_OTP_DIGITS)\n\t\tlet code = ''\n\t\tfor (let i = 0; i < EMAIL_OTP_DIGITS; i++) {\n\t\t\tcode += (bytes[i] % 10).toString()\n\t\t}\n\t\treturn code\n\t}\n}\n"],"names":["RateLimitScopes","InvalidateEmailOtpTokensCommand","SaveEmailOtpTokenCommand","PersonTokenQuery","ClaimOtpAttemptCommand","MAX_OTP_ATTEMPTS","validateToken","InvalidateTokenCommand"],"mappings":";;;;;;;;;;;AAWA,MAAM,+BAA+B;AACrC,MAAM,mBAAmB;AASlB,MAAM,gBAAgB;AAAA,EAC5B,YACkB,QACA,WACA,aAChB;AAHgB,SAAA,SAAA;AACA,SAAA,YAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaH,MAAM,SAAS,WAA4B,QAAmB,QAA4C;AACzG,UAAM,WAAW,MAAM,KAAK,YAAY,QAAQ,WAAWA,UAAAA,gBAAgB,mBAAmB,OAAO,IAAI,MAAM;AAC/G,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,aAAA;AAExB,UAAM,UAAU,WAAW,QAAQ,IAAIC,gCAAAA,gCAAgC,OAAO,EAAE,CAAC;AACjF,UAAM,UAAU,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,OAAO,IAAI,MAAM,4BAA4B,CAAC;AAC9G,UAAM,KAAK,OAAO,kBAAkB,WAAW;AAAA,MAC9C,OAAO,OAAO,SAAS;AAAA,MACvB;AAAA,IAAA,GACE;AAAA,MACF,SAAS;AAAA,MACT,WAAW;AAAA,IAAA,CACX;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,iBAAiB,WAA4B,QAAmB,MAAgC;AACrG,UAAM,cAAc,MAAM,UAAU,aAAa,MAAMC,kCAAiB,qBAAqB,OAAO,IAAI,eAAe,CAAC;AACxH,QAAI,CAAC,aAAa;AACjB,aAAO;AAAA,IACR;AAGA,UAAM,WAAW,MAAM,UAAU,WAAW,QAAQ,IAAIC,uBAAAA,uBAAuB,YAAY,IAAIC,MAAAA,gBAAgB,CAAC;AAChH,QAAI,CAAC,UAAU;AACd,aAAO;AAAA,IACR;AAGA,UAAM,aAAaC,MAAAA,cAAc;AAAA,MAChC,OAAO;AAAA,MACP,OAAO;AAAA,MACP,KAAK,KAAK,UAAU,IAAA;AAAA,MACpB,gBAAgB;AAAA,IAAA,CAChB;AACD,QAAI,CAAC,WAAW,IAAI;AACnB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,uBAAAA,uBAAuB,WAAW,OAAO,EAAE,CAAC;AACnF,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,eAAgC;AAG7C,UAAM,QAAQ,MAAM,KAAK,UAAU,YAAY,gBAAgB;AAC/D,QAAI,OAAO;AACX,aAAS,IAAI,GAAG,IAAI,kBAAkB,KAAK;AAC1C,eAAS,MAAM,CAAC,IAAI,IAAI,SAAA;AAAA,IACzB;AACA,WAAO;AAAA,EACR;AACD;;"}