@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/development/src/model/service/SignInManager.js

@@ -1,5 +1,7 @@
 import "../queries/apiKey/ApiKeyQuery.js";
 import "@contember/database";
+import "../type/ApiKey.js";
+import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
 import { ImplementationException } from "../../exceptions.js";
 import { PersonQuery } from "../queries/person/PersonQuery.js";
 import "../authorization/PermissionActions.js";
@@ -9,13 +11,21 @@ import "../authorization/PermissionsFactory.js";
 import "@contember/schema";
 import { ResponseError, ResponseOk } from "../utils/Response.js";
 import { AuthLogService } from "./AuthLogService.js";
+import "node:crypto";
+import { SetMfaGraceUntilCommand } from "../commands/person/SetMfaGraceUntilCommand.js";
+import { intervalToSeconds } from "../utils/interval.js";
 class SignInManager {
-  constructor(apiKeyManager, providers, otpAuthenticator) {
+  constructor(apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer) {
     this.apiKeyManager = apiKeyManager;
     this.providers = providers;
-    this.otpAuthenticator = otpAuthenticator;
+    this.otpManager = otpManager;
+    this.backupCodeManager = backupCodeManager;
+    this.emailOtpManager = emailOtpManager;
+    this.authPolicyResolver = authPolicyResolver;
+    this.loginRiskAnalyzer = loginRiskAnalyzer;
+    this.userMailer = userMailer;
   }
-  async signIn(dbContext, email, password, expiration, otpCode) {
+  async signIn(dbContext, email, password, expiration, otpCode, requestInfo, trustForwardedInfo, backupCode, config, geoCountry) {
     const person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email));
     if (person === null) {
       return new ResponseError("UNKNOWN_EMAIL", `Person with email ${email} not found`, {
@@ -40,18 +50,221 @@ class SignInManager {
     if (!passwordValid) {
       return new ResponseError("INVALID_PASSWORD", `Password does not match`, authLogData);
     }
-    if (person.otp_uri && person.otp_activated_at) {
-      if (!otpCode) {
+    if (person.email_verification_required && person.email_verified_at === null) {
+      return new ResponseError("EMAIL_NOT_VERIFIED", `E-mail address has not been verified`, authLogData);
+    }
+    let usedBackupCode = false;
+    let mfaSatisfiedThisRequest = false;
+    const hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at);
+    if (hasActiveTotp) {
+      if (otpCode) {
+        if (!await this.otpManager.verifyOtp(dbContext, person, otpCode)) {
+          return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        mfaSatisfiedThisRequest = true;
+      } else if (backupCode) {
+        if (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {
+          return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        usedBackupCode = true;
+        mfaSatisfiedThisRequest = true;
+      } else {
         return new ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, authLogData);
       }
-      if (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {
+    } else if (person.email_otp_enabled) {
+      if (otpCode) {
+        if (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {
+          return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        mfaSatisfiedThisRequest = true;
+      } else if (backupCode) {
+        if (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {
+          return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        usedBackupCode = true;
+        mfaSatisfiedThisRequest = true;
+      } else {
+        const emailOtpConfig = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers));
+        const decision = await this.emailOtpManager.sendCode(dbContext, person, emailOtpConfig);
+        return new ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, {
+          emailOtpSent: decision.ok,
+          ...authLogData
+        });
+      }
+    } else {
+      const enforcement = await this.enforceMfaEnrollment(dbContext, person, otpCode, authLogData);
+      if (enforcement !== null) {
+        if ("error" in enforcement) {
+          return enforcement;
+        }
+        const riskHandled2 = await this.applyRiskPolicy(dbContext, person, {
+          config,
+          geoCountry,
+          requestInfo,
+          otpCode,
+          mfaSatisfiedThisRequest: true,
+          authLogData
+        });
+        if (riskHandled2 !== null && "error" in riskHandled2) {
+          return riskHandled2;
+        }
+        const sessionToken2 = await this.apiKeyManager.createSessionApiKey(
+          dbContext,
+          person.identity_id,
+          expiration,
+          requestInfo,
+          trustForwardedInfo
+        );
+        return new ResponseOk({
+          person,
+          token: sessionToken2,
+          backupCodes: enforcement.backupCodes,
+          unusualLoginDetected: riskHandled2?.unusualLoginDetected || void 0,
+          risk: riskHandled2?.risk,
+          ...authLogData
+        });
+      }
+    }
+    const riskHandled = await this.applyRiskPolicy(dbContext, person, {
+      config,
+      geoCountry,
+      requestInfo,
+      otpCode,
+      mfaSatisfiedThisRequest,
+      authLogData
+    });
+    if (riskHandled !== null && "error" in riskHandled) {
+      return riskHandled;
+    }
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo);
+    return new ResponseOk({
+      person,
+      token: sessionToken,
+      usedBackupCode,
+      unusualLoginDetected: riskHandled?.unusualLoginDetected || void 0,
+      risk: riskHandled?.risk,
+      ...authLogData
+    });
+  }
+  /**
+   * A03 — evaluate the sign-in risk score and act per policy. Returns:
+   * - `null` when anomaly detection is off or no `config` was supplied (the
+   *   default): no DB work, sign-in proceeds unchanged.
+   * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email
+   *   was sent (best-effort) but the session may still be issued.
+   * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was
+   *   supplied — reuses the email-OTP step-up channel (dispatches a code).
+   * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but
+   *   did not verify. A valid code consumes the token and the session is issued.
+   * - `{ unusualLoginDetected: false }` when the score was below every threshold.
+   *
+   * The audit entries (`unusual_login_detected`, `step_up_required`) are emitted
+   * by the resolver from the response metadata, matching the project convention.
+   */
+  async applyRiskPolicy(dbContext, person, args) {
+    const { config, geoCountry, requestInfo, otpCode, mfaSatisfiedThisRequest, authLogData } = args;
+    const policy = config?.login.anomalyDetection;
+    if (!config || !policy?.enabled) {
+      return null;
+    }
+    const assessment = await this.loginRiskAnalyzer.analyze(dbContext, person.id, {
+      geoCountry: geoCountry ?? null,
+      deviceFingerprint: this.loginRiskAnalyzer.fingerprint(requestInfo?.userAgent),
+      ip: requestInfo?.ip ?? null
+    }, policy);
+    if (assessment.action === "allow") {
+      return { unusualLoginDetected: false };
+    }
+    const riskMeta = { score: assessment.score, reasons: assessment.reasons };
+    if (assessment.action === "stepUp" && !mfaSatisfiedThisRequest) {
+      if (otpCode) {
+        if (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {
+          return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", {
+            stepUpRequired: true,
+            unusualLoginDetected: true,
+            risk: riskMeta,
+            ...authLogData
+          });
+        }
+      } else {
+        const decision = await this.emailOtpManager.sendCode(dbContext, person, config);
+        return new ResponseError("OTP_REQUIRED", "Additional verification is required for this sign-in", {
+          emailOtpSent: decision.ok,
+          stepUpRequired: true,
+          unusualLoginDetected: true,
+          risk: riskMeta,
+          ...authLogData
+        });
+      }
+    }
+    await this.sendUnusualLoginEmail(dbContext, person, geoCountry ?? null, requestInfo?.ip ?? null);
+    return { unusualLoginDetected: true, risk: riskMeta };
+  }
+  async sendUnusualLoginEmail(dbContext, person, geoCountry, ip) {
+    if (!person.email) {
+      return;
+    }
+    try {
+      await this.userMailer.sendUnusualLoginEmail(dbContext, {
+        email: person.email,
+        geoCountry,
+        ipAddress: ip
+      }, { projectId: null, variant: "" });
+    } catch {
+    }
+  }
+  /**
+   * A06 enforcement for the no-active-factor case. Returns:
+   * - `null` when MFA is not required, or grace currently allows sign-in
+   *   (caller proceeds to issue a session as normal). With zero auth_policy
+   *   rows this is always the outcome — no behavior change.
