@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/development/src/model/service/idp/IDPRevalidation.js

@@ -0,0 +1,37 @@
+import * as Typesafe from "@contember/typesafe";
+const IDPRevalidationConfig = Typesafe.partial({
+  enabled: Typesafe.boolean,
+  /**
+   * Fraction (0–1) of the access-token lifetime after which a proactive background (SWR)
+   * refresh starts — e.g. 0.5 = refresh once the token is half-expired. Default 0.5.
+   */
+  softRefreshThreshold: Typesafe.number,
+  /**
+   * Single-flight floor as a Postgres interval string: the minimum gap between revalidation
+   * attempts, so a burst of requests past the threshold triggers only one refresh.
+   * Default "10 seconds".
+   */
+  minInterval: Typesafe.string,
+  /**
+   * Throttle used when the IdP returns no token expiry (so the lifetime-based cadence can't
+   * apply), as a Postgres interval string. Default "5 minutes".
+   */
+  fallbackInterval: Typesafe.string,
+  /**
+   * `auto` (default): SWR/background before expiry, blocking once expired. `blocking`: always
+   * synchronous (zero revocation lag, at the cost of latency on the revalidation tick).
+   */
+  mode: Typesafe.enumeration("auto", "blocking"),
+  /** What to do when the IdP reports the session as gone. Currently only `revoke`. */
+  onFailure: Typesafe.enumeration("revoke")
+});
+const REVALIDATION_DEFAULT_SOFT_THRESHOLD = 0.5;
+const REVALIDATION_DEFAULT_MIN_INTERVAL = "10 seconds";
+const REVALIDATION_DEFAULT_FALLBACK_INTERVAL = "5 minutes";
+export {
+  IDPRevalidationConfig,
+  REVALIDATION_DEFAULT_FALLBACK_INTERVAL,
+  REVALIDATION_DEFAULT_MIN_INTERVAL,
+  REVALIDATION_DEFAULT_SOFT_THRESHOLD
+};
+//# sourceMappingURL=IDPRevalidation.js.map

package/dist/development/src/model/service/idp/IDPRevalidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IDPRevalidation.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IDPRevalidation.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\n\n/**\n * Provider-agnostic re-validation settings, stored on an IdP's `configuration.revalidation`.\n * Read both by the provider (to decide whether to capture session state at sign-in) and by\n * the generic verify hook (`ApiKeyManager.verifyAndProlong`) to drive re-validation.\n *\n * The cadence is driven by the **access-token lifetime**, not a fixed interval: while the\n * token is fresh the session is vouched-for and nothing happens; past `softRefreshThreshold`\n * of its lifetime a proactive background (SWR) refresh kicks in; once the token has actually\n * expired the refresh becomes blocking. See {@link IdpSessionRevalidator}.\n *\n * All fields optional; absent / `enabled: false` reproduces the pre-A24 behaviour exactly.\n */\nexport const IDPRevalidationConfig = Typesafe.partial({\n\tenabled: Typesafe.boolean,\n\t/**\n\t * Fraction (0–1) of the access-token lifetime after which a proactive background (SWR)\n\t * refresh starts — e.g. 0.5 = refresh once the token is half-expired. Default 0.5.\n\t */\n\tsoftRefreshThreshold: Typesafe.number,\n\t/**\n\t * Single-flight floor as a Postgres interval string: the minimum gap between revalidation\n\t * attempts, so a burst of requests past the threshold triggers only one refresh.\n\t * Default \"10 seconds\".\n\t */\n\tminInterval: Typesafe.string,\n\t/**\n\t * Throttle used when the IdP returns no token expiry (so the lifetime-based cadence can't\n\t * apply), as a Postgres interval string. Default \"5 minutes\".\n\t */\n\tfallbackInterval: Typesafe.string,\n\t/**\n\t * `auto` (default): SWR/background before expiry, blocking once expired. `blocking`: always\n\t * synchronous (zero revocation lag, at the cost of latency on the revalidation tick).\n\t */\n\tmode: Typesafe.enumeration('auto', 'blocking'),\n\t/** What to do when the IdP reports the session as gone. Currently only `revoke`. */\n\tonFailure: Typesafe.enumeration('revoke'),\n})\n\nexport type IDPRevalidationConfig = ReturnType<typeof IDPRevalidationConfig>\n\nexport const REVALIDATION_DEFAULT_SOFT_THRESHOLD = 0.5\nexport const REVALIDATION_DEFAULT_MIN_INTERVAL = '10 seconds'\nexport const REVALIDATION_DEFAULT_FALLBACK_INTERVAL = '5 minutes'\n"],"names":[],"mappings":";AAcO,MAAM,wBAAwB,SAAS,QAAQ;AAAA,EACrD,SAAS,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKlB,sBAAsB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM/B,aAAa,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB,kBAAkB,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAK3B,MAAM,SAAS,YAAY,QAAQ,UAAU;AAAA;AAAA,EAE7C,WAAW,SAAS,YAAY,QAAQ;AACzC,CAAC;AAIM,MAAM,sCAAsC;AAC5C,MAAM,oCAAoC;AAC1C,MAAM,yCAAyC;"}

package/dist/development/src/model/service/idp/IdpSessionRevalidator.cjs

@@ -0,0 +1,176 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const IdpSessionByApiKeyQuery = require("../../queries/idp/IdpSessionByApiKeyQuery.cjs");
+const ClaimIdpRevalidationCommand = require("../../commands/idp/ClaimIdpRevalidationCommand.cjs");
+const UpdateIdpSessionCommand = require("../../commands/idp/UpdateIdpSessionCommand.cjs");
+require("../../type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+const DisableApiKeyCommand = require("../../commands/apiKey/DisableApiKeyCommand.cjs");
+const CreateAuthLogEntryCommand = require("../../commands/authLog/CreateAuthLogEntryCommand.cjs");
+const IDPRevalidation = require("./IDPRevalidation.cjs");
+class IdpSessionRevalidator {
+  constructor(idpRegistry) {
+    this.idpRegistry = idpRegistry;
+  }
+  async revalidate(dbContext, readDbContext, apiKeyRow, requestInfo) {
+    const row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery.IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers));
+    if (!row) {
+      return "valid";
+    }
+    const config = this.resolveConfig(row.providerConfiguration);
+    if (!config.enabled) {
+      return "valid";
+    }
+    if (row.providerDisabledAt) {
+      await this.revoke(dbContext, apiKeyRow, row, "idp_disabled", requestInfo);
+      return "revoked";
+    }
+    const handler = this.idpRegistry.getHandlerOrNull(row.providerType);
+    if (!handler?.revalidate) {
+      return "valid";
+    }
+    const decision = this.decide(row, config, dbContext.providers.now());
+    if (!decision) {
+      return "valid";
+    }
+    let claimed;
+    try {
+      claimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand.ClaimIdpRevalidationCommand(row.id, decision.claimInterval));
+    } catch {
+      return "valid";
+    }
+    if (!claimed) {
+      return "valid";
+    }
+    if (decision.blocking) {
+      return await this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo);
+    }
+    setImmediate(() => {
+      this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {
+      });
+    });
+    return "valid";
+  }
+  /**
+   * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in
+   * JS (the claim handles intervals in SQL). Returns null to skip.
+   */
+  decide(row, config, now) {
+    const expiresAt = row.session.expiresAt;
+    const obtainedAt = row.tokenObtainedAt;
+    if (!expiresAt || !obtainedAt) {
+      return { blocking: config.mode === "blocking", claimInterval: config.fallbackInterval };
+    }
+    const lifetimeMs = expiresAt.getTime() - obtainedAt.getTime();
+    const softAtMs = obtainedAt.getTime() + lifetimeMs * config.softThreshold;
+    const nowMs = now.getTime();
+    if (nowMs < softAtMs) {
+      return null;
+    }
+    const expired = nowMs >= expiresAt.getTime();
+    return { blocking: config.mode === "blocking" || expired, claimInterval: config.minInterval };
+  }
+  async runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo) {
+    let config;
+    try {
+      config = handler.validateConfiguration(row.providerConfiguration);
+    } catch {
+      await this.logRevalidationFailed(dbContext, apiKeyRow, row, "config_invalid", requestInfo);
+      return "valid";
+    }
+    let result;
+    try {
+      result = await handler.revalidate(config, row.session);
+    } catch {
+      await this.logRevalidationFailed(dbContext, apiKeyRow, row, "revalidation_error", requestInfo);
+      return "valid";
+    }
+    if (result.status === "revoked") {
+      await this.revoke(dbContext, apiKeyRow, row, result.reason, requestInfo);
+      return "revoked";
+    }
+    if (result.idpSession) {
+      try {
+        await dbContext.commandBus.execute(new UpdateIdpSessionCommand.UpdateIdpSessionCommand(row.id, result.idpSession));
+        await this.logRevalidated(dbContext, apiKeyRow, row, requestInfo);
+      } catch {
+      }
+    }
+    return "valid";
+  }
+  async logRevalidated(dbContext, apiKeyRow, row, requestInfo) {
+    await dbContext.commandBus.execute(
+      new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
+        type: "idp_session_revalidated",
+        invokedById: apiKeyRow.identity_id,
+        personId: apiKeyRow.person_id ?? void 0,
+        identityProviderId: row.identityProviderId,
+        personTokenId: apiKeyRow.id,
+        success: true,
+        ipAddress: requestInfo?.ip,
+        userAgent: requestInfo?.userAgent
+      })
+    );
+  }
+  /**
+   * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is
+   * corrupt, so we kept the session rather than revoking it. Naturally throttled to one entry
+   * per claim window (we only reach here after a successful claim, which bumps
+   * `last_validated_at`). The write is best-effort and self-contained — a failure to audit must
+   * never propagate and fail a blocking verify request (the whole point of failing open).
+   */
+  async logRevalidationFailed(dbContext, apiKeyRow, row, errorCode, requestInfo) {
+    try {
+      await dbContext.commandBus.execute(
+        new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
+          type: "idp_session_revalidation_failed",
+          invokedById: apiKeyRow.identity_id,
+          personId: apiKeyRow.person_id ?? void 0,
+          identityProviderId: row.identityProviderId,
+          personTokenId: apiKeyRow.id,
+          // not a security failure (the session is kept) — a fail-open marker the operator
+          // can alert on. `success: true` keeps it out of the failed-login funnels.
+          success: true,
+          errorCode,
+          ipAddress: requestInfo?.ip,
+          userAgent: requestInfo?.userAgent
+        })
+      );
+    } catch {
+    }
+  }
+  async revoke(dbContext, apiKeyRow, row, reason, requestInfo) {
+    await dbContext.commandBus.execute(new DisableApiKeyCommand.DisableApiKeyCommand(apiKeyRow.id));
+    await dbContext.commandBus.execute(
+      new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
+        type: "idp_session_revoked",
+        invokedById: apiKeyRow.identity_id,
+        personId: apiKeyRow.person_id ?? void 0,
+        identityProviderId: row.identityProviderId,
+        personTokenId: apiKeyRow.id,
+        success: false,
+        errorCode: reason,
+        ipAddress: requestInfo?.ip,
+        userAgent: requestInfo?.userAgent,
+        // the action payload belongs in `event_data` (where every other audit event puts
+        // it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for
+        // transport context (forwarder IP/UA).
+        eventData: { reason }
+      })
+    );
+  }
+  resolveConfig(configuration) {
+    const raw = configuration.revalidation ?? {};
+    const threshold = typeof raw.softRefreshThreshold === "number" && raw.softRefreshThreshold > 0 && raw.softRefreshThreshold <= 1 ? raw.softRefreshThreshold : IDPRevalidation.REVALIDATION_DEFAULT_SOFT_THRESHOLD;
+    return {
+      enabled: raw.enabled === true,
+      softThreshold: threshold,
+      minInterval: typeof raw.minInterval === "string" ? raw.minInterval : IDPRevalidation.REVALIDATION_DEFAULT_MIN_INTERVAL,
+      fallbackInterval: typeof raw.fallbackInterval === "string" ? raw.fallbackInterval : IDPRevalidation.REVALIDATION_DEFAULT_FALLBACK_INTERVAL,
+      mode: raw.mode === "blocking" ? "blocking" : "auto"
+    };
+  }
+}
+exports.IdpSessionRevalidator = IdpSessionRevalidator;
+//# sourceMappingURL=IdpSessionRevalidator.cjs.map

