@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/development/src/model/service/LoginRiskAnalyzer.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginRiskAnalyzer.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/LoginRiskAnalyzer.ts"],"sourcesContent":["import { BinaryLike } from 'node:crypto'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Operator, SelectBuilder } from '@contember/database'\nimport { Config } from '../type/Config.js'\n\n/**\n * Risk weights per signal (A03 v1). Cumulative: a login from a new country on a\n * new device scores HIGH + MEDIUM. Chosen so that the shipped default thresholds\n * (email >= 1, step-up >= 3) map intuitively to \"any single low signal emails,\n * a high signal steps up\".\n */\nexport const RiskWeight = {\n\t/** New country (from the trusted reverse-proxy geo header). */\n\tnewCountry: 3,\n\t/** New user-agent fingerprint. */\n\tnewDevice: 2,\n\t/** New IP / IP-prefix. */\n\tnewIpPrefix: 1,\n} as const\n\nexport type RiskAction = 'allow' | 'email' | 'stepUp'\n\n/**\n * Auth-log `type` values that represent a successful *interactive* sign-in which\n * issued a session for the person from their own client — i.e. the rows whose\n * geo/device/IP form the baseline for the next sign-in's anomaly check. Password\n * (`login`), federated (`idp_login`), and magic-link (`passwordless_login`) all\n * qualify. Deliberately excluded: `passwordless_login_exchange` (the OTP\n * activation step issues no session) and `create_session_token` (an admin minting\n * a token carries the admin's client info, not the person's).\n */\nexport const BASELINE_SIGN_IN_TYPES = ['login', 'idp_login', 'passwordless_login'] as const\n\nexport interface LoginSignals {\n\t/** Country code from the trusted geo header, or null when unavailable. */\n\treadonly geoCountry: string | null\n\t/** Hash of the client user-agent, or null when no UA was provided. */\n\treadonly deviceFingerprint: string | null\n\t/** Client IP, or null when unavailable. */\n\treadonly ip: string | null\n}\n\nexport interface PriorLogin {\n\treadonly geoCountry: string | null\n\treadonly deviceFingerprint: string | null\n\treadonly ip: string | null\n}\n\nexport interface RiskAssessment {\n\treadonly score: number\n\treadonly action: RiskAction\n\t/** Greppable list of which signals fired, e.g. ['new_country', 'new_device']. */\n\treadonly reasons: readonly string[]\n}\n\n/**\n * A03 — sign-in anomaly detection (v1). Runs after password verification (and any\n * standing MFA), before a session is issued. Pure scoring lives in {@link score};\n * {@link analyze} loads the comparison history and applies the configured policy.\n *\n * v1 scope (locked): no GeoIP DB — country comes from a trusted reverse-proxy\n * header read through the same trust gate as the forwarded IP/UA. No\n * impossible-travel detection. Opt-in, disabled by default.\n */\nexport class LoginRiskAnalyzer {\n\tconstructor(\n\t\tprivate readonly hash: (value: BinaryLike, algo: string) => Buffer,\n\t) {}\n\n\t/**\n\t * Deterministic user-agent fingerprint: a hex sha256 of the raw UA. We never\n\t * store the raw UA in a second column nor any cross-site fingerprint — just a\n\t * stable hash so \"same browser\" comparisons work without retaining the string.\n\t * Returns null for an absent/empty UA.\n\t */\n\tfingerprint(userAgent: string | undefined | null): string | null {\n\t\tif (!userAgent) {\n\t\t\treturn null\n\t\t}\n\t\treturn this.hash(userAgent, 'sha256').toString('hex')\n\t}\n\n\t/**\n\t * Pure scoring. Compares the current sign-in's signals against the set of prior\n\t * successful logins. A signal fires only when (a) the current value is known,\n\t * (b) a baseline for *that* signal exists in history — at least one prior login\n\t * recorded a non-null value for it — and (c) the current value is absent from\n\t * that baseline. With no history at all, or no baseline yet for a given signal\n\t * (e.g. the geo header or device fingerprint only started being collected when\n\t * the feature was enabled, so every prior row is null for it), that signal is\n\t * treated as known. This keeps the documented \"no baseline to deviate from →\n\t * trusted\" rule true per signal, so turning the feature on does not score every\n\t * returning user's first login as anomalous.\n\t */\n\tscore(current: LoginSignals, history: readonly PriorLogin[], config: Config['login']['anomalyDetection']): RiskAssessment {\n\t\tconst reasons: string[] = []\n\t\tlet total = 0\n\n\t\tif (history.length === 0) {\n\t\t\treturn { score: 0, action: 'allow', reasons }\n\t\t}\n\n\t\tif (current.geoCountry !== null) {\n\t\t\tconst baseline = history.filter(h => h.geoCountry !== null)\n\t\t\tif (baseline.length > 0 && !baseline.some(h => h.geoCountry === current.geoCountry)) {\n\t\t\t\ttotal += RiskWeight.newCountry\n\t\t\t\treasons.push('new_country')\n\t\t\t}\n\t\t}\n\n\t\tconst currentFingerprint = current.deviceFingerprint\n\t\tif (currentFingerprint !== null) {\n\t\t\tconst baseline = history.filter(h => h.deviceFingerprint !== null)\n\t\t\tif (baseline.length > 0 && !baseline.some(h => h.deviceFingerprint === currentFingerprint)) {\n\t\t\t\ttotal += RiskWeight.newDevice\n\t\t\t\treasons.push('new_device')\n\t\t\t}\n\t\t}\n\n\t\tconst currentPrefix = ipPrefix(current.ip)\n\t\tif (currentPrefix !== null) {\n\t\t\tconst baselinePrefixes = history.map(h => ipPrefix(h.ip)).filter((p): p is string => p !== null)\n\t\t\tif (baselinePrefixes.length > 0 && !baselinePrefixes.includes(currentPrefix)) {\n\t\t\t\ttotal += RiskWeight.newIpPrefix\n\t\t\t\treasons.push('new_ip_prefix')\n\t\t\t}\n\t\t}\n\n\t\treturn { score: total, action: this.decide(total, config), reasons }\n\t}\n\n\tprivate decide(total: number, config: Config['login']['anomalyDetection']): RiskAction {\n\t\t// step-up wins over email when both thresholds are crossed. A threshold of 0\n\t\t// would always fire, so it is only meaningful when the feature is enabled.\n\t\tif (total >= config.stepUpThreshold) {\n\t\t\treturn 'stepUp'\n\t\t}\n\t\tif (total >= config.emailThreshold) {\n\t\t\treturn 'email'\n\t\t}\n\t\treturn 'allow'\n\t}\n\n\t/**\n\t * Loads the last N successful logins for the person and scores the current\n\t * sign-in against them. Returns `allow` with no DB work when the feature is\n\t * disabled (the default), so an opted-out deployment runs exactly as before.\n\t */\n\tasync analyze(\n\t\tdbContext: DatabaseContext,\n\t\tpersonId: string,\n\t\tcurrent: LoginSignals,\n\t\tconfig: Config['login']['anomalyDetection'],\n\t): Promise<RiskAssessment> {\n\t\tif (!config.enabled) {\n\t\t\treturn { score: 0, action: 'allow', reasons: [] }\n\t\t}\n\n\t\tconst limit = Math.max(1, config.historySize)\n\t\tconst rows = await SelectBuilder.create<{ geo_country: string | null; device_fingerprint: string | null; ip_address: string | null }>()\n\t\t\t.select(['person_auth_log', 'geo_country'])\n\t\t\t.select(['person_auth_log', 'device_fingerprint'])\n\t\t\t.select(['person_auth_log', 'ip_address'])\n\t\t\t.from('person_auth_log')\n\t\t\t.where(it =>\n\t\t\t\tit\n\t\t\t\t\t.compare(['person_auth_log', 'person_id'], Operator.eq, personId)\n\t\t\t\t\t// Baseline = any successful interactive sign-in that issued a session\n\t\t\t\t\t// (password / IdP / passwordless), not just password logins — otherwise\n\t\t\t\t\t// a person who normally signs in via IdP/passwordless has no baseline and\n\t\t\t\t\t// their rare password sign-in is wrongly treated as a trusted first login.\n\t\t\t\t\t.in(['person_auth_log', 'type'], [...BASELINE_SIGN_IN_TYPES])\n\t\t\t\t\t.compare(['person_auth_log', 'success'], Operator.eq, true)\n\t\t\t)\n\t\t\t.orderBy(['person_auth_log', 'created_at'], 'desc')\n\t\t\t.limit(limit)\n\t\t\t.getResult(dbContext.client)\n\n\t\tconst history: PriorLogin[] = rows.map(row => ({\n\t\t\tgeoCountry: row.geo_country,\n\t\t\tdeviceFingerprint: row.device_fingerprint,\n\t\t\tip: row.ip_address,\n\t\t}))\n\n\t\treturn this.score(current, history, config)\n\t}\n}\n\n/**\n * Coarsens an IP to a prefix so a roaming client on the same network is treated\n * as \"known\": /24 for IPv4, /48 for IPv6 (the typical site-allocation boundary).\n * Returns null for an absent or unparseable address. Intentionally string-based\n * to avoid pulling a parser onto the sign-in hot path, but the IPv6 form is fully\n * canonicalized (lower-cased, leading zeros stripped, `::` expanded) so the same\n * /48 written two different ways compares equal against stored values.\n */\nexport const ipPrefix = (ip: string | null): string | null => {\n\tif (!ip) {\n\t\treturn null\n\t}\n\tconst trimmed = ip.trim().toLowerCase()\n\tif (trimmed.length === 0) {\n\t\treturn null\n\t}\n\t// Pure IPv4 (dotted quad, no colon) → /24.\n\tif (!trimmed.includes(':')) {\n\t\tconst octets = trimmed.split('.')\n\t\tif (octets.length === 4) {\n\t\t\treturn `${octets[0]}.${octets[1]}.${octets[2]}.0/24`\n\t\t}\n\t\treturn trimmed\n\t}\n\t// IPv6. expandIpv6 also folds a trailing IPv4 dotted-quad (the ::ffff:a.b.c.d\n\t// form, in any compressed/expanded spelling) into two hextets, so the whole\n\t// address is canonicalized here in one place.\n\tconst hextets = expandIpv6(trimmed)\n\tif (hextets === null) {\n\t\treturn trimmed\n\t}\n\t// IPv4-mapped IPv6 (::ffff:a.b.c.d) carries the real client IPv4 in its low 32\n\t// bits → coarsen THAT to a /24. Guarded on the leading 80 bits being zero AND\n\t// the 6th hextet being ffff, so a *non-mapped* address that merely ends in\n\t// `:ffff:<dotted-quad>` (e.g. 2001:db8::ffff:1.2.3.4, or NAT64 64:ff9b::1.2.3.4)\n\t// stays a normal IPv6 /48 instead of collapsing to a bogus, colliding /24.\n\tif (hextets.slice(0, 5).every(h => parseInt(h, 16) === 0) && parseInt(hextets[5], 16) === 0xffff) {\n\t\tconst hi = parseInt(hextets[6], 16)\n\t\tconst lo = parseInt(hextets[7], 16)\n\t\treturn `${hi >> 8}.${hi & 0xff}.${lo >> 8}.0/24`\n\t}\n\t// Canonical /48 = the first three hextets, each with leading zeros stripped.\n\tconst network = hextets.slice(0, 3).map(h => parseInt(h, 16).toString(16))\n\treturn `${network.join(':')}::/48`\n}\n\n/**\n * Expands an IPv6 address to its 8 hextets (as lower-case hex strings, leading\n * zeros kept — the caller strips them). Handles a single `::` run and a trailing\n * IPv4 dotted-quad in the low 32 bits (`x:x:x:x:x:x:d.d.d.d`, e.g. the\n * `::ffff:a.b.c.d` mapped form), which it folds into two hextets first. Returns\n * null for anything that does not look like a valid IPv6 address so the caller can\n * fall back to a raw compare rather than mint a bogus prefix.\n */\nconst expandIpv6 = (value: string): string[] | null => {\n\t// Fold a trailing IPv4 dotted-quad into two hextets so the rest works purely in\n\t// hex groups (and a non-zero prefix before `:ffff:` is preserved as hextets,\n\t// not mistaken for an IPv4-mapped address).\n\tlet normalized = value\n\tconst dotted = /^(.*:)(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/.exec(value)\n\tif (dotted) {\n\t\tconst octets = [dotted[2], dotted[3], dotted[4], dotted[5]].map(Number)\n\t\tif (octets.some(o => o > 255)) {\n\t\t\treturn null\n\t\t}\n\t\tconst hi = ((octets[0] << 8) | octets[1]).toString(16)\n\t\tconst lo = ((octets[2] << 8) | octets[3]).toString(16)\n\t\tnormalized = `${dotted[1]}${hi}:${lo}`\n\t}\n\tconst parts = normalized.split('::')\n\tif (parts.length > 2) {\n\t\treturn null\n\t}\n\tconst head = parts[0] === '' ? [] : parts[0].split(':')\n\tconst tail = parts.length === 2 ? (parts[1] === '' ? [] : parts[1].split(':')) : []\n\tconst groups = parts.length === 2\n\t\t? [...head, ...Array(Math.max(0, 8 - head.length - tail.length)).fill('0'), ...tail]\n\t\t: head\n\tif (parts.length === 2 ? groups.length > 8 : groups.length !== 8) {\n\t\treturn null\n\t}\n\tif (groups.some(g => !/^[0-9a-f]{1,4}$/.test(g))) {\n\t\treturn null\n\t}\n\treturn groups\n}\n"],"names":["SelectBuilder","Operator"],"mappings":";;;AAWO,MAAM,aAAa;AAAA;AAAA,EAEzB,YAAY;AAAA;AAAA,EAEZ,WAAW;AAAA;AAAA,EAEX,aAAa;AACd;AAaO,MAAM,yBAAyB,CAAC,SAAS,aAAa,oBAAoB;AAiC1E,MAAM,kBAAkB;AAAA,EAC9B,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQH,YAAY,WAAqD;AAChE,QAAI,CAAC,WAAW;AACf,aAAO;AAAA,IACR;AACA,WAAO,KAAK,KAAK,WAAW,QAAQ,EAAE,SAAS,KAAK;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,SAAuB,SAAgC,QAA6D;AACzH,UAAM,UAAoB,CAAA;AAC1B,QAAI,QAAQ;AAEZ,QAAI,QAAQ,WAAW,GAAG;AACzB,aAAO,EAAE,OAAO,GAAG,QAAQ,SAAS,QAAA;AAAA,IACrC;AAEA,QAAI,QAAQ,eAAe,MAAM;AAChC,YAAM,WAAW,QAAQ,OAAO,CAAA,MAAK,EAAE,eAAe,IAAI;AAC1D,UAAI,SAAS,SAAS,KAAK,CAAC,SAAS,KAAK,CAAA,MAAK,EAAE,eAAe,QAAQ,UAAU,GAAG;AACpF,iBAAS,WAAW;AACpB,gBAAQ,KAAK,aAAa;AAAA,MAC3B;AAAA,IACD;AAEA,UAAM,qBAAqB,QAAQ;AACnC,QAAI,uBAAuB,MAAM;AAChC,YAAM,WAAW,QAAQ,OAAO,CAAA,MAAK,EAAE,sBAAsB,IAAI;AACjE,UAAI,SAAS,SAAS,KAAK,CAAC,SAAS,KAAK,CAAA,MAAK,EAAE,sBAAsB,kBAAkB,GAAG;AAC3F,iBAAS,WAAW;AACpB,gBAAQ,KAAK,YAAY;AAAA,MAC1B;AAAA,IACD;AAEA,UAAM,gBAAgB,SAAS,QAAQ,EAAE;AACzC,QAAI,kBAAkB,MAAM;AAC3B,YAAM,mBAAmB,QAAQ,IAAI,CAAA,MAAK,SAAS,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,MAAmB,MAAM,IAAI;AAC/F,UAAI,iBAAiB,SAAS,KAAK,CAAC,iBAAiB,SAAS,aAAa,GAAG;AAC7E,iBAAS,WAAW;AACpB,gBAAQ,KAAK,eAAe;AAAA,MAC7B;AAAA,IACD;AAEA,WAAO,EAAE,OAAO,OAAO,QAAQ,KAAK,OAAO,OAAO,MAAM,GAAG,QAAA;AAAA,EAC5D;AAAA,EAEQ,OAAO,OAAe,QAAyD;AAGtF,QAAI,SAAS,OAAO,iBAAiB;AACpC,aAAO;AAAA,IACR;AACA,QAAI,SAAS,OAAO,gBAAgB;AACnC,aAAO;AAAA,IACR;AACA,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,QACL,WACA,UACA,SACA,QAC0B;AAC1B,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO,EAAE,OAAO,GAAG,QAAQ,SAAS,SAAS,GAAC;AAAA,IAC/C;AAEA,UAAM,QAAQ,KAAK,IAAI,GAAG,OAAO,WAAW;AAC5C,UAAM,OAAO,MAAMA,SAAAA,cAAc,OAAA,EAC/B,OAAO,CAAC,mBAAmB,aAAa,CAAC,EACzC,OAAO,CAAC,mBAAmB,oBAAoB,CAAC,EAChD,OAAO,CAAC,mBAAmB,YAAY,CAAC,EACxC,KAAK,iBAAiB,EACtB;AAAA,MAAM,CAAA,OACN,GACE,QAAQ,CAAC,mBAAmB,WAAW,GAAGC,kBAAS,IAAI,QAAQ,EAK/D,GAAG,CAAC,mBAAmB,MAAM,GAAG,CAAC,GAAG,sBAAsB,CAAC,EAC3D,QAAQ,CAAC,mBAAmB,SAAS,GAAGA,SAAAA,SAAS,IAAI,IAAI;AAAA,IAAA,EAE3D,QAAQ,CAAC,mBAAmB,YAAY,GAAG,MAAM,EACjD,MAAM,KAAK,EACX,UAAU,UAAU,MAAM;AAE5B,UAAM,UAAwB,KAAK,IAAI,CAAA,SAAQ;AAAA,MAC9C,YAAY,IAAI;AAAA,MAChB,mBAAmB,IAAI;AAAA,MACvB,IAAI,IAAI;AAAA,IAAA,EACP;AAEF,WAAO,KAAK,MAAM,SAAS,SAAS,MAAM;AAAA,EAC3C;AACD;AAUO,MAAM,WAAW,CAAC,OAAqC;AAC7D,MAAI,CAAC,IAAI;AACR,WAAO;AAAA,EACR;AACA,QAAM,UAAU,GAAG,KAAA,EAAO,YAAA;AAC1B,MAAI,QAAQ,WAAW,GAAG;AACzB,WAAO;AAAA,EACR;AAEA,MAAI,CAAC,QAAQ,SAAS,GAAG,GAAG;AAC3B,UAAM,SAAS,QAAQ,MAAM,GAAG;AAChC,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO,GAAG,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;AAAA,IAC9C;AACA,WAAO;AAAA,EACR;AAIA,QAAM,UAAU,WAAW,OAAO;AAClC,MAAI,YAAY,MAAM;AACrB,WAAO;AAAA,EACR;AAMA,MAAI,QAAQ,MAAM,GAAG,CAAC,EAAE,MAAM,OAAK,SAAS,GAAG,EAAE,MAAM,CAAC,KAAK,SAAS,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAQ;AACjG,UAAM,KAAK,SAAS,QAAQ,CAAC,GAAG,EAAE;AAClC,UAAM,KAAK,SAAS,QAAQ,CAAC,GAAG,EAAE;AAClC,WAAO,GAAG,MAAM,CAAC,IAAI,KAAK,GAAI,IAAI,MAAM,CAAC;AAAA,EAC1C;AAEA,QAAM,UAAU,QAAQ,MAAM,GAAG,CAAC,EAAE,IAAI,CAAA,MAAK,SAAS,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC;AACzE,SAAO,GAAG,QAAQ,KAAK,GAAG,CAAC;AAC5B;AAUA,MAAM,aAAa,CAAC,UAAmC;AAItD,MAAI,aAAa;AACjB,QAAM,SAAS,oDAAoD,KAAK,KAAK;AAC7E,MAAI,QAAQ;AACX,UAAM,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM;AACtE,QAAI,OAAO,KAAK,CAAA,MAAK,IAAI,GAAG,GAAG;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,MAAO,OAAO,CAAC,KAAK,IAAK,OAAO,CAAC,GAAG,SAAS,EAAE;AACrD,UAAM,MAAO,OAAO,CAAC,KAAK,IAAK,OAAO,CAAC,GAAG,SAAS,EAAE;AACrD,iBAAa,GAAG,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE;AAAA,EACrC;AACA,QAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,MAAI,MAAM,SAAS,GAAG;AACrB,WAAO;AAAA,EACR;AACA,QAAM,OAAO,MAAM,CAAC,MAAM,KAAK,KAAK,MAAM,CAAC,EAAE,MAAM,GAAG;AACtD,QAAM,OAAO,MAAM,WAAW,IAAK,MAAM,CAAC,MAAM,KAAK,CAAA,IAAK,MAAM,CAAC,EAAE,MAAM,GAAG,IAAK,CAAA;AACjF,QAAM,SAAS,MAAM,WAAW,IAC7B,CAAC,GAAG,MAAM,GAAG,MAAM,KAAK,IAAI,GAAG,IAAI,KAAK,SAAS,KAAK,MAAM,CAAC,EAAE,KAAK,GAAG,GAAG,GAAG,IAAI,IACjF;AACH,MAAI,MAAM,WAAW,IAAI,OAAO,SAAS,IAAI,OAAO,WAAW,GAAG;AACjE,WAAO;AAAA,EACR;AACA,MAAI,OAAO,KAAK,CAAA,MAAK,CAAC,kBAAkB,KAAK,CAAC,CAAC,GAAG;AACjD,WAAO;AAAA,EACR;AACA,SAAO;AACR;;;;;"}

