@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/development/src/model/service/captcha/RecaptchaV3Provider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecaptchaV3Provider.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/RecaptchaV3Provider.ts"],"sourcesContent":["import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js'\n\nconst DEFAULT_THRESHOLD = 0.5\n\n/**\n * Google reCAPTCHA v3 — score-based. Falls back to DEFAULT_THRESHOLD when no\n * config-level threshold is set.\n */\nexport class RecaptchaV3Provider implements CaptchaProviderHandler {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://www.google.com/recaptcha/api/siteverify',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t) {}\n\n\tasync verify({ token, secret, remoteIp, threshold }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult> {\n\t\tconst body = new URLSearchParams({ secret, response: token })\n\t\tif (remoteIp) {\n\t\t\tbody.set('remoteip', remoteIp)\n\t\t}\n\t\tlet payload: { success?: boolean; score?: number; 'error-codes'?: string[] }\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(this.endpoint, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: { 'content-type': 'application/x-www-form-urlencoded' },\n\t\t\t\tbody,\n\t\t\t})\n\t\t\tpayload = await response.json() as typeof payload\n\t\t} catch (e) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: e instanceof Error ? e.message : String(e) }\n\t\t}\n\t\tif (!payload.success) {\n\t\t\treturn { ok: false, reason: 'invalid', detail: (payload['error-codes'] ?? []).join(',') }\n\t\t}\n\t\tconst score = payload.score ?? 0\n\t\tconst gate = threshold ?? DEFAULT_THRESHOLD\n\t\tif (score < gate) {\n\t\t\treturn { ok: false, reason: 'low_score', detail: `score=${score} < ${gate}` }\n\t\t}\n\t\treturn { ok: true, score }\n\t}\n}\n"],"names":[],"mappings":";;AAEA,MAAM,oBAAoB;AAMnB,MAAM,oBAAsD;AAAA,EAClE,YACkB,WAAmB,mDACnB,YAA0B,OAC1C;AAFgB,SAAA,WAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,aAA8D;AACrG,UAAM,OAAO,IAAI,gBAAgB,EAAE,QAAQ,UAAU,OAAO;AAC5D,QAAI,UAAU;AACb,WAAK,IAAI,YAAY,QAAQ;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAA;AAAA,QAC3B;AAAA,MAAA,CACA;AACD,gBAAU,MAAM,SAAS,KAAA;AAAA,IAC1B,SAAS,GAAG;AACX,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA;AAAA,IAC9F;AACA,QAAI,CAAC,QAAQ,SAAS;AACrB,aAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,SAAS,QAAQ,aAAa,KAAK,CAAA,GAAI,KAAK,GAAG,EAAA;AAAA,IACvF;AACA,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,OAAO,aAAa;AAC1B,QAAI,QAAQ,MAAM;AACjB,aAAO,EAAE,IAAI,OAAO,QAAQ,aAAa,QAAQ,SAAS,KAAK,MAAM,IAAI,GAAA;AAAA,IAC1E;AACA,WAAO,EAAE,IAAI,MAAM,MAAA;AAAA,EACpB;AACD;;"}

package/dist/development/src/model/service/captcha/RecaptchaV3Provider.js

@@ -0,0 +1,37 @@
+const DEFAULT_THRESHOLD = 0.5;
+class RecaptchaV3Provider {
+  constructor(endpoint = "https://www.google.com/recaptcha/api/siteverify", fetchImpl = fetch) {
+    this.endpoint = endpoint;
+    this.fetchImpl = fetchImpl;
+  }
+  async verify({ token, secret, remoteIp, threshold }) {
+    const body = new URLSearchParams({ secret, response: token });
+    if (remoteIp) {
+      body.set("remoteip", remoteIp);
+    }
+    let payload;
+    try {
+      const response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      });
+      payload = await response.json();
+    } catch (e) {
+      return { ok: false, reason: "verify_error", detail: e instanceof Error ? e.message : String(e) };
+    }
+    if (!payload.success) {
+      return { ok: false, reason: "invalid", detail: (payload["error-codes"] ?? []).join(",") };
+    }
+    const score = payload.score ?? 0;
+    const gate = threshold ?? DEFAULT_THRESHOLD;
+    if (score < gate) {
+      return { ok: false, reason: "low_score", detail: `score=${score} < ${gate}` };
+    }
+    return { ok: true, score };
+  }
+}
+export {
+  RecaptchaV3Provider
+};
+//# sourceMappingURL=RecaptchaV3Provider.js.map

package/dist/development/src/model/service/captcha/RecaptchaV3Provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecaptchaV3Provider.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/RecaptchaV3Provider.ts"],"sourcesContent":["import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js'\n\nconst DEFAULT_THRESHOLD = 0.5\n\n/**\n * Google reCAPTCHA v3 — score-based. Falls back to DEFAULT_THRESHOLD when no\n * config-level threshold is set.\n */\nexport class RecaptchaV3Provider implements CaptchaProviderHandler {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://www.google.com/recaptcha/api/siteverify',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t) {}\n\n\tasync verify({ token, secret, remoteIp, threshold }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult> {\n\t\tconst body = new URLSearchParams({ secret, response: token })\n\t\tif (remoteIp) {\n\t\t\tbody.set('remoteip', remoteIp)\n\t\t}\n\t\tlet payload: { success?: boolean; score?: number; 'error-codes'?: string[] }\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(this.endpoint, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: { 'content-type': 'application/x-www-form-urlencoded' },\n\t\t\t\tbody,\n\t\t\t})\n\t\t\tpayload = await response.json() as typeof payload\n\t\t} catch (e) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: e instanceof Error ? e.message : String(e) }\n\t\t}\n\t\tif (!payload.success) {\n\t\t\treturn { ok: false, reason: 'invalid', detail: (payload['error-codes'] ?? []).join(',') }\n\t\t}\n\t\tconst score = payload.score ?? 0\n\t\tconst gate = threshold ?? DEFAULT_THRESHOLD\n\t\tif (score < gate) {\n\t\t\treturn { ok: false, reason: 'low_score', detail: `score=${score} < ${gate}` }\n\t\t}\n\t\treturn { ok: true, score }\n\t}\n}\n"],"names":[],"mappings":"AAEA,MAAM,oBAAoB;AAMnB,MAAM,oBAAsD;AAAA,EAClE,YACkB,WAAmB,mDACnB,YAA0B,OAC1C;AAFgB,SAAA,WAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,aAA8D;AACrG,UAAM,OAAO,IAAI,gBAAgB,EAAE,QAAQ,UAAU,OAAO;AAC5D,QAAI,UAAU;AACb,WAAK,IAAI,YAAY,QAAQ;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAA;AAAA,QAC3B;AAAA,MAAA,CACA;AACD,gBAAU,MAAM,SAAS,KAAA;AAAA,IAC1B,SAAS,GAAG;AACX,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA;AAAA,IAC9F;AACA,QAAI,CAAC,QAAQ,SAAS;AACrB,aAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,SAAS,QAAQ,aAAa,KAAK,CAAA,GAAI,KAAK,GAAG,EAAA;AAAA,IACvF;AACA,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,OAAO,aAAa;AAC1B,QAAI,QAAQ,MAAM;AACjB,aAAO,EAAE,IAAI,OAAO,QAAQ,aAAa,QAAQ,SAAS,KAAK,MAAM,IAAI,GAAA;AAAA,IAC1E;AACA,WAAO,EAAE,IAAI,MAAM,MAAA;AAAA,EACpB;AACD;"}

package/dist/development/src/model/service/captcha/TurnstileProvider.cjs

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class TurnstileProvider {
+  constructor(endpoint = "https://challenges.cloudflare.com/turnstile/v0/siteverify", fetchImpl = fetch) {
+    this.endpoint = endpoint;
+    this.fetchImpl = fetchImpl;
+  }
+  async verify({ token, secret, remoteIp }) {
+    const body = new URLSearchParams({ secret, response: token });
+    if (remoteIp) {
+      body.set("remoteip", remoteIp);
+    }
+    let payload;
+    try {
+      const response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      });
+      payload = await response.json();
+    } catch (e) {
+      return { ok: false, reason: "verify_error", detail: e instanceof Error ? e.message : String(e) };
+    }
+    if (payload.success) {
+      return { ok: true };
+    }
+    const codes = payload["error-codes"] ?? [];
+    if (codes.includes("timeout-or-duplicate") || codes.includes("invalid-input-response")) {
+      return { ok: false, reason: "expired", detail: codes.join(",") };
+    }
+    return { ok: false, reason: "invalid", detail: codes.join(",") };
+  }
+}
+exports.TurnstileProvider = TurnstileProvider;
+//# sourceMappingURL=TurnstileProvider.cjs.map

package/dist/development/src/model/service/captcha/TurnstileProvider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TurnstileProvider.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/TurnstileProvider.ts"],"sourcesContent":["import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js'\n\n/**\n * Cloudflare Turnstile. Binary success/failure — `threshold` is ignored.\n * https://developers.cloudflare.com/turnstile/get-started/server-side-validation/\n */\nexport class TurnstileProvider implements CaptchaProviderHandler {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://challenges.cloudflare.com/turnstile/v0/siteverify',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t) {}\n\n\tasync verify({ token, secret, remoteIp }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult> {\n\t\tconst body = new URLSearchParams({ secret, response: token })\n\t\tif (remoteIp) {\n\t\t\tbody.set('remoteip', remoteIp)\n\t\t}\n\t\tlet payload: { success?: boolean; 'error-codes'?: string[] }\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(this.endpoint, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: { 'content-type': 'application/x-www-form-urlencoded' },\n\t\t\t\tbody,\n\t\t\t})\n\t\t\tpayload = await response.json() as typeof payload\n\t\t} catch (e) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: e instanceof Error ? e.message : String(e) }\n\t\t}\n\t\tif (payload.success) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst codes = payload['error-codes'] ?? []\n\t\tif (codes.includes('timeout-or-duplicate') || codes.includes('invalid-input-response')) {\n\t\t\treturn { ok: false, reason: 'expired', detail: codes.join(',') }\n\t\t}\n\t\treturn { ok: false, reason: 'invalid', detail: codes.join(',') }\n\t}\n}\n"],"names":[],"mappings":";;AAMO,MAAM,kBAAoD;AAAA,EAChE,YACkB,WAAmB,6DACnB,YAA0B,OAC1C;AAFgB,SAAA,WAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,EAAE,OAAO,QAAQ,YAA6D;AAC1F,UAAM,OAAO,IAAI,gBAAgB,EAAE,QAAQ,UAAU,OAAO;AAC5D,QAAI,UAAU;AACb,WAAK,IAAI,YAAY,QAAQ;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAA;AAAA,QAC3B;AAAA,MAAA,CACA;AACD,gBAAU,MAAM,SAAS,KAAA;AAAA,IAC1B,SAAS,GAAG;AACX,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA;AAAA,IAC9F;AACA,QAAI,QAAQ,SAAS;AACpB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,QAAQ,QAAQ,aAAa,KAAK,CAAA;AACxC,QAAI,MAAM,SAAS,sBAAsB,KAAK,MAAM,SAAS,wBAAwB,GAAG;AACvF,aAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,QAAQ,MAAM,KAAK,GAAG,EAAA;AAAA,IAC9D;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,QAAQ,MAAM,KAAK,GAAG,EAAA;AAAA,EAC9D;AACD;;"}