package/dist/development/src/model/service/idp/IdpSessionRevalidator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdpSessionRevalidator.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdpSessionRevalidator.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from '../../commands/index.js'\nimport { ApiKeyRow } from '../../queries/apiKey/ApiKeyQuery.js'\nimport { IdpSessionByApiKeyQuery, IdpSessionRow } from '../../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { ClaimIdpRevalidationCommand } from '../../commands/idp/ClaimIdpRevalidationCommand.js'\nimport { UpdateIdpSessionCommand } from '../../commands/idp/UpdateIdpSessionCommand.js'\nimport { DisableApiKeyCommand } from '../../commands/index.js'\nimport { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from './IDPRevalidation.js'\nimport { IdentityProviderHandler, RevalidationResult } from './IdentityProviderHandler.js'\n\nexport type RevalidationOutcome = 'valid' | 'revoked'\n\ntype ResolvedRevalidationConfig = {\n\tenabled: boolean\n\tsoftThreshold: number\n\tminInterval: string\n\tfallbackInterval: string\n\tmode: 'auto' | 'blocking'\n}\n\n/**\n * Decision for the current request: whether to attempt a revalidation, and if so whether it\n * must block the request. `claimInterval` is the single-flight floor for the atomic claim.\n */\ntype Decision = null | { blocking: boolean; claimInterval: string }\n\n/**\n * Re-validates IdP-backed sessions against their identity provider on the verify hot path\n * (A24). Invoked from `ApiKeyManager.verifyAndProlong`. Operates entirely through the supplied\n * database contexts and the command bus, so it does not depend on `ApiKeyManager` (no DI cycle).\n *\n * The cadence is driven by the **access-token lifetime**, not a fixed interval:\n *   - while the token is fresh (before `softRefreshThreshold` of its lifetime) → skip, free;\n *   - past the threshold but not yet expired → a proactive **background (SWR)** refresh, so the\n *     request keeps zero added latency and the token is renewed before it dies;\n *   - once the token has actually expired → a **blocking** refresh (we can't serve a dead token).\n * `mode: 'blocking'` forces every revalidation synchronous (zero revocation lag). When the IdP\n * returns no token expiry, falls back to a plain `fallbackInterval` background throttle.\n */\nexport class IdpSessionRevalidator {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {\n\t}\n\n\tasync revalidate(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tconst row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers))\n\t\tif (!row) {\n\t\t\t// not a federated session (password / IdP without revalidation) — fast no-op\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst config = this.resolveConfig(row.providerConfiguration)\n\t\tif (!config.enabled) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// A disabled IdP no longer vouches for its sessions.\n\t\tif (row.providerDisabledAt) {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, 'idp_disabled', requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(row.providerType)\n\t\tif (!handler?.revalidate) {\n\t\t\t// provider can't actively re-validate (e.g. SAML) — rely on expiry / SLO\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst decision = this.decide(row, config, dbContext.providers.now())\n\t\tif (!decision) {\n\t\t\t// token still fresh — vouched for, no IdP call\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// Atomic claim = single-flight. Loser (within the floor window, or lost the race) serves stale.\n\t\tlet claimed: boolean\n\t\ttry {\n\t\t\tclaimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval))\n\t\t} catch {\n\t\t\t// invalid interval string or transient DB error — fail open, retry next request\n\t\t\treturn 'valid'\n\t\t}\n\t\tif (!claimed) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (decision.blocking) {\n\t\t\treturn await this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo)\n\t\t}\n\n\t\t// SWR: serve this request from the (still valid) token, refresh after the response.\n\t\t// The work runs detached (after the response is sent), so any rejection — a transient\n\t\t// DB error in the revoke / persist writes, a corrupt-config throw — must be swallowed\n\t\t// here; otherwise it becomes an unhandledRejection and can take the worker down. The\n\t\t// session is simply kept and re-tried on a later request (the claim floor throttles).\n\t\tsetImmediate(() => {\n\t\t\tthis.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {})\n\t\t})\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in\n\t * JS (the claim handles intervals in SQL). Returns null to skip.\n\t */\n\tprivate decide(row: IdpSessionRow, config: ResolvedRevalidationConfig, now: Date): Decision {\n\t\tconst expiresAt = row.session.expiresAt\n\t\tconst obtainedAt = row.tokenObtainedAt\n\n\t\t// No lifetime info from the IdP → plain background throttle on fallbackInterval.\n\t\tif (!expiresAt || !obtainedAt) {\n\t\t\treturn { blocking: config.mode === 'blocking', claimInterval: config.fallbackInterval }\n\t\t}\n\n\t\tconst lifetimeMs = expiresAt.getTime() - obtainedAt.getTime()\n\t\tconst softAtMs = obtainedAt.getTime() + lifetimeMs * config.softThreshold\n\t\tconst nowMs = now.getTime()\n\n\t\tif (nowMs < softAtMs) {\n\t\t\treturn null // still within the trusted window\n\t\t}\n\n\t\tconst expired = nowMs >= expiresAt.getTime()\n\t\treturn { blocking: config.mode === 'blocking' || expired, claimInterval: config.minInterval }\n\t}\n\n\tprivate async runRevalidation(\n\t\tdbContext: DatabaseContext,\n\t\thandler: IdentityProviderHandler<{}>,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(row.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config — must NOT revoke; keep the session and retry later. Audit\n\t\t\t// it so the operator can tell \"vouched for\" apart from \"silently broken\" (without an\n\t\t\t// entry, a config typo disables re-validation invisibly for the life of every session).\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'config_invalid', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tlet result: RevalidationResult\n\t\ttry {\n\t\t\tresult = await handler.revalidate!(config, row.session)\n\t\t} catch {\n\t\t\t// transient failure (network / IdP down) — must NOT revoke; keep the session and retry\n\t\t\t// on a later request (the claim floor prevents hammering the IdP). Audited (throttled\n\t\t\t// to one entry per claim window) so a prolonged IdP outage is visible rather than a\n\t\t\t// silent fail-open.\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'revalidation_error', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (result.status === 'revoked') {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, result.reason, requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\t// Still valid — persist the rotated token (resets the lifetime reference) / refreshed\n\t\t// expiry. A rotation is a real, low-frequency event (token-lifetime cadence), so we\n\t\t// audit it as `idp_session_revalidated`; the no-op userinfo/introspection probes\n\t\t// (no rotated session) are intentionally NOT logged to keep the audit log usable.