package/dist/development/src/model/service/LoginRiskAnalyzer.js

@@ -0,0 +1,160 @@
+import { SelectBuilder, Operator } from "@contember/database";
+const RiskWeight = {
+  /** New country (from the trusted reverse-proxy geo header). */
+  newCountry: 3,
+  /** New user-agent fingerprint. */
+  newDevice: 2,
+  /** New IP / IP-prefix. */
+  newIpPrefix: 1
+};
+const BASELINE_SIGN_IN_TYPES = ["login", "idp_login", "passwordless_login"];
+class LoginRiskAnalyzer {
+  constructor(hash) {
+    this.hash = hash;
+  }
+  /**
+   * Deterministic user-agent fingerprint: a hex sha256 of the raw UA. We never
+   * store the raw UA in a second column nor any cross-site fingerprint — just a
+   * stable hash so "same browser" comparisons work without retaining the string.
+   * Returns null for an absent/empty UA.
+   */
+  fingerprint(userAgent) {
+    if (!userAgent) {
+      return null;
+    }
+    return this.hash(userAgent, "sha256").toString("hex");
+  }
+  /**
+   * Pure scoring. Compares the current sign-in's signals against the set of prior
+   * successful logins. A signal fires only when (a) the current value is known,
+   * (b) a baseline for *that* signal exists in history — at least one prior login
+   * recorded a non-null value for it — and (c) the current value is absent from
+   * that baseline. With no history at all, or no baseline yet for a given signal
+   * (e.g. the geo header or device fingerprint only started being collected when
+   * the feature was enabled, so every prior row is null for it), that signal is
+   * treated as known. This keeps the documented "no baseline to deviate from →
+   * trusted" rule true per signal, so turning the feature on does not score every
+   * returning user's first login as anomalous.
+   */
+  score(current, history, config) {
+    const reasons = [];
+    let total = 0;
+    if (history.length === 0) {
+      return { score: 0, action: "allow", reasons };
+    }
+    if (current.geoCountry !== null) {
+      const baseline = history.filter((h) => h.geoCountry !== null);
+      if (baseline.length > 0 && !baseline.some((h) => h.geoCountry === current.geoCountry)) {
+        total += RiskWeight.newCountry;
+        reasons.push("new_country");
+      }
+    }
+    const currentFingerprint = current.deviceFingerprint;
+    if (currentFingerprint !== null) {
+      const baseline = history.filter((h) => h.deviceFingerprint !== null);
+      if (baseline.length > 0 && !baseline.some((h) => h.deviceFingerprint === currentFingerprint)) {
+        total += RiskWeight.newDevice;
+        reasons.push("new_device");
+      }
+    }
+    const currentPrefix = ipPrefix(current.ip);
+    if (currentPrefix !== null) {
+      const baselinePrefixes = history.map((h) => ipPrefix(h.ip)).filter((p) => p !== null);
+      if (baselinePrefixes.length > 0 && !baselinePrefixes.includes(currentPrefix)) {
+        total += RiskWeight.newIpPrefix;
+        reasons.push("new_ip_prefix");
+      }
+    }
+    return { score: total, action: this.decide(total, config), reasons };
+  }
+  decide(total, config) {
+    if (total >= config.stepUpThreshold) {
+      return "stepUp";
+    }
+    if (total >= config.emailThreshold) {
+      return "email";
+    }
+    return "allow";
+  }
+  /**
+   * Loads the last N successful logins for the person and scores the current
+   * sign-in against them. Returns `allow` with no DB work when the feature is
+   * disabled (the default), so an opted-out deployment runs exactly as before.
+   */
+  async analyze(dbContext, personId, current, config) {
+    if (!config.enabled) {
+      return { score: 0, action: "allow", reasons: [] };
+    }
+    const limit = Math.max(1, config.historySize);
+    const rows = await SelectBuilder.create().select(["person_auth_log", "geo_country"]).select(["person_auth_log", "device_fingerprint"]).select(["person_auth_log", "ip_address"]).from("person_auth_log").where(
+      (it) => it.compare(["person_auth_log", "person_id"], Operator.eq, personId).in(["person_auth_log", "type"], [...BASELINE_SIGN_IN_TYPES]).compare(["person_auth_log", "success"], Operator.eq, true)
+    ).orderBy(["person_auth_log", "created_at"], "desc").limit(limit).getResult(dbContext.client);
+    const history = rows.map((row) => ({
+      geoCountry: row.geo_country,
+      deviceFingerprint: row.device_fingerprint,
+      ip: row.ip_address
+    }));
+    return this.score(current, history, config);
+  }
+}
+const ipPrefix = (ip) => {
+  if (!ip) {
+    return null;
+  }
+  const trimmed = ip.trim().toLowerCase();
+  if (trimmed.length === 0) {
+    return null;
+  }
+  if (!trimmed.includes(":")) {
+    const octets = trimmed.split(".");
+    if (octets.length === 4) {
+      return `${octets[0]}.${octets[1]}.${octets[2]}.0/24`;
+    }
+    return trimmed;
+  }
+  const hextets = expandIpv6(trimmed);
+  if (hextets === null) {
+    return trimmed;
+  }
+  if (hextets.slice(0, 5).every((h) => parseInt(h, 16) === 0) && parseInt(hextets[5], 16) === 65535) {
+    const hi = parseInt(hextets[6], 16);
+    const lo = parseInt(hextets[7], 16);
+    return `${hi >> 8}.${hi & 255}.${lo >> 8}.0/24`;
+  }
+  const network = hextets.slice(0, 3).map((h) => parseInt(h, 16).toString(16));
+  return `${network.join(":")}::/48`;
+};
+const expandIpv6 = (value) => {
+  let normalized = value;
+  const dotted = /^(.*:)(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(value);
+  if (dotted) {
+    const octets = [dotted[2], dotted[3], dotted[4], dotted[5]].map(Number);
+    if (octets.some((o) => o > 255)) {
+      return null;
+    }
+    const hi = (octets[0] << 8 | octets[1]).toString(16);
+    const lo = (octets[2] << 8 | octets[3]).toString(16);
+    normalized = `${dotted[1]}${hi}:${lo}`;
+  }
+  const parts = normalized.split("::");
+  if (parts.length > 2) {
+    return null;
+  }
+  const head = parts[0] === "" ? [] : parts[0].split(":");
+  const tail = parts.length === 2 ? parts[1] === "" ? [] : parts[1].split(":") : [];
+  const groups = parts.length === 2 ? [...head, ...Array(Math.max(0, 8 - head.length - tail.length)).fill("0"), ...tail] : head;
+  if (parts.length === 2 ? groups.length > 8 : groups.length !== 8) {
+    return null;
+  }
+  if (groups.some((g) => !/^[0-9a-f]{1,4}$/.test(g))) {
+    return null;
+  }
+  return groups;
+};
+export {
+  BASELINE_SIGN_IN_TYPES,
+  LoginRiskAnalyzer,
+  RiskWeight,
+  ipPrefix
+};
+//# sourceMappingURL=LoginRiskAnalyzer.js.map