package/dist/development/src/model/service/captcha/TurnstileProvider.js

@@ -0,0 +1,35 @@
+class TurnstileProvider {
+  constructor(endpoint = "https://challenges.cloudflare.com/turnstile/v0/siteverify", fetchImpl = fetch) {
+    this.endpoint = endpoint;
+    this.fetchImpl = fetchImpl;
+  }
+  async verify({ token, secret, remoteIp }) {
+    const body = new URLSearchParams({ secret, response: token });
+    if (remoteIp) {
+      body.set("remoteip", remoteIp);
+    }
+    let payload;
+    try {
+      const response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      });
+      payload = await response.json();
+    } catch (e) {
+      return { ok: false, reason: "verify_error", detail: e instanceof Error ? e.message : String(e) };
+    }
+    if (payload.success) {
+      return { ok: true };
+    }
+    const codes = payload["error-codes"] ?? [];
+    if (codes.includes("timeout-or-duplicate") || codes.includes("invalid-input-response")) {
+      return { ok: false, reason: "expired", detail: codes.join(",") };
+    }
+    return { ok: false, reason: "invalid", detail: codes.join(",") };
+  }
+}
+export {
+  TurnstileProvider
+};
+//# sourceMappingURL=TurnstileProvider.js.map

package/dist/development/src/model/service/captcha/TurnstileProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TurnstileProvider.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/TurnstileProvider.ts"],"sourcesContent":["import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js'\n\n/**\n * Cloudflare Turnstile. Binary success/failure — `threshold` is ignored.\n * https://developers.cloudflare.com/turnstile/get-started/server-side-validation/\n */\nexport class TurnstileProvider implements CaptchaProviderHandler {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://challenges.cloudflare.com/turnstile/v0/siteverify',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t) {}\n\n\tasync verify({ token, secret, remoteIp }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult> {\n\t\tconst body = new URLSearchParams({ secret, response: token })\n\t\tif (remoteIp) {\n\t\t\tbody.set('remoteip', remoteIp)\n\t\t}\n\t\tlet payload: { success?: boolean; 'error-codes'?: string[] }\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(this.endpoint, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: { 'content-type': 'application/x-www-form-urlencoded' },\n\t\t\t\tbody,\n\t\t\t})\n\t\t\tpayload = await response.json() as typeof payload\n\t\t} catch (e) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: e instanceof Error ? e.message : String(e) }\n\t\t}\n\t\tif (payload.success) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst codes = payload['error-codes'] ?? []\n\t\tif (codes.includes('timeout-or-duplicate') || codes.includes('invalid-input-response')) {\n\t\t\treturn { ok: false, reason: 'expired', detail: codes.join(',') }\n\t\t}\n\t\treturn { ok: false, reason: 'invalid', detail: codes.join(',') }\n\t}\n}\n"],"names":[],"mappings":"AAMO,MAAM,kBAAoD;AAAA,EAChE,YACkB,WAAmB,6DACnB,YAA0B,OAC1C;AAFgB,SAAA,WAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,EAAE,OAAO,QAAQ,YAA6D;AAC1F,UAAM,OAAO,IAAI,gBAAgB,EAAE,QAAQ,UAAU,OAAO;AAC5D,QAAI,UAAU;AACb,WAAK,IAAI,YAAY,QAAQ;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAA;AAAA,QAC3B;AAAA,MAAA,CACA;AACD,gBAAU,MAAM,SAAS,KAAA;AAAA,IAC1B,SAAS,GAAG;AACX,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA;AAAA,IAC9F;AACA,QAAI,QAAQ,SAAS;AACpB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,QAAQ,QAAQ,aAAa,KAAK,CAAA;AACxC,QAAI,MAAM,SAAS,sBAAsB,KAAK,MAAM,SAAS,wBAAwB,GAAG;AACvF,aAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,QAAQ,MAAM,KAAK,GAAG,EAAA;AAAA,IAC9D;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,QAAQ,MAAM,KAAK,GAAG,EAAA;AAAA,EAC9D;AACD;"}

package/dist/development/src/model/service/helpers/getPreferredProject.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"getPreferredProject.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":";;AAEO,MAAM,sBAAsB,CAAC,UAAqB,yBAAwD;AAChH,MAAI,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACA,SAAO;AACR;;"}
+{"version":3,"file":"getPreferredProject.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type/index.js'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":";;AAEO,MAAM,sBAAsB,CAAC,UAAqB,yBAAwD;AAChH,MAAI,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACA,SAAO;AACR;;"}

package/dist/development/src/model/service/helpers/getPreferredProject.js.map

@@ -1 +1 @@
-{"version":3,"file":"getPreferredProject.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":"AAEO,MAAM,sBAAsB,CAAC,UAAqB,yBAAwD;AAChH,MAAI,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACA,SAAO;AACR;"}
+{"version":3,"file":"getPreferredProject.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type/index.js'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":"AAEO,MAAM,sBAAsB,CAAC,UAAqB,yBAAwD;AAChH,MAAI,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACA,SAAO;AACR;"}

package/dist/development/src/model/service/helpers/isPasswordlessEnabled.cjs

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const isPasswordlessEnabled = (globalValue, personValue) => {
+  switch (globalValue) {
+    case "always":
+      return true;
+    case "never":
+      return false;
+    case "optIn":
+      return personValue === true;
+    case "optOut":
+      return personValue !== false;
+  }
+};
+exports.isPasswordlessEnabled = isPasswordlessEnabled;
+//# sourceMappingURL=isPasswordlessEnabled.cjs.map

package/dist/development/src/model/service/helpers/isPasswordlessEnabled.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"isPasswordlessEnabled.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/isPasswordlessEnabled.ts"],"sourcesContent":["import { ConfigPolicy } from '../../../schema/index.js'\n\n/**\n * Resolves whether passwordless sign-in is effectively available for a person,\n * combining the tenant-wide policy with the person's own flag. This is the same\n * gate the passwordless sign-in flow applies, so any caller that reasons about a\n * person's usable sign-in methods (e.g. the IdP disconnect lock-out check) stays\n * consistent with what sign-in actually permits.\n */\nexport const isPasswordlessEnabled = (globalValue: ConfigPolicy, personValue: boolean | null): boolean => {\n\tswitch (globalValue) {\n\t\tcase 'always':\n\t\t\treturn true\n\t\tcase 'never':\n\t\t\treturn false\n\t\tcase 'optIn':\n\t\t\treturn personValue === true\n\t\tcase 'optOut':\n\t\t\treturn personValue !== false\n\t}\n}\n"],"names":[],"mappings":";;AASO,MAAM,wBAAwB,CAAC,aAA2B,gBAAyC;AACzG,UAAQ,aAAA;AAAA,IACP,KAAK;AACJ,aAAO;AAAA,IACR,KAAK;AACJ,aAAO;AAAA,IACR,KAAK;AACJ,aAAO,gBAAgB;AAAA,IACxB,KAAK;AACJ,aAAO,gBAAgB;AAAA,EAAA;AAE1B;;"}

package/dist/development/src/model/service/helpers/isPasswordlessEnabled.js

@@ -0,0 +1,16 @@
+const isPasswordlessEnabled = (globalValue, personValue) => {
+  switch (globalValue) {
+    case "always":
+      return true;
+    case "never":
+      return false;
+    case "optIn":
+      return personValue === true;
+    case "optOut":
+      return personValue !== false;
+  }
+};
+export {
+  isPasswordlessEnabled
+};
+//# sourceMappingURL=isPasswordlessEnabled.js.map

package/dist/development/src/model/service/helpers/isPasswordlessEnabled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isPasswordlessEnabled.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/isPasswordlessEnabled.ts"],"sourcesContent":["import { ConfigPolicy } from '../../../schema/index.js'\n\n/**\n * Resolves whether passwordless sign-in is effectively available for a person,\n * combining the tenant-wide policy with the person's own flag. This is the same\n * gate the passwordless sign-in flow applies, so any caller that reasons about a\n * person's usable sign-in methods (e.g. the IdP disconnect lock-out check) stays\n * consistent with what sign-in actually permits.\n */\nexport const isPasswordlessEnabled = (globalValue: ConfigPolicy, personValue: boolean | null): boolean => {\n\tswitch (globalValue) {\n\t\tcase 'always':\n\t\t\treturn true\n\t\tcase 'never':\n\t\t\treturn false\n\t\tcase 'optIn':\n\t\t\treturn personValue === true\n\t\tcase 'optOut':\n\t\t\treturn personValue !== false\n\t}\n}\n"],"names":[],"mappings":"AASO,MAAM,wBAAwB,CAAC,aAA2B,gBAAyC;AACzG,UAAQ,aAAA;AAAA,IACP,KAAK;AACJ,aAAO;AAAA,IACR,KAAK;AACJ,aAAO;AAAA,IACR,KAAK;AACJ,aAAO,gBAAgB;AAAA,IACxB,KAAK;AACJ,aAAO,gBAAgB;AAAA,EAAA;AAE1B;"}

package/dist/development/src/model/service/idp/BackchannelLogoutManager.cjs

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const IdentityProviderBySlugQuery = require("../../queries/idp/IdentityProviderBySlugQuery.cjs");
+const IdpSessionsBySidQuery = require("../../queries/idp/IdpSessionsBySidQuery.cjs");
+const IdpSessionsBySubQuery = require("../../queries/idp/IdpSessionsBySubQuery.cjs");
+const ApiKeyQuery = require("../../queries/apiKey/ApiKeyQuery.cjs");
+require("../../type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+const DisableApiKeyCommand = require("../../commands/apiKey/DisableApiKeyCommand.cjs");
+const CreateAuthLogEntryCommand = require("../../commands/authLog/CreateAuthLogEntryCommand.cjs");
+const IDPValidationError = require("./IDPValidationError.cjs");
+class BackchannelLogoutManager {
+  constructor(idpRegistry) {
+    this.idpRegistry = idpRegistry;
+  }
+  async logout(db, providerSlug, logoutToken) {
+    const provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery.IdentityProviderBySlugQuery(providerSlug));
+    if (!provider) {
+      return { status: "provider_not_found" };
+    }
+    const handler = this.idpRegistry.getHandlerOrNull(provider.type);
+    if (!handler?.validateLogoutToken) {
+      return { status: "not_supported" };
+    }
+    let config;
+    try {
+      config = handler.validateConfiguration(provider.configuration);
+    } catch (e) {
+      return { status: "invalid_token", message: "IdP configuration is invalid" };
+    }
+    let claims;
+    try {
+      claims = await handler.validateLogoutToken(config, logoutToken);
+    } catch (e) {
+      return { status: "invalid_token", message: e instanceof IDPValidationError.IDPValidationError ? e.message : "Invalid logout token" };
+    }
+    const sessions = await this.resolveTargetSessions(db, provider.id, claims);
+    let revokedCount = 0;
+    for (const session of sessions) {
+      const disabled = await db.commandBus.execute(new DisableApiKeyCommand.DisableApiKeyCommand(session.apiKeyId));
+      if (disabled) {
+        revokedCount++;
+      }
+    }
+    await this.audit(db, provider.id, claims, revokedCount, sessions[0]?.apiKeyId);
+    return { status: "ok", revokedCount };
+  }
+  async resolveTargetSessions(db, identityProviderId, claims) {
+    if (claims.sid) {
+      return db.queryHandler.fetch(new IdpSessionsBySidQuery.IdpSessionsBySidQuery(identityProviderId, claims.sid));
+    }
+    if (claims.sub) {
+      return db.queryHandler.fetch(new IdpSessionsBySubQuery.IdpSessionsBySubQuery(identityProviderId, claims.sub));
+    }
+    return [];
+  }
+  async audit(db, identityProviderId, claims, revokedCount, targetApiKeyId) {
+    let invokedById;
+    let personId;
+    if (targetApiKeyId) {
+      const apiKeyRow = await db.queryHandler.fetch(new ApiKeyQuery.ApiKeyByIdQuery(targetApiKeyId));
+      if (apiKeyRow) {
+        invokedById = apiKeyRow.identity_id;
+        personId = apiKeyRow.person_id ?? void 0;
+      }
+    }
+    try {
+      await db.commandBus.execute(
+        new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
+          type: "idp_backchannel_logout",
+          invokedById,
+          personId,
+          identityProviderId,
+          success: true,
+          eventData: { sid: claims.sid ?? null, sub: claims.sub ?? null, revokedCount }
+        })
+      );
+    } catch {
+    }
+  }
+}
+exports.BackchannelLogoutManager = BackchannelLogoutManager;
+//# sourceMappingURL=BackchannelLogoutManager.cjs.map