\n\t\t//\n\t\t// The IdP has already vouched for the session, so these post-success writes are pure\n\t\t// best-effort bookkeeping (they only reset the SWR cadence reference). A transient DB\n\t\t// error or an `encrypt()` throw here must NOT fail the request — otherwise a blocking\n\t\t// revalidation fails closed on a successful refresh, contradicting \"fail open\" (the SWR\n\t\t// path already swallows this). Keep the existing row; the claim floor throttles a retry.\n\t\tif (result.idpSession) {\n\t\t\ttry {\n\t\t\t\tawait dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession))\n\t\t\t\tawait this.logRevalidated(dbContext, apiKeyRow, row, requestInfo)\n\t\t\t} catch {\n\t\t\t\t// fall through — session stays valid, persist retried on a later request\n\t\t\t}\n\t\t}\n\t\treturn 'valid'\n\t}\n\n\tprivate async logRevalidated(dbContext: DatabaseContext, apiKeyRow: ApiKeyRow, row: IdpSessionRow, requestInfo?: ApiKeyRequestInfo): Promise<void> {\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revalidated',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: true,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is\n\t * corrupt, so we kept the session rather than revoking it. Naturally throttled to one entry\n\t * per claim window (we only reach here after a successful claim, which bumps\n\t * `last_validated_at`). The write is best-effort and self-contained — a failure to audit must\n\t * never propagate and fail a blocking verify request (the whole point of failing open).\n\t */\n\tprivate async logRevalidationFailed(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\terrorCode: 'config_invalid' | 'revalidation_error',\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\t\t// not a security failure (the session is kept) — a fail-open marker the operator\n\t\t\t\t\t// can alert on. `success: true` keeps it out of the failed-login funnels.\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\terrorCode,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort observability — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async revoke(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\treason: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revoked',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: false,\n\t\t\t\terrorCode: reason,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t// the action payload belongs in `event_data` (where every other audit event puts\n\t\t\t\t// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for\n\t\t\t\t// transport context (forwarder IP/UA).\n\t\t\t\teventData: { reason },\n\t\t\t}),\n\t\t)\n\t}\n\n\tprivate resolveConfig(configuration: Record<string, unknown>): ResolvedRevalidationConfig {\n\t\tconst raw = (configuration.revalidation ?? {}) as Record<string, unknown>\n\t\tconst threshold = typeof raw.softRefreshThreshold === 'number' && raw.softRefreshThreshold > 0 && raw.softRefreshThreshold <= 1\n\t\t\t? raw.softRefreshThreshold\n\t\t\t: REVALIDATION_DEFAULT_SOFT_THRESHOLD\n\t\treturn {\n\t\t\tenabled: raw.enabled === true,\n\t\t\tsoftThreshold: threshold,\n\t\t\tminInterval: typeof raw.minInterval === 'string' ? raw.minInterval : REVALIDATION_DEFAULT_MIN_INTERVAL,\n\t\t\tfallbackInterval: typeof raw.fallbackInterval === 'string' ? raw.fallbackInterval : REVALIDATION_DEFAULT_FALLBACK_INTERVAL,\n\t\t\tmode: raw.mode === 'blocking' ? 'blocking' : 'auto',\n\t\t}\n\t}\n}\n"],"names":["IdpSessionByApiKeyQuery","ClaimIdpRevalidationCommand","UpdateIdpSessionCommand","CreateAuthLogEntryCommand","DisableApiKeyCommand","REVALIDATION_DEFAULT_SOFT_THRESHOLD","REVALIDATION_DEFAULT_MIN_INTERVAL","REVALIDATION_DEFAULT_FALLBACK_INTERVAL"],"mappings":";;;;;;;;;;;AAyCO,MAAM,sBAAsB;AAAA,EAClC,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EAElB;AAAA,EAEA,MAAM,WACL,WACA,eACA,WACA,aAC+B;AAC/B,UAAM,MAAM,MAAM,cAAc,aAAa,MAAM,IAAIA,wBAAAA,wBAAwB,UAAU,IAAI,cAAc,SAAS,CAAC;AACrH,QAAI,CAAC,KAAK;AAET,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,KAAK,cAAc,IAAI,qBAAqB;AAC3D,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO;AAAA,IACR;AAGA,QAAI,IAAI,oBAAoB;AAC3B,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,gBAAgB,WAAW;AACxE,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,IAAI,YAAY;AAClE,QAAI,CAAC,SAAS,YAAY;AAEzB,aAAO;AAAA,IACR;AAEA,UAAM,WAAW,KAAK,OAAO,KAAK,QAAQ,UAAU,UAAU,KAAK;AACnE,QAAI,CAAC,UAAU;AAEd,aAAO;AAAA,IACR;AAGA,QAAI;AACJ,QAAI;AACH,gBAAU,MAAM,UAAU,WAAW,QAAQ,IAAIC,wDAA4B,IAAI,IAAI,SAAS,aAAa,CAAC;AAAA,IAC7G,QAAQ;AAEP,aAAO;AAAA,IACR;AACA,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AAEA,QAAI,SAAS,UAAU;AACtB,aAAO,MAAM,KAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW;AAAA,IAClF;AAOA,iBAAa,MAAM;AAClB,WAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrF,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,OAAO,KAAoB,QAAoC,KAAqB;AAC3F,UAAM,YAAY,IAAI,QAAQ;AAC9B,UAAM,aAAa,IAAI;AAGvB,QAAI,CAAC,aAAa,CAAC,YAAY;AAC9B,aAAO,EAAE,UAAU,OAAO,SAAS,YAAY,eAAe,OAAO,iBAAA;AAAA,IACtE;AAEA,UAAM,aAAa,UAAU,QAAA,IAAY,WAAW,QAAA;AACpD,UAAM,WAAW,WAAW,QAAA,IAAY,aAAa,OAAO;AAC5D,UAAM,QAAQ,IAAI,QAAA;AAElB,QAAI,QAAQ,UAAU;AACrB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,SAAS,UAAU,QAAA;AACnC,WAAO,EAAE,UAAU,OAAO,SAAS,cAAc,SAAS,eAAe,OAAO,YAAA;AAAA,EACjF;AAAA,EAEA,MAAc,gBACb,WACA,SACA,KACA,WACA,aAC+B;AAC/B,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,IAAI,qBAAqB;AAAA,IACjE,QAAQ;AAIP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,kBAAkB,WAAW;AACzF,aAAO;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,WAAY,QAAQ,IAAI,OAAO;AAAA,IACvD,QAAQ;AAKP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,sBAAsB,WAAW;AAC7F,aAAO;AAAA,IACR;AAEA,QAAI,OAAO,WAAW,WAAW;AAChC,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,OAAO,QAAQ,WAAW;AACvE,aAAO;AAAA,IACR;AAYA,QAAI,OAAO,YAAY;AACtB,UAAI;AACH,cAAM,UAAU,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,IAAI,IAAI,OAAO,UAAU,CAAC;AACzF,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,WAAW;AAAA,MACjE,QAAQ;AAAA,MAER;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,eAAe,WAA4B,WAAsB,KAAoB,aAAgD;AAClJ,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAIC,oDAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA,MAAA,CACxB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,sBACb,WACA,WACA,KACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAIA,oDAA0B;AAAA,UAC7B,MAAM;AAAA,UACN,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA,UACjC,oBAAoB,IAAI;AAAA,UACxB,eAAe,UAAU;AAAA;AAAA;AAAA,UAGzB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,QAAA,CACxB;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AAAA,EAEA,MAAc,OACb,WACA,WACA,KACA,QACA,aACgB;AAChB,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,UAAU,EAAE,CAAC;AACzE,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAID,oDAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW;AAAA,QACX,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA;AAAA;AAAA;AAAA,QAIxB,WAAW,EAAE,OAAA;AAAA,MAAO,CACpB;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,cAAc,eAAoE;AACzF,UAAM,MAAO,cAAc,gBAAgB,CAAA;AAC3C,UAAM,YAAY,OAAO,IAAI,yBAAyB,YAAY,IAAI,uBAAuB,KAAK,IAAI,wBAAwB,IAC3H,IAAI,uBACJE,gBAAAA;AACH,WAAO;AAAA,MACN,SAAS,IAAI,YAAY;AAAA,MACzB,eAAe;AAAA,MACf,aAAa,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAcC,gBAAAA;AAAAA,MACrE,kBAAkB,OAAO,IAAI,qBAAqB,WAAW,IAAI,mBAAmBC,gBAAAA;AAAAA,MACpF,MAAM,IAAI,SAAS,aAAa,aAAa;AAAA,IAAA;AAAA,EAE/C;AACD;;"}

