@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/production/src/model/service/PasswordlessSignInManager.js

@@ -1,6 +1,7 @@
 import "../queries/apiKey/ApiKeyQuery.js";
-import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
 import "@contember/database";
+import "../type/ApiKey.js";
+import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
 import { ImplementationException } from "../../exceptions.js";
 import { PersonQuery } from "../queries/person/PersonQuery.js";
 import "../authorization/PermissionActions.js";
@@ -9,7 +10,7 @@ import "../authorization/PermissionContext.js";
 import "../authorization/PermissionsFactory.js";
 import "@contember/schema";
 import { ResponseError, ResponseOk } from "../utils/Response.js";
-import "../type/ApiKey.js";
+import { MarkEmailVerifiedCommand } from "../commands/person/MarkEmailVerifiedCommand.js";
 import { ActivateOtpCommand } from "../commands/personToken/ActivateOtpCommand.js";
 import { CreatePersonTokenCommand } from "../commands/personToken/CreatePersonTokenCommand.js";
 import { InvalidateTokenCommand } from "../commands/personToken/InvalidateTokenCommand.js";
@@ -17,18 +18,21 @@ import { IncreaseOtpAttemptCommand } from "../commands/personToken/IncreaseOtpAt
 import { PersonTokenQuery } from "../queries/personToken/PersonTokenQuery.js";
 import { validateToken } from "../utils/token.js";
 import { getPreferredProject } from "./helpers/getPreferredProject.js";
+import { isPasswordlessEnabled } from "./helpers/isPasswordlessEnabled.js";
 import { AuthLogService } from "./AuthLogService.js";
 import { intervalToSeconds } from "../utils/interval.js";
+import { NextMailAttemptQuery } from "../queries/authLog/NextMailAttemptQuery.js";
 class PasswordlessSignInManager {
-  constructor(apiKeyManager, mailer, projectManager, otpAuthenticator) {
+  constructor(apiKeyManager, mailer, projectManager, otpManager, backupCodeManager) {
     this.apiKeyManager = apiKeyManager;
     this.mailer = mailer;
     this.projectManager = projectManager;
-    this.otpAuthenticator = otpAuthenticator;
+    this.otpManager = otpManager;
+    this.backupCodeManager = backupCodeManager;
   }
   async initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }) {
     return db.transaction(async (db2) => {
-      const configuration = await db2.queryHandler.fetch(new ConfigurationQuery());
+      const configuration = await db2.queryHandler.fetch(new ConfigurationQuery(db2.providers));
       if (configuration.passwordless.enabled === "never") {
         return new ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled", {
           [AuthLogService.Key]: new AuthLogService.Bag({})
@@ -42,7 +46,7 @@ class PasswordlessSignInManager {
           })
         });
       }
-      if (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
+      if (!isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {
         return new ResponseError("PASSWORDLESS_DISABLED", "Passwordless sign-in is disabled for this person", {
           [AuthLogService.Key]: new AuthLogService.Bag({
             personInput: email,
@@ -50,6 +54,22 @@ class PasswordlessSignInManager {
           })
         });
       }
+      const nextAllowed = await db2.queryHandler.fetch(
+        new NextMailAttemptQuery(email, "passwordless_login_init", "passwordless_login")
+      );
+      if (nextAllowed > /* @__PURE__ */ new Date()) {
+        const retryAfterSeconds = Math.max(1, Math.ceil((nextAllowed.getTime() - Date.now()) / 1e3));
+        return new ResponseError(
+          "RATE_LIMIT_EXCEEDED",
+          `Too many passwordless sign-in requests for this email. Retry after ${retryAfterSeconds}s.`,
+          {
+            [AuthLogService.Key]: new AuthLogService.Bag({
+              personInput: email,
+              personId: person.id
+            })
+          }
+        );
+      }
       const createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(
         person.id,
         intervalToSeconds(configuration.passwordless.expiration) / 60
@@ -91,7 +111,7 @@ class PasswordlessSignInManager {
     urlObj.searchParams.set("email", email);
     return urlObj.toString();
   }
-  async signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }) {
+  async signInPasswordless({ db, expiration, token, requestId, mfaOtp, backupCode, validationType, requestInfo, trustForwardedInfo }) {
     return db.transaction(async (db2) => {
       const tokenResult = await db2.queryHandler.fetch(PersonTokenQuery.byId(requestId, "passwordless"));
       const tokenValidationResult = validateToken({
@@ -127,8 +147,28 @@ class PasswordlessSignInManager {
           })
         });
       }
-      if (personRow.otp_uri && personRow.otp_activated_at) {
-        if (!mfaOtp) {
+      let usedBackupCode = false;
+      if (personRow.otp_secret && personRow.otp_activated_at) {
+        if (mfaOtp) {
+          if (!await this.otpManager.verifyOtp(db2, personRow, mfaOtp)) {
+            return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", {
+              [AuthLogService.Key]: new AuthLogService.Bag({
+                personId: personRow.id,
+                tokenId: tokenResult?.id
+              })
+            });
+          }
+        } else if (backupCode) {
+          if (!await this.backupCodeManager.verifyAndConsume(db2, personRow, backupCode)) {
+            return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", {
+              [AuthLogService.Key]: new AuthLogService.Bag({
+                personId: personRow.id,
+                tokenId: tokenResult?.id
+              })
+            });
+          }
+          usedBackupCode = true;
+        } else {
           return new ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, {
             [AuthLogService.Key]: new AuthLogService.Bag({
               personId: personRow.id,
@@ -136,23 +176,23 @@ class PasswordlessSignInManager {
             })
           });
         }
-        if (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {
-          return new ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", {
-            [AuthLogService.Key]: new AuthLogService.Bag({
-              personId: personRow.id,
-              tokenId: tokenResult?.id
-            })
-          });
-        }
       }
       await db2.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id));
-      const sessionToken = await this.apiKeyManager.createSessionApiKey(db2, personRow.identity_id, expiration);
+      const emailVerifiedNow = personRow.email_verified_at === null;
+      if (emailVerifiedNow) {
+        await db2.commandBus.execute(new MarkEmailVerifiedCommand(personRow.id));
+      }
+      const sessionToken = await this.apiKeyManager.createSessionApiKey(db2, personRow.identity_id, expiration, requestInfo, trustForwardedInfo);
       return new ResponseOk({
         person: personRow,
         token: sessionToken,
+        usedBackupCode,
         [AuthLogService.Key]: new AuthLogService.Bag({
           personId: personRow.id,
-          tokenId: tokenResult?.id
+          tokenId: tokenResult?.id,
+          // Record that this sign-in also satisfied e-mail verification, so
+          // the audit trail shows when/how the address became verified.
+          eventData: emailVerifiedNow ? { emailVerified: true } : void 0
         })
       });
     });
@@ -185,18 +225,6 @@ class PasswordlessSignInManager {
       });
     });
   }
-  isEnabled(globalValue, personValue) {
-    switch (globalValue) {
-      case "always":
-        return true;
-      case "never":
-        return false;
-      case "optIn":
-        return personValue === true;
-      case "optOut":
-        return personValue !== false;
-    }
-  }
 }
 export {
   PasswordlessSignInManager

package/dist/production/src/model/service/PasswordlessSignInManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordlessSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport {\n\tActivatePasswordlessOtpErrorCode,\n\tConfigPolicy,\n\tInitSignInPasswordlessErrorCode,\n\tInitSignInPasswordlessResult,\n\tSignInPasswordlessErrorCode,\n} from '../../schema'\nimport { DatabaseContext, validateToken } from '../utils'\nimport { UserMailer } from '../mailing'\nimport { ActivateOtpCommand, CreatePersonTokenCommand, IncreaseOtpAttemptCommand, InvalidateTokenCommand } from '../commands'\nimport { getPreferredProject } from './helpers/getPreferredProject'\nimport { ProjectManager } from './ProjectManager'\nimport { PermissionContext } from '../authorization'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery'\nimport { ImplementationException } from '../../exceptions'\nimport { OtpAuthenticator } from './OtpAuthenticator'\nimport { PersonToken } from '../type'\nimport { AuthLogService } from './AuthLogService'\nimport { intervalToSeconds } from '../utils/interval'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery())\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!this.isEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(\n\t\t\t\tperson.id,\n\t\t\t\tintervalToSeconds(configuration.passwordless.expiration) / 60,\n\t\t\t)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\trequestId: result.id,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string | null, token: string, requestId: string, email: string): string | null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\texpiration?: number\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.otp_uri && personRow.otp_activated_at) {\n\t\t\t\tif (!mfaOtp) {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\n\t\t\t\tif (!this.otpAuthenticator.validate({ uri: personRow.otp_uri }, mfaOtp)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate isEnabled(globalValue: ConfigPolicy, personValue: boolean | null): boolean {\n\t\tswitch (globalValue) {\n\t\t\tcase 'always':\n\t\t\t\treturn true\n\t\t\tcase 'never':\n\t\t\t\treturn false\n\t\t\tcase 'optIn':\n\t\t\t\treturn personValue === true\n\t\t\tcase 'optOut':\n\t\t\t\treturn personValue !== false\n\t\t}\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<\n\t\tInitSignInPasswordlessResult & {\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t},\n\t\tInitSignInPasswordlessErrorCode,\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}\n\t>\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t},\n\t\tActivatePasswordlessOtpErrorCode,\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}\n\t>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,kBAChB;AAJgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AACrE,WAAO,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAI,oBAAoB;AAC1E,UAAI,cAAc,aAAa,YAAY,SAAS;AACnD,eAAO,IAAI,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI,CAAA,CAAE;AAAA,QAAA,CAC/C;AAAA,MACF;AAEA,YAAM,SAAS,MAAMA,IAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAI,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UAAA,CACb;AAAA,QAAA,CACD;AAAA,MACF;AACA,UAAI,CAAC,KAAK,UAAU,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AACrF,eAAO,IAAI,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UAAA,CACjB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,qBAAqB,yBAAyB;AAAA,QACnD,OAAO;AAAA,QACP,kBAAkB,cAAc,aAAa,UAAU,IAAI;AAAA,MAAA;AAE5D,YAAM,SAAS,MAAMA,IAAG,WAAW,QAAQ,kBAAkB;AAE7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEtG,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAU,oBAAoB,UAAU,eAAe,IAAI;AAEjE,YAAM,KAAK,OAAO,sBAAsBA,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,QACtB,WAAW,OAAO;AAAA,MAAA,GAChB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAI,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAAA,CAChB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEQ,UAAU,KAAoB,OAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACT,aAAO;AAAA,IACR;AACA,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,WAAO,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,aAAa,IAAI,cAAc,SAAS;AAC/C,WAAO,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAA;AAAA,EACf;AAAA,EAEA,MAAM,mBAAmB,EAAE,IAAI,YAAY,OAAO,WAAW,QAAQ,kBAOH;AACjE,WAAO,GAAG,YAAY,OAAOA,QAAsE;AAClG,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAA;AAAA,QAClB;AAAA,MAAA,CACA;AACD,UAAI,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAI,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAC3E;AACA,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAA;AAAA,UACrC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AACjB,cAAM,IAAI,wBAAA;AAAA,MACX;AACA,YAAM,YAAY,MAAMA,IAAG,aAAa,MAAM,YAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAI,wBAAA;AAAA,MACX;AACA,UAAI,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAI,cAAc,mBAAmB,sBAAsB;AAAA,UACjE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,UAAI,UAAU,WAAW,UAAU,kBAAkB;AACpD,YAAI,CAAC,QAAQ;AACZ,iBAAO,IAAI,cAAc,gBAAgB,yCAAyC;AAAA,YACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YAAA,CACtB;AAAA,UAAA,CACD;AAAA,QACF;AAEA,YAAI,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,UAAU,WAAW,MAAM,GAAG;AACxE,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YAAA,CACtB;AAAA,UAAA,CACD;AAAA,QACF;AAAA,MACD;AAEA,YAAMA,IAAG,WAAW,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AACvF,YAAM,eAAe,MAAM,KAAK,cAAc,oBAAoBA,KAAI,UAAU,aAAa,UAAU;AAEvG,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA,QAAA,CACtB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,EAAE,IAAI,OAAO,WAAW,WAKiB;AACtE,WAAO,GAAG,YAAY,OAAOA,QAA2E;AACvG,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAA;AAAA,QAClB,gBAAgB;AAAA,MAAA,CAChB;AACD,UAAI,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAA;AAAA,UACrC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAMA,IAAG,WAAW,QAAQ,IAAI,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QAAA,CACtB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEQ,UAAU,aAA2B,aAAsC;AAClF,YAAQ,aAAA;AAAA,MACP,KAAK;AACJ,eAAO;AAAA,MACR,KAAK;AACJ,eAAO;AAAA,MACR,KAAK;AACJ,eAAO,gBAAgB;AAAA,MACxB,KAAK;AACJ,eAAO,gBAAgB;AAAA,IAAA;AAAA,EAE1B;AACD;"}