package/dist/development/src/model/service/idp/BackchannelLogoutManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackchannelLogoutManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/BackchannelLogoutManager.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { IdentityProviderBySlugQuery } from '../../queries/idp/IdentityProviderBySlugQuery.js'\nimport { IdpSessionBySidRow, IdpSessionsBySidQuery } from '../../queries/idp/IdpSessionsBySidQuery.js'\nimport { IdpSessionsBySubQuery } from '../../queries/idp/IdpSessionsBySubQuery.js'\nimport { ApiKeyByIdQuery } from '../../queries/apiKey/ApiKeyQuery.js'\nimport { DisableApiKeyCommand } from '../../commands/index.js'\nimport { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { IDPValidationError } from './IDPValidationError.js'\n\nexport type BackchannelLogoutResult =\n\t| { status: 'ok'; revokedCount: number }\n\t| { status: 'provider_not_found' }\n\t| { status: 'not_supported' }\n\t| { status: 'invalid_token'; message: string }\n\n/**\n * Handles an incoming OIDC Back-Channel Logout request (A10). Runs entirely on the HTTP auth path\n * (no GraphQL resolver), so — like {@link IdpSessionRevalidator} — it owns its own audit write\n * rather than deferring to a resolver. Flow:\n *   1. resolve the IdP by slug (the back-channel endpoint carries a `?provider=` query param, since\n *      the IdP only knows which client it is calling, not the Contember tenant/provider record);\n *   2. validate the IdP-signed logout token and extract `sid` / `sub`;\n *   3. look up the local federated session(s) the token targets and revoke their api_key(s).\n *\n * A logout token with a `sid` targets that single IdP session; a `sub`-only token (rare — most IdPs\n * send a `sid`) targets *all* of that subject's federated sessions under the provider. Either way, a\n * token that matches no live session is reported as `revokedCount: 0` and audited, not failed.\n */\nexport class BackchannelLogoutManager {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync logout(db: DatabaseContext, providerSlug: string, logoutToken: string): Promise<BackchannelLogoutResult> {\n\t\tconst provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(providerSlug))\n\t\tif (!provider) {\n\t\t\treturn { status: 'provider_not_found' }\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(provider.type)\n\t\tif (!handler?.validateLogoutToken) {\n\t\t\treturn { status: 'not_supported' }\n\t\t}\n\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(provider.configuration)\n\t\t} catch (e) {\n\t\t\treturn { status: 'invalid_token', message: 'IdP configuration is invalid' }\n\t\t}\n\n\t\tlet claims: { sid?: string; sub?: string }\n\t\ttry {\n\t\t\tclaims = await handler.validateLogoutToken(config, logoutToken)\n\t\t} catch (e) {\n\t\t\treturn { status: 'invalid_token', message: e instanceof IDPValidationError ? e.message : 'Invalid logout token' }\n\t\t}\n\n\t\tconst sessions = await this.resolveTargetSessions(db, provider.id, claims)\n\t\tlet revokedCount = 0\n\t\tfor (const session of sessions) {\n\t\t\tconst disabled = await db.commandBus.execute(new DisableApiKeyCommand(session.apiKeyId))\n\t\t\tif (disabled) {\n\t\t\t\trevokedCount++\n\t\t\t}\n\t\t}\n\n\t\tawait this.audit(db, provider.id, claims, revokedCount, sessions[0]?.apiKeyId)\n\n\t\treturn { status: 'ok', revokedCount }\n\t}\n\n\tprivate async resolveTargetSessions(\n\t\tdb: DatabaseContext,\n\t\tidentityProviderId: string,\n\t\tclaims: { sid?: string; sub?: string },\n\t): Promise<IdpSessionBySidRow[]> {\n\t\t// Prefer `sid` (targets one session); fall back to `sub` (targets all the subject's sessions).\n\t\tif (claims.sid) {\n\t\t\treturn db.queryHandler.fetch(new IdpSessionsBySidQuery(identityProviderId, claims.sid))\n\t\t}\n\t\tif (claims.sub) {\n\t\t\treturn db.queryHandler.fetch(new IdpSessionsBySubQuery(identityProviderId, claims.sub))\n\t\t}\n\t\treturn []\n\t}\n\n\tprivate async audit(\n\t\tdb: DatabaseContext,\n\t\tidentityProviderId: string,\n\t\tclaims: { sid?: string; sub?: string },\n\t\trevokedCount: number,\n\t\ttargetApiKeyId: string | undefined,\n\t): Promise<void> {\n\t\t// Resolve the affected identity for the audit `invoked_by_id` from a targeted session, when\n\t\t// one resolves. Otherwise leave it unset (→ NULL) — the provider id is NOT a valid identity id\n\t\t// and inserting it would violate the `invoked_by_id` FK (the provider is recorded separately\n\t\t// in `identity_provider_id`).\n\t\tlet invokedById: string | undefined\n\t\tlet personId: string | undefined\n\t\tif (targetApiKeyId) {\n\t\t\tconst apiKeyRow = await db.queryHandler.fetch(new ApiKeyByIdQuery(targetApiKeyId))\n\t\t\tif (apiKeyRow) {\n\t\t\t\tinvokedById = apiKeyRow.identity_id\n\t\t\t\tpersonId = apiKeyRow.person_id ?? undefined\n\t\t\t}\n\t\t}\n\n\t\ttry {\n\t\t\tawait db.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_backchannel_logout',\n\t\t\t\t\tinvokedById,\n\t\t\t\t\tpersonId,\n\t\t\t\t\tidentityProviderId,\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\teventData: { sid: claims.sid ?? null, sub: claims.sub ?? null, revokedCount },\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort observability — never fail the logout because the audit write failed\n\t\t}\n\t}\n}\n"],"names":["IdentityProviderBySlugQuery","IDPValidationError","DisableApiKeyCommand","IdpSessionsBySidQuery","IdpSessionsBySubQuery","ApiKeyByIdQuery","CreateAuthLogEntryCommand"],"mappings":";;;;;;;;;;;;AA6BO,MAAM,yBAAyB;AAAA,EACrC,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,IAAqB,cAAsB,aAAuD;AAC9G,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIA,4BAAAA,4BAA4B,YAAY,CAAC;AAC1F,QAAI,CAAC,UAAU;AACd,aAAO,EAAE,QAAQ,qBAAA;AAAA,IAClB;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,SAAS,IAAI;AAC/D,QAAI,CAAC,SAAS,qBAAqB;AAClC,aAAO,EAAE,QAAQ,gBAAA;AAAA,IAClB;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,SAAS,aAAa;AAAA,IAC9D,SAAS,GAAG;AACX,aAAO,EAAE,QAAQ,iBAAiB,SAAS,+BAAA;AAAA,IAC5C;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,oBAAoB,QAAQ,WAAW;AAAA,IAC/D,SAAS,GAAG;AACX,aAAO,EAAE,QAAQ,iBAAiB,SAAS,aAAaC,wCAAqB,EAAE,UAAU,uBAAA;AAAA,IAC1F;AAEA,UAAM,WAAW,MAAM,KAAK,sBAAsB,IAAI,SAAS,IAAI,MAAM;AACzE,QAAI,eAAe;AACnB,eAAW,WAAW,UAAU;AAC/B,YAAM,WAAW,MAAM,GAAG,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,QAAQ,QAAQ,CAAC;AACvF,UAAI,UAAU;AACb;AAAA,MACD;AAAA,IACD;AAEA,UAAM,KAAK,MAAM,IAAI,SAAS,IAAI,QAAQ,cAAc,SAAS,CAAC,GAAG,QAAQ;AAE7E,WAAO,EAAE,QAAQ,MAAM,aAAA;AAAA,EACxB;AAAA,EAEA,MAAc,sBACb,IACA,oBACA,QACgC;AAEhC,QAAI,OAAO,KAAK;AACf,aAAO,GAAG,aAAa,MAAM,IAAIC,sBAAAA,sBAAsB,oBAAoB,OAAO,GAAG,CAAC;AAAA,IACvF;AACA,QAAI,OAAO,KAAK;AACf,aAAO,GAAG,aAAa,MAAM,IAAIC,sBAAAA,sBAAsB,oBAAoB,OAAO,GAAG,CAAC;AAAA,IACvF;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAc,MACb,IACA,oBACA,QACA,cACA,gBACgB;AAKhB,QAAI;AACJ,QAAI;AACJ,QAAI,gBAAgB;AACnB,YAAM,YAAY,MAAM,GAAG,aAAa,MAAM,IAAIC,YAAAA,gBAAgB,cAAc,CAAC;AACjF,UAAI,WAAW;AACd,sBAAc,UAAU;AACxB,mBAAW,UAAU,aAAa;AAAA,MACnC;AAAA,IACD;AAEA,QAAI;AACH,YAAM,GAAG,WAAW;AAAA,QACnB,IAAIC,oDAA0B;AAAA,UAC7B,MAAM;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,WAAW,EAAE,KAAK,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,aAAA;AAAA,QAAa,CAC5E;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AACD;;"}