+   * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to
+   *   enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.
+   * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP
+   *   promoted to active); caller issues the session.
+   */
+  async enforceMfaEnrollment(dbContext, person, otpCode, authLogData) {
+    const policy = await this.authPolicyResolver.resolveForIdentity(dbContext, person.identity_id, person.roles);
+    if (!policy.mfaRequired) {
+      return null;
+    }
+    const now = this.providers.now();
+    let graceSeconds;
+    if (policy.graceDuration !== null) {
+      graceSeconds = intervalToSeconds(policy.graceDuration);
+    } else {
+      const config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers));
+      graceSeconds = intervalToSeconds(config.login.mfaGraceDuration);
+    }
+    if (person.mfa_grace_until !== null) {
+      if (person.mfa_grace_until.getTime() > now.getTime()) {
+        return null;
+      }
+    } else if (graceSeconds > 0) {
+      const graceUntil = new Date(now.getTime() + graceSeconds * 1e3);
+      await dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceUntil));
+      return null;
+    }
+    if (otpCode && person.otp_pending_secret) {
+      if (!await this.otpManager.verifyPendingOtp(person, otpCode)) {
         return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
       }
+      const promoted = await this.otpManager.confirmOtp(dbContext, person);
+      if (!promoted) {
+        return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+      }
+      const backupCodes = await this.backupCodeManager.generate(dbContext, person.id);
+      return { backupCodes };
     }
-    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
-    return new ResponseOk({ person, token: sessionToken, ...authLogData });
+    const otp = await this.otpManager.prepareOtp(dbContext, person, "Contember");
+    const mfaEnrollment = { otpUri: otp.uri, otpSecret: otp.secret };
+    return new ResponseError("MFA_ENROLLMENT_REQUIRED", "MFA enrollment is required", {
+      mfaEnrollmentRequired: true,
+      mfaEnrollment,
+      ...authLogData
+    });
   }
-  async createSessionToken(dbContext, personIdentifier, expiration, verifier) {
+  async createSessionToken(dbContext, personIdentifier, expiration, verifier, requestInfo, trustForwardedInfo) {
     const person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier));
     if (person === null) {
       if (personIdentifier.type === "email") {
@@ -79,7 +292,7 @@ class SignInManager {
       });
     }
     await verifier?.(person);
-    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo);
     return new ResponseOk({
       person,
       token: sessionToken,

package/dist/development/src/model/service/SignInManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, SignInErrorCode } from '../../schema'\nimport { ApiKeyManager, OtpAuthenticator } from '../service'\nimport { PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ImplementationException } from '../../exceptions'\nimport { AuthLogService } from './AuthLogService'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\tif (person.otp_uri && person.otp_activated_at) {\n\t\t\tif (!otpCode) {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\n\t\t\tif (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\n\t\treturn new ResponseOk({ person, token: sessionToken, ...authLogData })\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":[],"mappings":";;;;;;;;;;;AASA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,kBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,WAA4B,OAAe,UAAkB,YAAqB,SAA2C;AACzI,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAI,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAI,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAI,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAEA,QAAI,OAAO,WAAW,OAAO,kBAAkB;AAC9C,UAAI,CAAC,SAAS;AACb,eAAO,IAAI,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAEA,UAAI,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,OAAO,GAAG;AACtE,eAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AAAA,IACD;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAE3G,WAAO,IAAI,WAAW,EAAE,QAAQ,OAAO,cAAc,GAAG,aAAa;AAAA,EACtE;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAI,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAI,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAI,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAC3G,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;"}
+{"version":3,"file":"SignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, MfaEnrollment, SignInErrorCode } from '../../schema/index.js'\nimport { ApiKeyManager, AuthPolicyResolver, BackupCodeManager, EmailOtpManager, LoginRiskAnalyzer, OtpManager } from '../service/index.js'\nimport { ConfigurationQuery, PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries/index.js'\nimport { Config } from '../type/Config.js'\nimport { Providers } from '../providers.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ApiKeyRequestInfo, SetMfaGraceUntilCommand } from '../commands/index.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly emailOtpManager: EmailOtpManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t\tprivate readonly loginRiskAnalyzer: LoginRiskAnalyzer,\n\t\tprivate readonly userMailer: UserMailer,\n\t) {}\n\n\tasync signIn(\n\t\tdbContext: DatabaseContext,\n\t\temail: string,\n\t\tpassword: string,\n\t\texpiration?: number,\n\t\totpCode?: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t\tbackupCode?: string,\n\t\tconfig?: Config,\n\t\tgeoCountry?: string,\n\t): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\t// Block sign-in for accounts that were created while email verification\n\t\t// was required but never proved ownership. Accounts predating the\n\t\t// requirement carry email_verification_required = false and pass through.\n\t\tif (person.email_verification_required && person.email_verified_at === null) {\n\t\t\treturn new ResponseError('EMAIL_NOT_VERIFIED', `E-mail address has not been verified`, authLogData)\n\t\t}\n\n\t\tlet usedBackupCode = false\n\t\t// Whether a second factor was actively proven in THIS request. Anomaly\n\t\t// step-up (A03) reuses this: a login that already cleared a second factor\n\t\t// is not asked to step up again.\n\t\tlet mfaSatisfiedThisRequest = false\n\t\tconst hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at)\n\t\tif (hasActiveTotp) {\n\t\t\t// Active TOTP takes precedence (A07 path, unchanged).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.otpManager.verifyOtp(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\t\t} else if (person.email_otp_enabled) {\n\t\t\t// No active TOTP, but email OTP is enabled (A05).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\t// Dispatch a fresh code and ask the client to retry with otpToken. Reuses\n\t\t\t\t// the existing OTP_REQUIRED contract so clients that already handle it work.\n\t\t\t\t// The send is rate-limited per person; when throttled nothing is emailed\n\t\t\t\t// (emailOtpSent: false) but a previously emailed code stays valid.\n\t\t\t\t// Independent fetch (not the passed-in `config`): the email-OTP send is\n\t\t\t\t// rate-limited by the live config and this branch never reaches the\n\t\t\t\t// anomaly analyzer, so query shape stays as before A03.