+{"version":3,"file":"PasswordlessSignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PasswordlessSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey/index.js'\nimport { ConfigurationQuery, PersonQuery, PersonRow } from '../queries/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport {\n\tActivatePasswordlessOtpErrorCode,\n\tInitSignInPasswordlessErrorCode,\n\tInitSignInPasswordlessResult,\n\tSignInPasswordlessErrorCode,\n} from '../../schema/index.js'\nimport { DatabaseContext, validateToken } from '../utils/index.js'\nimport { UserMailer } from '../mailing/index.js'\nimport {\n\tActivateOtpCommand,\n\tApiKeyRequestInfo,\n\tCreatePersonTokenCommand,\n\tIncreaseOtpAttemptCommand,\n\tInvalidateTokenCommand,\n\tMarkEmailVerifiedCommand,\n} from '../commands/index.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { isPasswordlessEnabled } from './helpers/isPasswordlessEnabled.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { OtpManager } from './OtpManager.js'\nimport { BackupCodeManager } from './BackupCodeManager.js'\nimport { PersonToken } from '../type/index.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { intervalToSeconds } from '../utils/interval.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\n\nclass PasswordlessSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t) {}\n\n\tasync initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {\n\t\tdb: DatabaseContext\n\t\tpermissionContext: PermissionContext\n\t\temail: string\n\t\tmailVariant?: string\n\t\tmailProject?: string\n\t}): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse> => {\n\t\t\tconst configuration = await db.queryHandler.fetch(new ConfigurationQuery(db.providers))\n\t\t\tif (configuration.passwordless.enabled === 'never') {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst person = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\t\tif (!person) {\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!isPasswordlessEnabled(configuration.passwordless.enabled, person.passwordless_enabled)) {\n\t\t\t\treturn new ResponseError('PASSWORDLESS_DISABLED', 'Passwordless sign-in is disabled for this person', {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\t// Per-email exponential backoff on outbound mails — bound the spam\n\t\t\t// pressure on a real user even if attackers spray the endpoint.\n\t\t\t// Reuses login_* backoff config against person_auth_log.\n\t\t\tconst nextAllowed = await db.queryHandler.fetch(\n\t\t\t\tnew NextMailAttemptQuery(email, 'passwordless_login_init', 'passwordless_login'),\n\t\t\t)\n\t\t\tif (nextAllowed > new Date()) {\n\t\t\t\tconst retryAfterSeconds = Math.max(1, Math.ceil((nextAllowed.getTime() - Date.now()) / 1000))\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'RATE_LIMIT_EXCEEDED',\n\t\t\t\t\t`Too many passwordless sign-in requests for this email. Retry after ${retryAfterSeconds}s.`,\n\t\t\t\t\t{\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonInput: email,\n\t\t\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t},\n\t\t\t\t)\n\t\t\t}\n\n\t\t\tconst createTokenCommand = CreatePersonTokenCommand.createPasswordlessRequest(\n\t\t\t\tperson.id,\n\t\t\t\tintervalToSeconds(configuration.passwordless.expiration) / 60,\n\t\t\t)\n\t\t\tconst result = await db.commandBus.execute(createTokenCommand)\n\n\t\t\tconst url = this.formatUrl(configuration.passwordless.url ?? null, result.token, result.id, email) ?? undefined\n\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(db, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, mailProject ?? null)\n\n\t\t\tawait this.mailer.sendPasswordlessEmail(db, {\n\t\t\t\temail,\n\t\t\t\ttoken: result.token,\n\t\t\t\turl,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\trequestId: result.id,\n\t\t\t}, {\n\t\t\t\tvariant: mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t})\n\n\t\t\treturn new ResponseOk({\n\t\t\t\trequestId: result.id,\n\t\t\t\texpiresAt: result.expiresAt,\n\t\t\t\tperson,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\ttokenId: result.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tprivate formatUrl(url: string | null, token: string, requestId: string, email: string): string | null {\n\t\tif (!url) {\n\t\t\treturn null\n\t\t}\n\t\tconst urlObj = new URL(url)\n\t\turlObj.searchParams.set('token', token)\n\t\turlObj.searchParams.set('request_id', requestId)\n\t\turlObj.searchParams.set('email', email)\n\t\treturn urlObj.toString()\n\t}\n\n\tasync signInPasswordless({ db, expiration, token, requestId, mfaOtp, backupCode, validationType, requestInfo, trustForwardedInfo }: {\n\t\tdb: DatabaseContext\n\t\tvalidationType: PersonToken.ValidationType\n\t\trequestId: string\n\t\ttoken: string\n\t\tmfaOtp?: string\n\t\tbackupCode?: string\n\t\texpiration?: number\n\t\trequestInfo?: ApiKeyRequestInfo\n\t\ttrustForwardedInfo?: boolean\n\t}): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.SignInPasswordlessResponse> => {\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType,\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\tif (tokenValidationResult.error === 'TOKEN_INVALID' && validationType === 'otp') {\n\t\t\t\t\tawait db.commandBus.execute(new IncreaseOtpAttemptCommand(tokenResult!.id))\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\t\t\tif (!tokenResult) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tconst personRow = await db.queryHandler.fetch(PersonQuery.byId(tokenValidationResult.result.person_id))\n\t\t\tif (!personRow) {\n\t\t\t\tthrow new ImplementationException()\n\t\t\t}\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tlet usedBackupCode = false\n\t\t\tif (personRow.otp_secret && personRow.otp_activated_at) {\n\t\t\t\tif (mfaOtp) {\n\t\t\t\t\tif (!await this.otpManager.verifyOtp(db, personRow, mfaOtp)) {\n\t\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t})\n\t\t\t\t\t}\n\t\t\t\t} else if (backupCode) {\n\t\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(db, personRow, backupCode)) {\n\t\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t})\n\t\t\t\t\t}\n\t\t\t\t\tusedBackupCode = true\n\t\t\t\t} else {\n\t\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t}\n\t\t\t// NOTE: passwordless sign-in does NOT enforce mandatory-MFA enrollment.\n\t\t\t// A person with no MFA factor is let through even when an auth_policy would\n\t\t\t// require MFA — enroll-via-sign-in is password-only, and passwordless email\n\t\t\t// access is itself a possession factor. An existing factor (TOTP/backup\n\t\t\t// code, handled above) is still verified. Documented limitation (A06).\n\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\t\t// Receiving and clicking the magic link proves ownership of the address,\n\t\t\t// so a successful passwordless sign-in also satisfies the e-mail\n\t\t\t// verification requirement. Without this, a required-but-unverified\n\t\t\t// account could obtain a session here while being blocked from password\n\t\t\t// sign-in (SignInManager) — an inconsistent, exploitable gap.\n\t\t\tconst emailVerifiedNow = personRow.email_verified_at === null\n\t\t\tif (emailVerifiedNow) {\n\t\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(personRow.id))\n\t\t\t}\n\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration, requestInfo, trustForwardedInfo)\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\tusedBackupCode,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t// Record that this sign-in also satisfied e-mail verification, so\n\t\t\t\t\t// the audit trail shows when/how the address became verified.\n\t\t\t\t\teventData: emailVerifiedNow ? { emailVerified: true } : undefined,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync activatePasswordlessOtp({ db, token, requestId, otpHash }: {\n\t\tdb: DatabaseContext\n\t\trequestId: string\n\t\ttoken: string\n\t\totpHash: string\n\t}): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> {\n\t\treturn db.transaction(async (db): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse> => {\n\t\t\tconst tokenResult = await db.queryHandler.fetch(PersonTokenQuery.byId(requestId, 'passwordless'))\n\t\t\tconst tokenValidationResult = validateToken({\n\t\t\t\tentry: tokenResult,\n\t\t\t\ttoken,\n\t\t\t\tnow: db.providers.now(),\n\t\t\t\tvalidationType: 'token',\n\t\t\t})\n\t\t\tif (!tokenValidationResult.ok) {\n\t\t\t\treturn new ResponseError(tokenValidationResult.error, tokenValidationResult.errorMessage, {\n\t\t\t\t\t...tokenValidationResult.metadata ?? {},\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tawait db.commandBus.execute(new ActivateOtpCommand(tokenValidationResult.result.id, otpHash))\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: tokenResult?.person_id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: tokenResult?.person_id,\n\t\t\t\t\ttokenId: tokenResult?.id,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n}\n\nnamespace PasswordlessSignInManager {\n\texport type InitSignInPasswordlessResponse = Response<\n\t\tInitSignInPasswordlessResult & {\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t},\n\t\tInitSignInPasswordlessErrorCode,\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}\n\t>\n\n\tinterface SignInPasswordlessResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\t/** True when MFA was satisfied by consuming a backup code (instead of a TOTP token). */\n\t\treadonly usedBackupCode?: boolean\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\texport type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\n\texport type ActivatePasswordlessOtpResponse = Response<\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t},\n\t\tActivatePasswordlessOtpErrorCode,\n\t\t{\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}\n\t>\n}\n\nexport { PasswordlessSignInManager }\n"],"names":["db"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgCA,MAAM,0BAA0B;AAAA,EAC/B,YACkB,eACA,QACA,gBACA,YACA,mBAChB;AALgB,SAAA,gBAAA;AACA,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBAAuB,EAAE,IAAI,mBAAmB,aAAa,aAAa,SAMV;AACrE,WAAO,GAAG,YAAY,OAAOA,QAA0E;AACtG,YAAM,gBAAgB,MAAMA,IAAG,aAAa,MAAM,IAAI,mBAAmBA,IAAG,SAAS,CAAC;AACtF,UAAI,cAAc,aAAa,YAAY,SAAS;AACnD,eAAO,IAAI,cAAc,yBAAyB,oCAAoC;AAAA,UACrF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI,CAAA,CAAE;AAAA,QAAA,CAC/C;AAAA,MACF;AAEA,YAAM,SAAS,MAAMA,IAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AACrE,UAAI,CAAC,QAAQ;AACZ,eAAO,IAAI,cAAc,oBAAoB,UAAU,KAAK,cAAc;AAAA,UACzE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,UAAA,CACb;AAAA,QAAA,CACD;AAAA,MACF;AACA,UAAI,CAAC,sBAAsB,cAAc,aAAa,SAAS,OAAO,oBAAoB,GAAG;AAC5F,eAAO,IAAI,cAAc,yBAAyB,oDAAoD;AAAA,UACrG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa;AAAA,YACb,UAAU,OAAO;AAAA,UAAA,CACjB;AAAA,QAAA,CACD;AAAA,MACF;AAKA,YAAM,cAAc,MAAMA,IAAG,aAAa;AAAA,QACzC,IAAI,qBAAqB,OAAO,2BAA2B,oBAAoB;AAAA,MAAA;AAEhF,UAAI,cAAc,oBAAI,QAAQ;AAC7B,cAAM,oBAAoB,KAAK,IAAI,GAAG,KAAK,MAAM,YAAY,QAAA,IAAY,KAAK,IAAA,KAAS,GAAI,CAAC;AAC5F,eAAO,IAAI;AAAA,UACV;AAAA,UACA,sEAAsE,iBAAiB;AAAA,UACvF;AAAA,YACC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,aAAa;AAAA,cACb,UAAU,OAAO;AAAA,YAAA,CACjB;AAAA,UAAA;AAAA,QACF;AAAA,MAEF;AAEA,YAAM,qBAAqB,yBAAyB;AAAA,QACnD,OAAO;AAAA,QACP,kBAAkB,cAAc,aAAa,UAAU,IAAI;AAAA,MAAA;AAE5D,YAAM,SAAS,MAAMA,IAAG,WAAW,QAAQ,kBAAkB;AAE7D,YAAM,MAAM,KAAK,UAAU,cAAc,aAAa,OAAO,MAAM,OAAO,OAAO,OAAO,IAAI,KAAK,KAAK;AAEtG,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsBA,KAAI,OAAO,aAAa,iBAAiB;AAC1G,YAAM,UAAU,oBAAoB,UAAU,eAAe,IAAI;AAEjE,YAAM,KAAK,OAAO,sBAAsBA,KAAI;AAAA,QAC3C;AAAA,QACA,OAAO,OAAO;AAAA,QACd;AAAA,QACA,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,QACtB,WAAW,OAAO;AAAA,MAAA,GAChB;AAAA,QACF,SAAS,eAAe;AAAA,QACxB,WAAW,SAAS,MAAM;AAAA,MAAA,CAC1B;AAED,aAAO,IAAI,WAAW;AAAA,QACrB,WAAW,OAAO;AAAA,QAClB,WAAW,OAAO;AAAA,QAClB;AAAA,QACA,