package/dist/development/src/model/service/idp/BackchannelLogoutManager.js

@@ -0,0 +1,84 @@
+import { IdentityProviderBySlugQuery } from "../../queries/idp/IdentityProviderBySlugQuery.js";
+import { IdpSessionsBySidQuery } from "../../queries/idp/IdpSessionsBySidQuery.js";
+import { IdpSessionsBySubQuery } from "../../queries/idp/IdpSessionsBySubQuery.js";
+import { ApiKeyByIdQuery } from "../../queries/apiKey/ApiKeyQuery.js";
+import "../../type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import { DisableApiKeyCommand } from "../../commands/apiKey/DisableApiKeyCommand.js";
+import { CreateAuthLogEntryCommand } from "../../commands/authLog/CreateAuthLogEntryCommand.js";
+import { IDPValidationError } from "./IDPValidationError.js";
+class BackchannelLogoutManager {
+  constructor(idpRegistry) {
+    this.idpRegistry = idpRegistry;
+  }
+  async logout(db, providerSlug, logoutToken) {
+    const provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(providerSlug));
+    if (!provider) {
+      return { status: "provider_not_found" };
+    }
+    const handler = this.idpRegistry.getHandlerOrNull(provider.type);
+    if (!handler?.validateLogoutToken) {
+      return { status: "not_supported" };
+    }
+    let config;
+    try {
+      config = handler.validateConfiguration(provider.configuration);
+    } catch (e) {
+      return { status: "invalid_token", message: "IdP configuration is invalid" };
+    }
+    let claims;
+    try {
+      claims = await handler.validateLogoutToken(config, logoutToken);
+    } catch (e) {
+      return { status: "invalid_token", message: e instanceof IDPValidationError ? e.message : "Invalid logout token" };
+    }
+    const sessions = await this.resolveTargetSessions(db, provider.id, claims);
+    let revokedCount = 0;
+    for (const session of sessions) {
+      const disabled = await db.commandBus.execute(new DisableApiKeyCommand(session.apiKeyId));
+      if (disabled) {
+        revokedCount++;
+      }
+    }
+    await this.audit(db, provider.id, claims, revokedCount, sessions[0]?.apiKeyId);
+    return { status: "ok", revokedCount };
+  }
+  async resolveTargetSessions(db, identityProviderId, claims) {
+    if (claims.sid) {
+      return db.queryHandler.fetch(new IdpSessionsBySidQuery(identityProviderId, claims.sid));
+    }
+    if (claims.sub) {
+      return db.queryHandler.fetch(new IdpSessionsBySubQuery(identityProviderId, claims.sub));
+    }
+    return [];
+  }
+  async audit(db, identityProviderId, claims, revokedCount, targetApiKeyId) {
+    let invokedById;
+    let personId;
+    if (targetApiKeyId) {
+      const apiKeyRow = await db.queryHandler.fetch(new ApiKeyByIdQuery(targetApiKeyId));
+      if (apiKeyRow) {
+        invokedById = apiKeyRow.identity_id;
+        personId = apiKeyRow.person_id ?? void 0;
+      }
+    }
+    try {
+      await db.commandBus.execute(
+        new CreateAuthLogEntryCommand({
+          type: "idp_backchannel_logout",
+          invokedById,
+          personId,
+          identityProviderId,
+          success: true,
+          eventData: { sid: claims.sid ?? null, sub: claims.sub ?? null, revokedCount }
+        })
+      );
+    } catch {
+    }
+  }
+}
+export {
+  BackchannelLogoutManager
+};
+//# sourceMappingURL=BackchannelLogoutManager.js.map

package/dist/development/src/model/service/idp/BackchannelLogoutManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackchannelLogoutManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/BackchannelLogoutManager.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { IdentityProviderBySlugQuery } from '../../queries/idp/IdentityProviderBySlugQuery.js'\nimport { IdpSessionBySidRow, IdpSessionsBySidQuery } from '../../queries/idp/IdpSessionsBySidQuery.js'\nimport { IdpSessionsBySubQuery } from '../../queries/idp/IdpSessionsBySubQuery.js'\nimport { ApiKeyByIdQuery } from '../../queries/apiKey/ApiKeyQuery.js'\nimport { DisableApiKeyCommand } from '../../commands/index.js'\nimport { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { IDPValidationError } from './IDPValidationError.js'\n\nexport type BackchannelLogoutResult =\n\t| { status: 'ok'; revokedCount: number }\n\t| { status: 'provider_not_found' }\n\t| { status: 'not_supported' }\n\t| { status: 'invalid_token'; message: string }\n\n/**\n * Handles an incoming OIDC Back-Channel Logout request (A10). Runs entirely on the HTTP auth path\n * (no GraphQL resolver), so — like {@link IdpSessionRevalidator} — it owns its own audit write\n * rather than deferring to a resolver. Flow:\n *   1. resolve the IdP by slug (the back-channel endpoint carries a `?provider=` query param, since\n *      the IdP only knows which client it is calling, not the Contember tenant/provider record);\n *   2. validate the IdP-signed logout token and extract `sid` / `sub`;\n *   3. look up the local federated session(s) the token targets and revoke their api_key(s).\n *\n * A logout token with a `sid` targets that single IdP session; a `sub`-only token (rare — most IdPs\n * send a `sid`) targets *all* of that subject's federated sessions under the provider. Either way, a\n * token that matches no live session is reported as `revokedCount: 0` and audited, not failed.\n */\nexport class BackchannelLogoutManager {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync logout(db: DatabaseContext, providerSlug: string, logoutToken: string): Promise<BackchannelLogoutResult> {\n\t\tconst provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(providerSlug))\n\t\tif (!provider) {\n\t\t\treturn { status: 'provider_not_found' }\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(provider.type)\n\t\tif (!handler?.validateLogoutToken) {\n\t\t\treturn { status: 'not_supported' }\n\t\t}\n\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(provider.configuration)\n\t\t} catch (e) {\n\t\t\treturn { status: 'invalid_token', message: 'IdP configuration is invalid' }\n\t\t}\n\n\t\tlet claims: { sid?: string; sub?: string }\n\t\ttry {\n\t\t\tclaims = await handler.validateLogoutToken(config, logoutToken)\n\t\t} catch (e) {\n\t\t\treturn { status: 'invalid_token', message: e instanceof IDPValidationError ? e.message : 'Invalid logout token' }\n\t\t}\n\n\t\tconst sessions = await this.resolveTargetSessions(db, provider.id, claims)\n\t\tlet revokedCount = 0\n\t\tfor (const session of sessions) {\n\t\t\tconst disabled = await db.commandBus.execute(new DisableApiKeyCommand(session.apiKeyId))\n\t\t\tif (disabled) {\n\t\t\t\trevokedCount++\n\t\t\t}\n\t\t}\n\n\t\tawait this.audit(db, provider.id, claims, revokedCount, sessions[0]?.apiKeyId)\n\n\t\treturn { status: 'ok', revokedCount }\n\t}\n\n\tprivate async resolveTargetSessions(\n\t\tdb: DatabaseContext,\n\t\tidentityProviderId: string,\n\t\tclaims: { sid?: string; sub?: string },\n\t): Promise<IdpSessionBySidRow[]> {\n\t\t// Prefer `sid` (targets one session); fall back to `sub` (targets all the subject's sessions).\n\t\tif (claims.sid) {\n\t\t\treturn db.queryHandler.fetch(new IdpSessionsBySidQuery(identityProviderId, claims.sid))\n\t\t}\n\t\tif (claims.sub) {\n\t\t\treturn db.queryHandler.fetch(new IdpSessionsBySubQuery(identityProviderId, claims.sub))\n\t\t}\n\t\treturn []\n\t}\n\n\tprivate async audit(\n\t\tdb: DatabaseContext,\n\t\tidentityProviderId: string,\n\t\tclaims: { sid?: string; sub?: string },\n\t\trevokedCount: number,\n\t\ttargetApiKeyId: string | undefined,\n\t): Promise<void> {\n\t\t// Resolve the affected identity for the audit `invoked_by_id` from a targeted session, when\n\t\t// one resolves. Otherwise leave it unset (→ NULL) — the provider id is NOT a valid identity id\n\t\t// and inserting it would violate the `invoked_by_id` FK (the provider is recorded separately\n\t\t// in `identity_provider_id`).\n\t\tlet invokedById: string | undefined\n\t\tlet personId: string | undefined\n\t\tif (targetApiKeyId) {\n\t\t\tconst apiKeyRow = await db.queryHandler.fetch(new ApiKeyByIdQuery(targetApiKeyId))\n\t\t\tif (apiKeyRow) {\n\t\t\t\tinvokedById = apiKeyRow.identity_id\n\t\t\t\tpersonId = apiKeyRow.person_id ?? undefined\n\t\t\t}\n\t\t}\n\n\t\ttry {\n\t\t\tawait db.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_backchannel_logout',\n\t\t\t\t\tinvokedById,\n\t\t\t\t\tpersonId,\n\t\t\t\t\tidentityProviderId,\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\teventData: { sid: claims.sid ?? null, sub: claims.sub ?? null, revokedCount },\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort observability — never fail the logout because the audit write failed\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;AA6BO,MAAM,yBAAyB;AAAA,EACrC,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,IAAqB,cAAsB,aAAuD;AAC9G,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAI,4BAA4B,YAAY,CAAC;AAC1F,QAAI,CAAC,UAAU;AACd,aAAO,EAAE,QAAQ,qBAAA;AAAA,IAClB;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,SAAS,IAAI;AAC/D,QAAI,CAAC,SAAS,qBAAqB;AAClC,aAAO,EAAE,QAAQ,gBAAA;AAAA,IAClB;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,SAAS,aAAa;AAAA,IAC9D,SAAS,GAAG;AACX,aAAO,EAAE,QAAQ,iBAAiB,SAAS,+BAAA;AAAA,IAC5C;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,oBAAoB,QAAQ,WAAW;AAAA,IAC/D,SAAS,GAAG;AACX,aAAO,EAAE,QAAQ,iBAAiB,SAAS,aAAa,qBAAqB,EAAE,UAAU,uBAAA;AAAA,IAC1F;AAEA,UAAM,WAAW,MAAM,KAAK,sBAAsB,IAAI,SAAS,IAAI,MAAM;AACzE,QAAI,eAAe;AACnB,eAAW,WAAW,UAAU;AAC/B,YAAM,WAAW,MAAM,GAAG,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,QAAQ,CAAC;AACvF,UAAI,UAAU;AACb;AAAA,MACD;AAAA,IACD;AAEA,UAAM,KAAK,MAAM,IAAI,SAAS,IAAI,QAAQ,cAAc,SAAS,CAAC,GAAG,QAAQ;AAE7E,WAAO,EAAE,QAAQ,MAAM,aAAA;AAAA,EACxB;AAAA,EAEA,MAAc,sBACb,IACA,oBACA,QACgC;AAEhC,QAAI,OAAO,KAAK;AACf,aAAO,GAAG,aAAa,MAAM,IAAI,sBAAsB,oBAAoB,OAAO,GAAG,CAAC;AAAA,IACvF;AACA,QAAI,OAAO,KAAK;AACf,aAAO,GAAG,aAAa,MAAM,IAAI,sBAAsB,oBAAoB,OAAO,GAAG,CAAC;AAAA,IACvF;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAc,MACb,IACA,oBACA,QACA,cACA,gBACgB;AAKhB,QAAI;AACJ,QAAI;AACJ,QAAI,gBAAgB;AACnB,YAAM,YAAY,MAAM,GAAG,aAAa,MAAM,IAAI,gBAAgB,cAAc,CAAC;AACjF,UAAI,WAAW;AACd,sBAAc,UAAU;AACxB,mBAAW,UAAU,aAAa;AAAA,MACnC;AAAA,IACD;AAEA,QAAI;AACH,YAAM,GAAG,WAAW;AAAA,QACnB,IAAI,0BAA0B;AAAA,UAC7B,MAAM;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,WAAW,EAAE,KAAK,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,aAAA;AAAA,QAAa,CAC5E;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AACD;"}