package/dist/development/src/model/service/LoginRiskAnalyzer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginRiskAnalyzer.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/LoginRiskAnalyzer.ts"],"sourcesContent":["import { BinaryLike } from 'node:crypto'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Operator, SelectBuilder } from '@contember/database'\nimport { Config } from '../type/Config.js'\n\n/**\n * Risk weights per signal (A03 v1). Cumulative: a login from a new country on a\n * new device scores HIGH + MEDIUM. Chosen so that the shipped default thresholds\n * (email >= 1, step-up >= 3) map intuitively to \"any single low signal emails,\n * a high signal steps up\".\n */\nexport const RiskWeight = {\n\t/** New country (from the trusted reverse-proxy geo header). */\n\tnewCountry: 3,\n\t/** New user-agent fingerprint. */\n\tnewDevice: 2,\n\t/** New IP / IP-prefix. */\n\tnewIpPrefix: 1,\n} as const\n\nexport type RiskAction = 'allow' | 'email' | 'stepUp'\n\n/**\n * Auth-log `type` values that represent a successful *interactive* sign-in which\n * issued a session for the person from their own client — i.e. the rows whose\n * geo/device/IP form the baseline for the next sign-in's anomaly check. Password\n * (`login`), federated (`idp_login`), and magic-link (`passwordless_login`) all\n * qualify. Deliberately excluded: `passwordless_login_exchange` (the OTP\n * activation step issues no session) and `create_session_token` (an admin minting\n * a token carries the admin's client info, not the person's).\n */\nexport const BASELINE_SIGN_IN_TYPES = ['login', 'idp_login', 'passwordless_login'] as const\n\nexport interface LoginSignals {\n\t/** Country code from the trusted geo header, or null when unavailable. */\n\treadonly geoCountry: string | null\n\t/** Hash of the client user-agent, or null when no UA was provided. */\n\treadonly deviceFingerprint: string | null\n\t/** Client IP, or null when unavailable. */\n\treadonly ip: string | null\n}\n\nexport interface PriorLogin {\n\treadonly geoCountry: string | null\n\treadonly deviceFingerprint: string | null\n\treadonly ip: string | null\n}\n\nexport interface RiskAssessment {\n\treadonly score: number\n\treadonly action: RiskAction\n\t/** Greppable list of which signals fired, e.g. ['new_country', 'new_device']. */\n\treadonly reasons: readonly string[]\n}\n\n/**\n * A03 — sign-in anomaly detection (v1). Runs after password verification (and any\n * standing MFA), before a session is issued. Pure scoring lives in {@link score};\n * {@link analyze} loads the comparison history and applies the configured policy.\n *\n * v1 scope (locked): no GeoIP DB — country comes from a trusted reverse-proxy\n * header read through the same trust gate as the forwarded IP/UA. No\n * impossible-travel detection. Opt-in, disabled by default.\n */\nexport class LoginRiskAnalyzer {\n\tconstructor(\n\t\tprivate readonly hash: (value: BinaryLike, algo: string) => Buffer,\n\t) {}\n\n\t/**\n\t * Deterministic user-agent fingerprint: a hex sha256 of the raw UA. We never\n\t * store the raw UA in a second column nor any cross-site fingerprint — just a\n\t * stable hash so \"same browser\" comparisons work without retaining the string.\n\t * Returns null for an absent/empty UA.\n\t */\n\tfingerprint(userAgent: string | undefined | null): string | null {\n\t\tif (!userAgent) {\n\t\t\treturn null\n\t\t}\n\t\treturn this.hash(userAgent, 'sha256').toString('hex')\n\t}\n\n\t/**\n\t * Pure scoring. Compares the current sign-in's signals against the set of prior\n\t * successful logins. A signal fires only when (a) the current value is known,\n\t * (b) a baseline for *that* signal exists in history — at least one prior login\n\t * recorded a non-null value for it — and (c) the current value is absent from\n\t * that baseline. With no history at all, or no baseline yet for a given signal\n\t * (e.g. the geo header or device fingerprint only started being collected when\n\t * the feature was enabled, so every prior row is null for it), that signal is\n\t * treated as known. This keeps the documented \"no baseline to deviate from →\n\t * trusted\" rule true per signal, so turning the feature on does not score every\n\t * returning user's first login as anomalous.\n\t */\n\tscore(current: LoginSignals, history: readonly PriorLogin[], config: Config['login']['anomalyDetection']): RiskAssessment {\n\t\tconst reasons: string[] = []\n\t\tlet total = 0\n\n\t\tif (history.length === 0) {\n\t\t\treturn { score: 0, action: 'allow', reasons }\n\t\t}\n\n\t\tif (current.geoCountry !== null) {\n\t\t\tconst baseline = history.filter(h => h.geoCountry !== null)\n\t\t\tif (baseline.length > 0 && !baseline.some(h => h.geoCountry === current.geoCountry)) {\n\t\t\t\ttotal += RiskWeight.newCountry\n\t\t\t\treasons.push('new_country')\n\t\t\t}\n\t\t}\n\n\t\tconst currentFingerprint = current.deviceFingerprint\n\t\tif (currentFingerprint !== null) {\n\t\t\tconst baseline = history.filter(h => h.deviceFingerprint !== null)\n\t\t\tif (baseline.length > 0 && !baseline.some(h => h.deviceFingerprint === currentFingerprint)) {\n\t\t\t\ttotal += RiskWeight.newDevice\n\t\t\t\treasons.push('new_device')\n\t\t\t}\n\t\t}\n\n\t\tconst currentPrefix = ipPrefix(current.ip)\n\t\tif (currentPrefix !== null) {\n\t\t\tconst baselinePrefixes = history.map(h => ipPrefix(h.ip)).filter((p): p is string => p !== null)\n\t\t\tif (baselinePrefixes.length > 0 && !baselinePrefixes.includes(currentPrefix)) {\n\t\t\t\ttotal += RiskWeight.newIpPrefix\n\t\t\t\treasons.push('new_ip_prefix')\n\t\t\t}\n\t\t}\n\n\t\treturn { score: total, action: this.decide(total, config), reasons }\n\t}\n\n\tprivate decide(total: number, config: Config['login']['anomalyDetection']): RiskAction {\n\t\t// step-up wins over email when both thresholds are crossed. A threshold of 0\n\t\t// would always fire, so it is only meaningful when the feature is enabled.\n\t\tif (total >= config.stepUpThreshold) {\n\t\t\treturn 'stepUp'\n\t\t}\n\t\tif (total >= config.emailThreshold) {\n\t\t\treturn 'email'\n\t\t}\n\t\treturn 'allow'\n\t}\n\n\t/**\n\t * Loads the last N successful logins for the person and scores the current\n\t * sign-in against them. Returns `allow` with no DB work when the feature is\n\t * disabled (the default), so an opted-out deployment runs exactly as before.\n\t */\n\tasync analyze(\n\t\tdbContext: DatabaseContext,\n\t\tpersonId: string,\n\t\tcurrent: LoginSignals,\n\t\tconfig: Config['login']['anomalyDetection'],\n\t): Promise<RiskAssessment> {\n\t\tif (!config.enabled) {\n\t\t\treturn { score: 0, action: 'allow', reasons: [] }\n\t\t}\n\n\t\tconst limit = Math.max(1, config.historySize)\n\t\tconst rows = await SelectBuilder.create<{ geo_country: string | null; device_fingerprint: string | null; ip_address: string | null }>()\n\t\t\t.select(['person_auth_log', 'geo_country'])\n\t\t\t.select(['person_auth_log', 'device_fingerprint'])\n\t\t\t.select(['person_auth_log', 'ip_address'])\n\t\t\t.from('person_auth_log')\n\t\t\t.where(it =>\n\t\t\t\tit\n\t\t\t\t\t.compare(['person_auth_log', 'person_id'], Operator.eq, personId)\n\t\t\t\t\t// Baseline = any successful interactive sign-in that issued a session\n\t\t\t\t\t// (password / IdP / passwordless), not just password logins — otherwise\n\t\t\t\t\t// a person who normally signs in via IdP/passwordless has no baseline and\n\t\t\t\t\t// their rare password sign-in is wrongly treated as a trusted first login.\n\t\t\t\t\t.in(['person_auth_log', 'type'], [...BASELINE_SIGN_IN_TYPES])\n\t\t\t\t\t.compare(['person_auth_log', 'success'], Operator.eq, true)\n\t\t\t)\n\t\t\t.orderBy(['person_auth_log', 'created_at'], 'desc')\n\t\t\t.limit(limit)\n\t\t\t.getResult(dbContext.client)\n\n\t\tconst history: PriorLogin[] = rows.map(row => ({\n\t\t\tgeoCountry: row.geo_country,\n\t\t\tdeviceFingerprint: row.device_fingerprint,\n\t\t\tip: row.ip_address,\n\t\t}))\n\n\t\treturn this.score(current, history, config)\n\t}\n}\n\n/**\n * Coarsens an IP to a prefix so a roaming client on the same network is treated\n * as \"known\": /24 for IPv4, /48 for IPv6 (the typical site-allocation boundary).\n * Returns null for an absent or unparseable address. Intentionally string-based\n * to avoid pulling a parser onto the sign-in hot path, but the IPv6 form is fully\n * canonicalized (lower-cased, leading zeros stripped, `::` expanded) so the same\n * /48 written two different ways compares equal against stored values.\n */\nexport const ipPrefix = (ip: string | null): string | null => {\n\tif (!ip) {\n\t\treturn null\n\t}\n\tconst trimmed = ip.trim().toLowerCase()\n\tif (trimmed.length === 0) {\n\t\treturn null\n\t}\n\t// Pure IPv4 (dotted quad, no colon) → /24.\n\tif (!trimmed.includes(':')) {\n\t\tconst octets = trimmed.split('.')\n\t\tif (octets.length === 4) {\n\t\t\treturn `${octets[0]}.${octets[1]}.${octets[2]}.0/24`\n\t\t}\n\t\treturn trimmed\n\t}\n\t// IPv6. expandIpv6 also folds a trailing IPv4 dotted-quad (the ::ffff:a.b.c.d\n\t// form, in any compressed/expanded spelling) into two hextets, so the whole\n\t// address is canonicalized here in one place.\n\tconst hextets = expandIpv6(trimmed)\n\tif (hextets === null) {\n\t\treturn trimmed\n\t}\n\t// IPv4-mapped IPv6 (::ffff:a.b.c.d) carries the real client IPv4 in its low 32\n\t// bits → coarsen THAT to a /24. Guarded on the leading 80 bits being zero AND\n\t// the 6th hextet being ffff, so a *non-mapped* address that merely ends in\n\t// `:ffff:<dotted-quad>` (e.g. 2001:db8::ffff:1.2.3.4, or NAT64 64:ff9b::1.2.3.4)\n\t// stays a normal IPv6 /48 instead of collapsing to a bogus, colliding /24.\n\tif (hextets.slice(0, 5).every(h => parseInt(h, 16) === 0) && parseInt(hextets[5], 16) === 0xffff) {\n\t\tconst hi = parseInt(hextets[6], 16)\n\t\tconst lo = parseInt(hextets[7], 16)\n\t\treturn `${hi >> 8}.${hi & 0xff}.${lo >> 8}.0/24`\n\t}\n\t// Canonical /48 = the first three hextets, each with leading zeros stripped.\n\tconst network = hextets.slice(0, 3).map(h => parseInt(h, 16).toString(16))\n\treturn `${network.join(':')}::/48`\n}\n\n/**\n * Expands an IPv6 address to its 8 hextets (as lower-case hex strings, leading\n * zeros kept — the caller strips them). Handles a single `::` run and a trailing\n * IPv4 dotted-quad in the low 32 bits (`x:x:x:x:x:x:d.d.d.d`, e.g. the\n * `::ffff:a.b.c.d` mapped form), which it folds into two hextets first. Returns\n * null for anything that does not look like a valid IPv6 address so the caller can\n * fall back to a raw compare rather than mint a bogus prefix.\n */\nconst expandIpv6 = (value: string): string[] | null => {\n\t// Fold a trailing IPv4 dotted-quad into two hextets so the rest works purely in\n\t// hex groups (and a non-zero prefix before `:ffff:` is preserved as hextets,\n\t// not mistaken for an IPv4-mapped address).\n\tlet normalized = value\n\tconst dotted = /^(.*:)(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/.exec(value)\n\tif (dotted) {\n\t\tconst octets = [dotted[2], dotted[3], dotted[4], dotted[5]].map(Number)\n\t\tif (octets.some(o => o > 255)) {\n\t\t\treturn null\n\t\t}\n\t\tconst hi = ((octets[0] << 8) | octets[1]).toString(16)\n\t\tconst lo = ((octets[2] << 8) | octets[3]).toString(16)\n\t\tnormalized = `${dotted[1]}${hi}:${lo}`\n\t}\n\tconst parts = normalized.split('::')\n\tif (parts.length > 2) {\n\t\treturn null\n\t}\n\tconst head = parts[0] === '' ? [] : parts[0].split(':')\n\tconst tail = parts.length === 2 ? (parts[1] === '' ? [] : parts[1].split(':')) : []\n\tconst groups = parts.length === 2\n\t\t? [...head, ...Array(Math.max(0, 8 - head.length - tail.length)).fill('0'), ...tail]\n\t\t: head\n\tif (parts.length === 2 ? groups.length > 8 : groups.length !== 8) {\n\t\treturn null\n\t}\n\tif (groups.some(g => !/^[0-9a-f]{1,4}$/.test(g))) {\n\t\treturn null\n\t}\n\treturn groups\n}\n"],"names":[],"mappings":";AAWO,MAAM,aAAa;AAAA;AAAA,EAEzB,YAAY;AAAA;AAAA,EAEZ,WAAW;AAAA;AAAA,EAEX,aAAa;AACd;AAaO,MAAM,yBAAyB,CAAC,SAAS,aAAa,oBAAoB;AAiC1E,MAAM,kBAAkB;AAAA,EAC9B,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQH,YAAY,WAAqD;AAChE,QAAI,CAAC,WAAW;AACf,aAAO;AAAA,IACR;AACA,WAAO,KAAK,KAAK,WAAW,QAAQ,EAAE,SAAS,KAAK;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,SAAuB,SAAgC,QAA6D;AACzH,UAAM,UAAoB,CAAA;AAC1B,QAAI,QAAQ;AAEZ,QAAI,QAAQ,WAAW,GAAG;AACzB,aAAO,EAAE,OAAO,GAAG,QAAQ,SAAS,QAAA;AAAA,IACrC;AAEA,QAAI,QAAQ,eAAe,MAAM;AAChC,YAAM,WAAW,QAAQ,OAAO,CAAA,MAAK,EAAE,eAAe,IAAI;AAC1D,UAAI,SAAS,SAAS,KAAK,CAAC,SAAS,KAAK,CAAA,MAAK,EAAE,eAAe,QAAQ,UAAU,GAAG;AACpF,iBAAS,WAAW;AACpB,gBAAQ,KAAK,aAAa;AAAA,MAC3B;AAAA,IACD;AAEA,UAAM,qBAAqB,QAAQ;AACnC,QAAI,uBAAuB,MAAM;AAChC,YAAM,WAAW,QAAQ,OAAO,CAAA,MAAK,EAAE,sBAAsB,IAAI;AACjE,UAAI,SAAS,SAAS,KAAK,CAAC,SAAS,KAAK,CAAA,MAAK,EAAE,sBAAsB,kBAAkB,GAAG;AAC3F,iBAAS,WAAW;AACpB,gBAAQ,KAAK,YAAY;AAAA,MAC1B;AAAA,IACD;AAEA,UAAM,gBAAgB,SAAS,QAAQ,EAAE;AACzC,QAAI,kBAAkB,MAAM;AAC3B,YAAM,mBAAmB,QAAQ,IAAI,CAAA,MAAK,SAAS,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,MAAmB,MAAM,IAAI;AAC/F,UAAI,iBAAiB,SAAS,KAAK,CAAC,iBAAiB,SAAS,aAAa,GAAG;AAC7E,iBAAS,WAAW;AACpB,gBAAQ,KAAK,eAAe;AAAA,MAC7B;AAAA,IACD;AAEA,WAAO,EAAE,OAAO,OAAO,QAAQ,KAAK,OAAO,OAAO,MAAM,GAAG,QAAA;AAAA,EAC5D;AAAA,EAEQ,OAAO,OAAe,QAAyD;AAGtF,QAAI,SAAS,OAAO,iBAAiB;AACpC,aAAO;AAAA,IACR;AACA,QAAI,SAAS,OAAO,gBAAgB;AACnC,aAAO;AAAA,IACR;AACA,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,QACL,WACA,UACA,SACA,QAC0B;AAC1B,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO,EAAE,OAAO,GAAG,QAAQ,SAAS,SAAS,GAAC;AAAA,IAC/C;AAEA,UAAM,QAAQ,KAAK,IAAI,GAAG,OAAO,WAAW;AAC5C,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,OAAO,CAAC,mBAAmB,aAAa,CAAC,EACzC,OAAO,CAAC,mBAAmB,oBAAoB,CAAC,EAChD,OAAO,CAAC,mBAAmB,YAAY,CAAC,EACxC,KAAK,iBAAiB,EACtB;AAAA,MAAM,CAAA,OACN,GACE,QAAQ,CAAC,mBAAmB,WAAW,GAAG,SAAS,IAAI,QAAQ,EAK/D,GAAG,CAAC,mBAAmB,MAAM,GAAG,CAAC,GAAG,sBAAsB,CAAC,EAC3D,QAAQ,CAAC,mBAAmB,SAAS,GAAG,SAAS,IAAI,IAAI;AAAA,IAAA,EAE3D,QAAQ,CAAC,mBAAmB,YAAY,GAAG,MAAM,EACjD,MAAM,KAAK,EACX,UAAU,UAAU,MAAM;AAE5B,UAAM,UAAwB,KAAK,IAAI,CAAA,SAAQ;AAAA,MAC9C,YAAY,IAAI;AAAA,MAChB,mBAAmB,IAAI;AAAA,MACvB,IAAI,IAAI;AAAA,IAAA,EACP;AAEF,WAAO,KAAK,MAAM,SAAS,SAAS,MAAM;AAAA,EAC3C;AACD;AAUO,MAAM,WAAW,CAAC,OAAqC;AAC7D,MAAI,CAAC,IAAI;AACR,WAAO;AAAA,EACR;AACA,QAAM,UAAU,GAAG,KAAA,EAAO,YAAA;AAC1B,MAAI,QAAQ,WAAW,GAAG;AACzB,WAAO;AAAA,EACR;AAEA,MAAI,CAAC,QAAQ,SAAS,GAAG,GAAG;AAC3B,UAAM,SAAS,QAAQ,MAAM,GAAG;AAChC,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO,GAAG,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC;AAAA,IAC9C;AACA,WAAO;AAAA,EACR;AAIA,QAAM,UAAU,WAAW,OAAO;AAClC,MAAI,YAAY,MAAM;AACrB,WAAO;AAAA,EACR;AAMA,MAAI,QAAQ,MAAM,GAAG,CAAC,EAAE,MAAM,OAAK,SAAS,GAAG,EAAE,MAAM,CAAC,KAAK,SAAS,QAAQ,CAAC,GAAG,EAAE,MAAM,OAAQ;AACjG,UAAM,KAAK,SAAS,QAAQ,CAAC,GAAG,EAAE;AAClC,UAAM,KAAK,SAAS,QAAQ,CAAC,GAAG,EAAE;AAClC,WAAO,GAAG,MAAM,CAAC,IAAI,KAAK,GAAI,IAAI,MAAM,CAAC;AAAA,EAC1C;AAEA,QAAM,UAAU,QAAQ,MAAM,GAAG,CAAC,EAAE,IAAI,CAAA,MAAK,SAAS,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC;AACzE,SAAO,GAAG,QAAQ,KAAK,GAAG,CAAC;AAC5B;AAUA,MAAM,aAAa,CAAC,UAAmC;AAItD,MAAI,aAAa;AACjB,QAAM,SAAS,oDAAoD,KAAK,KAAK;AAC7E,MAAI,QAAQ;AACX,UAAM,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM;AACtE,QAAI,OAAO,KAAK,CAAA,MAAK,IAAI,GAAG,GAAG;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,MAAO,OAAO,CAAC,KAAK,IAAK,OAAO,CAAC,GAAG,SAAS,EAAE;AACrD,UAAM,MAAO,OAAO,CAAC,KAAK,IAAK,OAAO,CAAC,GAAG,SAAS,EAAE;AACrD,iBAAa,GAAG,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE;AAAA,EACrC;AACA,QAAM,QAAQ,WAAW,MAAM,IAAI;AACnC,MAAI,MAAM,SAAS,GAAG;AACrB,WAAO;AAAA,EACR;AACA,QAAM,OAAO,MAAM,CAAC,MAAM,KAAK,KAAK,MAAM,CAAC,EAAE,MAAM,GAAG;AACtD,QAAM,OAAO,MAAM,WAAW,IAAK,MAAM,CAAC,MAAM,KAAK,CAAA,IAAK,MAAM,CAAC,EAAE,MAAM,GAAG,IAAK,CAAA;AACjF,QAAM,SAAS,MAAM,WAAW,IAC7B,CAAC,GAAG,MAAM,GAAG,MAAM,KAAK,IAAI,GAAG,IAAI,KAAK,SAAS,KAAK,MAAM,CAAC,EAAE,KAAK,GAAG,GAAG,GAAG,IAAI,IACjF;AACH,MAAI,MAAM,WAAW,IAAI,OAAO,SAAS,IAAI,OAAO,WAAW,GAAG;AACjE,WAAO;AAAA,EACR;AACA,MAAI,OAAO,KAAK,CAAA,MAAK,CAAC,kBAAkB,KAAK,CAAC,CAAC,GAAG;AACjD,WAAO;AAAA,EACR;AACA,SAAO;AACR;"}