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,UACb,UAAU,OAAO;AAAA,UACjB,SAAS,OAAO;AAAA,QAAA,CAChB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEQ,UAAU,KAAoB,OAAe,WAAmB,OAA8B;AACrG,QAAI,CAAC,KAAK;AACT,aAAO;AAAA,IACR;AACA,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,WAAO,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,aAAa,IAAI,cAAc,SAAS;AAC/C,WAAO,aAAa,IAAI,SAAS,KAAK;AACtC,WAAO,OAAO,SAAA;AAAA,EACf;AAAA,EAEA,MAAM,mBAAmB,EAAE,IAAI,YAAY,OAAO,WAAW,QAAQ,YAAY,gBAAgB,aAAa,mBAAA,GAU5C;AACjE,WAAO,GAAG,YAAY,OAAOA,QAAsE;AAClG,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAA;AAAA,QAClB;AAAA,MAAA,CACA;AACD,UAAI,CAAC,sBAAsB,IAAI;AAC9B,YAAI,sBAAsB,UAAU,mBAAmB,mBAAmB,OAAO;AAChF,gBAAMA,IAAG,WAAW,QAAQ,IAAI,0BAA0B,YAAa,EAAE,CAAC;AAAA,QAC3E;AACA,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAA;AAAA,UACrC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AACA,UAAI,CAAC,aAAa;AACjB,cAAM,IAAI,wBAAA;AAAA,MACX;AACA,YAAM,YAAY,MAAMA,IAAG,aAAa,MAAM,YAAY,KAAK,sBAAsB,OAAO,SAAS,CAAC;AACtG,UAAI,CAAC,WAAW;AACf,cAAM,IAAI,wBAAA;AAAA,MACX;AACA,UAAI,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAI,cAAc,mBAAmB,sBAAsB;AAAA,UACjE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,UAAU;AAAA,YACpB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,UAAI,iBAAiB;AACrB,UAAI,UAAU,cAAc,UAAU,kBAAkB;AACvD,YAAI,QAAQ;AACX,cAAI,CAAC,MAAM,KAAK,WAAW,UAAUA,KAAI,WAAW,MAAM,GAAG;AAC5D,mBAAO,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,cAChF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,gBAC5C,UAAU,UAAU;AAAA,gBACpB,SAAS,aAAa;AAAA,cAAA,CACtB;AAAA,YAAA,CACD;AAAA,UACF;AAAA,QACD,WAAW,YAAY;AACtB,cAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiBA,KAAI,WAAW,UAAU,GAAG;AAC9E,mBAAO,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,cAChF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,gBAC5C,UAAU,UAAU;AAAA,gBACpB,SAAS,aAAa;AAAA,cAAA,CACtB;AAAA,YAAA,CACD;AAAA,UACF;AACA,2BAAiB;AAAA,QAClB,OAAO;AACN,iBAAO,IAAI,cAAc,gBAAgB,yCAAyC;AAAA,YACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,cAC5C,UAAU,UAAU;AAAA,cACpB,SAAS,aAAa;AAAA,YAAA,CACtB;AAAA,UAAA,CACD;AAAA,QACF;AAAA,MACD;AAOA,YAAMA,IAAG,WAAW,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AAMvF,YAAM,mBAAmB,UAAU,sBAAsB;AACzD,UAAI,kBAAkB;AACrB,cAAMA,IAAG,WAAW,QAAQ,IAAI,yBAAyB,UAAU,EAAE,CAAC;AAAA,MACvE;AACA,YAAM,eAAe,MAAM,KAAK,cAAc,oBAAoBA,KAAI,UAAU,aAAa,YAAY,aAAa,kBAAkB;AAExI,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP;AAAA,QACA,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,SAAS,aAAa;AAAA;AAAA;AAAA,UAGtB,WAAW,mBAAmB,EAAE,eAAe,SAAS;AAAA,QAAA,CACxD;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,wBAAwB,EAAE,IAAI,OAAO,WAAW,WAKiB;AACtE,WAAO,GAAG,YAAY,OAAOA,QAA2E;AACvG,YAAM,cAAc,MAAMA,IAAG,aAAa,MAAM,iBAAiB,KAAK,WAAW,cAAc,CAAC;AAChG,YAAM,wBAAwB,cAAc;AAAA,QAC3C,OAAO;AAAA,QACP;AAAA,QACA,KAAKA,IAAG,UAAU,IAAA;AAAA,QAClB,gBAAgB;AAAA,MAAA,CAChB;AACD,UAAI,CAAC,sBAAsB,IAAI;AAC9B,eAAO,IAAI,cAAc,sBAAsB,OAAO,sBAAsB,cAAc;AAAA,UACzF,GAAG,sBAAsB,YAAY,CAAA;AAAA,UACrC,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,UAAU,aAAa;AAAA,YACvB,SAAS,aAAa;AAAA,UAAA,CACtB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAMA,IAAG,WAAW,QAAQ,IAAI,mBAAmB,sBAAsB,OAAO,IAAI,OAAO,CAAC;AAE5F,aAAO,IAAI,WAAW;AAAA,QACrB,QAAQ,aAAa;AAAA,QACrB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,aAAa;AAAA,UACvB,SAAS,aAAa;AAAA,QAAA,CACtB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AACD;"}

package/dist/production/src/model/service/PersonAccessManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonAccessManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand'\nimport { ApiKeyManager } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DisablePersonErrorCode } from '../../schema'\n\nclass PersonAccessManager {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonDisableAccessResponse> {\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tif (person.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, person.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, person.identity_id)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":["ResponseError","ResponseOk","DisablePersonCommand"],"mappings":";;;;AAOA,MAAM,oBAAoB;AAAA,EACzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,WAA4B,QAAyD;AACxG,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC/C,UAAI,OAAO,gBAAgB,MAAM;AAChC,eAAO,IAAIA,SAAAA,cAAc,2BAA2B,4BAA4B;AAAA,MACjF;AAGA,YAAM,KAAK,qBAAqB,KAAK,OAAO,EAAE;AAC9C,YAAM,KAAK,uBAAuB,KAAK,OAAO,WAAW;AAEzD,aAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,QAAQ,CAAC;AAAA,EACtE;AAAA,EAEA,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAC5E;AACD;;"}
+{"version":3,"file":"PersonAccessManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { PersonQuery, PersonRow } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand.js'\nimport { ApiKeyManager } from './apiKey/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { DisablePersonErrorCode } from '../../schema/index.js'\n\nclass PersonAccessManager {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonDisableAccessResponse> {\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tif (person.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, person.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, person.identity_id)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":["ResponseError","ResponseOk","DisablePersonCommand"],"mappings":";;;;AAOA,MAAM,oBAAoB;AAAA,EACzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,WAA4B,QAAyD;AACxG,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC/C,UAAI,OAAO,gBAAgB,MAAM;AAChC,eAAO,IAAIA,SAAAA,cAAc,2BAA2B,4BAA4B;AAAA,MACjF;AAGA,YAAM,KAAK,qBAAqB,KAAK,OAAO,EAAE;AAC9C,YAAM,KAAK,uBAAuB,KAAK,OAAO,WAAW;AAEzD,aAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,QAAQ,CAAC;AAAA,EACtE;AAAA,EAEA,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAC5E;AACD;;"}

package/dist/production/src/model/service/PersonAccessManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonAccessManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand'\nimport { ApiKeyManager } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DisablePersonErrorCode } from '../../schema'\n\nclass PersonAccessManager {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonDisableAccessResponse> {\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tif (person.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, person.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, person.identity_id)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":[],"mappings":";;AAOA,MAAM,oBAAoB;AAAA,EACzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,WAA4B,QAAyD;AACxG,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC/C,UAAI,OAAO,gBAAgB,MAAM;AAChC,eAAO,IAAI,cAAc,2BAA2B,4BAA4B;AAAA,MACjF;AAGA,YAAM,KAAK,qBAAqB,KAAK,OAAO,EAAE;AAC9C,YAAM,KAAK,uBAAuB,KAAK,OAAO,WAAW;AAEzD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,CAAC;AAAA,EACtE;AAAA,EAEA,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAC5E;AACD;"}
+{"version":3,"file":"PersonAccessManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { PersonQuery, PersonRow } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand.js'\nimport { ApiKeyManager } from './apiKey/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { DisablePersonErrorCode } from '../../schema/index.js'\n\nclass PersonAccessManager {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonDisableAccessResponse> {\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tif (person.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, person.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, person.identity_id)\n\n\t\t\treturn new ResponseOk(null)\n\t\t})\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":[],"mappings":";;AAOA,MAAM,oBAAoB;AAAA,EACzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,WAA4B,QAAyD;AACxG,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC/C,UAAI,OAAO,gBAAgB,MAAM;AAChC,eAAO,IAAI,cAAc,2BAA2B,4BAA4B;AAAA,MACjF;AAGA,YAAM,KAAK,qBAAqB,KAAK,OAAO,EAAE;AAC9C,YAAM,KAAK,uBAAuB,KAAK,OAAO,WAAW;AAEzD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,CAAC;AAAA,EACtE;AAAA,EAEA,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAC5E;AACD;"}

package/dist/production/src/model/service/PersonManager.cjs

@@ -4,14 +4,16 @@ const ChangeProfileCommand = require("../commands/person/ChangeProfileCommand.cj
 const Response = require("../utils/Response.cjs");
 require("../queries/apiKey/ApiKeyQuery.cjs");
 require("@contember/database");
+require("../type/ApiKey.cjs");
 const PersonQuery = require("../queries/person/PersonQuery.cjs");
+const PersonsQuery = require("../queries/person/PersonsQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
 require("../authorization/PermissionContext.cjs");
 require("../authorization/PermissionsFactory.cjs");
 require("@contember/schema");
-require("../type/ApiKey.cjs");
 require("node:crypto");
+const email = require("../utils/email.cjs");
 const TogglePersonPasswordlessCommand = require("../commands/person/TogglePersonPasswordlessCommand.cjs");
 class PersonManager {
   constructor(emailValidator) {
@@ -22,14 +24,18 @@ class PersonManager {
       PersonQuery.PersonQuery.byId(personId)
     );
   }
+  async listPersons(dbContext, filter = {}, limit, offset) {
+    return await dbContext.queryHandler.fetch(new PersonsQuery.PersonsQuery(filter, limit, offset));
+  }
   async changeProfile(dbContext, person, data) {
-    if (data.email !== void 0 && person.email !== data.email) {
+    const emailChanging = data.email !== void 0 && person.email !== email.normalizeEmail(data.email);
+    if (emailChanging) {
       const validationError = await this.emailValidator.validateEmail(dbContext, data.email);
       if (validationError !== null) {
         return new Response.ResponseError(validationError.error, validationError.errorMessage);
       }
     }
-    await dbContext.commandBus.execute(new ChangeProfileCommand.ChangeProfileCommand(person.id, data));
+    await dbContext.commandBus.execute(new ChangeProfileCommand.ChangeProfileCommand(person.id, data, emailChanging));
     return new Response.ResponseOk(null);
   }
   async togglePasswordless(dbContext, person, value) {

package/dist/production/src/model/service/PersonManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator'\nimport { TogglePersonPasswordlessCommand } from '../commands'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\tif (data.email !== undefined && person.email !== data.email) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":["PersonQuery","ResponseError","ChangeProfileCommand","ResponseOk","TogglePersonPasswordlessCommand"],"mappings":";;;;;;;;;;;;;;;AAOA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AAC7F,WAAO,MAAM,UAAU,aAAa;AAAA,MACnCA,YAAAA,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AACzI,QAAI,KAAK,UAAU,UAAa,OAAO,UAAU,KAAK,OAAO;AAC5D,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAK;AACrF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAIC,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,OAAO,IAAI,IAAI,CAAC;AAC5E,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACvH,UAAM,UAAU,WAAW,QAAQ,IAAIC,gCAAAA,gCAAgC,OAAO,IAAI,KAAK,CAAC;AACxF,WAAO,IAAID,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}
+{"version":3,"file":"PersonManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { PersonListRow, PersonQuery, PersonRow, PersonsQuery, PersonsQueryFilter } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { TogglePersonPasswordlessCommand } from '../commands/index.js'\nimport { normalizeEmail } from '../utils/email.js'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync listPersons(\n\t\tdbContext: DatabaseContext,\n\t\tfilter: PersonsQueryFilter = {},\n\t\tlimit?: number | null,\n\t\toffset?: number | null,\n\t): Promise<PersonListRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new PersonsQuery(filter, limit, offset))\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\t// Compare normalized: a case-/whitespace-only edit is not a real change, so\n\t\t// it neither needs re-validation nor should drop the verified status.\n\t\tconst emailChanging = data.email !== undefined && person.email !== normalizeEmail(data.email)\n\t\tif (emailChanging) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email!)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\t// On a real e-mail change via the direct path (admin changeProfile, or\n\t\t// changeMyProfile when no verification applies) the new address has not\n\t\t// been proven, so any prior verification no longer holds — clear it. For\n\t\t// verification-required accounts this re-arms the sign-in gate; for the\n\t\t// rest email_verified_at was already null, so it is a harmless no-op.\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data, emailChanging))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":["PersonQuery","PersonsQuery","normalizeEmail","ResponseError","ChangeProfileCommand","ResponseOk","TogglePersonPasswordlessCommand"],"mappings":";;;;;;;;;;;;;;;;;AAQA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AAC7F,WAAO,MAAM,UAAU,aAAa;AAAA,MACnCA,YAAAA,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,YACL,WACA,SAA6B,CAAA,GAC7B,OACA,QAC2B;AAC3B,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIC,aAAAA,aAAa,QAAQ,OAAO,MAAM,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AAGzI,UAAM,gBAAgB,KAAK,UAAU,UAAa,OAAO,UAAUC,MAAAA,eAAe,KAAK,KAAK;AAC5F,QAAI,eAAe;AAClB,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAM;AACtF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAIC,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AAMA,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,OAAO,IAAI,MAAM,aAAa,CAAC;AAC3F,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACvH,UAAM,UAAU,WAAW,QAAQ,IAAIC,gCAAAA,gCAAgC,OAAO,IAAI,KAAK,CAAC;AACxF,WAAO,IAAID,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}