package/dist/development/src/model/service/idp/IDPHandlerRegistry.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IDPHandlerRegistry.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPHandlerRegistry.ts"],"sourcesContent":["import { IdentityProviderHandler } from './IdentityProviderHandler'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError'\n\nexport class IDPHandlerRegistry {\n\tprivate providers: Record<string, IdentityProviderHandler<any>> = {}\n\n\tpublic registerHandler(type: string, provider: IdentityProviderHandler<any>): void {\n\t\tthis.providers[type] = provider\n\t}\n\n\tpublic getHandlerOrNull(type: string): IdentityProviderHandler<{}> | null {\n\t\treturn this.providers[type] ?? null\n\t}\n\n\tpublic getHandler(type: string): IdentityProviderHandler<{}> {\n\t\tconst provider = this.providers[type]\n\t\tif (!provider) {\n\t\t\tthrow new IdentityProviderNotFoundError(`Identity provider handler ${type} not found`)\n\t\t}\n\t\treturn provider\n\t}\n}\n"],"names":["IdentityProviderNotFoundError"],"mappings":";;;;;;AAGO,MAAM,mBAAmB;AAAA,EAAzB,cAAA;AACN,kBAAA,MAAQ,aAA0D,EAAC;AAAA,EAAA;AAAA,EAE5D,gBAAgB,MAAc,UAA8C;AAClF,SAAK,UAAU,IAAI,IAAI;AAAA,EACxB;AAAA,EAEO,iBAAiB,MAAkD;AACzE,WAAO,KAAK,UAAU,IAAI,KAAK;AAAA,EAChC;AAAA,EAEO,WAAW,MAA2C;AAC5D,UAAM,WAAW,KAAK,UAAU,IAAI;AACpC,QAAI,CAAC,UAAU;AACd,YAAM,IAAIA,8BAAAA,8BAA8B,6BAA6B,IAAI,YAAY;AAAA,IACtF;AACA,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"IDPHandlerRegistry.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPHandlerRegistry.ts"],"sourcesContent":["import { IdentityProviderHandler } from './IdentityProviderHandler.js'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError.js'\n\nexport class IDPHandlerRegistry {\n\tprivate providers: Record<string, IdentityProviderHandler<any>> = {}\n\n\tpublic registerHandler(type: string, provider: IdentityProviderHandler<any>): void {\n\t\tthis.providers[type] = provider\n\t}\n\n\tpublic getHandlerOrNull(type: string): IdentityProviderHandler<{}> | null {\n\t\treturn this.providers[type] ?? null\n\t}\n\n\tpublic getHandler(type: string): IdentityProviderHandler<{}> {\n\t\tconst provider = this.providers[type]\n\t\tif (!provider) {\n\t\t\tthrow new IdentityProviderNotFoundError(`Identity provider handler ${type} not found`)\n\t\t}\n\t\treturn provider\n\t}\n}\n"],"names":["IdentityProviderNotFoundError"],"mappings":";;;;;;AAGO,MAAM,mBAAmB;AAAA,EAAzB,cAAA;AACN,kBAAA,MAAQ,aAA0D,EAAC;AAAA,EAAA;AAAA,EAE5D,gBAAgB,MAAc,UAA8C;AAClF,SAAK,UAAU,IAAI,IAAI;AAAA,EACxB;AAAA,EAEO,iBAAiB,MAAkD;AACzE,WAAO,KAAK,UAAU,IAAI,KAAK;AAAA,EAChC;AAAA,EAEO,WAAW,MAA2C;AAC5D,UAAM,WAAW,KAAK,UAAU,IAAI;AACpC,QAAI,CAAC,UAAU;AACd,YAAM,IAAIA,8BAAAA,8BAA8B,6BAA6B,IAAI,YAAY;AAAA,IACtF;AACA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/service/idp/IDPHandlerRegistry.js.map

@@ -1 +1 @@
-{"version":3,"file":"IDPHandlerRegistry.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPHandlerRegistry.ts"],"sourcesContent":["import { IdentityProviderHandler } from './IdentityProviderHandler'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError'\n\nexport class IDPHandlerRegistry {\n\tprivate providers: Record<string, IdentityProviderHandler<any>> = {}\n\n\tpublic registerHandler(type: string, provider: IdentityProviderHandler<any>): void {\n\t\tthis.providers[type] = provider\n\t}\n\n\tpublic getHandlerOrNull(type: string): IdentityProviderHandler<{}> | null {\n\t\treturn this.providers[type] ?? null\n\t}\n\n\tpublic getHandler(type: string): IdentityProviderHandler<{}> {\n\t\tconst provider = this.providers[type]\n\t\tif (!provider) {\n\t\t\tthrow new IdentityProviderNotFoundError(`Identity provider handler ${type} not found`)\n\t\t}\n\t\treturn provider\n\t}\n}\n"],"names":[],"mappings":";;;;AAGO,MAAM,mBAAmB;AAAA,EAAzB,cAAA;AACN,kBAAA,MAAQ,aAA0D,EAAC;AAAA,EAAA;AAAA,EAE5D,gBAAgB,MAAc,UAA8C;AAClF,SAAK,UAAU,IAAI,IAAI;AAAA,EACxB;AAAA,EAEO,iBAAiB,MAAkD;AACzE,WAAO,KAAK,UAAU,IAAI,KAAK;AAAA,EAChC;AAAA,EAEO,WAAW,MAA2C;AAC5D,UAAM,WAAW,KAAK,UAAU,IAAI;AACpC,QAAI,CAAC,UAAU;AACd,YAAM,IAAI,8BAA8B,6BAA6B,IAAI,YAAY;AAAA,IACtF;AACA,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"IDPHandlerRegistry.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPHandlerRegistry.ts"],"sourcesContent":["import { IdentityProviderHandler } from './IdentityProviderHandler.js'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError.js'\n\nexport class IDPHandlerRegistry {\n\tprivate providers: Record<string, IdentityProviderHandler<any>> = {}\n\n\tpublic registerHandler(type: string, provider: IdentityProviderHandler<any>): void {\n\t\tthis.providers[type] = provider\n\t}\n\n\tpublic getHandlerOrNull(type: string): IdentityProviderHandler<{}> | null {\n\t\treturn this.providers[type] ?? null\n\t}\n\n\tpublic getHandler(type: string): IdentityProviderHandler<{}> {\n\t\tconst provider = this.providers[type]\n\t\tif (!provider) {\n\t\t\tthrow new IdentityProviderNotFoundError(`Identity provider handler ${type} not found`)\n\t\t}\n\t\treturn provider\n\t}\n}\n"],"names":[],"mappings":";;;;AAGO,MAAM,mBAAmB;AAAA,EAAzB,cAAA;AACN,kBAAA,MAAQ,aAA0D,EAAC;AAAA,EAAA;AAAA,EAE5D,gBAAgB,MAAc,UAA8C;AAClF,SAAK,UAAU,IAAI,IAAI;AAAA,EACxB;AAAA,EAEO,iBAAiB,MAAkD;AACzE,WAAO,KAAK,UAAU,IAAI,KAAK;AAAA,EAChC;AAAA,EAEO,WAAW,MAA2C;AAC5D,UAAM,WAAW,KAAK,UAAU,IAAI;AACpC,QAAI,CAAC,UAAU;AACd,YAAM,IAAI,8BAA8B,6BAA6B,IAAI,YAAY;AAAA,IACtF;AACA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/service/idp/IDPManager.cjs

@@ -3,6 +3,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Response = require("../../utils/Response.cjs");
 require("../../queries/apiKey/ApiKeyQuery.cjs");
 require("@contember/database");
+require("../../type/ApiKey.cjs");
 const IdentityProviderBySlugQuery = require("../../queries/idp/IdentityProviderBySlugQuery.cjs");
 const IdentityProvidersQuery = require("../../queries/idp/IdentityProvidersQuery.cjs");
 require("../../authorization/PermissionActions.cjs");