package/dist/development/src/model/service/MailTemplateManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MailTemplateManager.ts"],"sourcesContent":["import { AddMailTemplateCommand, RemoveMailTemplateCommand } from '../commands'\nimport { MailTemplate, MailTemplateIdentifier } from '../mailing'\nimport { DatabaseContext } from '../utils'\n\nexport class MailTemplateManager {\n\tpublic async addMailTemplate(dbContext: DatabaseContext, mailTemplate: MailTemplate): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new AddMailTemplateCommand(mailTemplate))\n\t}\n\n\tpublic async removeMailTemplate(dbContext: DatabaseContext, mailTemplateId: MailTemplateIdentifier): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new RemoveMailTemplateCommand(mailTemplateId))\n\t}\n}\n"],"names":["AddMailTemplateCommand","RemoveMailTemplateCommand"],"mappings":";;;;;;;AAIO,MAAM,oBAAoB;AAAA,EAChC,MAAa,gBAAgB,WAA4B,cAA2C;AACnG,UAAM,UAAU,WAAW,QAAQ,IAAIA,uBAAAA,uBAAuB,YAAY,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAa,mBAAmB,WAA4B,gBAA0D;AACrH,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAIC,0BAAAA,0BAA0B,cAAc,CAAC;AAAA,EACxF;AACD;;"}
+{"version":3,"file":"MailTemplateManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MailTemplateManager.ts"],"sourcesContent":["import { AddMailTemplateCommand, RemoveMailTemplateCommand } from '../commands/index.js'\nimport { MailTemplate, MailTemplateIdentifier } from '../mailing/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class MailTemplateManager {\n\tpublic async addMailTemplate(dbContext: DatabaseContext, mailTemplate: MailTemplate): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new AddMailTemplateCommand(mailTemplate))\n\t}\n\n\tpublic async removeMailTemplate(dbContext: DatabaseContext, mailTemplateId: MailTemplateIdentifier): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new RemoveMailTemplateCommand(mailTemplateId))\n\t}\n}\n"],"names":["AddMailTemplateCommand","RemoveMailTemplateCommand"],"mappings":";;;;;;;AAIO,MAAM,oBAAoB;AAAA,EAChC,MAAa,gBAAgB,WAA4B,cAA2C;AACnG,UAAM,UAAU,WAAW,QAAQ,IAAIA,uBAAAA,uBAAuB,YAAY,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAa,mBAAmB,WAA4B,gBAA0D;AACrH,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAIC,0BAAAA,0BAA0B,cAAc,CAAC;AAAA,EACxF;AACD;;"}