package/dist/production/src/model/service/PersonManager.js

@@ -2,14 +2,16 @@ import { ChangeProfileCommand } from "../commands/person/ChangeProfileCommand.js
 import { ResponseError, ResponseOk } from "../utils/Response.js";
 import "../queries/apiKey/ApiKeyQuery.js";
 import "@contember/database";
+import "../type/ApiKey.js";
 import { PersonQuery } from "../queries/person/PersonQuery.js";
+import { PersonsQuery } from "../queries/person/PersonsQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
 import "../authorization/PermissionContext.js";
 import "../authorization/PermissionsFactory.js";
 import "@contember/schema";
-import "../type/ApiKey.js";
 import "node:crypto";
+import { normalizeEmail } from "../utils/email.js";
 import { TogglePersonPasswordlessCommand } from "../commands/person/TogglePersonPasswordlessCommand.js";
 class PersonManager {
   constructor(emailValidator) {
@@ -20,14 +22,18 @@ class PersonManager {
       PersonQuery.byId(personId)
     );
   }
+  async listPersons(dbContext, filter = {}, limit, offset) {
+    return await dbContext.queryHandler.fetch(new PersonsQuery(filter, limit, offset));
+  }
   async changeProfile(dbContext, person, data) {
-    if (data.email !== void 0 && person.email !== data.email) {
+    const emailChanging = data.email !== void 0 && person.email !== normalizeEmail(data.email);
+    if (emailChanging) {
       const validationError = await this.emailValidator.validateEmail(dbContext, data.email);
       if (validationError !== null) {
         return new ResponseError(validationError.error, validationError.errorMessage);
       }
     }
-    await dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data));
+    await dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data, emailChanging));
     return new ResponseOk(null);
   }
   async togglePasswordless(dbContext, person, value) {

package/dist/production/src/model/service/PersonManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator'\nimport { TogglePersonPasswordlessCommand } from '../commands'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\tif (data.email !== undefined && person.email !== data.email) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":[],"mappings":";;;;;;;;;;;;;AAOA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AAC7F,WAAO,MAAM,UAAU,aAAa;AAAA,MACnC,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AACzI,QAAI,KAAK,UAAU,UAAa,OAAO,UAAU,KAAK,OAAO;AAC5D,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAK;AACrF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AACA,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,IAAI,IAAI,CAAC;AAC5E,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACvH,UAAM,UAAU,WAAW,QAAQ,IAAI,gCAAgC,OAAO,IAAI,KAAK,CAAC;AACxF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}
+{"version":3,"file":"PersonManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { PersonListRow, PersonQuery, PersonRow, PersonsQuery, PersonsQueryFilter } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { TogglePersonPasswordlessCommand } from '../commands/index.js'\nimport { normalizeEmail } from '../utils/email.js'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync listPersons(\n\t\tdbContext: DatabaseContext,\n\t\tfilter: PersonsQueryFilter = {},\n\t\tlimit?: number | null,\n\t\toffset?: number | null,\n\t): Promise<PersonListRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new PersonsQuery(filter, limit, offset))\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\t// Compare normalized: a case-/whitespace-only edit is not a real change, so\n\t\t// it neither needs re-validation nor should drop the verified status.\n\t\tconst emailChanging = data.email !== undefined && person.email !== normalizeEmail(data.email)\n\t\tif (emailChanging) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email!)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\t// On a real e-mail change via the direct path (admin changeProfile, or\n\t\t// changeMyProfile when no verification applies) the new address has not\n\t\t// been proven, so any prior verification no longer holds — clear it. For\n\t\t// verification-required accounts this re-arms the sign-in gate; for the\n\t\t// rest email_verified_at was already null, so it is a harmless no-op.\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data, emailChanging))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAQA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AAC7F,WAAO,MAAM,UAAU,aAAa;AAAA,MACnC,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,YACL,WACA,SAA6B,CAAA,GAC7B,OACA,QAC2B;AAC3B,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,aAAa,QAAQ,OAAO,MAAM,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AAGzI,UAAM,gBAAgB,KAAK,UAAU,UAAa,OAAO,UAAU,eAAe,KAAK,KAAK;AAC5F,QAAI,eAAe;AAClB,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAM;AACtF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AAMA,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,IAAI,MAAM,aAAa,CAAC;AAC3F,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACvH,UAAM,UAAU,WAAW,QAAQ,IAAI,gCAAgC,OAAO,IAAI,KAAK,CAAC;AACxF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}

package/dist/production/src/model/service/ProjectManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectManager.ts"],"sourcesContent":["import { AddProjectMemberCommand, CreateProjectCommand, SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { PermissionContext } from '../authorization'\nimport { Project, ProjectInitializer, ProjectWithSecrets } from '../type'\nimport { ProjectBySlugQuery, ProjectsByIdentityQuery, ProjectsQuery, ProjectUpdateTimestampQuery } from '../queries'\nimport { SecretsManager } from './SecretsManager'\nimport { DatabaseContext, TokenHash } from '../utils'\nimport { createSetMembershipVariables } from './membershipUtils'\nimport { ImplementationException } from '../../exceptions'\nimport { ProjectRole } from '@contember/schema'\nimport { ApiKeyService, CreateApiKeyResult } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { CreateProjectResponseErrorCode } from '../../schema'\nimport { Logger } from '@contember/logger'\n\nexport class ProjectManager {\n\tconstructor(\n\t\tprivate readonly secretManager: SecretsManager,\n\t\tprivate readonly projectIntializer: ProjectInitializer,\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tpublic async createProject(\n\t\tdbContext: DatabaseContext,\n\t\tlogger: Logger,\n\t\tproject: Pick<ProjectWithSecrets, 'name' | 'slug' | 'config' | 'secrets'>,\n\t\toptions: {\n\t\t\townerIdentityId?: string\n\t\t\tdeployTokenHash?: TokenHash\n\t\t\tnoDeployToken?: boolean\n\t\t},\n\t): Promise<CreateProjectResponse> {\n\t\treturn await dbContext.transaction(async (db): Promise<CreateProjectResponse> => {\n\t\t\tconst bus = db.commandBus\n\n\t\t\tconst now = db.providers.now()\n\t\t\tconst projectId = await bus.execute(new CreateProjectCommand(project, now))\n\t\t\tif (!projectId) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `Project ${project.slug} already exists`)\n\t\t\t}\n\t\t\tfor (const [key, value] of Object.entries(project.secrets)) {\n\t\t\t\tawait bus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tif (options.ownerIdentityId) {\n\t\t\t\tconst memberships = createSetMembershipVariables([{ role: ProjectRole.ADMIN, variables: [] }])\n\t\t\t\tconst addProjectMemberCommand = new AddProjectMemberCommand(projectId, options.ownerIdentityId, memberships)\n\t\t\t\tconst addMemberResult = await db.commandBus.execute(addProjectMemberCommand)\n\t\t\t\tif (!addMemberResult.ok) {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst deployMembership = [{ role: ProjectRole.DEPLOYER, variables: [] }]\n\t\t\tconst deployKeyDescription = `Deploy key for ${project.slug}`\n\t\t\tconst deployResult = options.noDeployToken === true\n\t\t\t\t? undefined\n\t\t\t\t: await this.apiKeyService.createProjectPermanentApiKey(db, projectId, deployMembership, deployKeyDescription, options.deployTokenHash)\n\n\t\t\ttry {\n\t\t\t\tawait this.projectIntializer.initializeProject({\n\t\t\t\t\tid: projectId,\n\t\t\t\t\t...project,\n\t\t\t\t\tupdatedAt: now,\n\t\t\t\t}, logger)\n\t\t\t} catch (e) {\n\t\t\t\tlogger.error(e, { message: 'Project initialization failed' })\n\t\t\t\tawait db.client.connection.rollback()\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'INIT_ERROR',\n\t\t\t\t\t`Project initialization error: ${e instanceof Error && 'message' in e ? e.message : 'unknown'}`,\n\t\t\t\t)\n\t\t\t}\n\n\t\t\treturn new ResponseOk(new CreateProjectResult(deployResult?.result))\n\t\t})\n\t}\n\n\tpublic async updateProject(dbContext: DatabaseContext, id: string, data: Partial<Pick<Project, 'name' | 'config'>>): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new UpdateProjectCommand(id, data))\n\t}\n\n\tpublic async getProjectBySlug(dbContext: DatabaseContext, slug: string): Promise<Project | null> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug))\n\t}\n\n\tpublic async getProjectState(dbContext: DatabaseContext, slug: string, updatedAt: Date): Promise<'valid' | 'updated' | 'not_found'> {\n\t\tconst updatedNew = await dbContext.queryHandler.fetch(new ProjectUpdateTimestampQuery(slug))\n\t\tif (!updatedNew) {\n\t\t\treturn 'not_found'\n\t\t}\n\t\treturn updatedNew > updatedAt ? 'updated' : 'valid'\n\t}\n\n\tpublic async getProjectWithSecretsBySlug(dbContext: DatabaseContext, slug: string, alias: boolean): Promise<ProjectWithSecrets | null> {\n\t\tconst project = await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug, alias))\n\t\tif (!project) {\n\t\t\treturn null\n\t\t}\n\t\tconst secrets = await this.secretManager.readSecrets(dbContext, project.id)\n\t\treturn { ...project, secrets }\n\t}\n\n\tpublic async getProjects(dbContext: DatabaseContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsQuery())\n\t}\n\n\tpublic async getProjectsByIdentity(dbContext: DatabaseContext, identityId: string, permissionContext: PermissionContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsByIdentityQuery(identityId, permissionContext))\n\t}\n}\n\nexport class ProjectInitError extends Error {}\n\nexport type CreateProjectResponse = Response<CreateProjectResult, CreateProjectResponseErrorCode>\n\nexport class CreateProjectResult {\n\tconstructor(public readonly deployerApiKey?: CreateApiKeyResult) {\n\t}\n}\n"],"names":["CreateProjectCommand","ResponseError","SetProjectSecretCommand","createSetMembershipVariables","ProjectRole","AddProjectMemberCommand","ImplementationException","ResponseOk","UpdateProjectCommand","ProjectBySlugQuery","ProjectUpdateTimestampQuery","ProjectsQuery","ProjectsByIdentityQuery"],"mappings":";;;;;;;;;;;;;;;;;;AAcO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,mBACA,eAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAa,cACZ,WACA,QACA,SACA,SAKiC;AACjC,WAAO,MAAM,UAAU,YAAY,OAAO,OAAuC;AAChF,YAAM,MAAM,GAAG;AAEf,YAAM,MAAM,GAAG,UAAU,IAAA;AACzB,YAAM,YAAY,MAAM,IAAI,QAAQ,IAAIA,0CAAqB,SAAS,GAAG,CAAC;AAC1E,UAAI,CAAC,WAAW;AACf,eAAO,IAAIC,SAAAA,cAAc,kBAAkB,WAAW,QAAQ,IAAI,iBAAiB;AAAA,MACpF;AACA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC3D,cAAM,IAAI,QAAQ,IAAIC,gDAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAClF;AACA,UAAI,QAAQ,iBAAiB;AAC5B,cAAM,cAAcC,6CAA6B,CAAC,EAAE,MAAMC,OAAAA,YAAY,OAAO,WAAW,CAAA,EAAC,CAAG,CAAC;AAC7F,cAAM,0BAA0B,IAAIC,wBAAAA,wBAAwB,WAAW,QAAQ,iBAAiB,WAAW;AAC3G,cAAM,kBAAkB,MAAM,GAAG,WAAW,QAAQ,uBAAuB;AAC3E,YAAI,CAAC,gBAAgB,IAAI;AACxB,gBAAM,IAAIC,WAAAA,wBAAA;AAAA,QACX;AAAA,MACD;AAEA,YAAM,mBAAmB,CAAC,EAAE,MAAMF,OAAAA,YAAY,UAAU,WAAW,CAAA,GAAI;AACvE,YAAM,uBAAuB,kBAAkB,QAAQ,IAAI;AAC3D,YAAM,eAAe,QAAQ,kBAAkB,OAC5C,SACA,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,kBAAkB,sBAAsB,QAAQ,eAAe;AAEvI,UAAI;AACH,cAAM,KAAK,kBAAkB,kBAAkB;AAAA,UAC9C,IAAI;AAAA,UACJ,GAAG;AAAA,UACH,WAAW;AAAA,QAAA,GACT,MAAM;AAAA,MACV,SAAS,GAAG;AACX,eAAO,MAAM,GAAG,EAAE,SAAS,iCAAiC;AAC5D,cAAM,GAAG,OAAO,WAAW,SAAA;AAC3B,eAAO,IAAIH,SAAAA;AAAAA,UACV;AAAA,UACA,iCAAiC,aAAa,SAAS,aAAa,IAAI,EAAE,UAAU,SAAS;AAAA,QAAA;AAAA,MAE/F;AAEA,aAAO,IAAIM,SAAAA,WAAW,IAAI,oBAAoB,cAAc,MAAM,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,cAAc,WAA4B,IAAY,MAAgE;AAClI,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,IAAI,IAAI,CAAC;AAAA,EACtE;AAAA,EAEA,MAAa,iBAAiB,WAA4B,MAAuC;AAChG,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIC,mBAAAA,mBAAmB,IAAI,CAAC;AAAA,EACvE;AAAA,EAEA,MAAa,gBAAgB,WAA4B,MAAc,WAA6D;AACnI,UAAM,aAAa,MAAM,UAAU,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,IAAI,CAAC;AAC3F,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,aAAa,YAAY,YAAY;AAAA,EAC7C;AAAA,EAEA,MAAa,4BAA4B,WAA4B,MAAc,OAAoD;AACtI,UAAM,UAAU,MAAM,UAAU,aAAa,MAAM,IAAID,mBAAAA,mBAAmB,MAAM,KAAK,CAAC;AACtF,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,UAAM,UAAU,MAAM,KAAK,cAAc,YAAY,WAAW,QAAQ,EAAE;AAC1E,WAAO,EAAE,GAAG,SAAS,QAAA;AAAA,EACtB;AAAA,EAEA,MAAa,YAAY,WAAgD;AACxE,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIE,cAAAA,eAAe;AAAA,EAC9D;AAAA,EAEA,MAAa,sBAAsB,WAA4B,YAAoB,mBAA0D;AAC5I,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIC,gDAAwB,YAAY,iBAAiB,CAAC;AAAA,EACrG;AACD;AAEO,MAAM,yBAAyB,MAAM;AAAC;AAItC,MAAM,oBAAoB;AAAA,EAChC,YAA4B,gBAAqC;AAArC,SAAA,iBAAA;AAAA,EAC5B;AACD;;;;"}