package/dist/development/src/model/service/idp/IDPManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IDPManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response'\nimport { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema'\nimport { DatabaseContext } from '../../utils'\nimport { IdentityProviderData } from '../../type'\nimport { IdentityProviderBySlugQuery, IdentityProvidersQuery } from '../../queries'\nimport { CreateIdpCommand } from '../../commands/idp/CreateIdpCommand'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError'\nimport { InvalidIDPConfigurationError } from './InvalidIDPConfigurationError'\nimport { DisableIdpCommand } from '../../commands/idp/DisableIdpCommand'\nimport { EnableIdpCommand } from '../../commands/idp/EnableIdpCommand'\nimport { UpdateIdpCommand, UpdateIdpData } from '../../commands/idp/UpdateIdpCommand'\nimport { IdentityProviderDto } from '../../queries/idp/types'\n\nexport class IDPManager {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {\n\t}\n\n\tpublic async addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse> {\n\t\treturn await db.transaction(async (db): Promise<RegisterIDPResponse> => {\n\t\t\ttry {\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(idp.type)\n\t\t\t\tproviderService.validateConfiguration(idp.configuration)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IdentityProviderNotFoundError) {\n\t\t\t\t\treturn new ResponseError('UNKNOWN_TYPE', `IDP type ${idp.type} not found`)\n\t\t\t\t}\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idp.slug))\n\t\t\tif (existing) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `IDP with slug ${idp.slug} already exists`)\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new CreateIdpCommand(idp))\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async disableIDP(db: DatabaseContext, slug: string): Promise<DisableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (!existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new DisableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async enableIDP(db: DatabaseContext, slug: string): Promise<EnableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new EnableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async updateIDP(db: DatabaseContext, slug: string, data: UpdateIdpData, mergeConfiguration: boolean): Promise<UpdateIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\n\t\t\tconst newConfiguration = (() => {\n\t\t\t\tif (!data.configuration) {\n\t\t\t\t\treturn existing.configuration\n\t\t\t\t}\n\t\t\t\tif (!mergeConfiguration) {\n\t\t\t\t\treturn data.configuration\n\t\t\t\t}\n\n\t\t\t\tconst newConfiguration = { ...existing.configuration }\n\t\t\t\tfor (const [key, value] of Object.entries(data.configuration)) {\n\t\t\t\t\tif (value === null) {\n\t\t\t\t\t\tdelete newConfiguration[key]\n\t\t\t\t\t} else {\n\t\t\t\t\t\tnewConfiguration[key] = value\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\treturn newConfiguration\n\t\t\t})()\n\n\t\t\ttry {\n\t\t\t\tconst type = data.type ?? existing.type\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(type)\n\t\t\t\tif (data.configuration !== undefined || type !== existing.type) {\n\t\t\t\t\tproviderService.validateConfiguration(newConfiguration)\n\t\t\t\t}\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(\n\t\t\t\tnew UpdateIdpCommand(existing.id, {\n\t\t\t\t\t...data,\n\t\t\t\t\tconfiguration: data.configuration ? newConfiguration : undefined,\n\t\t\t\t}),\n\t\t\t)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]> {\n\t\tconst result = await db.queryHandler.fetch(new IdentityProvidersQuery())\n\t\treturn result.map(it => {\n\t\t\tconst providerService = this.idpRegistry.getHandlerOrNull(it.type)\n\t\t\tconst configuration = providerService?.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(it.configuration)\n\t\t\t\t: it.configuration\n\n\t\t\treturn { ...it, configuration }\n\t\t})\n\t}\n}\n\nexport type RegisterIDPResponse = Response<null, AddIdpErrorCode>\nexport type DisableIDPResponse = Response<null, DisableIdpErrorCode>\nexport type EnableIDPResponse = Response<null, EnableIdpErrorCode>\nexport type UpdateIDPResponse = Response<null, UpdateIdpErrorCode>\n"],"names":["db","IdentityProviderNotFoundError","ResponseError","InvalidIDPConfigurationError","IdentityProviderBySlugQuery","CreateIdpCommand","ResponseOk","DisableIdpCommand","EnableIdpCommand","newConfiguration","UpdateIdpCommand","IdentityProvidersQuery"],"mappings":";;;;;;;;;;;;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EAElB;AAAA,EAEA,MAAa,OAAO,IAAqB,KAAyD;AACjG,WAAO,MAAM,GAAG,YAAY,OAAOA,QAAqC;AACvE,UAAI;AACH,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI,IAAI;AAC5D,wBAAgB,sBAAsB,IAAI,aAAa;AAAA,MACxD,SAAS,GAAG;AACX,YAAI,aAAaC,8BAAAA,+BAA+B;AAC/C,iBAAO,IAAIC,SAAAA,cAAc,gBAAgB,YAAY,IAAI,IAAI,YAAY;AAAA,QAC1E;AACA,YAAI,aAAaC,6BAAAA,8BAA8B;AAC9C,iBAAO,IAAID,SAAAA,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAM,WAAW,MAAMF,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,IAAI,CAAC;AACtF,UAAI,UAAU;AACb,eAAO,IAAIF,SAAAA,cAAc,kBAAkB,iBAAiB,IAAI,IAAI,iBAAiB;AAAA,MACtF;AACA,YAAMF,IAAG,WAAW,QAAQ,IAAIK,iBAAAA,iBAAiB,GAAG,CAAC;AACrD,aAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,IAAqB,MAA2C;AACvF,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,CAAC,SAAS,YAAY;AACzB,cAAMF,IAAG,WAAW,QAAQ,IAAIO,kBAAAA,kBAAkB,SAAS,EAAE,CAAC;AAAA,MAC/D;AACA,aAAO,IAAID,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAA0C;AACrF,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,SAAS,YAAY;AACxB,cAAMF,IAAG,WAAW,QAAQ,IAAIQ,iBAAAA,iBAAiB,SAAS,EAAE,CAAC;AAAA,MAC9D;AACA,aAAO,IAAIF,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAAc,MAAqB,oBAAyD;AACvI,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AAEA,YAAM,oBAAoB,MAAM;AAC/B,YAAI,CAAC,KAAK,eAAe;AACxB,iBAAO,SAAS;AAAA,QACjB;AACA,YAAI,CAAC,oBAAoB;AACxB,iBAAO,KAAK;AAAA,QACb;AAEA,cAAMO,oBAAmB,EAAE,GAAG,SAAS,cAAA;AACvC,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,aAAa,GAAG;AAC9D,cAAI,UAAU,MAAM;AACnB,mBAAOA,kBAAiB,GAAG;AAAA,UAC5B,OAAO;AACNA,8BAAiB,GAAG,IAAI;AAAA,UACzB;AAAA,QACD;AAEA,eAAOA;AAAAA,MACR,GAAA;AAEA,UAAI;AACH,cAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI;AACxD,YAAI,KAAK,kBAAkB,UAAa,SAAS,SAAS,MAAM;AAC/D,0BAAgB,sBAAsB,gBAAgB;AAAA,QACvD;AAAA,MACD,SAAS,GAAG;AACX,YAAI,aAAaN,6BAAAA,8BAA8B;AAC9C,iBAAO,IAAID,SAAAA,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAMF,IAAG,WAAW;AAAA,QACnB,IAAIU,iBAAAA,iBAAiB,SAAS,IAAI;AAAA,UACjC,GAAG;AAAA,UACH,eAAe,KAAK,gBAAgB,mBAAmB;AAAA,QAAA,CACvD;AAAA,MAAA;AAGF,aAAO,IAAIJ,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,QAAQ,IAAqD;AACzE,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,IAAIK,uBAAAA,wBAAwB;AACvE,WAAO,OAAO,IAAI,CAAA,OAAM;AACvB,YAAM,kBAAkB,KAAK,YAAY,iBAAiB,GAAG,IAAI;AACjE,YAAM,gBAAgB,iBAAiB,yBACpC,gBAAgB,uBAAuB,GAAG,aAAa,IACvD,GAAG;AAEN,aAAO,EAAE,GAAG,IAAI,cAAA;AAAA,IACjB,CAAC;AAAA,EACF;AACD;;"}
+{"version":3,"file":"IDPManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\nimport { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema/index.js'\nimport { DatabaseContext } from '../../utils/index.js'\nimport { IdentityProviderData } from '../../type/index.js'\nimport { IdentityProviderBySlugQuery, IdentityProvidersQuery } from '../../queries/index.js'\nimport { CreateIdpCommand } from '../../commands/idp/CreateIdpCommand.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError.js'\nimport { InvalidIDPConfigurationError } from './InvalidIDPConfigurationError.js'\nimport { DisableIdpCommand } from '../../commands/idp/DisableIdpCommand.js'\nimport { EnableIdpCommand } from '../../commands/idp/EnableIdpCommand.js'\nimport { UpdateIdpCommand, UpdateIdpData } from '../../commands/idp/UpdateIdpCommand.js'\nimport { IdentityProviderDto } from '../../queries/idp/types.js'\n\nexport class IDPManager {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {\n\t}\n\n\tpublic async addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse> {\n\t\treturn await db.transaction(async (db): Promise<RegisterIDPResponse> => {\n\t\t\ttry {\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(idp.type)\n\t\t\t\tproviderService.validateConfiguration(idp.configuration)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IdentityProviderNotFoundError) {\n\t\t\t\t\treturn new ResponseError('UNKNOWN_TYPE', `IDP type ${idp.type} not found`)\n\t\t\t\t}\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idp.slug))\n\t\t\tif (existing) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `IDP with slug ${idp.slug} already exists`)\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new CreateIdpCommand(idp))\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async disableIDP(db: DatabaseContext, slug: string): Promise<DisableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (!existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new DisableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async enableIDP(db: DatabaseContext, slug: string): Promise<EnableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new EnableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async updateIDP(db: DatabaseContext, slug: string, data: UpdateIdpData, mergeConfiguration: boolean): Promise<UpdateIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\n\t\t\tconst newConfiguration = (() => {\n\t\t\t\tif (!data.configuration) {\n\t\t\t\t\treturn existing.configuration\n\t\t\t\t}\n\t\t\t\tif (!mergeConfiguration) {\n\t\t\t\t\treturn data.configuration\n\t\t\t\t}\n\n\t\t\t\tconst newConfiguration = { ...existing.configuration }\n\t\t\t\tfor (const [key, value] of Object.entries(data.configuration)) {\n\t\t\t\t\tif (value === null) {\n\t\t\t\t\t\tdelete newConfiguration[key]\n\t\t\t\t\t} else {\n\t\t\t\t\t\tnewConfiguration[key] = value\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\treturn newConfiguration\n\t\t\t})()\n\n\t\t\ttry {\n\t\t\t\tconst type = data.type ?? existing.type\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(type)\n\t\t\t\tif (data.configuration !== undefined || type !== existing.type) {\n\t\t\t\t\tproviderService.validateConfiguration(newConfiguration)\n\t\t\t\t}\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(\n\t\t\t\tnew UpdateIdpCommand(existing.id, {\n\t\t\t\t\t...data,\n\t\t\t\t\tconfiguration: data.configuration ? newConfiguration : undefined,\n\t\t\t\t}),\n\t\t\t)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]> {\n\t\tconst result = await db.queryHandler.fetch(new IdentityProvidersQuery())\n\t\treturn result.map(it => {\n\t\t\tconst providerService = this.idpRegistry.getHandlerOrNull(it.type)\n\t\t\tconst configuration = providerService?.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(it.configuration)\n\t\t\t\t: it.configuration\n\n\t\t\treturn { ...it, configuration }\n\t\t})\n\t}\n}\n\nexport type RegisterIDPResponse = Response<null, AddIdpErrorCode>\nexport type DisableIDPResponse = Response<null, DisableIdpErrorCode>\nexport type EnableIDPResponse = Response<null, EnableIdpErrorCode>\nexport type UpdateIDPResponse = Response<null, UpdateIdpErrorCode>\n"],"names":["db","IdentityProviderNotFoundError","ResponseError","InvalidIDPConfigurationError","IdentityProviderBySlugQuery","CreateIdpCommand","ResponseOk","DisableIdpCommand","EnableIdpCommand","newConfiguration","UpdateIdpCommand","IdentityProvidersQuery"],"mappings":";;;;;;;;;;;;;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EAElB;AAAA,EAEA,MAAa,OAAO,IAAqB,KAAyD;AACjG,WAAO,MAAM,GAAG,YAAY,OAAOA,QAAqC;AACvE,UAAI;AACH,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI,IAAI;AAC5D,wBAAgB,sBAAsB,IAAI,aAAa;AAAA,MACxD,SAAS,GAAG;AACX,YAAI,aAAaC,8BAAAA,+BAA+B;AAC/C,iBAAO,IAAIC,SAAAA,cAAc,gBAAgB,YAAY,IAAI,IAAI,YAAY;AAAA,QAC1E;AACA,YAAI,aAAaC,6BAAAA,8BAA8B;AAC9C,iBAAO,IAAID,SAAAA,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAM,WAAW,MAAMF,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,IAAI,CAAC;AACtF,UAAI,UAAU;AACb,eAAO,IAAIF,SAAAA,cAAc,kBAAkB,iBAAiB,IAAI,IAAI,iBAAiB;AAAA,MACtF;AACA,YAAMF,IAAG,WAAW,QAAQ,IAAIK,iBAAAA,iBAAiB,GAAG,CAAC;AACrD,aAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,IAAqB,MAA2C;AACvF,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,CAAC,SAAS,YAAY;AACzB,cAAMF,IAAG,WAAW,QAAQ,IAAIO,kBAAAA,kBAAkB,SAAS,EAAE,CAAC;AAAA,MAC/D;AACA,aAAO,IAAID,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAA0C;AACrF,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,SAAS,YAAY;AACxB,cAAMF,IAAG,WAAW,QAAQ,IAAIQ,iBAAAA,iBAAiB,SAAS,EAAE,CAAC;AAAA,MAC9D;AACA,aAAO,IAAIF,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAAc,MAAqB,oBAAyD;AACvI,WAAO,MAAM,GAAG,YAAY,OAAMN,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAII,4BAAAA,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAIF,SAAAA,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AAEA,YAAM,oBAAoB,MAAM;AAC/B,YAAI,CAAC,KAAK,eAAe;AACxB,iBAAO,SAAS;AAAA,QACjB;AACA,YAAI,CAAC,oBAAoB;AACxB,iBAAO,KAAK;AAAA,QACb;AAEA,cAAMO,oBAAmB,EAAE,GAAG,SAAS,cAAA;AACvC,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,aAAa,GAAG;AAC9D,cAAI,UAAU,MAAM;AACnB,mBAAOA,kBAAiB,GAAG;AAAA,UAC5B,OAAO;AACNA,8BAAiB,GAAG,IAAI;AAAA,UACzB;AAAA,QACD;AAEA,eAAOA;AAAAA,MACR,GAAA;AAEA,UAAI;AACH,cAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI;AACxD,YAAI,KAAK,kBAAkB,UAAa,SAAS,SAAS,MAAM;AAC/D,0BAAgB,sBAAsB,gBAAgB;AAAA,QACvD;AAAA,MACD,SAAS,GAAG;AACX,YAAI,aAAaN,6BAAAA,8BAA8B;AAC9C,iBAAO,IAAID,SAAAA,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAMF,IAAG,WAAW;AAAA,QACnB,IAAIU,iBAAAA,iBAAiB,SAAS,IAAI;AAAA,UACjC,GAAG;AAAA,UACH,eAAe,KAAK,gBAAgB,mBAAmB;AAAA,QAAA,CACvD;AAAA,MAAA;AAGF,aAAO,IAAIJ,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,QAAQ,IAAqD;AACzE,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,IAAIK,uBAAAA,wBAAwB;AACvE,WAAO,OAAO,IAAI,CAAA,OAAM;AACvB,YAAM,kBAAkB,KAAK,YAAY,iBAAiB,GAAG,IAAI;AACjE,YAAM,gBAAgB,iBAAiB,yBACpC,gBAAgB,uBAAuB,GAAG,aAAa,IACvD,GAAG;AAEN,aAAO,EAAE,GAAG,IAAI,cAAA;AAAA,IACjB,CAAC;AAAA,EACF;AACD;;"}