\n\t\t\t\tconst emailOtpConfig = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, emailOtpConfig)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t} else {\n\t\t\t// No active factor at all (A06). Enforce MFA if a matching auth_policy\n\t\t\t// requires it. With no policy rows configured this resolves to\n\t\t\t// mfaRequired=false and sign-in proceeds exactly as before.\n\t\t\tconst enforcement = await this.enforceMfaEnrollment(dbContext, person, otpCode, authLogData)\n\t\t\tif (enforcement !== null) {\n\t\t\t\tif ('error' in enforcement) {\n\t\t\t\t\treturn enforcement\n\t\t\t\t}\n\t\t\t\t// Enrollment completed in this request (pending TOTP promoted to active),\n\t\t\t\t// so MFA is definitively satisfied — anomaly step-up cannot apply.\n\t\t\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\t\t\tconfig,\n\t\t\t\t\tgeoCountry,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\totpCode,\n\t\t\t\t\tmfaSatisfiedThisRequest: true,\n\t\t\t\t\tauthLogData,\n\t\t\t\t})\n\t\t\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\t\t\treturn riskHandled\n\t\t\t\t}\n\t\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(\n\t\t\t\t\tdbContext,\n\t\t\t\t\tperson.identity_id,\n\t\t\t\t\texpiration,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\ttrustForwardedInfo,\n\t\t\t\t)\n\t\t\t\treturn new ResponseOk({\n\t\t\t\t\tperson,\n\t\t\t\t\ttoken: sessionToken,\n\t\t\t\t\tbackupCodes: enforcement.backupCodes,\n\t\t\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected || undefined,\n\t\t\t\t\trisk: riskHandled?.risk,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\tconfig,\n\t\t\tgeoCountry,\n\t\t\trequestInfo,\n\t\t\totpCode,\n\t\t\tmfaSatisfiedThisRequest,\n\t\t\tauthLogData,\n\t\t})\n\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\treturn riskHandled\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\tusedBackupCode,\n\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected || undefined,\n\t\t\trisk: riskHandled?.risk,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\t/**\n\t * A03 — evaluate the sign-in risk score and act per policy. Returns:\n\t * - `null` when anomaly detection is off or no `config` was supplied (the\n\t *   default): no DB work, sign-in proceeds unchanged.\n\t * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email\n\t *   was sent (best-effort) but the session may still be issued.\n\t * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was\n\t *   supplied — reuses the email-OTP step-up channel (dispatches a code).\n\t * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but\n\t *   did not verify. A valid code consumes the token and the session is issued.\n\t * - `{ unusualLoginDetected: false }` when the score was below every threshold.\n\t *\n\t * The audit entries (`unusual_login_detected`, `step_up_required`) are emitted\n\t * by the resolver from the response metadata, matching the project convention.\n\t */\n\tprivate async applyRiskPolicy(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\targs: {\n\t\t\tconfig?: Config\n\t\t\tgeoCountry?: string\n\t\t\trequestInfo?: ApiKeyRequestInfo\n\t\t\totpCode?: string\n\t\t\tmfaSatisfiedThisRequest: boolean\n\t\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag }\n\t\t},\n\t): Promise<RiskPolicyOutcome> {\n\t\tconst { config, geoCountry, requestInfo, otpCode, mfaSatisfiedThisRequest, authLogData } = args\n\t\tconst policy = config?.login.anomalyDetection\n\t\tif (!config || !policy?.enabled) {\n\t\t\treturn null\n\t\t}\n\n\t\tconst assessment = await this.loginRiskAnalyzer.analyze(dbContext, person.id, {\n\t\t\tgeoCountry: geoCountry ?? null,\n\t\t\tdeviceFingerprint: this.loginRiskAnalyzer.fingerprint(requestInfo?.userAgent),\n\t\t\tip: requestInfo?.ip ?? null,\n\t\t}, policy)\n\n\t\tif (assessment.action === 'allow') {\n\t\t\treturn { unusualLoginDetected: false }\n\t\t}\n\n\t\tconst riskMeta = { score: assessment.score, reasons: assessment.reasons }\n\n\t\tif (assessment.action === 'stepUp' && !mfaSatisfiedThisRequest) {\n\t\t\t// Reuse the existing email-OTP step-up channel. This is independent of\n\t\t\t// `person.email_otp_enabled`, which gates email OTP only as the *primary*\n\t\t\t// second factor (A05); the step-up challenge stands on its own, so a person\n\t\t\t// with no standing MFA can still complete it. Without consuming the code\n\t\t\t// here, such a person would never satisfy the step-up and would loop on\n\t\t\t// OTP_REQUIRED forever (the score is unchanged on every retry).\n\t\t\tif (otpCode) {\n\t\t\t\t// Retry leg: the client resent the emailed code as otpToken. Mirror the\n\t\t\t\t// A05 contract — an invalid code is rejected (not re-sent); the per-code\n\t\t\t\t// 3-attempt cap still applies, and a fresh code is issued only when the\n\t\t\t\t// client retries without a code.\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\t// A failed *forced* second factor is itself an anomaly signal — carry the\n\t\t\t\t\t// step-up/risk metadata so the resolver still emits unusual_login_detected\n\t\t\t\t\t// + step_up_required with the score/reasons, rather than logging it as an\n\t\t\t\t\t// ordinary mistyped-OTP login indistinguishable from a normal 2FA typo.\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t\t...authLogData,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\t// Step-up satisfied this request — fall through to notify + allow below.\n\t\t\t} else {\n\t\t\t\t// First leg: dispatch a code and ask the client to retry with otpToken.\n\t\t\t\t// Rate-limited per person; a previously emailed code stays valid when throttled.\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, config)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', 'Additional verification is required for this sign-in', {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\t// action === 'email', or step-up satisfied (already this request, or just now\n\t\t// via the emailed code): notify the person of the unusual sign-in. A failed\n\t\t// email must never block sign-in.\n\t\tawait this.sendUnusualLoginEmail(dbContext, person, geoCountry ?? null, requestInfo?.ip ?? null)\n\t\treturn { unusualLoginDetected: true, risk: riskMeta }\n\t}\n\n\tprivate async sendUnusualLoginEmail(dbContext: DatabaseContext, person: PersonRow, geoCountry: string | null, ip: string | null): Promise<void> {\n\t\tif (!person.email) {\n\t\t\t// No address to notify (e.g. an IDP-only person) — nothing to send.\n\t\t\treturn\n\t\t}\n\t\ttry {\n\t\t\tawait this.userMailer.sendUnusualLoginEmail(dbContext, {\n\t\t\t\temail: person.email,\n\t\t\t\tgeoCountry,\n\t\t\t\tipAddress: ip,\n\t\t\t}, { projectId: null, variant: '' })\n\t\t} catch {\n\t\t\t// ignore — informational only\n\t\t}\n\t}\n\n\t/**\n\t * A06 enforcement for the no-active-factor case. Returns:\n\t * - `null` when MFA is not required, or grace currently allows sign-in\n\t *   (caller proceeds to issue a session as normal). With zero auth_policy\n\t *   rows this is always the outcome — no behavior change.\n\t * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to\n\t *   enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.\n\t * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP\n\t *   promoted to active); caller issues the session.