+{"version":3,"file":"ProjectManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectManager.ts"],"sourcesContent":["import { AddProjectMemberCommand, CreateProjectCommand, SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { Project, ProjectInitializer, ProjectWithSecrets } from '../type/index.js'\nimport { ProjectBySlugQuery, ProjectsByIdentityQuery, ProjectsQuery, ProjectUpdateTimestampQuery } from '../queries/index.js'\nimport { SecretsManager } from './SecretsManager.js'\nimport { DatabaseContext, TokenHash } from '../utils/index.js'\nimport { createSetMembershipVariables } from './membershipUtils.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { ProjectRole } from '@contember/schema'\nimport { ApiKeyService, CreateApiKeyResult } from './apiKey/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { CreateProjectResponseErrorCode } from '../../schema/index.js'\nimport { Logger } from '@contember/logger'\n\nexport class ProjectManager {\n\tconstructor(\n\t\tprivate readonly secretManager: SecretsManager,\n\t\tprivate readonly projectIntializer: ProjectInitializer,\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tpublic async createProject(\n\t\tdbContext: DatabaseContext,\n\t\tlogger: Logger,\n\t\tproject: Pick<ProjectWithSecrets, 'name' | 'slug' | 'config' | 'secrets'>,\n\t\toptions: {\n\t\t\townerIdentityId?: string\n\t\t\tdeployTokenHash?: TokenHash\n\t\t\tnoDeployToken?: boolean\n\t\t},\n\t): Promise<CreateProjectResponse> {\n\t\treturn await dbContext.transaction(async (db): Promise<CreateProjectResponse> => {\n\t\t\tconst bus = db.commandBus\n\n\t\t\tconst now = db.providers.now()\n\t\t\tconst projectId = await bus.execute(new CreateProjectCommand(project, now))\n\t\t\tif (!projectId) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `Project ${project.slug} already exists`)\n\t\t\t}\n\t\t\tfor (const [key, value] of Object.entries(project.secrets)) {\n\t\t\t\tawait bus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tif (options.ownerIdentityId) {\n\t\t\t\tconst memberships = createSetMembershipVariables([{ role: ProjectRole.ADMIN, variables: [] }])\n\t\t\t\tconst addProjectMemberCommand = new AddProjectMemberCommand(projectId, options.ownerIdentityId, memberships)\n\t\t\t\tconst addMemberResult = await db.commandBus.execute(addProjectMemberCommand)\n\t\t\t\tif (!addMemberResult.ok) {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst deployMembership = [{ role: ProjectRole.DEPLOYER, variables: [] }]\n\t\t\tconst deployKeyDescription = `Deploy key for ${project.slug}`\n\t\t\tconst deployResult = options.noDeployToken === true\n\t\t\t\t? undefined\n\t\t\t\t: await this.apiKeyService.createProjectPermanentApiKey(db, projectId, deployMembership, deployKeyDescription, options.deployTokenHash)\n\n\t\t\ttry {\n\t\t\t\tawait this.projectIntializer.initializeProject({\n\t\t\t\t\tid: projectId,\n\t\t\t\t\t...project,\n\t\t\t\t\tupdatedAt: now,\n\t\t\t\t}, logger)\n\t\t\t} catch (e) {\n\t\t\t\tlogger.error(e, { message: 'Project initialization failed' })\n\t\t\t\tawait db.client.connection.rollback()\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'INIT_ERROR',\n\t\t\t\t\t`Project initialization error: ${e instanceof Error && 'message' in e ? e.message : 'unknown'}`,\n\t\t\t\t)\n\t\t\t}\n\n\t\t\treturn new ResponseOk(new CreateProjectResult(deployResult?.result))\n\t\t})\n\t}\n\n\tpublic async updateProject(dbContext: DatabaseContext, id: string, data: Partial<Pick<Project, 'name' | 'config'>>): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new UpdateProjectCommand(id, data))\n\t}\n\n\tpublic async getProjectBySlug(dbContext: DatabaseContext, slug: string): Promise<Project | null> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug))\n\t}\n\n\tpublic async getProjectState(dbContext: DatabaseContext, slug: string, updatedAt: Date): Promise<'valid' | 'updated' | 'not_found'> {\n\t\tconst updatedNew = await dbContext.queryHandler.fetch(new ProjectUpdateTimestampQuery(slug))\n\t\tif (!updatedNew) {\n\t\t\treturn 'not_found'\n\t\t}\n\t\treturn updatedNew > updatedAt ? 'updated' : 'valid'\n\t}\n\n\tpublic async getProjectWithSecretsBySlug(dbContext: DatabaseContext, slug: string, alias: boolean): Promise<ProjectWithSecrets | null> {\n\t\tconst project = await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug, alias))\n\t\tif (!project) {\n\t\t\treturn null\n\t\t}\n\t\tconst secrets = await this.secretManager.readSecrets(dbContext, project.id)\n\t\treturn { ...project, secrets }\n\t}\n\n\tpublic async getProjects(dbContext: DatabaseContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsQuery())\n\t}\n\n\tpublic async getProjectsByIdentity(dbContext: DatabaseContext, identityId: string, permissionContext: PermissionContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsByIdentityQuery(identityId, permissionContext))\n\t}\n}\n\nexport class ProjectInitError extends Error {}\n\nexport type CreateProjectResponse = Response<CreateProjectResult, CreateProjectResponseErrorCode>\n\nexport class CreateProjectResult {\n\tconstructor(public readonly deployerApiKey?: CreateApiKeyResult) {\n\t}\n}\n"],"names":["CreateProjectCommand","ResponseError","SetProjectSecretCommand","createSetMembershipVariables","ProjectRole","AddProjectMemberCommand","ImplementationException","ResponseOk","UpdateProjectCommand","ProjectBySlugQuery","ProjectUpdateTimestampQuery","ProjectsQuery","ProjectsByIdentityQuery"],"mappings":";;;;;;;;;;;;;;;;;;AAcO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,mBACA,eAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAa,cACZ,WACA,QACA,SACA,SAKiC;AACjC,WAAO,MAAM,UAAU,YAAY,OAAO,OAAuC;AAChF,YAAM,MAAM,GAAG;AAEf,YAAM,MAAM,GAAG,UAAU,IAAA;AACzB,YAAM,YAAY,MAAM,IAAI,QAAQ,IAAIA,0CAAqB,SAAS,GAAG,CAAC;AAC1E,UAAI,CAAC,WAAW;AACf,eAAO,IAAIC,SAAAA,cAAc,kBAAkB,WAAW,QAAQ,IAAI,iBAAiB;AAAA,MACpF;AACA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC3D,cAAM,IAAI,QAAQ,IAAIC,gDAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAClF;AACA,UAAI,QAAQ,iBAAiB;AAC5B,cAAM,cAAcC,6CAA6B,CAAC,EAAE,MAAMC,OAAAA,YAAY,OAAO,WAAW,CAAA,EAAC,CAAG,CAAC;AAC7F,cAAM,0BAA0B,IAAIC,wBAAAA,wBAAwB,WAAW,QAAQ,iBAAiB,WAAW;AAC3G,cAAM,kBAAkB,MAAM,GAAG,WAAW,QAAQ,uBAAuB;AAC3E,YAAI,CAAC,gBAAgB,IAAI;AACxB,gBAAM,IAAIC,WAAAA,wBAAA;AAAA,QACX;AAAA,MACD;AAEA,YAAM,mBAAmB,CAAC,EAAE,MAAMF,OAAAA,YAAY,UAAU,WAAW,CAAA,GAAI;AACvE,YAAM,uBAAuB,kBAAkB,QAAQ,IAAI;AAC3D,YAAM,eAAe,QAAQ,kBAAkB,OAC5C,SACA,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,kBAAkB,sBAAsB,QAAQ,eAAe;AAEvI,UAAI;AACH,cAAM,KAAK,kBAAkB,kBAAkB;AAAA,UAC9C,IAAI;AAAA,UACJ,GAAG;AAAA,UACH,WAAW;AAAA,QAAA,GACT,MAAM;AAAA,MACV,SAAS,GAAG;AACX,eAAO,MAAM,GAAG,EAAE,SAAS,iCAAiC;AAC5D,cAAM,GAAG,OAAO,WAAW,SAAA;AAC3B,eAAO,IAAIH,SAAAA;AAAAA,UACV;AAAA,UACA,iCAAiC,aAAa,SAAS,aAAa,IAAI,EAAE,UAAU,SAAS;AAAA,QAAA;AAAA,MAE/F;AAEA,aAAO,IAAIM,SAAAA,WAAW,IAAI,oBAAoB,cAAc,MAAM,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,cAAc,WAA4B,IAAY,MAAgE;AAClI,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,IAAI,IAAI,CAAC;AAAA,EACtE;AAAA,EAEA,MAAa,iBAAiB,WAA4B,MAAuC;AAChG,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIC,mBAAAA,mBAAmB,IAAI,CAAC;AAAA,EACvE;AAAA,EAEA,MAAa,gBAAgB,WAA4B,MAAc,WAA6D;AACnI,UAAM,aAAa,MAAM,UAAU,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,IAAI,CAAC;AAC3F,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,aAAa,YAAY,YAAY;AAAA,EAC7C;AAAA,EAEA,MAAa,4BAA4B,WAA4B,MAAc,OAAoD;AACtI,UAAM,UAAU,MAAM,UAAU,aAAa,MAAM,IAAID,mBAAAA,mBAAmB,MAAM,KAAK,CAAC;AACtF,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,UAAM,UAAU,MAAM,KAAK,cAAc,YAAY,WAAW,QAAQ,EAAE;AAC1E,WAAO,EAAE,GAAG,SAAS,QAAA;AAAA,EACtB;AAAA,EAEA,MAAa,YAAY,WAAgD;AACxE,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIE,cAAAA,eAAe;AAAA,EAC9D;AAAA,EAEA,MAAa,sBAAsB,WAA4B,YAAoB,mBAA0D;AAC5I,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIC,gDAAwB,YAAY,iBAAiB,CAAC;AAAA,EACrG;AACD;AAEO,MAAM,yBAAyB,MAAM;AAAC;AAItC,MAAM,oBAAoB;AAAA,EAChC,YAA4B,gBAAqC;AAArC,SAAA,iBAAA;AAAA,EAC5B;AACD;;;;"}

package/dist/production/src/model/service/ProjectManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectManager.ts"],"sourcesContent":["import { AddProjectMemberCommand, CreateProjectCommand, SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { PermissionContext } from '../authorization'\nimport { Project, ProjectInitializer, ProjectWithSecrets } from '../type'\nimport { ProjectBySlugQuery, ProjectsByIdentityQuery, ProjectsQuery, ProjectUpdateTimestampQuery } from '../queries'\nimport { SecretsManager } from './SecretsManager'\nimport { DatabaseContext, TokenHash } from '../utils'\nimport { createSetMembershipVariables } from './membershipUtils'\nimport { ImplementationException } from '../../exceptions'\nimport { ProjectRole } from '@contember/schema'\nimport { ApiKeyService, CreateApiKeyResult } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { CreateProjectResponseErrorCode } from '../../schema'\nimport { Logger } from '@contember/logger'\n\nexport class ProjectManager {\n\tconstructor(\n\t\tprivate readonly secretManager: SecretsManager,\n\t\tprivate readonly projectIntializer: ProjectInitializer,\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tpublic async createProject(\n\t\tdbContext: DatabaseContext,\n\t\tlogger: Logger,\n\t\tproject: Pick<ProjectWithSecrets, 'name' | 'slug' | 'config' | 'secrets'>,\n\t\toptions: {\n\t\t\townerIdentityId?: string\n\t\t\tdeployTokenHash?: TokenHash\n\t\t\tnoDeployToken?: boolean\n\t\t},\n\t): Promise<CreateProjectResponse> {\n\t\treturn await dbContext.transaction(async (db): Promise<CreateProjectResponse> => {\n\t\t\tconst bus = db.commandBus\n\n\t\t\tconst now = db.providers.now()\n\t\t\tconst projectId = await bus.execute(new CreateProjectCommand(project, now))\n\t\t\tif (!projectId) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `Project ${project.slug} already exists`)\n\t\t\t}\n\t\t\tfor (const [key, value] of Object.entries(project.secrets)) {\n\t\t\t\tawait bus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tif (options.ownerIdentityId) {\n\t\t\t\tconst memberships = createSetMembershipVariables([{ role: ProjectRole.ADMIN, variables: [] }])\n\t\t\t\tconst addProjectMemberCommand = new AddProjectMemberCommand(projectId, options.ownerIdentityId, memberships)\n\t\t\t\tconst addMemberResult = await db.commandBus.execute(addProjectMemberCommand)\n\t\t\t\tif (!addMemberResult.ok) {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst deployMembership = [{ role: ProjectRole.DEPLOYER, variables: [] }]\n\t\t\tconst deployKeyDescription = `Deploy key for ${project.slug}`\n\t\t\tconst deployResult = options.noDeployToken === true\n\t\t\t\t? undefined\n\t\t\t\t: await this.apiKeyService.createProjectPermanentApiKey(db, projectId, deployMembership, deployKeyDescription, options.deployTokenHash)\n\n\t\t\ttry {\n\t\t\t\tawait this.projectIntializer.initializeProject({\n\t\t\t\t\tid: projectId,\n\t\t\t\t\t...project,\n\t\t\t\t\tupdatedAt: now,\n\t\t\t\t}, logger)\n\t\t\t} catch (e) {\n\t\t\t\tlogger.error(e, { message: 'Project initialization failed' })\n\t\t\t\tawait db.client.connection.rollback()\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'INIT_ERROR',\n\t\t\t\t\t`Project initialization error: ${e instanceof Error && 'message' in e ? e.message : 'unknown'}`,\n\t\t\t\t)\n\t\t\t}\n\n\t\t\treturn new ResponseOk(new CreateProjectResult(deployResult?.result))\n\t\t})\n\t}\n\n\tpublic async updateProject(dbContext: DatabaseContext, id: string, data: Partial<Pick<Project, 'name' | 'config'>>): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new UpdateProjectCommand(id, data))\n\t}\n\n\tpublic async getProjectBySlug(dbContext: DatabaseContext, slug: string): Promise<Project | null> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug))\n\t}\n\n\tpublic async getProjectState(dbContext: DatabaseContext, slug: string, updatedAt: Date): Promise<'valid' | 'updated' | 'not_found'> {\n\t\tconst updatedNew = await dbContext.queryHandler.fetch(new ProjectUpdateTimestampQuery(slug))\n\t\tif (!updatedNew) {\n\t\t\treturn 'not_found'\n\t\t}\n\t\treturn updatedNew > updatedAt ? 