package/dist/development/src/model/service/idp/IdpSessionRevalidator.js

@@ -0,0 +1,176 @@
+import { IdpSessionByApiKeyQuery } from "../../queries/idp/IdpSessionByApiKeyQuery.js";
+import { ClaimIdpRevalidationCommand } from "../../commands/idp/ClaimIdpRevalidationCommand.js";
+import { UpdateIdpSessionCommand } from "../../commands/idp/UpdateIdpSessionCommand.js";
+import "../../type/ApiKey.js";
+import "@contember/database";
+import "node:crypto";
+import { DisableApiKeyCommand } from "../../commands/apiKey/DisableApiKeyCommand.js";
+import { CreateAuthLogEntryCommand } from "../../commands/authLog/CreateAuthLogEntryCommand.js";
+import { REVALIDATION_DEFAULT_SOFT_THRESHOLD, REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL } from "./IDPRevalidation.js";
+class IdpSessionRevalidator {
+  constructor(idpRegistry) {
+    this.idpRegistry = idpRegistry;
+  }
+  async revalidate(dbContext, readDbContext, apiKeyRow, requestInfo) {
+    const row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers));
+    if (!row) {
+      return "valid";
+    }
+    const config = this.resolveConfig(row.providerConfiguration);
+    if (!config.enabled) {
+      return "valid";
+    }
+    if (row.providerDisabledAt) {
+      await this.revoke(dbContext, apiKeyRow, row, "idp_disabled", requestInfo);
+      return "revoked";
+    }
+    const handler = this.idpRegistry.getHandlerOrNull(row.providerType);
+    if (!handler?.revalidate) {
+      return "valid";
+    }
+    const decision = this.decide(row, config, dbContext.providers.now());
+    if (!decision) {
+      return "valid";
+    }
+    let claimed;
+    try {
+      claimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval));
+    } catch {
+      return "valid";
+    }
+    if (!claimed) {
+      return "valid";
+    }
+    if (decision.blocking) {
+      return await this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo);
+    }
+    setImmediate(() => {
+      this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {
+      });
+    });
+    return "valid";
+  }
+  /**
+   * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in
+   * JS (the claim handles intervals in SQL). Returns null to skip.
+   */
+  decide(row, config, now) {
+    const expiresAt = row.session.expiresAt;
+    const obtainedAt = row.tokenObtainedAt;
+    if (!expiresAt || !obtainedAt) {
+      return { blocking: config.mode === "blocking", claimInterval: config.fallbackInterval };
+    }
+    const lifetimeMs = expiresAt.getTime() - obtainedAt.getTime();
+    const softAtMs = obtainedAt.getTime() + lifetimeMs * config.softThreshold;
+    const nowMs = now.getTime();
+    if (nowMs < softAtMs) {
+      return null;
+    }
+    const expired = nowMs >= expiresAt.getTime();
+    return { blocking: config.mode === "blocking" || expired, claimInterval: config.minInterval };
+  }
+  async runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo) {
+    let config;
+    try {
+      config = handler.validateConfiguration(row.providerConfiguration);
+    } catch {
+      await this.logRevalidationFailed(dbContext, apiKeyRow, row, "config_invalid", requestInfo);
+      return "valid";
+    }
+    let result;
+    try {
+      result = await handler.revalidate(config, row.session);
+    } catch {
+      await this.logRevalidationFailed(dbContext, apiKeyRow, row, "revalidation_error", requestInfo);
+      return "valid";
+    }
+    if (result.status === "revoked") {
+      await this.revoke(dbContext, apiKeyRow, row, result.reason, requestInfo);
+      return "revoked";
+    }
+    if (result.idpSession) {
+      try {
+        await dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession));
+        await this.logRevalidated(dbContext, apiKeyRow, row, requestInfo);
+      } catch {
+      }
+    }
+    return "valid";
+  }
+  async logRevalidated(dbContext, apiKeyRow, row, requestInfo) {
+    await dbContext.commandBus.execute(
+      new CreateAuthLogEntryCommand({
+        type: "idp_session_revalidated",
+        invokedById: apiKeyRow.identity_id,
+        personId: apiKeyRow.person_id ?? void 0,
+        identityProviderId: row.identityProviderId,
+        personTokenId: apiKeyRow.id,
+        success: true,
+        ipAddress: requestInfo?.ip,
+        userAgent: requestInfo?.userAgent
+      })
+    );
+  }
+  /**
+   * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is
+   * corrupt, so we kept the session rather than revoking it. Naturally throttled to one entry
+   * per claim window (we only reach here after a successful claim, which bumps
+   * `last_validated_at`). The write is best-effort and self-contained — a failure to audit must
+   * never propagate and fail a blocking verify request (the whole point of failing open).
+   */
+  async logRevalidationFailed(dbContext, apiKeyRow, row, errorCode, requestInfo) {
+    try {
+      await dbContext.commandBus.execute(
+        new CreateAuthLogEntryCommand({
+          type: "idp_session_revalidation_failed",
+          invokedById: apiKeyRow.identity_id,
+          personId: apiKeyRow.person_id ?? void 0,
+          identityProviderId: row.identityProviderId,
+          personTokenId: apiKeyRow.id,
+          // not a security failure (the session is kept) — a fail-open marker the operator
+          // can alert on. `success: true` keeps it out of the failed-login funnels.
+          success: true,
+          errorCode,
+          ipAddress: requestInfo?.ip,
+          userAgent: requestInfo?.userAgent
+        })
+      );
+    } catch {
+    }
+  }
+  async revoke(dbContext, apiKeyRow, row, reason, requestInfo) {
+    await dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id));
+    await dbContext.commandBus.execute(
+      new CreateAuthLogEntryCommand({
+        type: "idp_session_revoked",
+        invokedById: apiKeyRow.identity_id,
+        personId: apiKeyRow.person_id ?? void 0,
+        identityProviderId: row.identityProviderId,
+        personTokenId: apiKeyRow.id,
+        success: false,
+        errorCode: reason,
+        ipAddress: requestInfo?.ip,
+        userAgent: requestInfo?.userAgent,
+        // the action payload belongs in `event_data` (where every other audit event puts
+        // it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for
+        // transport context (forwarder IP/UA).
+        eventData: { reason }
+      })
+    );
+  }
+  resolveConfig(configuration) {
+    const raw = configuration.revalidation ?? {};
+    const threshold = typeof raw.softRefreshThreshold === "number" && raw.softRefreshThreshold > 0 && raw.softRefreshThreshold <= 1 ? raw.softRefreshThreshold : REVALIDATION_DEFAULT_SOFT_THRESHOLD;
+    return {
+      enabled: raw.enabled === true,
+      softThreshold: threshold,
+      minInterval: typeof raw.minInterval === "string" ? raw.minInterval : REVALIDATION_DEFAULT_MIN_INTERVAL,
+      fallbackInterval: typeof raw.fallbackInterval === "string" ? raw.fallbackInterval : REVALIDATION_DEFAULT_FALLBACK_INTERVAL,
+      mode: raw.mode === "blocking" ? "blocking" : "auto"
+    };
+  }
+}
+export {
+  IdpSessionRevalidator
+};
+//# sourceMappingURL=IdpSessionRevalidator.js.map