package/dist/development/src/model/service/MailTemplateManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MailTemplateManager.ts"],"sourcesContent":["import { AddMailTemplateCommand, RemoveMailTemplateCommand } from '../commands'\nimport { MailTemplate, MailTemplateIdentifier } from '../mailing'\nimport { DatabaseContext } from '../utils'\n\nexport class MailTemplateManager {\n\tpublic async addMailTemplate(dbContext: DatabaseContext, mailTemplate: MailTemplate): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new AddMailTemplateCommand(mailTemplate))\n\t}\n\n\tpublic async removeMailTemplate(dbContext: DatabaseContext, mailTemplateId: MailTemplateIdentifier): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new RemoveMailTemplateCommand(mailTemplateId))\n\t}\n}\n"],"names":[],"mappings":";;;;;AAIO,MAAM,oBAAoB;AAAA,EAChC,MAAa,gBAAgB,WAA4B,cAA2C;AACnG,UAAM,UAAU,WAAW,QAAQ,IAAI,uBAAuB,YAAY,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAa,mBAAmB,WAA4B,gBAA0D;AACrH,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAI,0BAA0B,cAAc,CAAC;AAAA,EACxF;AACD;"}
+{"version":3,"file":"MailTemplateManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MailTemplateManager.ts"],"sourcesContent":["import { AddMailTemplateCommand, RemoveMailTemplateCommand } from '../commands/index.js'\nimport { MailTemplate, MailTemplateIdentifier } from '../mailing/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class MailTemplateManager {\n\tpublic async addMailTemplate(dbContext: DatabaseContext, mailTemplate: MailTemplate): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new AddMailTemplateCommand(mailTemplate))\n\t}\n\n\tpublic async removeMailTemplate(dbContext: DatabaseContext, mailTemplateId: MailTemplateIdentifier): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new RemoveMailTemplateCommand(mailTemplateId))\n\t}\n}\n"],"names":[],"mappings":";;;;;AAIO,MAAM,oBAAoB;AAAA,EAChC,MAAa,gBAAgB,WAA4B,cAA2C;AACnG,UAAM,UAAU,WAAW,QAAQ,IAAI,uBAAuB,YAAY,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAa,mBAAmB,WAA4B,gBAA0D;AACrH,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAI,0BAA0B,cAAc,CAAC;AAAA,EACxF;AACD;"}

package/dist/development/src/model/service/MembershipValidator.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type'\nimport { MembershipResolver, MembershipValidationError, MembershipValidationErrorType } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity, false).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":["MembershipResolver"],"mappings":";;;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAIA,YAAAA,sBACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAA;AAAA,IACX;AACA,WAAO,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAaA,+BAAmB,iBAAiB,KAAK,EAAE;AAAA,EAClG;AACD;;;;;;;;;;"}
+{"version":3,"file":"MembershipValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type/index.js'\nimport { MembershipResolver, MembershipValidationError, MembershipValidationErrorType } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity, false).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":["MembershipResolver"],"mappings":";;;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAIA,YAAAA,sBACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAA;AAAA,IACX;AACA,WAAO,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAaA,+BAAmB,iBAAiB,KAAK,EAAE;AAAA,EAClG;AACD;;;;;;;;;;"}

package/dist/development/src/model/service/MembershipValidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type'\nimport { MembershipResolver, MembershipValidationError, MembershipValidationErrorType } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity, false).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":[],"mappings":";;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAI,sBACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAA;AAAA,IACX;AACA,WAAO,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAa,mBAAmB,iBAAiB,KAAK,EAAE;AAAA,EAClG;AACD;"}
+{"version":3,"file":"MembershipValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/MembershipValidator.ts"],"sourcesContent":["import { ProjectSchemaResolver } from '../type/index.js'\nimport { MembershipResolver, MembershipValidationError, MembershipValidationErrorType } from '@contember/schema-utils'\nimport { Acl } from '@contember/schema'\n\nexport class MembershipValidator {\n\tconstructor(\n\t\tprivate readonly schemaResolver: ProjectSchemaResolver,\n\t\tprivate readonly resolver: MembershipResolver = new MembershipResolver(),\n\t) {}\n\n\tasync validate(project: string, memberships: readonly Acl.Membership[]): Promise<MembershipValidationError[]> {\n\t\tconst schema = await this.schemaResolver.getSchema(project)\n\t\tif (!schema) {\n\t\t\tthrow new Error()\n\t\t}\n\t\treturn this.resolver.resolve(schema.acl, memberships, MembershipResolver.UnknownIdentity, false).errors\n\t}\n}\n\nexport { MembershipValidationError, MembershipValidationErrorType }\n"],"names":[],"mappings":";;AAIO,MAAM,oBAAoB;AAAA,EAChC,YACkB,gBACA,WAA+B,IAAI,sBACnD;AAFgB,SAAA,iBAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,SAAS,SAAiB,aAA8E;AAC7G,UAAM,SAAS,MAAM,KAAK,eAAe,UAAU,OAAO;AAC1D,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAA;AAAA,IACX;AACA,WAAO,KAAK,SAAS,QAAQ,OAAO,KAAK,aAAa,mBAAmB,iBAAiB,KAAK,EAAE;AAAA,EAClG;AACD;"}

package/dist/development/src/model/service/OtpAuthenticator.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OtpAuthenticator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpAuthenticator.ts"],"sourcesContent":["import { Providers } from '../providers'\nimport { Secret, TOTP, URI } from 'otpauth'\n\nexport interface OtpData {\n\tsecret: string\n\turi: string\n}\n\nconst digits = 6\n\nexport class OtpAuthenticator {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'now' | 'randomBytes'>,\n\t) {\n\t}\n\n\tpublic validate(secret: SecretLike, token: string): boolean {\n\t\tconst result = TOTP.validate({\n\t\t\ttoken,\n\t\t\tdigits,\n\t\t\tsecret: getSecret(secret),\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t\treturn result !== null\n\t}\n\n\tpublic generate(secret: SecretLike): string {\n\t\treturn TOTP.generate({\n\t\t\tsecret: getSecret(secret),\n\t\t\tdigits,\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t}\n\n\tpublic async create(user: string, label: string): Promise<OtpData> {\n\t\tconst secret = new Secret({ buffer: (await this.providers.randomBytes(20)) as any })\n\t\tconst totp = new TOTP({\n\t\t\tlabel: user,\n\t\t\tissuer: label,\n\t\t\tsecret,\n\t\t})\n\t\treturn {\n\t\t\tsecret: secret.base32,\n\t\t\turi: totp.toString(),\n\t\t}\n\t}\n}\n\ntype SecretLike = { uri: string } | { secret: string }\nconst getSecret = function(otp: SecretLike): Secret {\n\treturn 'uri' in otp ? (URI.parse(otp.uri).secret) : Secret.fromBase32(otp.secret)\n}\n"],"names":["TOTP","Secret","URI"],"mappings":";;;AAQA,MAAM,SAAS;AAER,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEO,SAAS,QAAoB,OAAwB;AAC3D,UAAM,SAASA,QAAAA,KAAK,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,QAAQ,UAAU,MAAM;AAAA,MACxB,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AACD,WAAO,WAAW;AAAA,EACnB;AAAA,EAEO,SAAS,QAA4B;AAC3C,WAAOA,QAAAA,KAAK,SAAS;AAAA,MACpB,QAAQ,UAAU,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AAAA,EACF;AAAA,EAEA,MAAa,OAAO,MAAc,OAAiC;AAClE,UAAM,SAAS,IAAIC,QAAAA,OAAO,EAAE,QAAS,MAAM,KAAK,UAAU,YAAY,EAAE,GAAW;AACnF,UAAM,OAAO,IAAID,aAAK;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,IAAA,CACA;AACD,WAAO;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,KAAK,KAAK,SAAA;AAAA,IAAS;AAAA,EAErB;AACD;AAGA,MAAM,YAAY,SAAS,KAAyB;AACnD,SAAO,SAAS,MAAOE,QAAAA,IAAI,MAAM,IAAI,GAAG,EAAE,SAAUD,QAAAA,OAAO,WAAW,IAAI,MAAM;AACjF;;"}
+{"version":3,"file":"OtpAuthenticator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpAuthenticator.ts"],"sourcesContent":["import { Providers } from '../providers.js'\nimport { Secret, TOTP, URI } from 'otpauth'\n\nexport interface OtpData {\n\tsecret: string\n\turi: string\n}\n\nconst digits = 6\n\nexport class OtpAuthenticator {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'now' | 'randomBytes'>,\n\t) {\n\t}\n\n\tpublic validate(secret: SecretLike, token: string): boolean {\n\t\tconst result = TOTP.validate({\n\t\t\ttoken,\n\t\t\tdigits,\n\t\t\tsecret: getSecret(secret),\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t\treturn result !== null\n\t}\n\n\tpublic generate(secret: SecretLike): string {\n\t\treturn TOTP.generate({\n\t\t\tsecret: getSecret(secret),\n\t\t\tdigits,\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t}\n\n\tpublic async create(user: string, label: string): Promise<OtpData> {\n\t\tconst secret = new Secret({ buffer: (await this.providers.randomBytes(20)) as any })\n\t\tconst totp = new TOTP({\n\t\t\tlabel: user,\n\t\t\tissuer: label,\n\t\t\tsecret,\n\t\t})\n\t\treturn {\n\t\t\tsecret: secret.base32,\n\t\t\turi: totp.toString(),\n\t\t}\n\t}\n}\n\ntype SecretLike = { uri: string } | { secret: string }\nconst getSecret = function(otp: SecretLike): Secret {\n\treturn 'uri' in otp ? (URI.parse(otp.uri).secret) : Secret.fromBase32(otp.secret)\n}\n"],"names":["TOTP","Secret","URI"],"mappings":";;;AAQA,MAAM,SAAS;AAER,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEO,SAAS,QAAoB,OAAwB;AAC3D,UAAM,SAASA,QAAAA,KAAK,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,QAAQ,UAAU,MAAM;AAAA,MACxB,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AACD,WAAO,WAAW;AAAA,EACnB;AAAA,EAEO,SAAS,QAA4B;AAC3C,WAAOA,QAAAA,KAAK,SAAS;AAAA,MACpB,QAAQ,UAAU,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AAAA,EACF;AAAA,EAEA,MAAa,OAAO,MAAc,OAAiC;AAClE,UAAM,SAAS,IAAIC,QAAAA,OAAO,EAAE,QAAS,MAAM,KAAK,UAAU,YAAY,EAAE,GAAW;AACnF,UAAM,OAAO,IAAID,aAAK;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,IAAA,CACA;AACD,WAAO;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,KAAK,KAAK,SAAA;AAAA,IAAS;AAAA,EAErB;AACD;AAGA,MAAM,YAAY,SAAS,KAAyB;AACnD,SAAO,SAAS,MAAOE,QAAAA,IAAI,MAAM,IAAI,GAAG,EAAE,SAAUD,QAAAA,OAAO,WAAW,IAAI,MAAM;AACjF;;"}