'updated' : 'valid'\n\t}\n\n\tpublic async getProjectWithSecretsBySlug(dbContext: DatabaseContext, slug: string, alias: boolean): Promise<ProjectWithSecrets | null> {\n\t\tconst project = await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug, alias))\n\t\tif (!project) {\n\t\t\treturn null\n\t\t}\n\t\tconst secrets = await this.secretManager.readSecrets(dbContext, project.id)\n\t\treturn { ...project, secrets }\n\t}\n\n\tpublic async getProjects(dbContext: DatabaseContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsQuery())\n\t}\n\n\tpublic async getProjectsByIdentity(dbContext: DatabaseContext, identityId: string, permissionContext: PermissionContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsByIdentityQuery(identityId, permissionContext))\n\t}\n}\n\nexport class ProjectInitError extends Error {}\n\nexport type CreateProjectResponse = Response<CreateProjectResult, CreateProjectResponseErrorCode>\n\nexport class CreateProjectResult {\n\tconstructor(public readonly deployerApiKey?: CreateApiKeyResult) {\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAcO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,mBACA,eAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAa,cACZ,WACA,QACA,SACA,SAKiC;AACjC,WAAO,MAAM,UAAU,YAAY,OAAO,OAAuC;AAChF,YAAM,MAAM,GAAG;AAEf,YAAM,MAAM,GAAG,UAAU,IAAA;AACzB,YAAM,YAAY,MAAM,IAAI,QAAQ,IAAI,qBAAqB,SAAS,GAAG,CAAC;AAC1E,UAAI,CAAC,WAAW;AACf,eAAO,IAAI,cAAc,kBAAkB,WAAW,QAAQ,IAAI,iBAAiB;AAAA,MACpF;AACA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC3D,cAAM,IAAI,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAClF;AACA,UAAI,QAAQ,iBAAiB;AAC5B,cAAM,cAAc,6BAA6B,CAAC,EAAE,MAAM,YAAY,OAAO,WAAW,CAAA,EAAC,CAAG,CAAC;AAC7F,cAAM,0BAA0B,IAAI,wBAAwB,WAAW,QAAQ,iBAAiB,WAAW;AAC3G,cAAM,kBAAkB,MAAM,GAAG,WAAW,QAAQ,uBAAuB;AAC3E,YAAI,CAAC,gBAAgB,IAAI;AACxB,gBAAM,IAAI,wBAAA;AAAA,QACX;AAAA,MACD;AAEA,YAAM,mBAAmB,CAAC,EAAE,MAAM,YAAY,UAAU,WAAW,CAAA,GAAI;AACvE,YAAM,uBAAuB,kBAAkB,QAAQ,IAAI;AAC3D,YAAM,eAAe,QAAQ,kBAAkB,OAC5C,SACA,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,kBAAkB,sBAAsB,QAAQ,eAAe;AAEvI,UAAI;AACH,cAAM,KAAK,kBAAkB,kBAAkB;AAAA,UAC9C,IAAI;AAAA,UACJ,GAAG;AAAA,UACH,WAAW;AAAA,QAAA,GACT,MAAM;AAAA,MACV,SAAS,GAAG;AACX,eAAO,MAAM,GAAG,EAAE,SAAS,iCAAiC;AAC5D,cAAM,GAAG,OAAO,WAAW,SAAA;AAC3B,eAAO,IAAI;AAAA,UACV;AAAA,UACA,iCAAiC,aAAa,SAAS,aAAa,IAAI,EAAE,UAAU,SAAS;AAAA,QAAA;AAAA,MAE/F;AAEA,aAAO,IAAI,WAAW,IAAI,oBAAoB,cAAc,MAAM,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,cAAc,WAA4B,IAAY,MAAgE;AAClI,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,IAAI,IAAI,CAAC;AAAA,EACtE;AAAA,EAEA,MAAa,iBAAiB,WAA4B,MAAuC;AAChG,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,IAAI,CAAC;AAAA,EACvE;AAAA,EAEA,MAAa,gBAAgB,WAA4B,MAAc,WAA6D;AACnI,UAAM,aAAa,MAAM,UAAU,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAC3F,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,aAAa,YAAY,YAAY;AAAA,EAC7C;AAAA,EAEA,MAAa,4BAA4B,WAA4B,MAAc,OAAoD;AACtI,UAAM,UAAU,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,MAAM,KAAK,CAAC;AACtF,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,UAAM,UAAU,MAAM,KAAK,cAAc,YAAY,WAAW,QAAQ,EAAE;AAC1E,WAAO,EAAE,GAAG,SAAS,QAAA;AAAA,EACtB;AAAA,EAEA,MAAa,YAAY,WAAgD;AACxE,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,eAAe;AAAA,EAC9D;AAAA,EAEA,MAAa,sBAAsB,WAA4B,YAAoB,mBAA0D;AAC5I,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,wBAAwB,YAAY,iBAAiB,CAAC;AAAA,EACrG;AACD;AAEO,MAAM,yBAAyB,MAAM;AAAC;AAItC,MAAM,oBAAoB;AAAA,EAChC,YAA4B,gBAAqC;AAArC,SAAA,iBAAA;AAAA,EAC5B;AACD;"}
+{"version":3,"file":"ProjectManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectManager.ts"],"sourcesContent":["import { AddProjectMemberCommand, CreateProjectCommand, SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { Project, ProjectInitializer, ProjectWithSecrets } from '../type/index.js'\nimport { ProjectBySlugQuery, ProjectsByIdentityQuery, ProjectsQuery, ProjectUpdateTimestampQuery } from '../queries/index.js'\nimport { SecretsManager } from './SecretsManager.js'\nimport { DatabaseContext, TokenHash } from '../utils/index.js'\nimport { createSetMembershipVariables } from './membershipUtils.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { ProjectRole } from '@contember/schema'\nimport { ApiKeyService, CreateApiKeyResult } from './apiKey/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { CreateProjectResponseErrorCode } from '../../schema/index.js'\nimport { Logger } from '@contember/logger'\n\nexport class ProjectManager {\n\tconstructor(\n\t\tprivate readonly secretManager: SecretsManager,\n\t\tprivate readonly projectIntializer: ProjectInitializer,\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tpublic async createProject(\n\t\tdbContext: DatabaseContext,\n\t\tlogger: Logger,\n\t\tproject: Pick<ProjectWithSecrets, 'name' | 'slug' | 'config' | 'secrets'>,\n\t\toptions: {\n\t\t\townerIdentityId?: string\n\t\t\tdeployTokenHash?: TokenHash\n\t\t\tnoDeployToken?: boolean\n\t\t},\n\t): Promise<CreateProjectResponse> {\n\t\treturn await dbContext.transaction(async (db): Promise<CreateProjectResponse> => {\n\t\t\tconst bus = db.commandBus\n\n\t\t\tconst now = db.providers.now()\n\t\t\tconst projectId = await bus.execute(new CreateProjectCommand(project, now))\n\t\t\tif (!projectId) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `Project ${project.slug} already exists`)\n\t\t\t}\n\t\t\tfor (const [key, value] of Object.entries(project.secrets)) {\n\t\t\t\tawait bus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tif (options.ownerIdentityId) {\n\t\t\t\tconst memberships = createSetMembershipVariables([{ role: ProjectRole.ADMIN, variables: [] }])\n\t\t\t\tconst addProjectMemberCommand = new AddProjectMemberCommand(projectId, options.ownerIdentityId, memberships)\n\t\t\t\tconst addMemberResult = await db.commandBus.execute(addProjectMemberCommand)\n\t\t\t\tif (!addMemberResult.ok) {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst deployMembership = [{ role: ProjectRole.DEPLOYER, variables: [] }]\n\t\t\tconst deployKeyDescription = `Deploy key for ${project.slug}`\n\t\t\tconst deployResult = options.noDeployToken === true\n\t\t\t\t? undefined\n\t\t\t\t: await this.apiKeyService.createProjectPermanentApiKey(db, projectId, deployMembership, deployKeyDescription, options.deployTokenHash)\n\n\t\t\ttry {\n\t\t\t\tawait this.projectIntializer.initializeProject({\n\t\t\t\t\tid: projectId,\n\t\t\t\t\t...project,\n\t\t\t\t\tupdatedAt: now,\n\t\t\t\t}, logger)\n\t\t\t} catch (e) {\n\t\t\t\tlogger.error(e, { message: 'Project initialization failed' })\n\t\t\t\tawait db.client.connection.rollback()\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'INIT_ERROR',\n\t\t\t\t\t`Project initialization error: ${e instanceof Error && 'message' in e ? e.message : 'unknown'}`,\n\t\t\t\t)\n\t\t\t}\n\n\t\t\treturn new ResponseOk(new CreateProjectResult(deployResult?.result))\n\t\t})\n\t}\n\n\tpublic async updateProject(dbContext: DatabaseContext, id: string, data: Partial<Pick<Project, 'name' | 'config'>>): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new UpdateProjectCommand(id, data))\n\t}\n\n\tpublic async getProjectBySlug(dbContext: DatabaseContext, slug: string): Promise<Project | null> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug))\n\t}\n\n\tpublic async getProjectState(dbContext: DatabaseContext, slug: string, updatedAt: Date): Promise<'valid' | 'updated' | 'not_found'> {\n\t\tconst updatedNew = await dbContext.queryHandler.fetch(new ProjectUpdateTimestampQuery(slug))\n\t\tif (!updatedNew) {\n\t\t\treturn 'not_found'\n\t\t}\n\t\treturn updatedNew > updatedAt ? 'updated' : 'valid'\n\t}\n\n\tpublic async getProjectWithSecretsBySlug(dbContext: DatabaseContext, slug: string, alias: boolean): Promise<ProjectWithSecrets | null> {\n\t\tconst project = await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug, alias))\n\t\tif (!project) {\n\t\t\treturn null\n\t\t}\n\t\tconst secrets = await this.secretManager.readSecrets(dbContext, project.id)\n\t\treturn { ...project, secrets }\n\t}\n\n\tpublic async getProjects(dbContext: DatabaseContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsQuery())\n\t}\n\n\tpublic async getProjectsByIdentity(dbContext: DatabaseContext, identityId: string, permissionContext: PermissionContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsByIdentityQuery(identityId, permissionContext))\n\t}\n}\n\nexport class ProjectInitError extends Error {}\n\nexport type CreateProjectResponse = Response<CreateProjectResult, CreateProjectResponseErrorCode>\n\nexport class CreateProjectResult {\n\tconstructor(public readonly deployerApiKey?: CreateApiKeyResult) {\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAcO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,mBACA,eAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAa,cACZ,WACA,QACA,SACA,SAKiC;AACjC,WAAO,MAAM,UAAU,YAAY,OAAO,OAAuC;AAChF,YAAM,MAAM,GAAG;AAEf,YAAM,MAAM,GAAG,UAAU,IAAA;AACzB,YAAM,YAAY,MAAM,IAAI,QAAQ,IAAI,qBAAqB,SAAS,GAAG,CAAC;AAC1E,UAAI,CAAC,WAAW;AACf,eAAO,IAAI,cAAc,kBAAkB,WAAW,QAAQ,IAAI,iBAAiB;AAAA,MACpF;AACA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC3D,cAAM,IAAI,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAClF;AACA,UAAI,QAAQ,iBAAiB;AAC5B,cAAM,cAAc,6BAA6B,CAAC,EAAE,MAAM,YAAY,OAAO,WAAW,CAAA,EAAC,CAAG,CAAC;AAC7F,cAAM,0BAA0B,IAAI,wBAAwB,WAAW,QAAQ,iBAAiB,WAAW;AAC3G,cAAM,kBAAkB,MAAM,GAAG,WAAW,QAAQ,uBAAuB;AAC3E,YAAI,CAAC,gBAAgB,IAAI;AACxB,gBAAM,IAAI,wBAAA;AAAA,QACX;AAAA,MACD;AAEA,YAAM,mBAAmB,CAAC,EAAE,MAAM,YAAY,UAAU,WAAW,CAAA,GAAI;AACvE,YAAM,uBAAuB,kBAAkB,QAAQ,IAAI;AAC3D,YAAM,eAAe,QAAQ,kBAAkB,OAC5C,SACA,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,kBAAkB,sBAAsB,QAAQ,eAAe;AAEvI,UAAI;AACH,cAAM,KAAK,kBAAkB,kBAAkB;AAAA,UAC9C,IAAI;AAAA,UACJ,GAAG;AAAA,UACH,WAAW;AAAA,QAAA,GACT,MAAM;AAAA,MACV,SAAS,GAAG;AACX,eAAO,MAAM,GAAG,EAAE,SAAS,iCAAiC;AAC5D,cAAM,GAAG,OAAO,WAAW,SAAA;AAC3B,eAAO,IAAI;AAAA,UACV;AAAA,UACA,iCAAiC,aAAa,SAAS,aAAa,IAAI,EAAE,UAAU,SAAS;AAAA,QAAA;AAAA,MAE/F;AAEA,aAAO,IAAI,WAAW,IAAI,oBAAoB,cAAc,MAAM,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,cAAc,WAA4B,IAAY,MAAgE;AAClI,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,IAAI,IAAI,CAAC;AAAA,EACtE;AAAA,EAEA,MAAa,iBAAiB,WAA4B,MAAuC;AAChG,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,IAAI,CAAC;AAAA,EACvE;AAAA,EAEA,MAAa,gBAAgB,WAA4B,MAAc,WAA6D;AACnI,UAAM,aAAa,MAAM,UAAU,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAC3F,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,aAAa,YAAY,YAAY;AAAA,EAC7C;AAAA,EAEA,MAAa,4BAA4B,WAA4B,MAAc,OAAoD;AACtI,UAAM,UAAU,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,MAAM,KAAK,CAAC;AACtF,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,UAAM,UAAU,MAAM,KAAK,cAAc,YAAY,WAAW,QAAQ,EAAE;AAC1E,WAAO,EAAE,GAAG,SAAS,QAAA;AAAA,EACtB;AAAA,EAEA,MAAa,YAAY,WAAgD;AACxE,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,eAAe;AAAA,EAC9D;AAAA,EAEA,MAAa,sBAAsB,WAA4B,YAAoB,mBAA0D;AAC5I,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,wBAAwB,YAAY,iBAAiB,CAAC;AAAA,EACrG;AACD;AAEO,MAAM,yBAAyB,MAAM;AAAC;AAItC,MAAM,oBAAoB;AAAA,EAChC,YAA4B,gBAAqC;AAArC,SAAA,iBAAA;AAAA,EAC5B;AACD;"}