package/dist/development/src/model/service/idp/IdpSessionRevalidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdpSessionRevalidator.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdpSessionRevalidator.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from '../../commands/index.js'\nimport { ApiKeyRow } from '../../queries/apiKey/ApiKeyQuery.js'\nimport { IdpSessionByApiKeyQuery, IdpSessionRow } from '../../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { ClaimIdpRevalidationCommand } from '../../commands/idp/ClaimIdpRevalidationCommand.js'\nimport { UpdateIdpSessionCommand } from '../../commands/idp/UpdateIdpSessionCommand.js'\nimport { DisableApiKeyCommand } from '../../commands/index.js'\nimport { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from './IDPRevalidation.js'\nimport { IdentityProviderHandler, RevalidationResult } from './IdentityProviderHandler.js'\n\nexport type RevalidationOutcome = 'valid' | 'revoked'\n\ntype ResolvedRevalidationConfig = {\n\tenabled: boolean\n\tsoftThreshold: number\n\tminInterval: string\n\tfallbackInterval: string\n\tmode: 'auto' | 'blocking'\n}\n\n/**\n * Decision for the current request: whether to attempt a revalidation, and if so whether it\n * must block the request. `claimInterval` is the single-flight floor for the atomic claim.\n */\ntype Decision = null | { blocking: boolean; claimInterval: string }\n\n/**\n * Re-validates IdP-backed sessions against their identity provider on the verify hot path\n * (A24). Invoked from `ApiKeyManager.verifyAndProlong`. Operates entirely through the supplied\n * database contexts and the command bus, so it does not depend on `ApiKeyManager` (no DI cycle).\n *\n * The cadence is driven by the **access-token lifetime**, not a fixed interval:\n *   - while the token is fresh (before `softRefreshThreshold` of its lifetime) → skip, free;\n *   - past the threshold but not yet expired → a proactive **background (SWR)** refresh, so the\n *     request keeps zero added latency and the token is renewed before it dies;\n *   - once the token has actually expired → a **blocking** refresh (we can't serve a dead token).\n * `mode: 'blocking'` forces every revalidation synchronous (zero revocation lag). When the IdP\n * returns no token expiry, falls back to a plain `fallbackInterval` background throttle.\n */\nexport class IdpSessionRevalidator {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {\n\t}\n\n\tasync revalidate(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tconst row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers))\n\t\tif (!row) {\n\t\t\t// not a federated session (password / IdP without revalidation) — fast no-op\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst config = this.resolveConfig(row.providerConfiguration)\n\t\tif (!config.enabled) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// A disabled IdP no longer vouches for its sessions.\n\t\tif (row.providerDisabledAt) {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, 'idp_disabled', requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(row.providerType)\n\t\tif (!handler?.revalidate) {\n\t\t\t// provider can't actively re-validate (e.g. SAML) — rely on expiry / SLO\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst decision = this.decide(row, config, dbContext.providers.now())\n\t\tif (!decision) {\n\t\t\t// token still fresh — vouched for, no IdP call\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// Atomic claim = single-flight. Loser (within the floor window, or lost the race) serves stale.\n\t\tlet claimed: boolean\n\t\ttry {\n\t\t\tclaimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval))\n\t\t} catch {\n\t\t\t// invalid interval string or transient DB error — fail open, retry next request\n\t\t\treturn 'valid'\n\t\t}\n\t\tif (!claimed) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (decision.blocking) {\n\t\t\treturn await this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo)\n\t\t}\n\n\t\t// SWR: serve this request from the (still valid) token, refresh after the response.\n\t\t// The work runs detached (after the response is sent), so any rejection — a transient\n\t\t// DB error in the revoke / persist writes, a corrupt-config throw — must be swallowed\n\t\t// here; otherwise it becomes an unhandledRejection and can take the worker down. The\n\t\t// session is simply kept and re-tried on a later request (the claim floor throttles).\n\t\tsetImmediate(() => {\n\t\t\tthis.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {})\n\t\t})\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in\n\t * JS (the claim handles intervals in SQL). Returns null to skip.\n\t */\n\tprivate decide(row: IdpSessionRow, config: ResolvedRevalidationConfig, now: Date): Decision {\n\t\tconst expiresAt = row.session.expiresAt\n\t\tconst obtainedAt = row.tokenObtainedAt\n\n\t\t// No lifetime info from the IdP → plain background throttle on fallbackInterval.\n\t\tif (!expiresAt || !obtainedAt) {\n\t\t\treturn { blocking: config.mode === 'blocking', claimInterval: config.fallbackInterval }\n\t\t}\n\n\t\tconst lifetimeMs = expiresAt.getTime() - obtainedAt.getTime()\n\t\tconst softAtMs = obtainedAt.getTime() + lifetimeMs * config.softThreshold\n\t\tconst nowMs = now.getTime()\n\n\t\tif (nowMs < softAtMs) {\n\t\t\treturn null // still within the trusted window\n\t\t}\n\n\t\tconst expired = nowMs >= expiresAt.getTime()\n\t\treturn { blocking: config.mode === 'blocking' || expired, claimInterval: config.minInterval }\n\t}\n\n\tprivate async runRevalidation(\n\t\tdbContext: DatabaseContext,\n\t\thandler: IdentityProviderHandler<{}>,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(row.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config — must NOT revoke; keep the session and retry later. Audit\n\t\t\t// it so the operator can tell \"vouched for\" apart from \"silently broken\" (without an\n\t\t\t// entry, a config typo disables re-validation invisibly for the life of every session).\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'config_invalid', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tlet result: RevalidationResult\n\t\ttry {\n\t\t\tresult = await handler.revalidate!(config, row.session)\n\t\t} catch {\n\t\t\t// transient failure (network / IdP down) — must NOT revoke; keep the session and retry\n\t\t\t// on a later request (the claim floor prevents hammering the IdP). Audited (throttled\n\t\t\t// to one entry per claim window) so a prolonged IdP outage is visible rather than a\n\t\t\t// silent fail-open.\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'revalidation_error', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (result.status === 'revoked') {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, result.reason, requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\t// Still valid — persist the rotated token (resets the lifetime reference) / refreshed\n\t\t// expiry. A rotation is a real, low-frequency event (token-lifetime cadence), so we\n\t\t// audit it as `idp_session_revalidated`; the no-op userinfo/introspection probes\n\t\t// (no rotated session) are intentionally NOT logged to keep the audit log usable.\n\t\t//\n\t\t// The IdP has already vouched for the session, so these post-success writes are pure\n\t\t// best-effort bookkeeping (they only reset the SWR cadence reference). A transient DB\n\t\t// error or an `encrypt()` throw here must NOT fail the request — otherwise a blocking\n\t\t// revalidation fails closed on a successful refresh, contradicting \"fail open\" (the SWR\n\t\t// path already swallows this). Keep the existing row; the claim floor throttles a retry.\n\t\tif (result.idpSession) {\n\t\t\ttry {\n\t\t\t\tawait dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession))\n\t\t\t\tawait this.logRevalidated(dbContext, apiKeyRow, row, requestInfo)\n\t\t\t} catch {\n\t\t\t\t// fall through — session stays valid, persist retried on a later request\n\t\t\t}\n\t\t}\n\t\treturn 'valid'\n\t}\n\n\tprivate async logRevalidated(dbContext: DatabaseContext, apiKeyRow: ApiKeyRow, row: IdpSessionRow, requestInfo?: ApiKeyRequestInfo): Promise<void> {\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revalidated',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: true,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is\n\t * corrupt, so we kept the session rather than revoking it. Naturally throttled to one entry\n\t * per claim window (we only reach here after a successful claim, which bumps\n\t * `last_validated_at`). The write is best-effort and self-contained — a failure to audit must\n\t * never propagate and fail a blocking verify request (the whole point of failing open).\n\t */\n\tprivate async logRevalidationFailed(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\terrorCode: 'config_invalid' | 'revalidation_error',\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\t\t// not a security failure (the session is kept) — a fail-open marker the operator\n\t\t\t\t\t// can alert on. `success: true` keeps it out of the failed-login funnels.\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\terrorCode,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort observability — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async revoke(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\treason: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revoked',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: false,\n\t\t\t\terrorCode: reason,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t// the action payload belongs in `event_data` (where every other audit event puts\n\t\t\t\t// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for\n\t\t\t\t// transport context (forwarder IP/UA).\n\t\t\t\teventData: { reason },\n\t\t\t}),\n\t\t)\n\t}\n\n\tprivate resolveConfig(configuration: Record<string, unknown>): ResolvedRevalidationConfig {\n\t\tconst raw = (configuration.revalidation ?? {}) as Record<string, unknown>\n\t\tconst threshold = typeof raw.softRefreshThreshold === 'number' && raw.softRefreshThreshold > 0 && raw.softRefreshThreshold <= 1\n\t\t\t? raw.softRefreshThreshold\n\t\t\t: REVALIDATION_DEFAULT_SOFT_THRESHOLD\n\t\treturn {\n\t\t\tenabled: raw.enabled === true,\n\t\t\tsoftThreshold: threshold,\n\t\t\tminInterval: typeof raw.minInterval === 'string' ? raw.minInterval : REVALIDATION_DEFAULT_MIN_INTERVAL,\n\t\t\tfallbackInterval: typeof raw.fallbackInterval === 'string' ? raw.fallbackInterval : REVALIDATION_DEFAULT_FALLBACK_INTERVAL,\n\t\t\tmode: raw.mode === 'blocking' ? 'blocking' : 'auto',\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AAyCO,MAAM,sBAAsB;AAAA,EAClC,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EAElB;AAAA,EAEA,MAAM,WACL,WACA,eACA,WACA,aAC+B;AAC/B,UAAM,MAAM,MAAM,cAAc,aAAa,MAAM,IAAI,wBAAwB,UAAU,IAAI,cAAc,SAAS,CAAC;AACrH,QAAI,CAAC,KAAK;AAET,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,KAAK,cAAc,IAAI,qBAAqB;AAC3D,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO;AAAA,IACR;AAGA,QAAI,IAAI,oBAAoB;AAC3B,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,gBAAgB,WAAW;AACxE,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,IAAI,YAAY;AAClE,QAAI,CAAC,SAAS,YAAY;AAEzB,aAAO;AAAA,IACR;AAEA,UAAM,WAAW,KAAK,OAAO,KAAK,QAAQ,UAAU,UAAU,KAAK;AACnE,QAAI,CAAC,UAAU;AAEd,aAAO;AAAA,IACR;AAGA,QAAI;AACJ,QAAI;AACH,gBAAU,MAAM,UAAU,WAAW,QAAQ,IAAI,4BAA4B,IAAI,IAAI,SAAS,aAAa,CAAC;AAAA,IAC7G,QAAQ;AAEP,aAAO;AAAA,IACR;AACA,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AAEA,QAAI,SAAS,UAAU;AACtB,aAAO,MAAM,KAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW;AAAA,IAClF;AAOA,iBAAa,MAAM;AAClB,WAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrF,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,OAAO,KAAoB,QAAoC,KAAqB;AAC3F,UAAM,YAAY,IAAI,QAAQ;AAC9B,UAAM,aAAa,IAAI;AAGvB,QAAI,CAAC,aAAa,CAAC,YAAY;AAC9B,aAAO,EAAE,UAAU,OAAO,SAAS,YAAY,eAAe,OAAO,iBAAA;AAAA,IACtE;AAEA,UAAM,aAAa,UAAU,QAAA,IAAY,WAAW,QAAA;AACpD,UAAM,WAAW,WAAW,QAAA,IAAY,aAAa,OAAO;AAC5D,UAAM,QAAQ,IAAI,QAAA;AAElB,QAAI,QAAQ,UAAU;AACrB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,SAAS,UAAU,QAAA;AACnC,WAAO,EAAE,UAAU,OAAO,SAAS,cAAc,SAAS,eAAe,OAAO,YAAA;AAAA,EACjF;AAAA,EAEA,MAAc,gBACb,WACA,SACA,KACA,WACA,aAC+B;AAC/B,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,IAAI,qBAAqB;AAAA,IACjE,QAAQ;AAIP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,kBAAkB,WAAW;AACzF,aAAO;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,WAAY,QAAQ,IAAI,OAAO;AAAA,IACvD,QAAQ;AAKP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,sBAAsB,WAAW;AAC7F,aAAO;AAAA,IACR;AAEA,QAAI,OAAO,WAAW,WAAW;AAChC,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,OAAO,QAAQ,WAAW;AACvE,aAAO;AAAA,IACR;AAYA,QAAI,OAAO,YAAY;AACtB,UAAI;AACH,cAAM,UAAU,WAAW,QAAQ,IAAI,wBAAwB,IAAI,IAAI,OAAO,UAAU,CAAC;AACzF,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,WAAW;AAAA,MACjE,QAAQ;AAAA,MAER;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,eAAe,WAA4B,WAAsB,KAAoB,aAAgD;AAClJ,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAI,0BAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA,MAAA,CACxB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,sBACb,WACA,WACA,KACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAI,0BAA0B;AAAA,UAC7B,MAAM;AAAA,UACN,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA,UACjC,oBAAoB,IAAI;AAAA,UACxB,eAAe,UAAU;AAAA;AAAA;AAAA,UAGzB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,QAAA,CACxB;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AAAA,EAEA,MAAc,OACb,WACA,WACA,KACA,QACA,aACgB;AAChB,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,UAAU,EAAE,CAAC;AACzE,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAI,0BAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW;AAAA,QACX,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA;AAAA;AAAA;AAAA,QAIxB,WAAW,EAAE,OAAA;AAAA,MAAO,CACpB;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,cAAc,eAAoE;AACzF,UAAM,MAAO,cAAc,gBAAgB,CAAA;AAC3C,UAAM,YAAY,OAAO,IAAI,yBAAyB,YAAY,IAAI,uBAAuB,KAAK,IAAI,wBAAwB,IAC3H,IAAI,uBACJ;AACH,WAAO;AAAA,MACN,SAAS,IAAI,YAAY;AAAA,MACzB,eAAe;AAAA,MACf,aAAa,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAc;AAAA,MACrE,kBAAkB,OAAO,IAAI,qBAAqB,WAAW,IAAI,mBAAmB;AAAA,MACpF,MAAM,IAAI,SAAS,aAAa,aAAa;AAAA,IAAA;AAAA,EAE/C;AACD;"}