\n\t */\n\tprivate async enforceMfaEnrollment(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\totpCode: string | undefined,\n\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag },\n\t): Promise<\n\t\t| null\n\t\t| ResponseError<SignInErrorCode, {\n\t\t\temailOtpSent?: boolean\n\t\t\tmfaEnrollmentRequired?: boolean\n\t\t\tmfaEnrollment?: MfaEnrollment\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}>\n\t\t| { backupCodes: string[] }\n\t> {\n\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(dbContext, person.identity_id, person.roles)\n\t\tif (!policy.mfaRequired) {\n\t\t\treturn null\n\t\t}\n\n\t\tconst now = this.providers.now()\n\n\t\t// Resolve the effective grace duration (seconds). A per-policy override\n\t\t// wins; otherwise we fall back to the global config default. Only fetch the\n\t\t// config when the override is absent, to keep query shapes minimal.\n\t\tlet graceSeconds: number\n\t\tif (policy.graceDuration !== null) {\n\t\t\tgraceSeconds = intervalToSeconds(policy.graceDuration)\n\t\t} else {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\tgraceSeconds = intervalToSeconds(config.login.mfaGraceDuration)\n\t\t}\n\n\t\t// Grace handling. Default grace duration is 0 (immediate enforcement), so\n\t\t// by default neither branch below opens a window.\n\t\tif (person.mfa_grace_until !== null) {\n\t\t\tif (person.mfa_grace_until.getTime() > now.getTime()) {\n\t\t\t\t// Still inside an open grace window — allow sign-in.\n\t\t\t\treturn null\n\t\t\t}\n\t\t\t// Grace expired → fall through to enforcement.\n\t\t} else if (graceSeconds > 0) {\n\t\t\t// Open the grace window now and allow this sign-in.\n\t\t\tconst graceUntil = new Date(now.getTime() + graceSeconds * 1000)\n\t\t\tawait dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceUntil))\n\t\t\treturn null\n\t\t}\n\n\t\t// Enforce.\n\t\tif (otpCode && person.otp_pending_secret) {\n\t\t\t// Enrollment completion: verify against the pending secret, then promote.\n\t\t\tif (!await this.otpManager.verifyPendingOtp(person, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst promoted = await this.otpManager.confirmOtp(dbContext, person)\n\t\t\tif (!promoted) {\n\t\t\t\t// Lost a concurrent enrollment-completion race: the pending secret was\n\t\t\t\t// already promoted by the other request (which issued the backup codes).\n\t\t\t\t// Don't regenerate here — that would invalidate the codes already\n\t\t\t\t// returned. TOTP is now active, so a retry signs in via the normal path.\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst backupCodes = await this.backupCodeManager.generate(dbContext, person.id)\n\t\t\treturn { backupCodes }\n\t\t}\n\n\t\t// Provision a fresh pending TOTP secret and ask the client to enroll.\n\t\tconst otp = await this.otpManager.prepareOtp(dbContext, person, 'Contember')\n\t\tconst mfaEnrollment: MfaEnrollment = { otpUri: otp.uri, otpSecret: otp.secret }\n\t\treturn new ResponseError('MFA_ENROLLMENT_REQUIRED', 'MFA enrollment is required', {\n\t\t\tmfaEnrollmentRequired: true,\n\t\t\tmfaEnrollment,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\n/** A03: greppable payload describing why a sign-in scored as unusual. */\nexport interface RiskMeta {\n\treadonly score: number\n\treadonly reasons: readonly string[]\n}\n\n/**\n * Result of {@link SignInManager.applyRiskPolicy}: `null` = feature off / no\n * config; a metadata object when the session may still be issued; a\n * `ResponseError` when step-up blocks the session.\n */\ntype RiskPolicyOutcome =\n\t| null\n\t| { unusualLoginDetected: boolean; risk?: RiskMeta }\n\t| ResponseError<SignInErrorCode, {\n\t\temailOtpSent?: boolean\n\t\tstepUpRequired?: boolean\n\t\tunusualLoginDetected?: boolean\n\t\trisk?: RiskMeta\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t/** True when MFA was satisfied by consuming a backup code (instead of a TOTP token). */\n\treadonly usedBackupCode?: boolean\n\t/** Set when sign-in completed an MFA enrollment (A06): the freshly issued backup codes, shown once. */\n\treadonly backupCodes?: string[]\n\t/** A03: true when this sign-in scored as unusual and an UNUSUAL_LOGIN email was sent. */\n\treadonly unusualLoginDetected?: boolean\n\t/** A03: the risk score + reasons, recorded in the `unusual_login_detected` audit `event_data`. */\n\treadonly risk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t/** Set on an OTP_REQUIRED error when an email-OTP code was just dispatched (A05). */\n\temailOtpSent?: boolean\n\t/** Set on a MFA_ENROLLMENT_REQUIRED error (A06): triggers the `mfa_enrollment_required` audit. */\n\tmfaEnrollmentRequired?: boolean\n\t/** Set on a MFA_ENROLLMENT_REQUIRED error (A06): the pending secret the client must enroll. */\n\tmfaEnrollment?: MfaEnrollment\n\t/** Set on an OTP_REQUIRED error raised by A03 anomaly step-up: triggers the `step_up_required` audit. */\n\tstepUpRequired?: boolean\n\t/** A03: true when the sign-in scored as unusual (triggers the `unusual_login_detected` audit). */\n\tunusualLoginDetected?: boolean\n\t/** A03: the risk score + reasons, recorded in the audit `event_data`. */\n\trisk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":["riskHandled","sessionToken"],"mappings":";;;;;;;;;;;;;;;;AAaA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,YACA,mBACA,iBACA,oBACA,mBACA,YAChB;AARgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,kBAAA;AACA,SAAA,qBAAA;AACA,SAAA,oBAAA;AACA,SAAA,aAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,WACA,OACA,UACA,YACA,SACA,aACA,oBACA,YACA,QACA,YAC0B;AAC1B,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAI,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAI,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAI,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAKA,QAAI,OAAO,+BAA+B,OAAO,sBAAsB,MAAM;AAC5E,aAAO,IAAI,cAAc,sBAAsB,wCAAwC,WAAW;AAAA,IACnG;AAEA,QAAI,iBAAiB;AAIrB,QAAI,0BAA0B;AAC9B,UAAM,gBAAgB,QAAQ,OAAO,cAAc,OAAO,gBAAgB;AAC1E,QAAI,eAAe;AAElB,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,WAAW,UAAU,WAAW,QAAQ,OAAO,GAAG;AACjE,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AACN,eAAO,IAAI,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAAA,IACD,WAAW,OAAO,mBAAmB;AAEpC,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAC7E,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AAQN,cAAM,iBAAiB,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AACrG,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,cAAc;AACtF,eAAO,IAAI,cAAc,gBAAgB,yCAAyC;AAAA,UACjF,cAAc,SAAS;AAAA,UACvB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD,OAAO;AAIN,YAAM,cAAc,MAAM,KAAK,qBAAqB,WAAW,QAAQ,SAAS,WAAW;AAC3F,UAAI,gBAAgB,MAAM;AACzB,YAAI,WAAW,aAAa;AAC3B,iBAAO;AAAA,QACR;AAGA,cAAMA,eAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,UACjE;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,yBAAyB;AAAA,UACzB;AAAA,QAAA,CACA;AACD,YAAIA,iBAAgB,QAAQ,WAAWA,cAAa;AACnD,iBAAOA;AAAAA,QACR;AACA,cAAMC,gBAAe,MAAM,KAAK,cAAc;AAAA,UAC7C;AAAA,UACA,OAAO;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,QAAA;AAED,eAAO,IAAI,WAAW;AAAA,UACrB;AAAA,UACA,OAAOA;AAAAA,UACP,aAAa,YAAY;AAAA,UACzB,sBAAsBD,cAAa,wBAAwB;AAAA,UAC3D,MAAMA,cAAa;AAAA,UACnB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAEA,UAAM,cAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACA;AACD,QAAI,gBAAgB,QAAQ,WAAW,aAAa;AACnD,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAE5I,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,sBAAsB,aAAa,wBAAwB;AAAA,MAC3D,MAAM,aAAa;AAAA,MACnB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAc,gBACb,WACA,QACA,MAQ6B;AAC7B,UAAM,EAAE,QAAQ,YAAY,aAAa,SAAS,yBAAyB,gBAAgB;AAC3F,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,CAAC,UAAU,CAAC,QAAQ,SAAS;AAChC,aAAO;AAAA,IACR;AAEA,UAAM,aAAa,MAAM,KAAK