package/dist/production/src/model/service/ProjectMemberManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMemberManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectMemberManager.ts"],"sourcesContent":["import {\n\tAddProjectMemberCommand,\n\tMembershipUpdateInput,\n\tRemoveProjectMemberCommand,\n\tRemoveProjectMemberResponse,\n\tUpdateProjectMemberCommand,\n\tUpdateProjectMemberResponse,\n} from '../commands'\nimport { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries'\nimport { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema'\nimport { AccessVerifier, PermissionActions, TenantRole } from '../authorization'\nimport { indexListBy, notEmpty } from '../../utils/array'\nimport { createSetMembershipVariables } from './membershipUtils'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { Response } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\n\nexport class ProjectMemberManager {\n\tasync addProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t): Promise<AddProjectMemberResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await db.commandBus.execute(\n\t\t\t\tnew AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),\n\t\t\t)\n\t\t})\n\t}\n\n\tasync updateProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly MembershipUpdateInput[],\n\t): Promise<UpdateProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships)),\n\t\t)\n\t}\n\n\tasync removeProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string): Promise<RemoveProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId)),\n\t\t)\n\t}\n\n\tasync getAllProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\treturn [\n\t\t\t...this.getImplicitProjectMemberships(identity),\n\t\t\t...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier),\n\t\t]\n\t}\n\n\tasync getEffectiveProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst implicit = this.getImplicitProjectMemberships(identity)\n\t\tif (implicit.length > 0) {\n\t\t\treturn implicit\n\t\t}\n\t\treturn await this.getStoredProjectsMemberships(dbContext, project, identity, undefined)\n\t}\n\n\tasync getStoredProjectsMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst memberships = await dbContext.queryHandler.fetch(\n\t\t\tnew ProjectMembershipByIdentityQuery(project, [identity.id]),\n\t\t)\n\t\tif (verifier === undefined) {\n\t\t\treturn memberships\n\t\t}\n\t\treturn await this.filterMemberships(memberships, verifier)\n\t}\n\n\tprivate getImplicitProjectMemberships(identity: { id: string; roles?: readonly string[] }): readonly Acl.Membership[] {\n\t\tif (identity.roles?.includes(TenantRole.SUPER_ADMIN) || identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {\n\t\t\treturn [{ role: ProjectRole.ADMIN, variables: [] }]\n\t\t}\n\t\treturn []\n\t}\n\n\tasync getProjectMembers(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\taccessVerifier: AccessVerifier,\n\t\tinput: ProjectMembersInput,\n\t): Promise<GetProjectMembersResponse> {\n\t\treturn dbContext.transaction(async db => {\n\t\t\tconst members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))\n\t\t\tconst memberships = await db.queryHandler.fetch(\n\t\t\t\tnew ProjectMembershipByIdentityQuery(\n\t\t\t\t\t{ id: projectId },\n\t\t\t\t\tmembers.map(it => it.id),\n\t\t\t\t),\n\t\t\t)\n\t\t\tconst filteredMemberships = await this.filterMemberships(memberships, accessVerifier)\n\t\t\tconst byIdentity = indexListBy(filteredMemberships, 'identityId')\n\t\t\treturn members\n\t\t\t\t.map(it => (byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null))\n\t\t\t\t.filter(notEmpty)\n\t\t})\n\t}\n\n\tprivate async filterMemberships<T extends Acl.Membership>(\n\t\tmemberships: readonly T[],\n\t\tverifier: AccessVerifier,\n\t): Promise<T[]> {\n\t\tconst filteredMemberships: T[] = []\n\t\tnextMembership: for (const membership of memberships) {\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst variables: { values: Acl.MembershipVariable['values']; name: string }[] = []\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)\n\t\t\t\tif (values.length === 0) {\n\t\t\t\t\tcontinue nextMembership\n\t\t\t\t}\n\t\t\t\tvariables.push({ name: variable.name, values })\n\t\t\t}\n\t\t\tfilteredMemberships.push({ ...membership, variables })\n\t\t}\n\n\t\treturn filteredMemberships\n\t}\n\n\tprivate async filterProjectMembershipVariableValues(\n\t\tmembership: Acl.Membership,\n\t\tvariable: Acl.MembershipVariable,\n\t\tverifier: AccessVerifier,\n\t): Promise<Acl.MembershipVariable['values']> {\n\t\tconst values = await Promise.all(\n\t\t\tvariable.values.map(async (value): Promise<string | null> => {\n\t\t\t\tconst subMembership = {\n\t\t\t\t\trole: membership.role,\n\t\t\t\t\tvariables: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: variable.name,\n\t\t\t\t\t\t\tvalues: [value],\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t}\n\n\t\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership])))) {\n\t\t\t\t\treturn null\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t}),\n\t\t)\n\t\treturn values.filter(notEmpty)\n\t}\n}\n\nexport type AddProjectMemberResponse = Response<null, AddProjectMemberErrorCode>\n\nexport type GetProjectMembersResponse = {\n\tidentity: { id: string }\n\tmemberships: readonly Acl.Membership[]\n}[]\n"],"names":["AddProjectMemberCommand","createSetMembershipVariables","UpdateProjectMemberCommand","RemoveProjectMemberCommand","ProjectMembershipByIdentityQuery","TenantRole","ProjectRole","ProjectMembersQuery","indexListBy","notEmpty","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAqB;AAAA,EACjC,MAAM,iBACL,WACA,WACA,YACA,aACoC;AACpC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,GAAG,WAAW;AAAA,QAC1B,IAAIA,wBAAAA,wBAAwB,WAAW,YAAYC,gBAAAA,6BAA6B,WAAW,CAAC;AAAA,MAAA;AAAA,IAE9F,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,oBACL,WACA,WACA,YACA,aACuC;AACvC,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAIC,sDAA2B,WAAW,YAAY,WAAW,CAAC;AAAA,IAAA;AAAA,EAE5G;AAAA,EAEA,MAAM,oBAAoB,WAA4B,WAAmB,YAA0D;AAClI,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAIC,2BAAAA,2BAA2B,WAAW,UAAU,CAAC;AAAA,IAAA;AAAA,EAE/F;AAAA,EAEA,MAAM,yBACL,WACA,SACA,UACA,UACqC;AACrC,WAAO;AAAA,MACN,GAAG,KAAK,8BAA8B,QAAQ;AAAA,MAC9C,GAAG,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,QAAQ;AAAA,IAAA;AAAA,EAEnF;AAAA,EAEA,MAAM,+BACL,WACA,SACA,UACqC;AACrC,UAAM,WAAW,KAAK,8BAA8B,QAAQ;AAC5D,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,MAAS;AAAA,EACvF;AAAA,EAEA,MAAM,6BACL,WACA,SACA,UACA,UACqC;AACrC,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAIC,kEAAiC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,IAAA;AAE5D,QAAI,aAAa,QAAW;AAC3B,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,kBAAkB,aAAa,QAAQ;AAAA,EAC1D;AAAA,EAEQ,8BAA8B,UAAgF;AACrH,QAAI,SAAS,OAAO,SAASC,MAAAA,WAAW,WAAW,KAAK,SAAS,OAAO,SAASA,MAAAA,WAAW,aAAa,GAAG;AAC3G,aAAO,CAAC,EAAE,MAAMC,OAAAA,YAAY,OAAO,WAAW,CAAA,GAAI;AAAA,IACnD;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAM,kBACL,WACA,WACA,gBACA,OACqC;AACrC,WAAO,UAAU,YAAY,OAAM,OAAM;AACxC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,WAAW,KAAK,CAAC;AACrF,YAAM,cAAc,MAAM,GAAG,aAAa;AAAA,QACzC,IAAIH,iCAAAA;AAAAA,UACH,EAAE,IAAI,UAAA;AAAA,UACN,QAAQ,IAAI,CAAA,OAAM,GAAG,EAAE;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,sBAAsB,MAAM,KAAK,kBAAkB,aAAa,cAAc;AACpF,YAAM,aAAaI,MAAAA,YAAY,qBAAqB,YAAY;AAChE,aAAO,QACL,IAAI,CAAA,OAAO,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa,WAAW,GAAG,EAAE,EAAA,IAAM,IAAK,EACvF,OAAOC,cAAQ;AAAA,IAClB,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,aACA,UACe;AACf,UAAM,sBAA2B,CAAA;AACjC,mBAAgB,YAAW,cAAc,aAAa;AACrD,UAAI,CAAE,MAAM,SAASC,oCAAkB,oBAAoB,CAAC,EAAE,MAAM,WAAW,MAAM,WAAW,GAAC,CAAG,CAAC,CAAC,GAAI;AACzG;AAAA,MACD;AACA,YAAM,YAA0E,CAAA;AAChF,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,SAAS,MAAM,KAAK,sCAAsC,YAAY,UAAU,QAAQ;AAC9F,YAAI,OAAO,WAAW,GAAG;AACxB,mBAAS;AAAA,QACV;AACA,kBAAU,KAAK,EAAE,MAAM,SAAS,MAAM,QAAQ;AAAA,MAC/C;AACA,0BAAoB,KAAK,EAAE,GAAG,YAAY,WAAW;AAAA,IACtD;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,sCACb,YACA,UACA,UAC4C;AAC5C,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC5B,SAAS,OAAO,IAAI,OAAO,UAAkC;AAC5D,cAAM,gBAAgB;AAAA,UACrB,MAAM,WAAW;AAAA,UACjB,WAAW;AAAA,YACV;AAAA,cACC,MAAM,SAAS;AAAA,cACf,QAAQ,CAAC,KAAK;AAAA,YAAA;AAAA,UACf;AAAA,QACD;AAGD,YAAI,CAAE,MAAM,SAASA,kBAAAA,kBAAkB,oBAAoB,CAAC,aAAa,CAAC,CAAC,GAAI;AAC9E,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,MACR,CAAC;AAAA,IAAA;AAEF,WAAO,OAAO,OAAOD,cAAQ;AAAA,EAC9B;AACD;;"}
+{"version":3,"file":"ProjectMemberManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectMemberManager.ts"],"sourcesContent":["import {\n\tAddProjectMemberCommand,\n\tMembershipUpdateInput,\n\tRemoveProjectMemberCommand,\n\tRemoveProjectMemberResponse,\n\tUpdateProjectMemberCommand,\n\tUpdateProjectMemberResponse,\n} from '../commands/index.js'\nimport { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries/index.js'\nimport { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema/index.js'\nimport { AccessVerifier, PermissionActions, TenantRole } from '../authorization/index.js'\nimport { indexListBy, notEmpty } from '../../utils/array.js'\nimport { createSetMembershipVariables } from './membershipUtils.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { Response } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class ProjectMemberManager {\n\tasync addProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t): Promise<AddProjectMemberResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await db.commandBus.execute(\n\t\t\t\tnew AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),\n\t\t\t)\n\t\t})\n\t}\n\n\tasync updateProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly MembershipUpdateInput[],\n\t): Promise<UpdateProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships)),\n\t\t)\n\t}\n\n\tasync removeProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string): Promise<RemoveProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId)),\n\t\t)\n\t}\n\n\tasync getAllProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\treturn [\n\t\t\t...this.getImplicitProjectMemberships(identity),\n\t\t\t...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier),\n\t\t]\n\t}\n\n\tasync getEffectiveProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst implicit = this.getImplicitProjectMemberships(identity)\n\t\tif (implicit.length > 0) {\n\t\t\treturn implicit\n\t\t}\n\t\treturn await this.getStoredProjectsMemberships(dbContext, project, identity, undefined)\n\t}\n\n\tasync getStoredProjectsMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst memberships = await dbContext.queryHandler.fetch(\n\t\t\tnew ProjectMembershipByIdentityQuery(project, [identity.id]),\n\t\t)\n\t\tif (verifier === undefined) {\n\t\t\treturn memberships\n\t\t}\n\t\treturn await this.filterMemberships(memberships, verifier)\n\t}\n\n\tprivate getImplicitProjectMemberships(identity: { id: string; roles?: readonly string[] }): readonly Acl.Membership[] {\n\t\tif (identity.roles?.includes(TenantRole.SUPER_ADMIN) || identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {\n\t\t\treturn [{ role: ProjectRole.ADMIN, variables: [] }]\n\t\t}\n\t\treturn []\n\t}\n\n\tasync getProjectMembers(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\taccessVerifier: AccessVerifier,\n\t\tinput: ProjectMembersInput,\n\t): Promise<GetProjectMembersResponse> {\n\t\treturn dbContext.transaction(async db => {\n\t\t\tconst members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))\n\t\t\tconst memberships = await db.queryHandler.fetch(\n\t\t\t\tnew ProjectMembershipByIdentityQuery(\n\t\t\t\t\t{ id: projectId },\n\t\t\t\t\tmembers.map(it => it.id),\n\t\t\t\t),\n\t\t\t)\n\t\t\tconst filteredMemberships = await this.filterMemberships(memberships, accessVerifier)\n\t\t\tconst byIdentity = indexListBy(filteredMemberships, 'identityId')\n\t\t\treturn members\n\t\t\t\t.map(it => (byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null))\n\t\t\t\t.filter(notEmpty)\n\t\t})\n\t}\n\n\tprivate async filterMemberships<T extends Acl.Membership>(\n\t\tmemberships: readonly T[],\n\t\tverifier: AccessVerifier,\n\t): Promise<T[]> {\n\t\tconst filteredMemberships: T[] = []\n\t\tnextMembership: for (const membership of memberships) {\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst variables: { values: Acl.MembershipVariable['values']; name: string }[] = []\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)\n\t\t\t\tif (values.length === 0) {\n\t\t\t\t\tcontinue nextMembership\n\t\t\t\t}\n\t\t\t\tvariables.push({ name: variable.name, values })\n\t\t\t}\n\t\t\tfilteredMemberships.push({ ...membership, variables })\n\t\t}\n\n\t\treturn filteredMemberships\n\t}\n\n\tprivate async filterProjectMembershipVariableValues(\n\t\tmembership: Acl.Membership,\n\t\tvariable: Acl.MembershipVariable,\n\t\tverifier: AccessVerifier,\n\t): Promise<Acl.MembershipVariable['values']> {\n\t\tconst values = await Promise.all(\n\t\t\tvariable.values.map(async (value): Promise<string | null> => {\n\t\t\t\tconst subMembership = {\n\t\t\t\t\trole: membership.role,\n\t\t\t\t\tvariables: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: variable.name,\n\t\t\t\t\t\t\tvalues: [value],\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t}\n\n\t\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership])))) {\n\t\t\t\t\treturn null\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t}),\n\t\t)\n\t\treturn values.filter(notEmpty)\n\t}\n}\n\nexport type AddProjectMemberResponse = Response<null, AddProjectMemberErrorCode>\n\nexport type GetProjectMembersResponse = {\n\tidentity: { id: string }\n\tmemberships: readonly