package/dist/development/src/model/service/idp/PersonIdentityProviderManager.cjs

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Response = require("../../utils/Response.cjs");
+require("../../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../../type/ApiKey.cjs");
+const ConfigurationQuery = require("../../queries/configuration/ConfigurationQuery.cjs");
+const PersonIdentityProvidersQuery = require("../../queries/idp/PersonIdentityProvidersQuery.cjs");
+require("../../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../../authorization/PermissionContext.cjs");
+require("../../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+const DisconnectPersonIdentityProviderCommand = require("../../commands/idp/DisconnectPersonIdentityProviderCommand.cjs");
+const isPasswordlessEnabled = require("../helpers/isPasswordlessEnabled.cjs");
+class PersonIdentityProviderManager {
+  async listPersonIdentityProviders(db, personId) {
+    return await db.queryHandler.fetch(new PersonIdentityProvidersQuery.PersonIdentityProvidersQuery(personId));
+  }
+  async disconnectIdentityProvider(db, person, connectionId) {
+    return await db.transaction(async (db2) => {
+      const connections = await db2.queryHandler.fetch(new PersonIdentityProvidersQuery.PersonIdentityProvidersQuery(person.id));
+      const connection = connections.find((it) => it.id === connectionId);
+      if (!connection) {
+        return new Response.ResponseError("NOT_FOUND", `You are not connected to the identity provider connection "${connectionId}".`);
+      }
+      const configuration = await db2.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(db2.providers));
+      const hasPassword = person.password_hash !== null;
+      const hasPasswordless = isPasswordlessEnabled.isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled);
+      const otherUsableConnections = connections.filter((it) => it.id !== connection.id && it.identityProviderDisabledAt === null);
+      const wouldLockOut = !hasPassword && !hasPasswordless && otherUsableConnections.length === 0;
+      if (wouldLockOut) {
+        return new Response.ResponseError(
+          "LAST_AUTH_METHOD",
+          "Cannot disconnect the only remaining sign-in method. Set up a password or another sign-in method first."
+        );
+      }
+      await db2.commandBus.execute(new DisconnectPersonIdentityProviderCommand.DisconnectPersonIdentityProviderCommand(person.id, connection.id));
+      return new Response.ResponseOk({ slug: connection.identityProviderSlug });
+    });
+  }
+}
+exports.PersonIdentityProviderManager = PersonIdentityProviderManager;
+//# sourceMappingURL=PersonIdentityProviderManager.cjs.map