,kBAAkB,QAAQ,WAAW,OAAO,IAAI;AAAA,MAC7E,YAAY,cAAc;AAAA,MAC1B,mBAAmB,KAAK,kBAAkB,YAAY,aAAa,SAAS;AAAA,MAC5E,IAAI,aAAa,MAAM;AAAA,IAAA,GACrB,MAAM;AAET,QAAI,WAAW,WAAW,SAAS;AAClC,aAAO,EAAE,sBAAsB,MAAA;AAAA,IAChC;AAEA,UAAM,WAAW,EAAE,OAAO,WAAW,OAAO,SAAS,WAAW,QAAA;AAEhE,QAAI,WAAW,WAAW,YAAY,CAAC,yBAAyB;AAO/D,UAAI,SAAS;AAKZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAK7E,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,gBAAgB;AAAA,YAChB,sBAAsB;AAAA,YACtB,MAAM;AAAA,YACN,GAAG;AAAA,UAAA,CACH;AAAA,QACF;AAAA,MAED,OAAO;AAGN,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,MAAM;AAC9E,eAAO,IAAI,cAAc,gBAAgB,wDAAwD;AAAA,UAChG,cAAc,SAAS;AAAA,UACvB,gBAAgB;AAAA,UAChB,sBAAsB;AAAA,UACtB,MAAM;AAAA,UACN,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAKA,UAAM,KAAK,sBAAsB,WAAW,QAAQ,cAAc,MAAM,aAAa,MAAM,IAAI;AAC/F,WAAO,EAAE,sBAAsB,MAAM,MAAM,SAAA;AAAA,EAC5C;AAAA,EAEA,MAAc,sBAAsB,WAA4B,QAAmB,YAA2B,IAAkC;AAC/I,QAAI,CAAC,OAAO,OAAO;AAElB;AAAA,IACD;AACA,QAAI;AACH,YAAM,KAAK,WAAW,sBAAsB,WAAW;AAAA,QACtD,OAAO,OAAO;AAAA,QACd;AAAA,QACA,WAAW;AAAA,MAAA,GACT,EAAE,WAAW,MAAM,SAAS,IAAI;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,qBACb,WACA,QACA,SACA,aAUC;AACD,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,WAAW,OAAO,aAAa,OAAO,KAAK;AAC3G,QAAI,CAAC,OAAO,aAAa;AACxB,aAAO;AAAA,IACR;AAEA,UAAM,MAAM,KAAK,UAAU,IAAA;AAK3B,QAAI;AACJ,QAAI,OAAO,kBAAkB,MAAM;AAClC,qBAAe,kBAAkB,OAAO,aAAa;AAAA,IACtD,OAAO;AACN,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AAC7F,qBAAe,kBAAkB,OAAO,MAAM,gBAAgB;AAAA,IAC/D;AAIA,QAAI,OAAO,oBAAoB,MAAM;AACpC,UAAI,OAAO,gBAAgB,QAAA,IAAY,IAAI,WAAW;AAErD,eAAO;AAAA,MACR;AAAA,IAED,WAAW,eAAe,GAAG;AAE5B,YAAM,aAAa,IAAI,KAAK,IAAI,QAAA,IAAY,eAAe,GAAI;AAC/D,YAAM,UAAU,WAAW,QAAQ,IAAI,wBAAwB,OAAO,IAAI,UAAU,CAAC;AACrF,aAAO;AAAA,IACR;AAGA,QAAI,WAAW,OAAO,oBAAoB;AAEzC,UAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,OAAO,GAAG;AAC7D,eAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,WAAW,MAAM,KAAK,WAAW,WAAW,WAAW,MAAM;AACnE,UAAI,CAAC,UAAU;AAKd,eAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,WAAW,OAAO,EAAE;AAC9E,aAAO,EAAE,YAAA;AAAA,IACV;AAGA,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,WAAW,QAAQ,WAAW;AAC3E,UAAM,gBAA+B,EAAE,QAAQ,IAAI,KAAK,WAAW,IAAI,OAAA;AACvE,WAAO,IAAI,cAAc,2BAA2B,8BAA8B;AAAA,MACjF,uBAAuB;AAAA,MACvB;AAAA,MACA,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACA,aACA,oBACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAI,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAI,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAI,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAC5I,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;"}

package/dist/development/src/model/service/SignOutManager.cjs

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ApiKey = require("../type/ApiKey.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+const PersonQuery = require("../queries/person/PersonQuery.cjs");
+const IdpSessionByApiKeyQuery = require("../queries/idp/IdpSessionByApiKeyQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+const Response = require("../utils/Response.cjs");
+class SignOutManager {
+  constructor(apiKeyManager, idpRegistry) {
+    this.apiKeyManager = apiKeyManager;
+    this.idpRegistry = idpRegistry;
+  }
+  async signOut(db, identityId, apiKeyId, all) {
+    const person = await db.queryHandler.fetch(PersonQuery.PersonQuery.byIdentity(identityId));
+    if (!person) {
+      return new Response.ResponseError("NOT_A_PERSON", "Only a person can sign out");
+    }
+    const personApiKey = await this.apiKeyManager.findApiKey(db, apiKeyId);
+    if (personApiKey?.type === ApiKey.ApiKey.Type.PERMANENT) {
+      return new Response.ResponseError(
+        "NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY",
+        "Only session API keys can be used for person sign out."
+      );
+    }
+    const logout = await this.resolveOidcLogout(db, apiKeyId);
+    if (all) {
+      await this.apiKeyManager.disableIdentityApiKeys(db, identityId);
+    } else {
+      await this.apiKeyManager.disableApiKey(db, apiKeyId);
+    }
+    return new Response.ResponseOk({
+      logoutUrl: logout?.logoutUrl ?? null,
+      identityProviderId: logout?.identityProviderId ?? null
+    });
+  }
+  async resolveOidcLogout(db, apiKeyId) {
+    const idpSession = await db.queryHandler.fetch(new IdpSessionByApiKeyQuery.IdpSessionByApiKeyQuery(apiKeyId, db.providers));
+    if (!idpSession) {
+      return null;
+    }
+    const handler = this.idpRegistry.getHandlerOrNull(idpSession.providerType);
+    if (!handler?.buildLogoutUrl) {
+      return { logoutUrl: null, identityProviderId: idpSession.identityProviderId };
+    }
+    let config;
+    try {
+      config = handler.validateConfiguration(idpSession.providerConfiguration);
+    } catch {
+      return { logoutUrl: null, identityProviderId: idpSession.identityProviderId };
+    }
+    const idToken = typeof idpSession.session.tokens?.id_token === "string" ? idpSession.session.tokens.id_token : void 0;
+    try {
+      const logoutUrl = await handler.buildLogoutUrl(config, {
+        idToken,
+        postLogoutRedirectUri: typeof idpSession.providerConfiguration.postLogoutRedirectUri === "string" ? idpSession.providerConfiguration.postLogoutRedirectUri : void 0
+      });
+      return { logoutUrl, identityProviderId: idpSession.identityProviderId };
+    } catch {
+      return { logoutUrl: null, identityProviderId: idpSession.identityProviderId };
+    }
+  }
+}
+exports.SignOutManager = SignOutManager;
+//# sourceMappingURL=SignOutManager.cjs.map

package/dist/development/src/model/service/SignOutManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignOutManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignOutManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ApiKey } from '../type/index.js'\nimport { PersonQuery } from '../queries/index.js'\nimport { IdpSessionByApiKeyQuery } from '../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './idp/IDPHandlerRegistry.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\n\nexport type SignOutErrorCode = 'NOT_A_PERSON' | 'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY'\n\nexport type SignOutResult = {\n\t/** Set when the session was federated via an OIDC IdP that exposes RP-initiated logout. */\n\treadonly logoutUrl: string | null\n\t/** The IdP this session belonged to, for auditing. Null for plain (password) sessions. */\n\treadonly identityProviderId: string | null\n}\n\nexport type SignOutResponse = Response<SignOutResult, SignOutErrorCode>\n\n/**\n * Owns the sign-out flow (extracted from `SignOutMutationResolver`, A10):\n *   - the existing local logout (disable this session, or all of the identity's sessions);\n *   - OIDC Single Logout — when the session was federated and the IdP advertises an\n *     `end_session_endpoint`, build the RP-initiated (front-channel) logout redirect URL the admin\n *     should send the browser to. Legacy IdPs without `end_session_endpoint` (and password\n *     sessions) gracefully fall back to a local-only logout with no `logoutUrl`.\n *\n * Auditing lives at the resolver layer (the manager only returns what happened), matching the\n * existing convention.\n */\nexport class SignOutManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signOut(\n\t\tdb: DatabaseContext,\n\t\tidentityId: string,\n\t\tapiKeyId: string,\n\t\tall: boolean,\n\t): Promise<SignOutResponse> {\n\t\tconst person = await db.queryHandler.fetch(PersonQuery.byIdentity(identityId))\n\t\tif (!person) {\n\t\t\treturn new ResponseError('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKey = await this.apiKeyManager.findApiKey(db, apiKeyId)\n\t\tif (personApiKey?