package/dist/development/src/model/service/idp/IDPManager.js

@@ -1,6 +1,7 @@
 import { ResponseError, ResponseOk } from "../../utils/Response.js";
 import "../../queries/apiKey/ApiKeyQuery.js";
 import "@contember/database";
+import "../../type/ApiKey.js";
 import { IdentityProviderBySlugQuery } from "../../queries/idp/IdentityProviderBySlugQuery.js";
 import { IdentityProvidersQuery } from "../../queries/idp/IdentityProvidersQuery.js";
 import "../../authorization/PermissionActions.js";

package/dist/development/src/model/service/idp/IDPManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"IDPManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response'\nimport { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema'\nimport { DatabaseContext } from '../../utils'\nimport { IdentityProviderData } from '../../type'\nimport { IdentityProviderBySlugQuery, IdentityProvidersQuery } from '../../queries'\nimport { CreateIdpCommand } from '../../commands/idp/CreateIdpCommand'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError'\nimport { InvalidIDPConfigurationError } from './InvalidIDPConfigurationError'\nimport { DisableIdpCommand } from '../../commands/idp/DisableIdpCommand'\nimport { EnableIdpCommand } from '../../commands/idp/EnableIdpCommand'\nimport { UpdateIdpCommand, UpdateIdpData } from '../../commands/idp/UpdateIdpCommand'\nimport { IdentityProviderDto } from '../../queries/idp/types'\n\nexport class IDPManager {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {\n\t}\n\n\tpublic async addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse> {\n\t\treturn await db.transaction(async (db): Promise<RegisterIDPResponse> => {\n\t\t\ttry {\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(idp.type)\n\t\t\t\tproviderService.validateConfiguration(idp.configuration)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IdentityProviderNotFoundError) {\n\t\t\t\t\treturn new ResponseError('UNKNOWN_TYPE', `IDP type ${idp.type} not found`)\n\t\t\t\t}\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idp.slug))\n\t\t\tif (existing) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `IDP with slug ${idp.slug} already exists`)\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new CreateIdpCommand(idp))\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async disableIDP(db: DatabaseContext, slug: string): Promise<DisableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (!existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new DisableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async enableIDP(db: DatabaseContext, slug: string): Promise<EnableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new EnableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async updateIDP(db: DatabaseContext, slug: string, data: UpdateIdpData, mergeConfiguration: boolean): Promise<UpdateIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\n\t\t\tconst newConfiguration = (() => {\n\t\t\t\tif (!data.configuration) {\n\t\t\t\t\treturn existing.configuration\n\t\t\t\t}\n\t\t\t\tif (!mergeConfiguration) {\n\t\t\t\t\treturn data.configuration\n\t\t\t\t}\n\n\t\t\t\tconst newConfiguration = { ...existing.configuration }\n\t\t\t\tfor (const [key, value] of Object.entries(data.configuration)) {\n\t\t\t\t\tif (value === null) {\n\t\t\t\t\t\tdelete newConfiguration[key]\n\t\t\t\t\t} else {\n\t\t\t\t\t\tnewConfiguration[key] = value\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\treturn newConfiguration\n\t\t\t})()\n\n\t\t\ttry {\n\t\t\t\tconst type = data.type ?? existing.type\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(type)\n\t\t\t\tif (data.configuration !== undefined || type !== existing.type) {\n\t\t\t\t\tproviderService.validateConfiguration(newConfiguration)\n\t\t\t\t}\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(\n\t\t\t\tnew UpdateIdpCommand(existing.id, {\n\t\t\t\t\t...data,\n\t\t\t\t\tconfiguration: data.configuration ? newConfiguration : undefined,\n\t\t\t\t}),\n\t\t\t)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]> {\n\t\tconst result = await db.queryHandler.fetch(new IdentityProvidersQuery())\n\t\treturn result.map(it => {\n\t\t\tconst providerService = this.idpRegistry.getHandlerOrNull(it.type)\n\t\t\tconst configuration = providerService?.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(it.configuration)\n\t\t\t\t: it.configuration\n\n\t\t\treturn { ...it, configuration }\n\t\t})\n\t}\n}\n\nexport type RegisterIDPResponse = Response<null, AddIdpErrorCode>\nexport type DisableIDPResponse = Response<null, DisableIdpErrorCode>\nexport type EnableIDPResponse = Response<null, EnableIdpErrorCode>\nexport type UpdateIDPResponse = Response<null, UpdateIdpErrorCode>\n"],"names":["db","newConfiguration"],"mappings":";;;;;;;;;;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EAElB;AAAA,EAEA,MAAa,OAAO,IAAqB,KAAyD;AACjG,WAAO,MAAM,GAAG,YAAY,OAAOA,QAAqC;AACvE,UAAI;AACH,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI,IAAI;AAC5D,wBAAgB,sBAAsB,IAAI,aAAa;AAAA,MACxD,SAAS,GAAG;AACX,YAAI,aAAa,+BAA+B;AAC/C,iBAAO,IAAI,cAAc,gBAAgB,YAAY,IAAI,IAAI,YAAY;AAAA,QAC1E;AACA,YAAI,aAAa,8BAA8B;AAC9C,iBAAO,IAAI,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,IAAI,CAAC;AACtF,UAAI,UAAU;AACb,eAAO,IAAI,cAAc,kBAAkB,iBAAiB,IAAI,IAAI,iBAAiB;AAAA,MACtF;AACA,YAAMA,IAAG,WAAW,QAAQ,IAAI,iBAAiB,GAAG,CAAC;AACrD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,IAAqB,MAA2C;AACvF,WAAO,MAAM,GAAG,YAAY,OAAMA,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAI,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,CAAC,SAAS,YAAY;AACzB,cAAMA,IAAG,WAAW,QAAQ,IAAI,kBAAkB,SAAS,EAAE,CAAC;AAAA,MAC/D;AACA,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAA0C;AACrF,WAAO,MAAM,GAAG,YAAY,OAAMA,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAI,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,SAAS,YAAY;AACxB,cAAMA,IAAG,WAAW,QAAQ,IAAI,iBAAiB,SAAS,EAAE,CAAC;AAAA,MAC9D;AACA,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAAc,MAAqB,oBAAyD;AACvI,WAAO,MAAM,GAAG,YAAY,OAAMA,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAI,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AAEA,YAAM,oBAAoB,MAAM;AAC/B,YAAI,CAAC,KAAK,eAAe;AACxB,iBAAO,SAAS;AAAA,QACjB;AACA,YAAI,CAAC,oBAAoB;AACxB,iBAAO,KAAK;AAAA,QACb;AAEA,cAAMC,oBAAmB,EAAE,GAAG,SAAS,cAAA;AACvC,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,aAAa,GAAG;AAC9D,cAAI,UAAU,MAAM;AACnB,mBAAOA,kBAAiB,GAAG;AAAA,UAC5B,OAAO;AACNA,8BAAiB,GAAG,IAAI;AAAA,UACzB;AAAA,QACD;AAEA,eAAOA;AAAAA,MACR,GAAA;AAEA,UAAI;AACH,cAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI;AACxD,YAAI,KAAK,kBAAkB,UAAa,SAAS,SAAS,MAAM;AAC/D,0BAAgB,sBAAsB,gBAAgB;AAAA,QACvD;AAAA,MACD,SAAS,GAAG;AACX,YAAI,aAAa,8BAA8B;AAC9C,iBAAO,IAAI,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAMD,IAAG,WAAW;AAAA,QACnB,IAAI,iBAAiB,SAAS,IAAI;AAAA,UACjC,GAAG;AAAA,UACH,eAAe,KAAK,gBAAgB,mBAAmB;AAAA,QAAA,CACvD;AAAA,MAAA;AAGF,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,QAAQ,IAAqD;AACzE,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,IAAI,wBAAwB;AACvE,WAAO,OAAO,IAAI,CAAA,OAAM;AACvB,YAAM,kBAAkB,KAAK,YAAY,iBAAiB,GAAG,IAAI;AACjE,YAAM,gBAAgB,iBAAiB,yBACpC,gBAAgB,uBAAuB,GAAG,aAAa,IACvD,GAAG;AAEN,aAAO,EAAE,GAAG,IAAI,cAAA;AAAA,IACjB,CAAC;AAAA,EACF;AACD;"}
+{"version":3,"file":"IDPManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\nimport { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErrorCode } from '../../../schema/index.js'\nimport { DatabaseContext } from '../../utils/index.js'\nimport { IdentityProviderData } from '../../type/index.js'\nimport { IdentityProviderBySlugQuery, IdentityProvidersQuery } from '../../queries/index.js'\nimport { CreateIdpCommand } from '../../commands/idp/CreateIdpCommand.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { IdentityProviderNotFoundError } from './IdentityProviderNotFoundError.js'\nimport { InvalidIDPConfigurationError } from './InvalidIDPConfigurationError.js'\nimport { DisableIdpCommand } from '../../commands/idp/DisableIdpCommand.js'\nimport { EnableIdpCommand } from '../../commands/idp/EnableIdpCommand.js'\nimport { UpdateIdpCommand, UpdateIdpData } from '../../commands/idp/UpdateIdpCommand.js'\nimport { IdentityProviderDto } from '../../queries/idp/types.js'\n\nexport class IDPManager {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {\n\t}\n\n\tpublic async addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse> {\n\t\treturn await db.transaction(async (db): Promise<RegisterIDPResponse> => {\n\t\t\ttry {\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(idp.type)\n\t\t\t\tproviderService.validateConfiguration(idp.configuration)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IdentityProviderNotFoundError) {\n\t\t\t\t\treturn new ResponseError('UNKNOWN_TYPE', `IDP type ${idp.type} not found`)\n\t\t\t\t}\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idp.slug))\n\t\t\tif (existing) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `IDP with slug ${idp.slug} already exists`)\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new CreateIdpCommand(idp))\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async disableIDP(db: DatabaseContext, slug: string): Promise<DisableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (!existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new DisableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async enableIDP(db: DatabaseContext, slug: string): Promise<EnableIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\t\t\tif (existing.disabledAt) {\n\t\t\t\tawait db.commandBus.execute(new EnableIdpCommand(existing.id))\n\t\t\t}\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async updateIDP(db: DatabaseContext, slug: string, data: UpdateIdpData, mergeConfiguration: boolean): Promise<UpdateIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst existing = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(slug))\n\t\t\tif (!existing) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `IDP ${slug} not found`)\n\t\t\t}\n\n\t\t\tconst newConfiguration = (() => {\n\t\t\t\tif (!data.configuration) {\n\t\t\t\t\treturn existing.configuration\n\t\t\t\t}\n\t\t\t\tif (!mergeConfiguration) {\n\t\t\t\t\treturn data.configuration\n\t\t\t\t}\n\n\t\t\t\tconst newConfiguration = { ...existing.configuration }\n\t\t\t\tfor (const [key, value] of Object.entries(data.configuration)) {\n\t\t\t\t\tif (value === null) {\n\t\t\t\t\t\tdelete newConfiguration[key]\n\t\t\t\t\t} else {\n\t\t\t\t\t\tnewConfiguration[key] = value\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\treturn newConfiguration\n\t\t\t})()\n\n\t\t\ttry {\n\t\t\t\tconst type = data.type ?? existing.type\n\t\t\t\tconst providerService = this.idpRegistry.getHandler(type)\n\t\t\t\tif (data.configuration !== undefined || type !== existing.type) {\n\t\t\t\t\tproviderService.validateConfiguration(newConfiguration)\n\t\t\t\t}\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof InvalidIDPConfigurationError) {\n\t\t\t\t\treturn new ResponseError('INVALID_CONFIGURATION', `Invalid IDP configuration: ${e.message}`)\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(\n\t\t\t\tnew UpdateIdpCommand(existing.id, {\n\t\t\t\t\t...data,\n\t\t\t\t\tconfiguration: data.configuration ? newConfiguration : undefined,\n\t\t\t\t}),\n\t\t\t)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tpublic async listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]> {\n\t\tconst result = await db.queryHandler.fetch(new IdentityProvidersQuery())\n\t\treturn result.map(it => {\n\t\t\tconst providerService = this.idpRegistry.getHandlerOrNull(it.type)\n\t\t\tconst configuration = providerService?.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(it.configuration)\n\t\t\t\t: it.configuration\n\n\t\t\treturn { ...it, configuration }\n\t\t})\n\t}\n}\n\nexport type RegisterIDPResponse = Response<null, AddIdpErrorCode>\nexport type DisableIDPResponse = Response<null, DisableIdpErrorCode>\nexport type EnableIDPResponse = Response<null, EnableIdpErrorCode>\nexport type UpdateIDPResponse = Response<null, UpdateIdpErrorCode>\n"],"names":["db","newConfiguration"],"mappings":";;;;;;;;;;;;;;;;;AAcO,MAAM,WAAW;AAAA,EACvB,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EAElB;AAAA,EAEA,MAAa,OAAO,IAAqB,KAAyD;AACjG,WAAO,MAAM,GAAG,YAAY,OAAOA,QAAqC;AACvE,UAAI;AACH,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI,IAAI;AAC5D,wBAAgB,sBAAsB,IAAI,aAAa;AAAA,MACxD,SAAS,GAAG;AACX,YAAI,aAAa,+BAA+B;AAC/C,iBAAO,IAAI,cAAc,gBAAgB,YAAY,IAAI,IAAI,YAAY;AAAA,QAC1E;AACA,YAAI,aAAa,8BAA8B;AAC9C,iBAAO,IAAI,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,IAAI,CAAC;AACtF,UAAI,UAAU;AACb,eAAO,IAAI,cAAc,kBAAkB,iBAAiB,IAAI,IAAI,iBAAiB;AAAA,MACtF;AACA,YAAMA,IAAG,WAAW,QAAQ,IAAI,iBAAiB,GAAG,CAAC;AACrD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,IAAqB,MAA2C;AACvF,WAAO,MAAM,GAAG,YAAY,OAAMA,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAI,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,CAAC,SAAS,YAAY;AACzB,cAAMA,IAAG,WAAW,QAAQ,IAAI,kBAAkB,SAAS,EAAE,CAAC;AAAA,MAC/D;AACA,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAA0C;AACrF,WAAO,MAAM,GAAG,YAAY,OAAMA,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAI,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AACA,UAAI,SAAS,YAAY;AACxB,cAAMA,IAAG,WAAW,QAAQ,IAAI,iBAAiB,SAAS,EAAE,CAAC;AAAA,MAC9D;AACA,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,UAAU,IAAqB,MAAc,MAAqB,oBAAyD;AACvI,WAAO,MAAM,GAAG,YAAY,OAAMA,QAAM;AACvC,YAAM,WAAW,MAAMA,IAAG,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAClF,UAAI,CAAC,UAAU;AACd,eAAO,IAAI,cAAc,aAAa,OAAO,IAAI,YAAY;AAAA,MAC9D;AAEA,YAAM,oBAAoB,MAAM;AAC/B,YAAI,CAAC,KAAK,eAAe;AACxB,iBAAO,SAAS;AAAA,QACjB;AACA,YAAI,CAAC,oBAAoB;AACxB,iBAAO,KAAK;AAAA,QACb;AAEA,cAAMC,oBAAmB,EAAE,GAAG,SAAS,cAAA;AACvC,mBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,KAAK,aAAa,GAAG;AAC9D,cAAI,UAAU,MAAM;AACnB,mBAAOA,kBAAiB,GAAG;AAAA,UAC5B,OAAO;AACNA,8BAAiB,GAAG,IAAI;AAAA,UACzB;AAAA,QACD;AAEA,eAAOA;AAAAA,MACR,GAAA;AAEA,UAAI;AACH,cAAM,OAAO,KAAK,QAAQ,SAAS;AACnC,cAAM,kBAAkB,KAAK,YAAY,WAAW,IAAI;AACxD,YAAI,KAAK,kBAAkB,UAAa,SAAS,SAAS,MAAM;AAC/D,0BAAgB,sBAAsB,gBAAgB;AAAA,QACvD;AAAA,MACD,SAAS,GAAG;AACX,YAAI,aAAa,8BAA8B;AAC9C,iBAAO,IAAI,cAAc,yBAAyB,8BAA8B,EAAE,OAAO,EAAE;AAAA,QAC5F;AACA,cAAM;AAAA,MACP;AAEA,YAAMD,IAAG,WAAW;AAAA,QACnB,IAAI,iBAAiB,SAAS,IAAI;AAAA,UACjC,GAAG;AAAA,UACH,eAAe,KAAK,gBAAgB,mBAAmB;AAAA,QAAA,CACvD;AAAA,MAAA;AAGF,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,QAAQ,IAAqD;AACzE,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,IAAI,wBAAwB;AACvE,WAAO,OAAO,IAAI,CAAA,OAAM;AACvB,YAAM,kBAAkB,KAAK,YAAY,iBAAiB,GAAG,IAAI;AACjE,YAAM,gBAAgB,iBAAiB,yBACpC,gBAAgB,uBAAuB,GAAG,aAAa,IACvD,GAAG;AAEN,aAAO,EAAE,GAAG,IAAI,cAAA;AAAA,IACjB,CAAC;AAAA,EACF;AACD;"}