package/dist/development/src/model/service/idp/PersonIdentityProviderManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonIdentityProviderManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/PersonIdentityProviderManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\nimport { DisconnectIdpErrorCode } from '../../../schema/index.js'\nimport { DatabaseContext } from '../../utils/index.js'\nimport { ConfigurationQuery, PersonIdentityProviderRow, PersonIdentityProvidersQuery, PersonRow } from '../../queries/index.js'\nimport { DisconnectPersonIdentityProviderCommand } from '../../commands/idp/DisconnectPersonIdentityProviderCommand.js'\nimport { isPasswordlessEnabled } from '../helpers/isPasswordlessEnabled.js'\n\n/**\n * Manages the external IdP connections of the *currently authenticated* person.\n *\n * Lock-out policy: a person may always disconnect a provider as long as it does\n * not remove their last remaining sign-in method. A connection is refused only\n * when, after removal, the person would have no password, no passwordless\n * sign-in enabled and no other *usable* IdP connection left — which would lock\n * them out of their account entirely. Whether passwordless counts is decided by\n * the same tenant policy the sign-in flow applies, and connections to disabled\n * providers are not counted as a usable fallback (they cannot sign in).\n */\nexport class PersonIdentityProviderManager {\n\tpublic async listPersonIdentityProviders(db: DatabaseContext, personId: string): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await db.queryHandler.fetch(new PersonIdentityProvidersQuery(personId))\n\t}\n\n\tpublic async disconnectIdentityProvider(db: DatabaseContext, person: PersonRow, connectionId: string): Promise<DisconnectIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst connections = await db.queryHandler.fetch(new PersonIdentityProvidersQuery(person.id))\n\t\t\tconst connection = connections.find(it => it.id === connectionId)\n\t\t\tif (!connection) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `You are not connected to the identity provider connection \"${connectionId}\".`)\n\t\t\t}\n\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery(db.providers))\n\t\t\tconst hasPassword = person.password_hash !== null\n\t\t\tconst hasPasswordless = isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled)\n\t\t\tconst otherUsableConnections = connections.filter(it => it.id !== connection.id && it.identityProviderDisabledAt === null)\n\t\t\tconst wouldLockOut = !hasPassword && !hasPasswordless && otherUsableConnections.length === 0\n\t\t\tif (wouldLockOut) {\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'LAST_AUTH_METHOD',\n\t\t\t\t\t'Cannot disconnect the only remaining sign-in method. Set up a password or another sign-in method first.',\n\t\t\t\t)\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new DisconnectPersonIdentityProviderCommand(person.id, connection.id))\n\t\t\treturn new ResponseOk({ slug: connection.identityProviderSlug })\n\t\t})\n\t}\n}\n\nexport interface DisconnectIDPResult {\n\treadonly slug: string\n}\n\nexport type DisconnectIDPResponse = Response<DisconnectIDPResult, DisconnectIdpErrorCode>\n"],"names":["PersonIdentityProvidersQuery","db","ResponseError","ConfigurationQuery","isPasswordlessEnabled","DisconnectPersonIdentityProviderCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;AAkBO,MAAM,8BAA8B;AAAA,EAC1C,MAAa,4BAA4B,IAAqB,UAAwD;AACrH,WAAO,MAAM,GAAG,aAAa,MAAM,IAAIA,6BAAAA,6BAA6B,QAAQ,CAAC;AAAA,EAC9E;AAAA,EAEA,MAAa,2BAA2B,IAAqB,QAAmB,cAAsD;AACrI,WAAO,MAAM,GAAG,YAAY,OAAMC,QAAM;AACvC,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAM,IAAID,6BAAAA,6BAA6B,OAAO,EAAE,CAAC;AAC3F,YAAM,aAAa,YAAY,KAAK,CAAA,OAAM,GAAG,OAAO,YAAY;AAChE,UAAI,CAAC,YAAY;AAChB,eAAO,IAAIE,SAAAA,cAAc,aAAa,8DAA8D,YAAY,IAAI;AAAA,MACrH;AAEA,YAAM,gBAAgB,MAAMD,IAAG,aAAa,MAAM,IAAIE,mBAAAA,mBAAmBF,IAAG,SAAS,CAAC;AACtF,YAAM,cAAc,OAAO,kBAAkB;AAC7C,YAAM,kBAAkBG,sBAAAA,sBAAsB,cAAc,aAAa,SAAS,OAAO,oBAAoB;AAC7G,YAAM,yBAAyB,YAAY,OAAO,CAAA,OAAM,GAAG,OAAO,WAAW,MAAM,GAAG,+BAA+B,IAAI;AACzH,YAAM,eAAe,CAAC,eAAe,CAAC,mBAAmB,uBAAuB,WAAW;AAC3F,UAAI,cAAc;AACjB,eAAO,IAAIF,SAAAA;AAAAA,UACV;AAAA,UACA;AAAA,QAAA;AAAA,MAEF;AAEA,YAAMD,IAAG,WAAW,QAAQ,IAAII,wCAAAA,wCAAwC,OAAO,IAAI,WAAW,EAAE,CAAC;AACjG,aAAO,IAAIC,SAAAA,WAAW,EAAE,MAAM,WAAW,sBAAsB;AAAA,IAChE,CAAC;AAAA,EACF;AACD;;"}

package/dist/development/src/model/service/idp/PersonIdentityProviderManager.js

@@ -0,0 +1,44 @@
+import { ResponseError, ResponseOk } from "../../utils/Response.js";
+import "../../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../type/ApiKey.js";
+import { ConfigurationQuery } from "../../queries/configuration/ConfigurationQuery.js";
+import { PersonIdentityProvidersQuery } from "../../queries/idp/PersonIdentityProvidersQuery.js";
+import "../../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../../authorization/PermissionContext.js";
+import "../../authorization/PermissionsFactory.js";
+import "@contember/schema";
+import { DisconnectPersonIdentityProviderCommand } from "../../commands/idp/DisconnectPersonIdentityProviderCommand.js";
+import { isPasswordlessEnabled } from "../helpers/isPasswordlessEnabled.js";
+class PersonIdentityProviderManager {
+  async listPersonIdentityProviders(db, personId) {
+    return await db.queryHandler.fetch(new PersonIdentityProvidersQuery(personId));
+  }
+  async disconnectIdentityProvider(db, person, connectionId) {
+    return await db.transaction(async (db2) => {
+      const connections = await db2.queryHandler.fetch(new PersonIdentityProvidersQuery(person.id));
+      const connection = connections.find((it) => it.id === connectionId);
+      if (!connection) {
+        return new ResponseError("NOT_FOUND", `You are not connected to the identity provider connection "${connectionId}".`);
+      }
+      const configuration = await db2.queryHandler.fetch(new ConfigurationQuery(db2.providers));
+      const hasPassword = person.password_hash !== null;
+      const hasPasswordless = isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled);
+      const otherUsableConnections = connections.filter((it) => it.id !== connection.id && it.identityProviderDisabledAt === null);
+      const wouldLockOut = !hasPassword && !hasPasswordless && otherUsableConnections.length === 0;
+      if (wouldLockOut) {
+        return new ResponseError(
+          "LAST_AUTH_METHOD",
+          "Cannot disconnect the only remaining sign-in method. Set up a password or another sign-in method first."
+        );
+      }
+      await db2.commandBus.execute(new DisconnectPersonIdentityProviderCommand(person.id, connection.id));
+      return new ResponseOk({ slug: connection.identityProviderSlug });
+    });
+  }
+}
+export {
+  PersonIdentityProviderManager
+};
+//# sourceMappingURL=PersonIdentityProviderManager.js.map

package/dist/development/src/model/service/idp/PersonIdentityProviderManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonIdentityProviderManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/PersonIdentityProviderManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\nimport { DisconnectIdpErrorCode } from '../../../schema/index.js'\nimport { DatabaseContext } from '../../utils/index.js'\nimport { ConfigurationQuery, PersonIdentityProviderRow, PersonIdentityProvidersQuery, PersonRow } from '../../queries/index.js'\nimport { DisconnectPersonIdentityProviderCommand } from '../../commands/idp/DisconnectPersonIdentityProviderCommand.js'\nimport { isPasswordlessEnabled } from '../helpers/isPasswordlessEnabled.js'\n\n/**\n * Manages the external IdP connections of the *currently authenticated* person.\n *\n * Lock-out policy: a person may always disconnect a provider as long as it does\n * not remove their last remaining sign-in method. A connection is refused only\n * when, after removal, the person would have no password, no passwordless\n * sign-in enabled and no other *usable* IdP connection left — which would lock\n * them out of their account entirely. Whether passwordless counts is decided by\n * the same tenant policy the sign-in flow applies, and connections to disabled\n * providers are not counted as a usable fallback (they cannot sign in).\n */\nexport class PersonIdentityProviderManager {\n\tpublic async listPersonIdentityProviders(db: DatabaseContext, personId: string): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await db.queryHandler.fetch(new PersonIdentityProvidersQuery(personId))\n\t}\n\n\tpublic async disconnectIdentityProvider(db: DatabaseContext, person: PersonRow, connectionId: string): Promise<DisconnectIDPResponse> {\n\t\treturn await db.transaction(async db => {\n\t\t\tconst connections = await db.queryHandler.fetch(new PersonIdentityProvidersQuery(person.id))\n\t\t\tconst connection = connections.find(it => it.id === connectionId)\n\t\t\tif (!connection) {\n\t\t\t\treturn new ResponseError('NOT_FOUND', `You are not connected to the identity provider connection \"${connectionId}\".`)\n\t\t\t}\n\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery(db.providers))\n\t\t\tconst hasPassword = person.password_hash !== null\n\t\t\tconst hasPasswordless = isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled)\n\t\t\tconst otherUsableConnections = connections.filter(it => it.id !== connection.id && it.identityProviderDisabledAt === null)\n\t\t\tconst wouldLockOut = !hasPassword && !hasPasswordless && otherUsableConnections.length === 0\n\t\t\tif (wouldLockOut) {\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'LAST_AUTH_METHOD',\n\t\t\t\t\t'Cannot disconnect the only remaining sign-in method. Set up a password or another sign-in method first.',\n\t\t\t\t)\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new DisconnectPersonIdentityProviderCommand(person.id, connection.id))\n\t\t\treturn new ResponseOk({ slug: connection.identityProviderSlug })\n\t\t})\n\t}\n}\n\nexport interface DisconnectIDPResult {\n\treadonly slug: string\n}\n\nexport type DisconnectIDPResponse = Response<DisconnectIDPResult, DisconnectIdpErrorCode>\n"],"names":["db"],"mappings":";;;;;;;;;;;;;AAkBO,MAAM,8BAA8B;AAAA,EAC1C,MAAa,4BAA4B,IAAqB,UAAwD;AACrH,WAAO,MAAM,GAAG,aAAa,MAAM,IAAI,6BAA6B,QAAQ,CAAC;AAAA,EAC9E;AAAA,EAEA,MAAa,2BAA2B,IAAqB,QAAmB,cAAsD;AACrI,WAAO,MAAM,GAAG,YAAY,OAAMA,QAAM;AACvC,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAM,IAAI,6BAA6B,OAAO,EAAE,CAAC;AAC3F,YAAM,aAAa,YAAY,KAAK,CAAA,OAAM,GAAG,OAAO,YAAY;AAChE,UAAI,CAAC,YAAY;AAChB,eAAO,IAAI,cAAc,aAAa,8DAA8D,YAAY,IAAI;AAAA,MACrH;AAEA,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAI,mBAAmBA,IAAG,SAAS,CAAC;AACtF,YAAM,cAAc,OAAO,kBAAkB;AAC7C,YAAM,kBAAkB,sBAAsB,cAAc,aAAa,SAAS,OAAO,oBAAoB;AAC7G,YAAM,yBAAyB,YAAY,OAAO,CAAA,OAAM,GAAG,OAAO,WAAW,MAAM,GAAG,+BAA+B,IAAI;AACzH,YAAM,eAAe,CAAC,eAAe,CAAC,mBAAmB,uBAAuB,WAAW;AAC3F,UAAI,cAAc;AACjB,eAAO,IAAI;AAAA,UACV;AAAA,UACA;AAAA,QAAA;AAAA,MAEF;AAEA,YAAMA,IAAG,WAAW,QAAQ,IAAI,wCAAwC,OAAO,IAAI,WAAW,EAAE,CAAC;AACjG,aAAO,IAAI,WAAW,EAAE,MAAM,WAAW,sBAAsB;AAAA,IAChE,CAAC;AAAA,EACF;AACD;"}