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY',\n\t\t\t\t'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\t// Resolve the RP-initiated logout URL *before* disabling the key — the federated-session row\n\t\t// is removed (FK ON DELETE CASCADE) once the api_key is gone, and we need its id_token.\n\t\tconst logout = await this.resolveOidcLogout(db, apiKeyId)\n\n\t\tif (all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, identityId)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(db, apiKeyId)\n\t\t}\n\n\t\treturn new ResponseOk({\n\t\t\tlogoutUrl: logout?.logoutUrl ?? null,\n\t\t\tidentityProviderId: logout?.identityProviderId ?? null,\n\t\t})\n\t}\n\n\tprivate async resolveOidcLogout(\n\t\tdb: DatabaseContext,\n\t\tapiKeyId: string,\n\t): Promise<{ logoutUrl: string | null; identityProviderId: string } | null> {\n\t\tconst idpSession = await db.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyId, db.providers))\n\t\tif (!idpSession) {\n\t\t\t// not a federated session (password / IdP without revalidation) — local logout only\n\t\t\treturn null\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(idpSession.providerType)\n\t\tif (!handler?.buildLogoutUrl) {\n\t\t\t// provider can't initiate logout at the IdP (e.g. Apple / Facebook) — local logout only\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(idpSession.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config must not break sign-out — degrade to a local-only logout\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tconst idToken = typeof idpSession.session.tokens?.id_token === 'string' ? idpSession.session.tokens.id_token : undefined\n\t\ttry {\n\t\t\tconst logoutUrl = await handler.buildLogoutUrl(config, {\n\t\t\t\tidToken,\n\t\t\t\tpostLogoutRedirectUri: typeof (idpSession.providerConfiguration as { postLogoutRedirectUri?: unknown }).postLogoutRedirectUri === 'string'\n\t\t\t\t\t? (idpSession.providerConfiguration as { postLogoutRedirectUri: string }).postLogoutRedirectUri\n\t\t\t\t\t: undefined,\n\t\t\t})\n\t\t\treturn { logoutUrl, identityProviderId: idpSession.identityProviderId }\n\t\t} catch {\n\t\t\t// discovery / IdP unreachable must not block local sign-out — degrade gracefully\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\t}\n}\n"],"names":["PersonQuery","ResponseError","ApiKey","ResponseOk","IdpSessionByApiKeyQuery"],"mappings":";;;;;;;;;;;;;AA8BO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,IACA,YACA,UACA,KAC2B;AAC3B,UAAM,SAAS,MAAM,GAAG,aAAa,MAAMA,wBAAY,WAAW,UAAU,CAAC;AAC7E,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAIC,SAAAA,cAAc,gBAAgB,4BAA4B;AAAA,IACtE;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,WAAW,IAAI,QAAQ;AACrE,QAAI,cAAc,SAASC,cAAO,KAAK,WAAW;AACjD,aAAO,IAAID,SAAAA;AAAAA,QACV;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AAIA,UAAM,SAAS,MAAM,KAAK,kBAAkB,IAAI,QAAQ;AAExD,QAAI,KAAK;AACR,YAAM,KAAK,cAAc,uBAAuB,IAAI,UAAU;AAAA,IAC/D,OAAO;AACN,YAAM,KAAK,cAAc,cAAc,IAAI,QAAQ;AAAA,IACpD;AAEA,WAAO,IAAIE,SAAAA,WAAW;AAAA,MACrB,WAAW,QAAQ,aAAa;AAAA,MAChC,oBAAoB,QAAQ,sBAAsB;AAAA,IAAA,CAClD;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,IACA,UAC2E;AAC3E,UAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIC,wBAAAA,wBAAwB,UAAU,GAAG,SAAS,CAAC;AAClG,QAAI,CAAC,YAAY;AAEhB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,WAAW,YAAY;AACzE,QAAI,CAAC,SAAS,gBAAgB;AAE7B,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,WAAW,qBAAqB;AAAA,IACxE,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,UAAM,UAAU,OAAO,WAAW,QAAQ,QAAQ,aAAa,WAAW,WAAW,QAAQ,OAAO,WAAW;AAC/G,QAAI;AACH,YAAM,YAAY,MAAM,QAAQ,eAAe,QAAQ;AAAA,QACtD;AAAA,QACA,uBAAuB,OAAQ,WAAW,sBAA8D,0BAA0B,WAC9H,WAAW,sBAA4D,wBACxE;AAAA,MAAA,CACH;AACD,aAAO,EAAE,WAAW,oBAAoB,WAAW,mBAAA;AAAA,IACpD,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAAA,EACD;AACD;;"}

package/dist/development/src/model/service/SignOutManager.js

@@ -0,0 +1,70 @@
+import { ApiKey } from "../type/ApiKey.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import { PersonQuery } from "../queries/person/PersonQuery.js";
+import { IdpSessionByApiKeyQuery } from "../queries/idp/IdpSessionByApiKeyQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+class SignOutManager {
+  constructor(apiKeyManager, idpRegistry) {
+    this.apiKeyManager = apiKeyManager;
+    this.idpRegistry = idpRegistry;
+  }
+  async signOut(db, identityId, apiKeyId, all) {
+    const person = await db.queryHandler.fetch(PersonQuery.byIdentity(identityId));
+    if (!person) {
+      return new ResponseError("NOT_A_PERSON", "Only a person can sign out");
+    }
+    const personApiKey = await this.apiKeyManager.findApiKey(db, apiKeyId);
+    if (personApiKey?.type === ApiKey.Type.PERMANENT) {
+      return new ResponseError(
+        "NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY",
+        "Only session API keys can be used for person sign out."
+      );
+    }
+    const logout = await this.resolveOidcLogout(db, apiKeyId);
+    if (all) {
+      await this.apiKeyManager.disableIdentityApiKeys(db, identityId);
+    } else {
+      await this.apiKeyManager.disableApiKey(db, apiKeyId);
+    }
+    return new ResponseOk({
+      logoutUrl: logout?.logoutUrl ?? null,
+      identityProviderId: logout?.identityProviderId ?? null
+    });
+  }
+  async resolveOidcLogout(db, apiKeyId) {
+    const idpSession = await db.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyId, db.providers));
+    if (!idpSession) {
+      return null;
+    }
+    const handler = this.idpRegistry.getHandlerOrNull(idpSession.providerType);
+    if (!handler?.buildLogoutUrl) {
+      return { logoutUrl: null, identityProviderId: idpSession.identityProviderId };
+    }
+    let config;
+    try {
+      config = handler.validateConfiguration(idpSession.providerConfiguration);
+    } catch {
+      return { logoutUrl: null, identityProviderId: idpSession.identityProviderId };
+    }
+    const idToken = typeof idpSession.session.tokens?.id_token === "string" ? idpSession.session.tokens.id_token : void 0;
+    try {
+      const logoutUrl = await handler.buildLogoutUrl(config, {
+        idToken,
+        postLogoutRedirectUri: typeof idpSession.providerConfiguration.postLogoutRedirectUri === "string" ? idpSession.providerConfiguration.postLogoutRedirectUri : void 0
+      });
+      return { logoutUrl, identityProviderId: idpSession.identityProviderId };
+    } catch {
+      return { logoutUrl: null, identityProviderId: idpSession.identityProviderId };
+    }
+  }
+}
+export {
+  SignOutManager
+};
+//# sourceMappingURL=SignOutManager.js.map