package/dist/development/src/model/service/OtpAuthenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpAuthenticator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpAuthenticator.ts"],"sourcesContent":["import { Providers } from '../providers'\nimport { Secret, TOTP, URI } from 'otpauth'\n\nexport interface OtpData {\n\tsecret: string\n\turi: string\n}\n\nconst digits = 6\n\nexport class OtpAuthenticator {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'now' | 'randomBytes'>,\n\t) {\n\t}\n\n\tpublic validate(secret: SecretLike, token: string): boolean {\n\t\tconst result = TOTP.validate({\n\t\t\ttoken,\n\t\t\tdigits,\n\t\t\tsecret: getSecret(secret),\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t\treturn result !== null\n\t}\n\n\tpublic generate(secret: SecretLike): string {\n\t\treturn TOTP.generate({\n\t\t\tsecret: getSecret(secret),\n\t\t\tdigits,\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t}\n\n\tpublic async create(user: string, label: string): Promise<OtpData> {\n\t\tconst secret = new Secret({ buffer: (await this.providers.randomBytes(20)) as any })\n\t\tconst totp = new TOTP({\n\t\t\tlabel: user,\n\t\t\tissuer: label,\n\t\t\tsecret,\n\t\t})\n\t\treturn {\n\t\t\tsecret: secret.base32,\n\t\t\turi: totp.toString(),\n\t\t}\n\t}\n}\n\ntype SecretLike = { uri: string } | { secret: string }\nconst getSecret = function(otp: SecretLike): Secret {\n\treturn 'uri' in otp ? (URI.parse(otp.uri).secret) : Secret.fromBase32(otp.secret)\n}\n"],"names":[],"mappings":";AAQA,MAAM,SAAS;AAER,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEO,SAAS,QAAoB,OAAwB;AAC3D,UAAM,SAAS,KAAK,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,QAAQ,UAAU,MAAM;AAAA,MACxB,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AACD,WAAO,WAAW;AAAA,EACnB;AAAA,EAEO,SAAS,QAA4B;AAC3C,WAAO,KAAK,SAAS;AAAA,MACpB,QAAQ,UAAU,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AAAA,EACF;AAAA,EAEA,MAAa,OAAO,MAAc,OAAiC;AAClE,UAAM,SAAS,IAAI,OAAO,EAAE,QAAS,MAAM,KAAK,UAAU,YAAY,EAAE,GAAW;AACnF,UAAM,OAAO,IAAI,KAAK;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,IAAA,CACA;AACD,WAAO;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,KAAK,KAAK,SAAA;AAAA,IAAS;AAAA,EAErB;AACD;AAGA,MAAM,YAAY,SAAS,KAAyB;AACnD,SAAO,SAAS,MAAO,IAAI,MAAM,IAAI,GAAG,EAAE,SAAU,OAAO,WAAW,IAAI,MAAM;AACjF;"}
+{"version":3,"file":"OtpAuthenticator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpAuthenticator.ts"],"sourcesContent":["import { Providers } from '../providers.js'\nimport { Secret, TOTP, URI } from 'otpauth'\n\nexport interface OtpData {\n\tsecret: string\n\turi: string\n}\n\nconst digits = 6\n\nexport class OtpAuthenticator {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'now' | 'randomBytes'>,\n\t) {\n\t}\n\n\tpublic validate(secret: SecretLike, token: string): boolean {\n\t\tconst result = TOTP.validate({\n\t\t\ttoken,\n\t\t\tdigits,\n\t\t\tsecret: getSecret(secret),\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t\treturn result !== null\n\t}\n\n\tpublic generate(secret: SecretLike): string {\n\t\treturn TOTP.generate({\n\t\t\tsecret: getSecret(secret),\n\t\t\tdigits,\n\t\t\ttimestamp: this.providers.now().getTime(),\n\t\t})\n\t}\n\n\tpublic async create(user: string, label: string): Promise<OtpData> {\n\t\tconst secret = new Secret({ buffer: (await this.providers.randomBytes(20)) as any })\n\t\tconst totp = new TOTP({\n\t\t\tlabel: user,\n\t\t\tissuer: label,\n\t\t\tsecret,\n\t\t})\n\t\treturn {\n\t\t\tsecret: secret.base32,\n\t\t\turi: totp.toString(),\n\t\t}\n\t}\n}\n\ntype SecretLike = { uri: string } | { secret: string }\nconst getSecret = function(otp: SecretLike): Secret {\n\treturn 'uri' in otp ? (URI.parse(otp.uri).secret) : Secret.fromBase32(otp.secret)\n}\n"],"names":[],"mappings":";AAQA,MAAM,SAAS;AAER,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEO,SAAS,QAAoB,OAAwB;AAC3D,UAAM,SAAS,KAAK,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,QAAQ,UAAU,MAAM;AAAA,MACxB,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AACD,WAAO,WAAW;AAAA,EACnB;AAAA,EAEO,SAAS,QAA4B;AAC3C,WAAO,KAAK,SAAS;AAAA,MACpB,QAAQ,UAAU,MAAM;AAAA,MACxB;AAAA,MACA,WAAW,KAAK,UAAU,IAAA,EAAM,QAAA;AAAA,IAAQ,CACxC;AAAA,EACF;AAAA,EAEA,MAAa,OAAO,MAAc,OAAiC;AAClE,UAAM,SAAS,IAAI,OAAO,EAAE,QAAS,MAAM,KAAK,UAAU,YAAY,EAAE,GAAW;AACnF,UAAM,OAAO,IAAI,KAAK;AAAA,MACrB,OAAO;AAAA,MACP,QAAQ;AAAA,MACR;AAAA,IAAA,CACA;AACD,WAAO;AAAA,MACN,QAAQ,OAAO;AAAA,MACf,KAAK,KAAK,SAAA;AAAA,IAAS;AAAA,EAErB;AACD;AAGA,MAAM,YAAY,SAAS,KAAyB;AACnD,SAAO,SAAS,MAAO,IAAI,MAAM,IAAI,GAAG,EAAE,SAAU,OAAO,WAAW,IAAI,MAAM;AACjF;"}

package/dist/development/src/model/service/OtpManager.cjs

@@ -6,26 +6,76 @@ require("node:crypto");
 const ConfirmOtpCommand = require("../commands/otp/ConfirmOtpCommand.cjs");
 const DisableOtpCommand = require("../commands/otp/DisableOtpCommand.cjs");
 const PrepareOtpCommand = require("../commands/otp/PrepareOtpCommand.cjs");
+const ReEncryptOtpSecretCommand = require("../commands/otp/ReEncryptOtpSecretCommand.cjs");
+const otpauth = require("otpauth");
 class OtpManager {
-  constructor(otpAuthenticator) {
+  constructor(otpAuthenticator, providers) {
     this.otpAuthenticator = otpAuthenticator;
+    this.providers = providers;
   }
   async prepareOtp(dbContext, person, label) {
     const otp = await this.otpAuthenticator.create(person.email ?? person.name ?? "unnamed", label);
-    await dbContext.commandBus.execute(new PrepareOtpCommand.PrepareOtpCommand(person.id, otp.uri));
+    if (this.providers.encryptionEnabled) {
+      const encrypted = await this.providers.encrypt(Buffer.from(otp.secret, "utf8"));
+      await dbContext.commandBus.execute(new PrepareOtpCommand.PrepareOtpCommand(person.id, encrypted.value, encrypted.version));
+    } else {
+      await dbContext.commandBus.execute(new PrepareOtpCommand.PrepareOtpCommand(person.id, Buffer.from(otp.uri, "utf8"), 0));
+    }
     return otp;
   }
+  /** Promotes the pending TOTP secret to active. Returns false if there was no pending secret to promote (e.g. a lost concurrent confirm). */
   async confirmOtp(dbContext, person) {
-    await dbContext.commandBus.execute(new ConfirmOtpCommand.ConfirmOtpCommand(person.id));
+    return await dbContext.commandBus.execute(new ConfirmOtpCommand.ConfirmOtpCommand(person.id));
   }
   async disableOtp(dbContext, person) {
     await dbContext.commandBus.execute(new DisableOtpCommand.DisableOtpCommand(person.id));
   }
-  verifyOtp(person, token) {
-    if (!person.otp_uri) {
+  /** Verifies a token against the person's *active* TOTP secret. */
+  async verifyOtp(dbContext, person, token) {
+    const resolved = await this.resolveSecret(person.otp_secret, person.otp_secret_version);
+    const valid = this.otpAuthenticator.validate(resolved.secretLike, token);
+    if (valid && resolved.reEncrypt) {
+      try {
+        const { oldVersion, base32 } = resolved.reEncrypt;
+        const encrypted = await this.providers.encrypt(Buffer.from(base32, "utf8"));
+        await dbContext.commandBus.execute(
+          new ReEncryptOtpSecretCommand.ReEncryptOtpSecretCommand(person.id, encrypted.value, encrypted.version, oldVersion)
+        );
+      } catch {
+      }
+    }
+    return valid;
+  }
+  /** Verifies a token against the person's *pending* TOTP secret (used during enrollment). */
+  async verifyPendingOtp(person, token) {
+    const resolved = await this.resolveSecret(person.otp_pending_secret, person.otp_pending_version);
+    return this.otpAuthenticator.validate(resolved.secretLike, token);
+  }
+  /**
+   * Resolves the stored secret bytes into something the authenticator understands.
+   * Version 0 = legacy plaintext otpauth URI. Version >= 1 = encrypted base32 secret.
+   *
+   * Also surfaces whether the active secret warrants opportunistic re-encryption:
+   * version-0 (legacy plaintext) always does; version>=1 does when the encryption
+   * layer signals the key has rotated (`needsReEncrypt`).
+   */
+  async resolveSecret(secret, version) {
+    if (!secret || version === null) {
       throw new OtpError("not configured");
     }
-    return this.otpAuthenticator.validate({ uri: person.otp_uri }, token);
+    if (version === 0) {
+      const uri = secret.toString("utf8");
+      return {
+        secretLike: { uri },
+        reEncrypt: { oldVersion: 0, base32: otpauth.URI.parse(uri).secret.base32 }
+      };
+    }
+    const decrypted = await this.providers.decrypt(secret, version);
+    const base32 = decrypted.value.toString("utf8");
+    return {
+      secretLike: { secret: base32 },
+      ...decrypted.needsReEncrypt ? { reEncrypt: { oldVersion: version, base32 } } : {}
+    };
   }
 }
 class OtpError extends Error {