package/dist/development/src/model/service/idp/providers/AppleProvider.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AppleProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes'\nimport { catchTypesafe } from './helpers'\nimport { IDPValidationError } from '../IDPValidationError'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["Typesafe","OIDCConfigurationOptions","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer","importPKCS8","SignJWT"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,qBAAqBA,oBAAS;AAAA,EAC1CA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS;AAAA,IAChB,QAAQA,oBAAS;AAAA,IACjB,UAAUA,oBAAS;AAAA,IACnB,YAAYA,oBAAS;AAAA,EAAA,CACrB;AAAA,EACDC,UAAAA;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACN,kBAAA,MAAQ,QAAA;AAER,kBAAA,MAAA,yBAAwBC,QAAAA,cAAc,oBAAoBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAWD,QAAAA,cAAcE,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAeJ,QAAAA,cAAcK,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMG,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAEA,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAMC,oBAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAMC,KAAAA,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAIC,KAAAA,QAAQ,CAAA,CAAE,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAA,CAAO,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEjB,WAAO,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;;;"}
+{"version":3,"file":"AppleProvider.cjs","sources":["../../../../../../../../packages/engine-tenant-api/src/model/service/idp/providers/AppleProvider.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\nimport { IdentityProviderHandler, IDPResponse, InitIDPAuthResult } from '../IdentityProviderHandler.js'\nimport { OIDCConfiguration, OIDCConfigurationOptions, OIDCInitData, OIDCResponseData, OIDCSessionData } from './OIDCTypes.js'\nimport { catchTypesafe } from './helpers.js'\nimport { IDPValidationError } from '../IDPValidationError.js'\nimport { InvalidIDPConfigurationError } from '../InvalidIDPConfigurationError.js'\nimport { handleOIDCResponse, initOIDCAuth } from './OIDCHelpers.js'\nimport { Client, Issuer } from 'openid-client'\nimport { importPKCS8, SignJWT } from 'jose'\n\nexport const AppleConfiguration = Typesafe.intersection(\n\tTypesafe.object({\n\t\tkeyId: Typesafe.string,\n\t\tteamId: Typesafe.string,\n\t\tclientId: Typesafe.string,\n\t\tprivateKey: Typesafe.string,\n\t}),\n\tOIDCConfigurationOptions,\n)\n\ntype AppleConfiguration = ReturnType<typeof AppleConfiguration>\n\nconst APPLE_OIDC_CONFIGURATION_ENDPOINT = 'https://appleid.apple.com/.well-known/openid-configuration'\n\nexport class AppleProvider implements IdentityProviderHandler<AppleConfiguration> {\n\tprivate issuer: Issuer<Client> | undefined\n\n\tvalidateConfiguration = catchTypesafe(AppleConfiguration, InvalidIDPConfigurationError)\n\n\tpublic async initAuth(configuration: AppleConfiguration, data: unknown): Promise<InitIDPAuthResult> {\n\t\tconst initData = catchTypesafe(OIDCInitData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await initOIDCAuth(client, {\n\t\t\tscope: configuration.scope ?? configuration.claims,\n\t\t\t...initData,\n\t\t})\n\t}\n\n\tpublic async processResponse(configuration: AppleConfiguration, data: unknown): Promise<IDPResponse> {\n\t\tconst responseData = catchTypesafe(OIDCResponseData, IDPValidationError)(data)\n\t\tconst client = await this.createOIDCClient(configuration)\n\t\treturn await handleOIDCResponse(client, responseData)\n\t}\n\n\tgetPublicConfiguration({ privateKey, ...config }: AppleConfiguration): Partial<AppleConfiguration> {\n\t\treturn config\n\t}\n\n\tprivate async createOIDCClient(configuration: AppleConfiguration): Promise<Client> {\n\t\tthis.issuer ??= await Issuer.discover(APPLE_OIDC_CONFIGURATION_ENDPOINT)\n\t\tconst privateKey = await importPKCS8(configuration.privateKey, 'ES256')\n\n\t\tconst jwt = await new SignJWT({})\n\t\t\t.setProtectedHeader({ alg: 'ES256', typ: 'JWT', kid: configuration.keyId })\n\t\t\t.setIssuedAt()\n\t\t\t.setIssuer(configuration.teamId)\n\t\t\t.setAudience('https://appleid.apple.com')\n\t\t\t.setSubject(configuration.clientId)\n\t\t\t.setExpirationTime('10m')\n\t\t\t.sign(privateKey)\n\n\t\treturn new this.issuer.Client(\n\t\t\t{\n\t\t\t\tclient_id: configuration.clientId,\n\t\t\t\tclient_secret: jwt,\n\t\t\t\tresponse_types: [configuration.responseType || 'code'],\n\t\t\t},\n\t\t\tundefined,\n\t\t\t{\n\t\t\t\tadditionalAuthorizedParties: [...(configuration.additionalAuthorizedParties ?? [])],\n\t\t\t},\n\t\t)\n\t}\n}\n"],"names":["Typesafe","OIDCConfigurationOptions","catchTypesafe","InvalidIDPConfigurationError","OIDCInitData","IDPValidationError","initOIDCAuth","OIDCResponseData","handleOIDCResponse","Issuer","importPKCS8","SignJWT"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUO,MAAM,qBAAqBA,oBAAS;AAAA,EAC1CA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS;AAAA,IAChB,QAAQA,oBAAS;AAAA,IACjB,UAAUA,oBAAS;AAAA,IACnB,YAAYA,oBAAS;AAAA,EAAA,CACrB;AAAA,EACDC,UAAAA;AACD;AAIA,MAAM,oCAAoC;AAEnC,MAAM,cAAqE;AAAA,EAA3E,cAAA;AACN,kBAAA,MAAQ,QAAA;AAER,kBAAA,MAAA,yBAAwBC,QAAAA,cAAc,oBAAoBC,6BAAAA,4BAA4B,CAAA;AAAA,EAAA;AAAA,EAEtF,MAAa,SAAS,eAAmC,MAA2C;AACnG,UAAM,WAAWD,QAAAA,cAAcE,UAAAA,cAAcC,mBAAAA,kBAAkB,EAAE,IAAI;AACrE,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMC,YAAAA,aAAa,QAAQ;AAAA,MACjC,OAAO,cAAc,SAAS,cAAc;AAAA,MAC5C,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAa,gBAAgB,eAAmC,MAAqC;AACpG,UAAM,eAAeJ,QAAAA,cAAcK,UAAAA,kBAAkBF,mBAAAA,kBAAkB,EAAE,IAAI;AAC7E,UAAM,SAAS,MAAM,KAAK,iBAAiB,aAAa;AACxD,WAAO,MAAMG,YAAAA,mBAAmB,QAAQ,YAAY;AAAA,EACrD;AAAA,EAEA,uBAAuB,EAAE,YAAY,GAAG,UAA2D;AAClG,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,iBAAiB,eAAoD;AAClF,SAAK,WAAL,KAAK,SAAW,MAAMC,oBAAO,SAAS,iCAAiC;AACvE,UAAM,aAAa,MAAMC,KAAAA,YAAY,cAAc,YAAY,OAAO;AAEtE,UAAM,MAAM,MAAM,IAAIC,KAAAA,QAAQ,CAAA,CAAE,EAC9B,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,KAAK,cAAc,MAAA,CAAO,EACzE,YAAA,EACA,UAAU,cAAc,MAAM,EAC9B,YAAY,2BAA2B,EACvC,WAAW,cAAc,QAAQ,EACjC,kBAAkB,KAAK,EACvB,KAAK,UAAU;AAEjB,WAAO,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,QACC,WAAW,cAAc;AAAA,QACzB,eAAe;AAAA,QACf,gBAAgB,CAAC,cAAc,gBAAgB,MAAM;AAAA,MAAA;AAAA,MAEtD;AAAA,MACA;AAAA,QACC,6BAA6B,CAAC,GAAI,cAAc,+BAA+B,CAAA,CAAG;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AACD;;;"}