package/dist/development/src/model/service/SignOutManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignOutManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignOutManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ApiKey } from '../type/index.js'\nimport { PersonQuery } from '../queries/index.js'\nimport { IdpSessionByApiKeyQuery } from '../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './idp/IDPHandlerRegistry.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\n\nexport type SignOutErrorCode = 'NOT_A_PERSON' | 'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY'\n\nexport type SignOutResult = {\n\t/** Set when the session was federated via an OIDC IdP that exposes RP-initiated logout. */\n\treadonly logoutUrl: string | null\n\t/** The IdP this session belonged to, for auditing. Null for plain (password) sessions. */\n\treadonly identityProviderId: string | null\n}\n\nexport type SignOutResponse = Response<SignOutResult, SignOutErrorCode>\n\n/**\n * Owns the sign-out flow (extracted from `SignOutMutationResolver`, A10):\n *   - the existing local logout (disable this session, or all of the identity's sessions);\n *   - OIDC Single Logout — when the session was federated and the IdP advertises an\n *     `end_session_endpoint`, build the RP-initiated (front-channel) logout redirect URL the admin\n *     should send the browser to. Legacy IdPs without `end_session_endpoint` (and password\n *     sessions) gracefully fall back to a local-only logout with no `logoutUrl`.\n *\n * Auditing lives at the resolver layer (the manager only returns what happened), matching the\n * existing convention.\n */\nexport class SignOutManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signOut(\n\t\tdb: DatabaseContext,\n\t\tidentityId: string,\n\t\tapiKeyId: string,\n\t\tall: boolean,\n\t): Promise<SignOutResponse> {\n\t\tconst person = await db.queryHandler.fetch(PersonQuery.byIdentity(identityId))\n\t\tif (!person) {\n\t\t\treturn new ResponseError('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKey = await this.apiKeyManager.findApiKey(db, apiKeyId)\n\t\tif (personApiKey?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY',\n\t\t\t\t'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\t// Resolve the RP-initiated logout URL *before* disabling the key — the federated-session row\n\t\t// is removed (FK ON DELETE CASCADE) once the api_key is gone, and we need its id_token.\n\t\tconst logout = await this.resolveOidcLogout(db, apiKeyId)\n\n\t\tif (all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, identityId)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(db, apiKeyId)\n\t\t}\n\n\t\treturn new ResponseOk({\n\t\t\tlogoutUrl: logout?.logoutUrl ?? null,\n\t\t\tidentityProviderId: logout?.identityProviderId ?? null,\n\t\t})\n\t}\n\n\tprivate async resolveOidcLogout(\n\t\tdb: DatabaseContext,\n\t\tapiKeyId: string,\n\t): Promise<{ logoutUrl: string | null; identityProviderId: string } | null> {\n\t\tconst idpSession = await db.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyId, db.providers))\n\t\tif (!idpSession) {\n\t\t\t// not a federated session (password / IdP without revalidation) — local logout only\n\t\t\treturn null\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(idpSession.providerType)\n\t\tif (!handler?.buildLogoutUrl) {\n\t\t\t// provider can't initiate logout at the IdP (e.g. Apple / Facebook) — local logout only\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(idpSession.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config must not break sign-out — degrade to a local-only logout\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tconst idToken = typeof idpSession.session.tokens?.id_token === 'string' ? idpSession.session.tokens.id_token : undefined\n\t\ttry {\n\t\t\tconst logoutUrl = await handler.buildLogoutUrl(config, {\n\t\t\t\tidToken,\n\t\t\t\tpostLogoutRedirectUri: typeof (idpSession.providerConfiguration as { postLogoutRedirectUri?: unknown }).postLogoutRedirectUri === 'string'\n\t\t\t\t\t? (idpSession.providerConfiguration as { postLogoutRedirectUri: string }).postLogoutRedirectUri\n\t\t\t\t\t: undefined,\n\t\t\t})\n\t\t\treturn { logoutUrl, identityProviderId: idpSession.identityProviderId }\n\t\t} catch {\n\t\t\t// discovery / IdP unreachable must not block local sign-out — degrade gracefully\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;AA8BO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,IACA,YACA,UACA,KAC2B;AAC3B,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,YAAY,WAAW,UAAU,CAAC;AAC7E,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,gBAAgB,4BAA4B;AAAA,IACtE;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,WAAW,IAAI,QAAQ;AACrE,QAAI,cAAc,SAAS,OAAO,KAAK,WAAW;AACjD,aAAO,IAAI;AAAA,QACV;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AAIA,UAAM,SAAS,MAAM,KAAK,kBAAkB,IAAI,QAAQ;AAExD,QAAI,KAAK;AACR,YAAM,KAAK,cAAc,uBAAuB,IAAI,UAAU;AAAA,IAC/D,OAAO;AACN,YAAM,KAAK,cAAc,cAAc,IAAI,QAAQ;AAAA,IACpD;AAEA,WAAO,IAAI,WAAW;AAAA,MACrB,WAAW,QAAQ,aAAa;AAAA,MAChC,oBAAoB,QAAQ,sBAAsB;AAAA,IAAA,CAClD;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,IACA,UAC2E;AAC3E,UAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,wBAAwB,UAAU,GAAG,SAAS,CAAC;AAClG,QAAI,CAAC,YAAY;AAEhB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,WAAW,YAAY;AACzE,QAAI,CAAC,SAAS,gBAAgB;AAE7B,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,WAAW,qBAAqB;AAAA,IACxE,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,UAAM,UAAU,OAAO,WAAW,QAAQ,QAAQ,aAAa,WAAW,WAAW,QAAQ,OAAO,WAAW;AAC/G,QAAI;AACH,YAAM,YAAY,MAAM,QAAQ,eAAe,QAAQ;AAAA,QACtD;AAAA,QACA,uBAAuB,OAAQ,WAAW,sBAA8D,0BAA0B,WAC9H,WAAW,sBAA4D,wBACxE;AAAA,MAAA,CACH;AACD,aAAO,EAAE,WAAW,oBAAoB,WAAW,mBAAA;AAAA,IACpD,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAAA,EACD;AACD;"}

package/dist/development/src/model/service/SignUpManager.cjs

@@ -6,42 +6,52 @@ require("node:crypto");
 const Response = require("../utils/Response.cjs");
 const CreatePersonCommand = require("../commands/person/CreatePersonCommand.cjs");
 const CreateIdentityCommand = require("../commands/identity/CreateIdentityCommand.cjs");
-require("../queries/apiKey/ApiKeyQuery.cjs");
-const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
 const Roles = require("../authorization/Roles.cjs");
 require("../authorization/PermissionContext.cjs");
 require("../authorization/PermissionsFactory.cjs");
 require("@contember/schema");
+const email = require("../utils/email.cjs");
 class SignUpManager {
   constructor(emailValidator, passwordStrengthValidator) {
     this.emailValidator = emailValidator;
     this.passwordStrengthValidator = passwordStrengthValidator;
   }
-  async signUp(dbContext, { email, password, roles = [] }) {
-    const validationError = await this.emailValidator.validateEmail(dbContext, email);
-    if (validationError !== null) {
-      return validationError;
+  async signUp(dbContext, args) {
+    const { email: email$1, password, roles = [], config } = args;
+    if (!email.validateEmail(email$1.trim())) {
+      return new Response.ResponseError("INVALID_EMAIL_FORMAT", "E-mail address is not in a valid format");
+    }
+    const existingPerson = await this.emailValidator.findExistingPerson(dbContext, email$1);
+    if (existingPerson !== null) {
+      const exposeMethod = config.login.revealUserExists && config.login.revealLoginMethod;
+      const recommendedAction = exposeMethod ? existingPerson.password_hash ? "SIGN_IN" : "RESET_PASSWORD" : void 0;
+      return new Response.ResponseError(
+        "EMAIL_ALREADY_EXISTS",
+        `User with email ${email$1} already exists`,
+        recommendedAction ? { recommendedAction } : void 0
+      );
     }
     const plainPassword = password.getPlain();
     if (plainPassword) {
-      const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery());
       const passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, "TOO_WEAK");
       if (!passwordVerifyResult.ok) {
         return passwordVerifyResult;
       }
     }
+    const emailVerificationRequired = config.signup.requireEmailVerification;