package/dist/development/src/model/service/OtpManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"OtpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand } from '../commands'\nimport { DatabaseContext } from '../utils'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator'\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri))\n\t\treturn otp\n\t}\n\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\tverifyOtp(person: PersonRow, token: string): boolean {\n\t\tif (!person.otp_uri) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\treturn this.otpAuthenticator.validate({ uri: person.otp_uri }, token)\n\t}\n}\n\nexport class OtpError extends Error {\n}\n"],"names":["PrepareOtpCommand","ConfirmOtpCommand","DisableOtpCommand"],"mappings":";;;;;;;;AAKO,MAAM,WAAW;AAAA,EACvB,YACkB,kBAChB;AADgB,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAChG,UAAM,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AAC9F,UAAM,UAAU,WAAW,QAAQ,IAAIA,kBAAAA,kBAAkB,OAAO,IAAI,IAAI,GAAG,CAAC;AAC5E,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAIC,kBAAAA,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAIC,kBAAAA,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,UAAU,QAAmB,OAAwB;AACpD,QAAI,CAAC,OAAO,SAAS;AACpB,YAAM,IAAI,SAAS,gBAAgB;AAAA,IACpC;AACA,WAAO,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,QAAA,GAAW,KAAK;AAAA,EACrE;AACD;AAEO,MAAM,iBAAiB,MAAM;AACpC;;;"}
+{"version":3,"file":"OtpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries/index.js'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand, ReEncryptOtpSecretCommand } from '../commands/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator.js'\nimport { Providers } from '../providers.js'\nimport { URI } from 'otpauth'\n\ntype SecretLike = { uri: string } | { secret: string }\n\n/**\n * Result of resolving a stored secret: the material the authenticator can\n * validate against, plus (optionally) the base32 secret and the version it was\n * stored under, so a successful verify can opportunistically re-encrypt it.\n */\ntype ResolvedSecret = {\n\tsecretLike: SecretLike\n\t/** Set when the active secret should be re-encrypted after a successful verify. */\n\treEncrypt?: { oldVersion: number; base32: string }\n}\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t\tprivate readonly providers: Pick<Providers, 'decrypt' | 'encrypt' | 'encryptionEnabled'>,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tif (this.providers.encryptionEnabled) {\n\t\t\t// A key is configured: store the base32 secret encrypted (version >= 1).\n\t\t\tconst encrypted = await this.providers.encrypt(Buffer.from(otp.secret, 'utf8'))\n\t\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, encrypted.value, encrypted.version))\n\t\t} else {\n\t\t\t// No key: store the plaintext otpauth URI as version 0, exactly like legacy\n\t\t\t// (pre-encryption) secrets. Opportunistic re-encryption upgrades it once a key\n\t\t\t// becomes available.\n\t\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, Buffer.from(otp.uri, 'utf8'), 0))\n\t\t}\n\t\treturn otp\n\t}\n\n\t/** Promotes the pending TOTP secret to active. Returns false if there was no pending secret to promote (e.g. a lost concurrent confirm). */\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\t/** Verifies a token against the person's *active* TOTP secret. */\n\tasync verifyOtp(dbContext: DatabaseContext, person: PersonRow, token: string): Promise<boolean> {\n\t\tconst resolved = await this.resolveSecret(person.otp_secret, person.otp_secret_version)\n\t\tconst valid = this.otpAuthenticator.validate(resolved.secretLike, token)\n\t\tif (valid && resolved.reEncrypt) {\n\t\t\t// Best-effort: re-encryption must never affect the verify result and any\n\t\t\t// failure (encrypt or update) is swallowed so the user still signs in.\n\t\t\ttry {\n\t\t\t\tconst { oldVersion, base32 } = resolved.reEncrypt\n\t\t\t\tconst encrypted = await this.providers.encrypt(Buffer.from(base32, 'utf8'))\n\t\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\t\tnew ReEncryptOtpSecretCommand(person.id, encrypted.value, encrypted.version, oldVersion),\n\t\t\t\t)\n\t\t\t} catch {\n\t\t\t\t// ignore — re-encryption is opportunistic\n\t\t\t}\n\t\t}\n\t\treturn valid\n\t}\n\n\t/** Verifies a token against the person's *pending* TOTP secret (used during enrollment). */\n\tasync verifyPendingOtp(person: PersonRow, token: string): Promise<boolean> {\n\t\tconst resolved = await this.resolveSecret(person.otp_pending_secret, person.otp_pending_version)\n\t\treturn this.otpAuthenticator.validate(resolved.secretLike, token)\n\t}\n\n\t/**\n\t * Resolves the stored secret bytes into something the authenticator understands.\n\t * Version 0 = legacy plaintext otpauth URI. Version >= 1 = encrypted base32 secret.\n\t *\n\t * Also surfaces whether the active secret warrants opportunistic re-encryption:\n\t * version-0 (legacy plaintext) always does; version>=1 does when the encryption\n\t * layer signals the key has rotated (`needsReEncrypt`).\n\t */\n\tprivate async resolveSecret(secret: Buffer | null, version: number | null): Promise<ResolvedSecret> {\n\t\tif (!secret || version === null) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\tif (version === 0) {\n\t\t\tconst uri = secret.toString('utf8')\n\t\t\treturn {\n\t\t\t\tsecretLike: { uri },\n\t\t\t\treEncrypt: { oldVersion: 0, base32: URI.parse(uri).secret.base32 },\n\t\t\t}\n\t\t}\n\t\tconst decrypted = await this.providers.decrypt(secret, version)\n\t\tconst base32 = decrypted.value.toString('utf8')\n\t\treturn {\n\t\t\tsecretLike: { secret: base32 },\n\t\t\t...(decrypted.needsReEncrypt ? { reEncrypt: { oldVersion: version, base32 } } : {}),\n\t\t}\n\t}\n}\n\nexport class OtpError extends Error {\n}\n"],"names":["PrepareOtpCommand","ConfirmOtpCommand","DisableOtpCommand","ReEncryptOtpSecretCommand","URI"],"mappings":";;;;;;;;;;AAoBO,MAAM,WAAW;AAAA,EACvB,YACkB,kBACA,WAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAChG,UAAM,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AAC9F,QAAI,KAAK,UAAU,mBAAmB;AAErC,YAAM,YAAY,MAAM,KAAK,UAAU,QAAQ,OAAO,KAAK,IAAI,QAAQ,MAAM,CAAC;AAC9E,YAAM,UAAU,WAAW,QAAQ,IAAIA,kBAAAA,kBAAkB,OAAO,IAAI,UAAU,OAAO,UAAU,OAAO,CAAC;AAAA,IACxG,OAAO;AAIN,YAAM,UAAU,WAAW,QAAQ,IAAIA,kBAAAA,kBAAkB,OAAO,IAAI,OAAO,KAAK,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC;AAAA,IACrG;AACA,WAAO;AAAA,EACR;AAAA;AAAA,EAGA,MAAM,WAAW,WAA4B,QAAqC;AACjF,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAIC,oCAAkB,OAAO,EAAE,CAAC;AAAA,EAC3E;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAIC,kBAAAA,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA;AAAA,EAGA,MAAM,UAAU,WAA4B,QAAmB,OAAiC;AAC/F,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,YAAY,OAAO,kBAAkB;AACtF,UAAM,QAAQ,KAAK,iBAAiB,SAAS,SAAS,YAAY,KAAK;AACvE,QAAI,SAAS,SAAS,WAAW;AAGhC,UAAI;AACH,cAAM,EAAE,YAAY,OAAA,IAAW,SAAS;AACxC,cAAM,YAAY,MAAM,KAAK,UAAU,QAAQ,OAAO,KAAK,QAAQ,MAAM,CAAC;AAC1E,cAAM,UAAU,WAAW;AAAA,UAC1B,IAAIC,0BAAAA,0BAA0B,OAAO,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU;AAAA,QAAA;AAAA,MAEzF,QAAQ;AAAA,MAER;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA;AAAA,EAGA,MAAM,iBAAiB,QAAmB,OAAiC;AAC1E,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,oBAAoB,OAAO,mBAAmB;AAC/F,WAAO,KAAK,iBAAiB,SAAS,SAAS,YAAY,KAAK;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,cAAc,QAAuB,SAAiD;AACnG,QAAI,CAAC,UAAU,YAAY,MAAM;AAChC,YAAM,IAAI,SAAS,gBAAgB;AAAA,IACpC;AACA,QAAI,YAAY,GAAG;AAClB,YAAM,MAAM,OAAO,SAAS,MAAM;AAClC,aAAO;AAAA,QACN,YAAY,EAAE,IAAA;AAAA,QACd,WAAW,EAAE,YAAY,GAAG,QAAQC,QAAAA,IAAI,MAAM,GAAG,EAAE,OAAO,OAAA;AAAA,MAAO;AAAA,IAEnE;AACA,UAAM,YAAY,MAAM,KAAK,UAAU,QAAQ,QAAQ,OAAO;AAC9D,UAAM,SAAS,UAAU,MAAM,SAAS,MAAM;AAC9C,WAAO;AAAA,MACN,YAAY,EAAE,QAAQ,OAAA;AAAA,MACtB,GAAI,UAAU,iBAAiB,EAAE,WAAW,EAAE,YAAY,SAAS,OAAA,MAAa,CAAA;AAAA,IAAC;AAAA,EAEnF;AACD;AAEO,MAAM,iBAAiB,MAAM;AACpC;;;"}

package/dist/development/src/model/service/OtpManager.js

@@ -4,26 +4,76 @@ import "node:crypto";
 import { ConfirmOtpCommand } from "../commands/otp/ConfirmOtpCommand.js";
 import { DisableOtpCommand } from "../commands/otp/DisableOtpCommand.js";
 import { PrepareOtpCommand } from "../commands/otp/PrepareOtpCommand.js";
+import { ReEncryptOtpSecretCommand } from "../commands/otp/ReEncryptOtpSecretCommand.js";
+import { URI } from "otpauth";
 class OtpManager {
-  constructor(otpAuthenticator) {
+  constructor(otpAuthenticator, providers) {
     this.otpAuthenticator = otpAuthenticator;
+    this.providers = providers;
   }
   async prepareOtp(dbContext, person, label) {
     const otp = await this.otpAuthenticator.create(person.email ?? person.name ?? "unnamed", label);
-    await dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri));
+    if (this.providers.encryptionEnabled) {
+      const encrypted = await this.providers.encrypt(Buffer.from(otp.secret, "utf8"));
+      await dbContext.commandBus.execute(new PrepareOtpCommand(person.id, encrypted.value, encrypted.version));
+    } else {
+      await dbContext.commandBus.execute(new PrepareOtpCommand(person.id, Buffer.from(otp.uri, "utf8"), 0));
+    }
     return otp;
   }
+  /** Promotes the pending TOTP secret to active. Returns false if there was no pending secret to promote (e.g. a lost concurrent confirm). */
   async confirmOtp(dbContext, person) {
-    await dbContext.commandBus.execute(new ConfirmOtpCommand(person.id));
+    return await dbContext.commandBus.execute(new ConfirmOtpCommand(person.id));
   }
   async disableOtp(dbContext, person) {
     await dbContext.commandBus.execute(new DisableOtpCommand(person.id));
   }
-  verifyOtp(person, token) {
-    if (!person.otp_uri) {
+  /** Verifies a token against the person's *active* TOTP secret. */
+  async verifyOtp(dbContext, person, token) {
+    const resolved = await this.resolveSecret(person.otp_secret, person.otp_secret_version);
+    const valid = this.otpAuthenticator.validate(resolved.secretLike, token);
+    if (valid && resolved.reEncrypt) {
+      try {
+        const { oldVersion, base32 } = resolved.reEncrypt;
+        const encrypted = await this.providers.encrypt(Buffer.from(base32, "utf8"));
+        await dbContext.commandBus.execute(
+          new ReEncryptOtpSecretCommand(person.id, encrypted.value, encrypted.version, oldVersion)
+        );
+      } catch {
+      }
+    }
+    return valid;
+  }
+  /** Verifies a token against the person's *pending* TOTP secret (used during enrollment). */
+  async verifyPendingOtp(person, token) {
+    const resolved = await this.resolveSecret(person.otp_pending_secret, person.otp_pending_version);
+    return this.otpAuthenticator.validate(resolved.secretLike, token);
+  }
+  /**
+   * Resolves the stored secret bytes into something the authenticator understands.
+   * Version 0 = legacy plaintext otpauth URI. Version >= 1 = encrypted base32 secret.
+   *
+   * Also surfaces whether the active secret warrants opportunistic re-encryption:
+   * version-0 (legacy plaintext) always does; version>=1 does when the encryption
+   * layer signals the key has rotated (`needsReEncrypt`).
+   */
+  async resolveSecret(secret, version) {
+    if (!secret || version === null) {
       throw new OtpError("not configured");
     }
-    return this.otpAuthenticator.validate({ uri: person.otp_uri }, token);
+    if (version === 0) {
+      const uri = secret.toString("utf8");
+      return {
+        secretLike: { uri },
+        reEncrypt: { oldVersion: 0, base32: URI.parse(uri).secret.base32 }
+      };
+    }
+    const decrypted = await this.providers.decrypt(secret, version);
+    const base32 = decrypted.value.toString("utf8");
+    return {
+      secretLike: { secret: base32 },
+      ...decrypted.needsReEncrypt ? { reEncrypt: { oldVersion: version, base32 } } : {}
+    };
   }
 }
 class OtpError extends Error {