package/dist/development/src/model/service/idp/IDPRevalidation.cjs

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Typesafe = require("@contember/typesafe");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
+const IDPRevalidationConfig = Typesafe__namespace.partial({
+  enabled: Typesafe__namespace.boolean,
+  /**
+   * Fraction (0–1) of the access-token lifetime after which a proactive background (SWR)
+   * refresh starts — e.g. 0.5 = refresh once the token is half-expired. Default 0.5.
+   */
+  softRefreshThreshold: Typesafe__namespace.number,
+  /**
+   * Single-flight floor as a Postgres interval string: the minimum gap between revalidation
+   * attempts, so a burst of requests past the threshold triggers only one refresh.
+   * Default "10 seconds".
+   */
+  minInterval: Typesafe__namespace.string,
+  /**
+   * Throttle used when the IdP returns no token expiry (so the lifetime-based cadence can't
+   * apply), as a Postgres interval string. Default "5 minutes".
+   */
+  fallbackInterval: Typesafe__namespace.string,
+  /**
+   * `auto` (default): SWR/background before expiry, blocking once expired. `blocking`: always
+   * synchronous (zero revocation lag, at the cost of latency on the revalidation tick).
+   */
+  mode: Typesafe__namespace.enumeration("auto", "blocking"),
+  /** What to do when the IdP reports the session as gone. Currently only `revoke`. */
+  onFailure: Typesafe__namespace.enumeration("revoke")
+});
+const REVALIDATION_DEFAULT_SOFT_THRESHOLD = 0.5;
+const REVALIDATION_DEFAULT_MIN_INTERVAL = "10 seconds";
+const REVALIDATION_DEFAULT_FALLBACK_INTERVAL = "5 minutes";
+exports.IDPRevalidationConfig = IDPRevalidationConfig;
+exports.REVALIDATION_DEFAULT_FALLBACK_INTERVAL = REVALIDATION_DEFAULT_FALLBACK_INTERVAL;
+exports.REVALIDATION_DEFAULT_MIN_INTERVAL = REVALIDATION_DEFAULT_MIN_INTERVAL;
+exports.REVALIDATION_DEFAULT_SOFT_THRESHOLD = REVALIDATION_DEFAULT_SOFT_THRESHOLD;
+//# sourceMappingURL=IDPRevalidation.cjs.map

package/dist/development/src/model/service/idp/IDPRevalidation.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPRevalidation.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPRevalidation.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\n\n/**\n * Provider-agnostic re-validation settings, stored on an IdP's `configuration.revalidation`.\n * Read both by the provider (to decide whether to capture session state at sign-in) and by\n * the generic verify hook (`ApiKeyManager.verifyAndProlong`) to drive re-validation.\n *\n * The cadence is driven by the **access-token lifetime**, not a fixed interval: while the\n * token is fresh the session is vouched-for and nothing happens; past `softRefreshThreshold`\n * of its lifetime a proactive background (SWR) refresh kicks in; once the token has actually\n * expired the refresh becomes blocking. See {@link IdpSessionRevalidator}.\n *\n * All fields optional; absent / `enabled: false` reproduces the pre-A24 behaviour exactly.\n */\nexport const IDPRevalidationConfig = Typesafe.partial({\n\tenabled: Typesafe.boolean,\n\t/**\n\t * Fraction (0–1) of the access-token lifetime after which a proactive background (SWR)\n\t * refresh starts — e.g. 0.5 = refresh once the token is half-expired. Default 0.5.\n\t */\n\tsoftRefreshThreshold: Typesafe.number,\n\t/**\n\t * Single-flight floor as a Postgres interval string: the minimum gap between revalidation\n\t * attempts, so a burst of requests past the threshold triggers only one refresh.\n\t * Default \"10 seconds\".\n\t */\n\tminInterval: Typesafe.string,\n\t/**\n\t * Throttle used when the IdP returns no token expiry (so the lifetime-based cadence can't\n\t * apply), as a Postgres interval string. Default \"5 minutes\".\n\t */\n\tfallbackInterval: Typesafe.string,\n\t/**\n\t * `auto` (default): SWR/background before expiry, blocking once expired. `blocking`: always\n\t * synchronous (zero revocation lag, at the cost of latency on the revalidation tick).\n\t */\n\tmode: Typesafe.enumeration('auto', 'blocking'),\n\t/** What to do when the IdP reports the session as gone. Currently only `revoke`. */\n\tonFailure: Typesafe.enumeration('revoke'),\n})\n\nexport type IDPRevalidationConfig = ReturnType<typeof IDPRevalidationConfig>\n\nexport const REVALIDATION_DEFAULT_SOFT_THRESHOLD = 0.5\nexport const REVALIDATION_DEFAULT_MIN_INTERVAL = '10 seconds'\nexport const REVALIDATION_DEFAULT_FALLBACK_INTERVAL = '5 minutes'\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AAcO,MAAM,wBAAwBA,oBAAS,QAAQ;AAAA,EACrD,SAASA,oBAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlB,sBAAsBA,oBAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/B,aAAaA,oBAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB,kBAAkBA,oBAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3B,MAAMA,oBAAS,YAAY,QAAQ,UAAU;AAAA;AAAA,EAE7C,WAAWA,oBAAS,YAAY,QAAQ;AACzC,CAAC;AAIM,MAAM,sCAAsC;AAC5C,MAAM,oCAAoC;AAC1C,MAAM,yCAAyC;;;;;"}