     const person = await dbContext.transaction(async (db) => {
       const identityId = await db.commandBus.execute(new CreateIdentityCommand.CreateIdentityCommand([...roles, Roles.TenantRole.PERSON]));
-      return await db.commandBus.execute(new CreatePersonCommand.CreatePersonCommand({ identityId, email, password }));
+      return await db.commandBus.execute(new CreatePersonCommand.CreatePersonCommand({ identityId, email: email$1, password, emailVerificationRequired }));
     });
-    return new Response.ResponseOk(new SignUpResult(person));
+    return new Response.ResponseOk(new SignUpResult(person, emailVerificationRequired));
   }
 }
 class SignUpResult {
-  constructor(person) {
+  constructor(person, emailVerificationRequired = false) {
     this.person = person;
+    this.emailVerificationRequired = emailVerificationRequired;
   }
 }
 exports.SignUpManager = SignUpManager;

package/dist/development/src/model/service/SignUpManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands'\nimport { ConfigurationQuery, PersonRow } from '../queries'\nimport { SignUpErrorCode, WeakPasswordReason } from '../../schema'\nimport { TenantRole } from '../authorization'\nimport { Response, ResponseOk } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\nimport { MaybePassword } from '../dtos'\nimport { EmailValidator } from './EmailValidator'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, { email, password, roles = [] }: SignUpUser): Promise<SignUpResponse> {\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, email)\n\t\tif (validationError !== null) {\n\t\t\treturn validationError\n\t\t}\n\t\tconst plainPassword = password.getPlain()\n\n\t\tif (plainPassword) {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tconst passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')\n\t\t\tif (!passwordVerifyResult.ok) {\n\t\t\t\treturn passwordVerifyResult\n\t\t\t}\n\t\t}\n\n\t\tconst person = await dbContext.transaction(async db => {\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\treturn await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password }))\n\t\t})\n\t\treturn new ResponseOk(new SignUpResult(person))\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(public readonly person: Omit<PersonRow, 'roles'>) {}\n}\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n}>\n"],"names":["ConfigurationQuery","CreateIdentityCommand","TenantRole","CreatePersonCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;AAiBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBACA,2BAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EAElB;AAAA,EAEA,MAAM,OAAO,WAA4B,EAAE,OAAO,UAAU,QAAQ,CAAA,KAA2C;AAC9G,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK;AAChF,QAAI,oBAAoB,MAAM;AAC7B,aAAO;AAAA,IACR;AACA,UAAM,gBAAgB,SAAS,SAAA;AAE/B,QAAI,eAAe;AAClB,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,mBAAAA,oBAAoB;AAC1E,YAAM,uBAAuB,MAAM,KAAK,0BAA0B,OAAO,eAAe,OAAO,UAAU,UAAU;AACnH,UAAI,CAAC,qBAAqB,IAAI;AAC7B,eAAO;AAAA,MACR;AAAA,IACD;AAEA,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,OAAM;AACtD,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIC,4CAAsB,CAAC,GAAG,OAAOC,iBAAW,MAAM,CAAC,CAAC;AACvG,aAAO,MAAM,GAAG,WAAW,QAAQ,IAAIC,wCAAoB,EAAE,YAAY,OAAO,SAAA,CAAU,CAAC;AAAA,IAC5F,CAAC;AACD,WAAO,IAAIC,SAAAA,WAAW,IAAI,aAAa,MAAM,CAAC;AAAA,EAC/C;AACD;AAEO,MAAM,aAAa;AAAA,EACzB,YAA4B,QAAkC;AAAlC,SAAA,SAAA;AAAA,EAAmC;AAChE;;;"}
+{"version":3,"file":"SignUpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands/index.js'\nimport { PersonRow } from '../queries/index.js'\nimport { SignUpErrorCode, SignUpRecommendedAction, WeakPasswordReason } from '../../schema/index.js'\nimport { TenantRole } from '../authorization/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { MaybePassword } from '../dtos/index.js'\nimport { EmailValidator } from './EmailValidator.js'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator.js'\nimport { validateEmail as isEmailFormatValid } from '../utils/email.js'\nimport { Config } from '../type/Config.js'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n\tconfig: Config\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, args: SignUpUser): Promise<SignUpResponse> {\n\t\tconst { email, password, roles = [], config } = args\n\n\t\tif (!isEmailFormatValid(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\n\t\tconst existingPerson = await this.emailValidator.findExistingPerson(dbContext, email)\n\t\tif (existingPerson !== null) {\n\t\t\tconst exposeMethod = config.login.revealUserExists && config.login.revealLoginMethod\n\t\t\tconst recommendedAction: SignUpRecommendedAction | undefined = exposeMethod\n\t\t\t\t? (existingPerson.password_hash ? 'SIGN_IN' : 'RESET_PASSWORD')\n\t\t\t\t: undefined\n\t\t\treturn new ResponseError(\n\t\t\t\t'EMAIL_ALREADY_EXISTS',\n\t\t\t\t`User with email ${email} already exists`,\n\t\t\t\trecommendedAction ? { recommendedAction } : undefined,\n\t\t\t)\n\t\t}\n\n\t\tconst plainPassword = password.getPlain()\n\n\t\tif (plainPassword) {\n\t\t\tconst passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')\n\t\t\tif (!passwordVerifyResult.ok) {\n\t\t\t\treturn passwordVerifyResult\n\t\t\t}\n\t\t}\n\n\t\t// Freeze the requirement onto the person at sign-up time. Flipping the\n\t\t// tenant-wide flag later must not retroactively lock out accounts that\n\t\t// were created while verification was optional.\n\t\tconst emailVerificationRequired = config.signup.requireEmailVerification\n\n\t\tconst person = await dbContext.transaction(async db => {\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\treturn await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password, emailVerificationRequired }))\n\t\t})\n\t\treturn new ResponseOk(new SignUpResult(person, emailVerificationRequired))\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(\n\t\tpublic readonly person: Omit<PersonRow, 'roles'>,\n\t\tpublic readonly emailVerificationRequired: boolean = false,\n\t) {}\n}\n\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n\trecommendedAction?: SignUpRecommendedAction\n}>\n"],"names":["email","isEmailFormatValid","ResponseError","CreateIdentityCommand","TenantRole","CreatePersonCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;AAoBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBACA,2BAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EAElB;AAAA,EAEA,MAAM,OAAO,WAA4B,MAA2C;AACnF,UAAM,EAAA,OAAEA,SAAO,UAAU,QAAQ,CAAA,GAAI,WAAW;AAEhD,QAAI,CAACC,MAAAA,cAAmBD,QAAM,KAAA,CAAM,GAAG;AACtC,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe,mBAAmB,WAAWF,OAAK;AACpF,QAAI,mBAAmB,MAAM;AAC5B,YAAM,eAAe,OAAO,MAAM,oBAAoB,OAAO,MAAM;AACnE,YAAM,oBAAyD,eAC3D,eAAe,gBAAgB,YAAY,mBAC5C;AACH,aAAO,IAAIE,SAAAA;AAAAA,QACV;AAAA,QACA,mBAAmBF,OAAK;AAAA,QACxB,oBAAoB,EAAE,sBAAsB;AAAA,MAAA;AAAA,IAE9C;AAEA,UAAM,gBAAgB,SAAS,SAAA;AAE/B,QAAI,eAAe;AAClB,YAAM,uBAAuB,MAAM,KAAK,0BAA0B,OAAO,eAAe,OAAO,UAAU,UAAU;AACnH,UAAI,CAAC,qBAAqB,IAAI;AAC7B,eAAO;AAAA,MACR;AAAA,IACD;AAKA,UAAM,4BAA4B,OAAO,OAAO;AAEhD,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,OAAM;AACtD,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIG,4CAAsB,CAAC,GAAG,OAAOC,iBAAW,MAAM,CAAC,CAAC;AACvG,aAAO,MAAM,GAAG,WAAW,QAAQ,IAAIC,oBAAAA,oBAAoB,EAAE,mBAAYL,SAAO,UAAU,0BAAA,CAA2B,CAAC;AAAA,IACvH,CAAC;AACD,WAAO,IAAIM,SAAAA,WAAW,IAAI,aAAa,QAAQ,yBAAyB,CAAC;AAAA,EAC1E;AACD;AAEO,MAAM,aAAa;AAAA,EACzB,YACiB,QACA,4BAAqC,OACpD;AAFe,SAAA,SAAA;AACA,SAAA,4BAAA;AAAA,EACd;AACJ;;;"}