package/dist/development/src/model/service/OtpManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"OtpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand } from '../commands'\nimport { DatabaseContext } from '../utils'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator'\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, otp.uri))\n\t\treturn otp\n\t}\n\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\tverifyOtp(person: PersonRow, token: string): boolean {\n\t\tif (!person.otp_uri) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\treturn this.otpAuthenticator.validate({ uri: person.otp_uri }, token)\n\t}\n}\n\nexport class OtpError extends Error {\n}\n"],"names":[],"mappings":";;;;;;AAKO,MAAM,WAAW;AAAA,EACvB,YACkB,kBAChB;AADgB,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAChG,UAAM,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AAC9F,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,IAAI,IAAI,GAAG,CAAC;AAC5E,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA,EAEA,UAAU,QAAmB,OAAwB;AACpD,QAAI,CAAC,OAAO,SAAS;AACpB,YAAM,IAAI,SAAS,gBAAgB;AAAA,IACpC;AACA,WAAO,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,QAAA,GAAW,KAAK;AAAA,EACrE;AACD;AAEO,MAAM,iBAAiB,MAAM;AACpC;"}
+{"version":3,"file":"OtpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/OtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries/index.js'\nimport { ConfirmOtpCommand, DisableOtpCommand, PrepareOtpCommand, ReEncryptOtpSecretCommand } from '../commands/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { OtpAuthenticator, OtpData } from './OtpAuthenticator.js'\nimport { Providers } from '../providers.js'\nimport { URI } from 'otpauth'\n\ntype SecretLike = { uri: string } | { secret: string }\n\n/**\n * Result of resolving a stored secret: the material the authenticator can\n * validate against, plus (optionally) the base32 secret and the version it was\n * stored under, so a successful verify can opportunistically re-encrypt it.\n */\ntype ResolvedSecret = {\n\tsecretLike: SecretLike\n\t/** Set when the active secret should be re-encrypted after a successful verify. */\n\treEncrypt?: { oldVersion: number; base32: string }\n}\n\nexport class OtpManager {\n\tconstructor(\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t\tprivate readonly providers: Pick<Providers, 'decrypt' | 'encrypt' | 'encryptionEnabled'>,\n\t) {}\n\n\tasync prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData> {\n\t\tconst otp = await this.otpAuthenticator.create(person.email ?? person.name ?? 'unnamed', label)\n\t\tif (this.providers.encryptionEnabled) {\n\t\t\t// A key is configured: store the base32 secret encrypted (version >= 1).\n\t\t\tconst encrypted = await this.providers.encrypt(Buffer.from(otp.secret, 'utf8'))\n\t\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, encrypted.value, encrypted.version))\n\t\t} else {\n\t\t\t// No key: store the plaintext otpauth URI as version 0, exactly like legacy\n\t\t\t// (pre-encryption) secrets. Opportunistic re-encryption upgrades it once a key\n\t\t\t// becomes available.\n\t\t\tawait dbContext.commandBus.execute(new PrepareOtpCommand(person.id, Buffer.from(otp.uri, 'utf8'), 0))\n\t\t}\n\t\treturn otp\n\t}\n\n\t/** Promotes the pending TOTP secret to active. Returns false if there was no pending secret to promote (e.g. a lost concurrent confirm). */\n\tasync confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new ConfirmOtpCommand(person.id))\n\t}\n\n\tasync disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOtpCommand(person.id))\n\t}\n\n\t/** Verifies a token against the person's *active* TOTP secret. */\n\tasync verifyOtp(dbContext: DatabaseContext, person: PersonRow, token: string): Promise<boolean> {\n\t\tconst resolved = await this.resolveSecret(person.otp_secret, person.otp_secret_version)\n\t\tconst valid = this.otpAuthenticator.validate(resolved.secretLike, token)\n\t\tif (valid && resolved.reEncrypt) {\n\t\t\t// Best-effort: re-encryption must never affect the verify result and any\n\t\t\t// failure (encrypt or update) is swallowed so the user still signs in.\n\t\t\ttry {\n\t\t\t\tconst { oldVersion, base32 } = resolved.reEncrypt\n\t\t\t\tconst encrypted = await this.providers.encrypt(Buffer.from(base32, 'utf8'))\n\t\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\t\tnew ReEncryptOtpSecretCommand(person.id, encrypted.value, encrypted.version, oldVersion),\n\t\t\t\t)\n\t\t\t} catch {\n\t\t\t\t// ignore — re-encryption is opportunistic\n\t\t\t}\n\t\t}\n\t\treturn valid\n\t}\n\n\t/** Verifies a token against the person's *pending* TOTP secret (used during enrollment). */\n\tasync verifyPendingOtp(person: PersonRow, token: string): Promise<boolean> {\n\t\tconst resolved = await this.resolveSecret(person.otp_pending_secret, person.otp_pending_version)\n\t\treturn this.otpAuthenticator.validate(resolved.secretLike, token)\n\t}\n\n\t/**\n\t * Resolves the stored secret bytes into something the authenticator understands.\n\t * Version 0 = legacy plaintext otpauth URI. Version >= 1 = encrypted base32 secret.\n\t *\n\t * Also surfaces whether the active secret warrants opportunistic re-encryption:\n\t * version-0 (legacy plaintext) always does; version>=1 does when the encryption\n\t * layer signals the key has rotated (`needsReEncrypt`).\n\t */\n\tprivate async resolveSecret(secret: Buffer | null, version: number | null): Promise<ResolvedSecret> {\n\t\tif (!secret || version === null) {\n\t\t\tthrow new OtpError('not configured')\n\t\t}\n\t\tif (version === 0) {\n\t\t\tconst uri = secret.toString('utf8')\n\t\t\treturn {\n\t\t\t\tsecretLike: { uri },\n\t\t\t\treEncrypt: { oldVersion: 0, base32: URI.parse(uri).secret.base32 },\n\t\t\t}\n\t\t}\n\t\tconst decrypted = await this.providers.decrypt(secret, version)\n\t\tconst base32 = decrypted.value.toString('utf8')\n\t\treturn {\n\t\t\tsecretLike: { secret: base32 },\n\t\t\t...(decrypted.needsReEncrypt ? { reEncrypt: { oldVersion: version, base32 } } : {}),\n\t\t}\n\t}\n}\n\nexport class OtpError extends Error {\n}\n"],"names":[],"mappings":";;;;;;;;AAoBO,MAAM,WAAW;AAAA,EACvB,YACkB,kBACA,WAChB;AAFgB,SAAA,mBAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,WAAW,WAA4B,QAAmB,OAAiC;AAChG,UAAM,MAAM,MAAM,KAAK,iBAAiB,OAAO,OAAO,SAAS,OAAO,QAAQ,WAAW,KAAK;AAC9F,QAAI,KAAK,UAAU,mBAAmB;AAErC,YAAM,YAAY,MAAM,KAAK,UAAU,QAAQ,OAAO,KAAK,IAAI,QAAQ,MAAM,CAAC;AAC9E,YAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,IAAI,UAAU,OAAO,UAAU,OAAO,CAAC;AAAA,IACxG,OAAO;AAIN,YAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,IAAI,OAAO,KAAK,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC;AAAA,IACrG;AACA,WAAO;AAAA,EACR;AAAA;AAAA,EAGA,MAAM,WAAW,WAA4B,QAAqC;AACjF,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EAC3E;AAAA,EAEA,MAAM,WAAW,WAA4B,QAAkC;AAC9E,UAAM,UAAU,WAAW,QAAQ,IAAI,kBAAkB,OAAO,EAAE,CAAC;AAAA,EACpE;AAAA;AAAA,EAGA,MAAM,UAAU,WAA4B,QAAmB,OAAiC;AAC/F,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,YAAY,OAAO,kBAAkB;AACtF,UAAM,QAAQ,KAAK,iBAAiB,SAAS,SAAS,YAAY,KAAK;AACvE,QAAI,SAAS,SAAS,WAAW;AAGhC,UAAI;AACH,cAAM,EAAE,YAAY,OAAA,IAAW,SAAS;AACxC,cAAM,YAAY,MAAM,KAAK,UAAU,QAAQ,OAAO,KAAK,QAAQ,MAAM,CAAC;AAC1E,cAAM,UAAU,WAAW;AAAA,UAC1B,IAAI,0BAA0B,OAAO,IAAI,UAAU,OAAO,UAAU,SAAS,UAAU;AAAA,QAAA;AAAA,MAEzF,QAAQ;AAAA,MAER;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA;AAAA,EAGA,MAAM,iBAAiB,QAAmB,OAAiC;AAC1E,UAAM,WAAW,MAAM,KAAK,cAAc,OAAO,oBAAoB,OAAO,mBAAmB;AAC/F,WAAO,KAAK,iBAAiB,SAAS,SAAS,YAAY,KAAK;AAAA,EACjE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,cAAc,QAAuB,SAAiD;AACnG,QAAI,CAAC,UAAU,YAAY,MAAM;AAChC,YAAM,IAAI,SAAS,gBAAgB;AAAA,IACpC;AACA,QAAI,YAAY,GAAG;AAClB,YAAM,MAAM,OAAO,SAAS,MAAM;AAClC,aAAO;AAAA,QACN,YAAY,EAAE,IAAA;AAAA,QACd,WAAW,EAAE,YAAY,GAAG,QAAQ,IAAI,MAAM,GAAG,EAAE,OAAO,OAAA;AAAA,MAAO;AAAA,IAEnE;AACA,UAAM,YAAY,MAAM,KAAK,UAAU,QAAQ,QAAQ,OAAO;AAC9D,UAAM,SAAS,UAAU,MAAM,SAAS,MAAM;AAC9C,WAAO;AAAA,MACN,YAAY,EAAE,QAAQ,OAAA;AAAA,MACtB,GAAI,UAAU,iBAAiB,EAAE,WAAW,EAAE,YAAY,SAAS,OAAA,MAAa,CAAA;AAAA,IAAC;AAAA,EAEnF;AACD;AAEO,MAAM,iBAAiB,MAAM;AACpC;"}

package/dist/development/src/model/service/PasswordChangeManager.cjs

@@ -18,7 +18,7 @@ class PasswordChangeManager {
     this.passwordStrengthVerifier = passwordStrengthVerifier;
   }
   async changePassword(dbContext, person, password) {
-    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(dbContext.providers));
     const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
     if (!passwordVerifyResult.ok) {
       return passwordVerifyResult;
@@ -27,7 +27,7 @@ class PasswordChangeManager {
     return new Response.ResponseOk(null);
   }
   async changeMyPassword(dbContext, person, currentPassword, password) {
-    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(dbContext.providers));
     const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
     if (!passwordVerifyResult.ok) {
       return passwordVerifyResult;

package/dist/development/src/model/service/PasswordChangeManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tcurrentPassword: string,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":["ConfigurationQuery","ChangePasswordCommand","ResponseOk","ResponseError"],"mappings":";;;;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,WACA,QACA,UACiF;AACjF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,mBAAAA,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBACL,WACA,QACA,iBACA,UACmF;AACnF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIF,mBAAAA,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAIG,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,IAC9D;AACA,QAAI,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AACjF,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,yBAAyB;AAAA,IACvE;AAEA,UAAM,UAAU,WAAW,QAAQ,IAAIF,sBAAAA,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}
+{"version":3,"file":"PasswordChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema/index.js'\nimport { ChangePasswordCommand } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ConfigurationQuery, PersonRow } from '../queries/index.js'\nimport { Providers } from '../providers.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator.js'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tcurrentPassword: string,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":["ConfigurationQuery","ChangePasswordCommand","ResponseOk","ResponseError"],"mappings":";;;;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,WACA,QACA,UACiF;AACjF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AAC7F,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBACL,WACA,QACA,iBACA,UACmF;AACnF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIF,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AAC7F,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAIG,SAAAA,cAAc,mBAAmB,iBAAiB;AAAA,IAC9D;AACA,QAAI,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AACjF,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,yBAAyB;AAAA,IACvE;AAEA,UAAM,UAAU,WAAW,QAAQ,IAAIF,sBAAAA,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}

package/dist/development/src/model/service/PasswordChangeManager.js

@@ -16,7 +16,7 @@ class PasswordChangeManager {
     this.passwordStrengthVerifier = passwordStrengthVerifier;
   }
   async changePassword(dbContext, person, password) {
-    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers));
     const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
     if (!passwordVerifyResult.ok) {
       return passwordVerifyResult;
@@ -25,7 +25,7 @@ class PasswordChangeManager {
     return new ResponseOk(null);
   }
   async changeMyPassword(dbContext, person, currentPassword, password) {
-    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery());
+    const config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers));
     const passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, "TOO_WEAK");
     if (!passwordVerifyResult.ok) {
       return passwordVerifyResult;

package/dist/development/src/model/service/PasswordChangeManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema'\nimport { ChangePasswordCommand } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tcurrentPassword: string,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":[],"mappings":";;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,WACA,QACA,UACiF;AACjF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBACL,WACA,QACA,iBACA,UACmF;AACnF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB;AAC1E,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,IAC9D;AACA,QAAI,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AACjF,aAAO,IAAI,cAAc,oBAAoB,yBAAyB;AAAA,IACvE;AAEA,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}
+{"version":3,"file":"PasswordChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordChangeManager.ts"],"sourcesContent":["import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema/index.js'\nimport { ChangePasswordCommand } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ConfigurationQuery, PersonRow } from '../queries/index.js'\nimport { Providers } from '../providers.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator.js'\n\nclass PasswordChangeManager {\n\tconstructor(\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly passwordStrengthVerifier: PasswordStrengthValidator,\n\t) {}\n\n\tasync changePassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangePasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync changeMyPassword(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\tcurrentPassword: string,\n\t\tpassword: string,\n\t): Promise<PasswordChangeManager.PasswordChangeResponse<ChangeMyPasswordErrorCode>> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\tconst passwordVerifyResult = await this.passwordStrengthVerifier.verify(password, config.password, 'TOO_WEAK')\n\t\tif (!passwordVerifyResult.ok) {\n\t\t\treturn passwordVerifyResult\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', 'No password set')\n\t\t}\n\t\tif (!(await this.providers.bcryptCompare(currentPassword, person.password_hash))) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', 'Password does not match')\n\t\t}\n\n\t\tawait dbContext.commandBus.execute(new ChangePasswordCommand(person.id, password))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PasswordChangeManager {\n\texport type PasswordChangeResponse<T extends ChangePasswordErrorCode | ChangeMyPasswordErrorCode> = Response<null, T, {\n\t\tweakPasswordReasons?: WeakPasswordReason[]\n\t}>\n}\n\nexport { PasswordChangeManager }\n"],"names":[],"mappings":";;;;;;;;;;;;AAQA,MAAM,sBAAsB;AAAA,EAC3B,YACkB,WACA,0BAChB;AAFgB,SAAA,YAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA,EAEH,MAAM,eACL,WACA,QACA,UACiF;AACjF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AAC7F,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,iBACL,WACA,QACA,iBACA,UACmF;AACnF,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AAC7F,UAAM,uBAAuB,MAAM,KAAK,yBAAyB,OAAO,UAAU,OAAO,UAAU,UAAU;AAC7G,QAAI,CAAC,qBAAqB,IAAI;AAC7B,aAAO;AAAA,IACR;AACA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAI,cAAc,mBAAmB,iBAAiB;AAAA,IAC9D;AACA,QAAI,CAAE,MAAM,KAAK,UAAU,cAAc,iBAAiB,OAAO,aAAa,GAAI;AACjF,aAAO,IAAI,cAAc,oBAAoB,yBAAyB;AAAA,IACvE;AAEA,UAAM,UAAU,WAAW,QAAQ,IAAI,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AACjF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}