Acl.Membership[]\n}[]\n"],"names":["AddProjectMemberCommand","createSetMembershipVariables","UpdateProjectMemberCommand","RemoveProjectMemberCommand","ProjectMembershipByIdentityQuery","TenantRole","ProjectRole","ProjectMembersQuery","indexListBy","notEmpty","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAqB;AAAA,EACjC,MAAM,iBACL,WACA,WACA,YACA,aACoC;AACpC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,GAAG,WAAW;AAAA,QAC1B,IAAIA,wBAAAA,wBAAwB,WAAW,YAAYC,gBAAAA,6BAA6B,WAAW,CAAC;AAAA,MAAA;AAAA,IAE9F,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,oBACL,WACA,WACA,YACA,aACuC;AACvC,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAIC,sDAA2B,WAAW,YAAY,WAAW,CAAC;AAAA,IAAA;AAAA,EAE5G;AAAA,EAEA,MAAM,oBAAoB,WAA4B,WAAmB,YAA0D;AAClI,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAIC,2BAAAA,2BAA2B,WAAW,UAAU,CAAC;AAAA,IAAA;AAAA,EAE/F;AAAA,EAEA,MAAM,yBACL,WACA,SACA,UACA,UACqC;AACrC,WAAO;AAAA,MACN,GAAG,KAAK,8BAA8B,QAAQ;AAAA,MAC9C,GAAG,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,QAAQ;AAAA,IAAA;AAAA,EAEnF;AAAA,EAEA,MAAM,+BACL,WACA,SACA,UACqC;AACrC,UAAM,WAAW,KAAK,8BAA8B,QAAQ;AAC5D,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,MAAS;AAAA,EACvF;AAAA,EAEA,MAAM,6BACL,WACA,SACA,UACA,UACqC;AACrC,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAIC,kEAAiC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,IAAA;AAE5D,QAAI,aAAa,QAAW;AAC3B,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,kBAAkB,aAAa,QAAQ;AAAA,EAC1D;AAAA,EAEQ,8BAA8B,UAAgF;AACrH,QAAI,SAAS,OAAO,SAASC,MAAAA,WAAW,WAAW,KAAK,SAAS,OAAO,SAASA,MAAAA,WAAW,aAAa,GAAG;AAC3G,aAAO,CAAC,EAAE,MAAMC,OAAAA,YAAY,OAAO,WAAW,CAAA,GAAI;AAAA,IACnD;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAM,kBACL,WACA,WACA,gBACA,OACqC;AACrC,WAAO,UAAU,YAAY,OAAM,OAAM;AACxC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,WAAW,KAAK,CAAC;AACrF,YAAM,cAAc,MAAM,GAAG,aAAa;AAAA,QACzC,IAAIH,iCAAAA;AAAAA,UACH,EAAE,IAAI,UAAA;AAAA,UACN,QAAQ,IAAI,CAAA,OAAM,GAAG,EAAE;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,sBAAsB,MAAM,KAAK,kBAAkB,aAAa,cAAc;AACpF,YAAM,aAAaI,MAAAA,YAAY,qBAAqB,YAAY;AAChE,aAAO,QACL,IAAI,CAAA,OAAO,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa,WAAW,GAAG,EAAE,EAAA,IAAM,IAAK,EACvF,OAAOC,cAAQ;AAAA,IAClB,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,aACA,UACe;AACf,UAAM,sBAA2B,CAAA;AACjC,mBAAgB,YAAW,cAAc,aAAa;AACrD,UAAI,CAAE,MAAM,SAASC,oCAAkB,oBAAoB,CAAC,EAAE,MAAM,WAAW,MAAM,WAAW,GAAC,CAAG,CAAC,CAAC,GAAI;AACzG;AAAA,MACD;AACA,YAAM,YAA0E,CAAA;AAChF,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,SAAS,MAAM,KAAK,sCAAsC,YAAY,UAAU,QAAQ;AAC9F,YAAI,OAAO,WAAW,GAAG;AACxB,mBAAS;AAAA,QACV;AACA,kBAAU,KAAK,EAAE,MAAM,SAAS,MAAM,QAAQ;AAAA,MAC/C;AACA,0BAAoB,KAAK,EAAE,GAAG,YAAY,WAAW;AAAA,IACtD;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,sCACb,YACA,UACA,UAC4C;AAC5C,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC5B,SAAS,OAAO,IAAI,OAAO,UAAkC;AAC5D,cAAM,gBAAgB;AAAA,UACrB,MAAM,WAAW;AAAA,UACjB,WAAW;AAAA,YACV;AAAA,cACC,MAAM,SAAS;AAAA,cACf,QAAQ,CAAC,KAAK;AAAA,YAAA;AAAA,UACf;AAAA,QACD;AAGD,YAAI,CAAE,MAAM,SAASA,kBAAAA,kBAAkB,oBAAoB,CAAC,aAAa,CAAC,CAAC,GAAI;AAC9E,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,MACR,CAAC;AAAA,IAAA;AAEF,WAAO,OAAO,OAAOD,cAAQ;AAAA,EAC9B;AACD;;"}

package/dist/production/src/model/service/ProjectMemberManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMemberManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectMemberManager.ts"],"sourcesContent":["import {\n\tAddProjectMemberCommand,\n\tMembershipUpdateInput,\n\tRemoveProjectMemberCommand,\n\tRemoveProjectMemberResponse,\n\tUpdateProjectMemberCommand,\n\tUpdateProjectMemberResponse,\n} from '../commands'\nimport { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries'\nimport { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema'\nimport { AccessVerifier, PermissionActions, TenantRole } from '../authorization'\nimport { indexListBy, notEmpty } from '../../utils/array'\nimport { createSetMembershipVariables } from './membershipUtils'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { Response } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\n\nexport class ProjectMemberManager {\n\tasync addProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t): Promise<AddProjectMemberResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await db.commandBus.execute(\n\t\t\t\tnew AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),\n\t\t\t)\n\t\t})\n\t}\n\n\tasync updateProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly MembershipUpdateInput[],\n\t): Promise<UpdateProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships)),\n\t\t)\n\t}\n\n\tasync removeProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string): Promise<RemoveProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId)),\n\t\t)\n\t}\n\n\tasync getAllProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\treturn [\n\t\t\t...this.getImplicitProjectMemberships(identity),\n\t\t\t...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier),\n\t\t]\n\t}\n\n\tasync getEffectiveProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst implicit = this.getImplicitProjectMemberships(identity)\n\t\tif (implicit.length > 0) {\n\t\t\treturn implicit\n\t\t}\n\t\treturn await this.getStoredProjectsMemberships(dbContext, project, identity, undefined)\n\t}\n\n\tasync getStoredProjectsMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst memberships = await dbContext.queryHandler.fetch(\n\t\t\tnew ProjectMembershipByIdentityQuery(project, [identity.id]),\n\t\t)\n\t\tif (verifier === undefined) {\n\t\t\treturn memberships\n\t\t}\n\t\treturn await this.filterMemberships(memberships, verifier)\n\t}\n\n\tprivate getImplicitProjectMemberships(identity: { id: string; roles?: readonly string[] }): readonly Acl.Membership[] {\n\t\tif (identity.roles?.includes(TenantRole.SUPER_ADMIN) || identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {\n\t\t\treturn [{ role: ProjectRole.ADMIN, variables: [] }]\n\t\t}\n\t\treturn []\n\t}\n\n\tasync getProjectMembers(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\taccessVerifier: AccessVerifier,\n\t\tinput: ProjectMembersInput,\n\t): Promise<GetProjectMembersResponse> {\n\t\treturn dbContext.transaction(async db => {\n\t\t\tconst members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))\n\t\t\tconst memberships = await db.queryHandler.fetch(\n\t\t\t\tnew ProjectMembershipByIdentityQuery(\n\t\t\t\t\t{ id: projectId },\n\t\t\t\t\tmembers.map(it => it.id),\n\t\t\t\t),\n\t\t\t)\n\t\t\tconst filteredMemberships = await this.filterMemberships(memberships, accessVerifier)\n\t\t\tconst byIdentity = indexListBy(filteredMemberships, 'identityId')\n\t\t\treturn members\n\t\t\t\t.map(it => (byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null))\n\t\t\t\t.filter(notEmpty)\n\t\t})\n\t}\n\n\tprivate async filterMemberships<T extends Acl.Membership>(\n\t\tmemberships: readonly T[],\n\t\tverifier: AccessVerifier,\n\t): Promise<T[]> {\n\t\tconst filteredMemberships: T[] = []\n\t\tnextMembership: for (const membership of memberships) {\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst variables: { values: Acl.MembershipVariable['values']; name: string }[] = []\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)\n\t\t\t\tif (values.length === 0) {\n\t\t\t\t\tcontinue nextMembership\n\t\t\t\t}\n\t\t\t\tvariables.push({ name: variable.name, values })\n\t\t\t}\n\t\t\tfilteredMemberships.push({ ...membership, variables })\n\t\t}\n\n\t\treturn filteredMemberships\n\t}\n\n\tprivate async filterProjectMembershipVariableValues(\n\t\tmembership: Acl.Membership,\n\t\tvariable: Acl.MembershipVariable,\n\t\tverifier: AccessVerifier,\n\t): Promise<Acl.MembershipVariable['values']> {\n\t\tconst values = await Promise.all(\n\t\t\tvariable.values.map(async (value): Promise<string | null> => {\n\t\t\t\tconst subMembership = {\n\t\t\t\t\trole: membership.role,\n\t\t\t\t\tvariables: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: variable.name,\n\t\t\t\t\t\t\tvalues: [value],\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t}\n\n\t\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership])))) {\n\t\t\t\t\treturn null\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t}),\n\t\t)\n\t\treturn values.filter(notEmpty)\n\t}\n}\n\nexport type AddProjectMemberResponse = Response<null, AddProjectMemberErrorCode>\n\nexport type GetProjectMembersResponse = {\n\tidentity: { id: string }\n\tmemberships: readonly Acl.Membership[]\n}[]\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAqB;AAAA,EACjC,MAAM,iBACL,WACA,WACA,YACA,aACoC;AACpC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,GAAG,WAAW;AAAA,QAC1B,IAAI,wBAAwB,WAAW,YAAY,6BAA6B,WAAW,CAAC;AAAA,MAAA;AAAA,IAE9F,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,oBACL,WACA,WACA,YACA,aACuC;AACvC,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,YAAY,WAAW,CAAC;AAAA,IAAA;AAAA,EAE5G;AAAA,EAEA,MAAM,oBAAoB,WAA4B,WAAmB,YAA0D;AAClI,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,UAAU,CAAC;AAAA,IAAA;AAAA,EAE/F;AAAA,EAEA,MAAM,yBACL,WACA,SACA,UACA,UACqC;AACrC,WAAO;AAAA,MACN,GAAG,KAAK,8BAA8B,QAAQ;AAAA,MAC9C,GAAG,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,QAAQ;AAAA,IAAA;AAAA,EAEnF;AAAA,EAEA,MAAM,+BACL,WACA,SACA,UACqC;AACrC,UAAM,WAAW,KAAK,8BAA8B,QAAQ;AAC5D,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,MAAS;AAAA,EACvF;AAAA,EAEA,MAAM,6BACL,WACA,SACA,UACA,UACqC;AACrC,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAI,iCAAiC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,IAAA;AAE5D,QAAI,aAAa,QAAW;AAC3B,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,kBAAkB,aAAa,QAAQ;AAAA,EAC1D;AAAA,EAEQ,8BAA8B,UAAgF;AACrH,QAAI,SAAS,OAAO,SAAS,WAAW,WAAW,KAAK,SAAS,OAAO,SAAS,WAAW,aAAa,GAAG;AAC3G,aAAO,CAAC,EAAE,MAAM,YAAY,OAAO,WAAW,CAAA,GAAI;AAAA,IACnD;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAM,kBACL,WACA,WACA,gBACA,OACqC;AACrC,WAAO,UAAU,YAAY,OAAM,OAAM;AACxC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,CAAC;AACrF,YAAM,cAAc,MAAM,GAAG,aAAa;AAAA,QACzC,IAAI;AAAA,UACH,EAAE,IAAI,UAAA;AAAA,UACN,QAAQ,IAAI,CAAA,OAAM,GAAG,EAAE;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,sBAAsB,MAAM,KAAK,kBAAkB,aAAa,cAAc;AACpF,YAAM,aAAa,YAAY,qBAAqB,YAAY;AAChE,aAAO,QACL,IAAI,CAAA,OAAO,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa,WAAW,GAAG,EAAE,EAAA,IAAM,IAAK,EACvF,OAAO,QAAQ;AAAA,IAClB,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,aACA,UACe;AACf,UAAM,sBAA2B,CAAA;AACjC,mBAAgB,YAAW,cAAc,aAAa;AACrD,UAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,EAAE,MAAM,WAAW,MAAM,WAAW,GAAC,CAAG,CAAC,CAAC,GAAI;AACzG;AAAA,MACD;AACA,YAAM,YAA0E,CAAA;AAChF,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,SAAS,MAAM,KAAK,sCAAsC,YAAY,UAAU,QAAQ;AAC9F,YAAI,OAAO,WAAW,GAAG;AACxB,mBAAS;AAAA,QACV;AACA,kBAAU,KAAK,EAAE,MAAM,SAAS,MAAM,QAAQ;AAAA,MAC/C;AACA,0BAAoB,KAAK,EAAE,GAAG,YAAY,WAAW;AAAA,IACtD;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,sCACb,YACA,UACA,UAC4C;AAC5C,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC5B,SAAS,OAAO,IAAI,OAAO,UAAkC;AAC5D,cAAM,gBAAgB;AAAA,UACrB,MAAM,WAAW;AAAA,UACjB,WAAW;AAAA,YACV;AAAA,cACC,MAAM,SAAS;AAAA,cACf,QAAQ,CAAC,KAAK;AAAA,YAAA;AAAA,UACf;AAAA,QACD;AAGD,YAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,aAAa,CAAC,CAAC,GAAI;AAC9E,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,MACR,CAAC;AAAA,IAAA;AAEF,WAAO,OAAO,OAAO,QAAQ;AAAA,EAC9B;AACD;"}
+{"version":3,"file":"ProjectMemberManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectMemberManager.ts"],"sourcesContent":["import {\n\tAddProjectMemberCommand,\n\tMembershipUpdateInput,\n\tRemoveProjectMemberCommand,\n\tRemoveProjectMemberResponse,\n\tUpdateProjectMemberCommand,\n\tUpdateProjectMemberResponse,\n} from '../commands/index.js'\nimport { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries/index.js'\nimport { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema/index.js'\nimport { AccessVerifier, PermissionActions, TenantRole } from '../authorization/index.js'\nimport { indexListBy, notEmpty } from '../../utils/array.js'\nimport { createSetMembershipVariables } from './membershipUtils.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { Response } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class ProjectMemberManager {\n\tasync addProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t): Promise<AddProjectMemberResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await db.commandBus.execute(\n\t\t\t\tnew AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),\n\t\t\t)\n\t\t})\n\t}\n\n\tasync updateProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly MembershipUpdateInput[],\n\t): Promise<UpdateProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships)),\n\t\t)\n\t}\n\n\tasync removeProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string): Promise<RemoveProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId)),\n\t\t)\n\t}\n\n\tasync getAllProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\treturn [\n\t\t\t...this.getImplicitProjectMemberships(identity),\n\t\t\t...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier),\n\t\t]\n\t}\n\n\tasync getEffectiveProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst implicit = this.getImplicitProjectMemberships(identity)\n\t\tif (implicit.length > 0) {\n\t\t\treturn implicit\n\t\t}\n\t\treturn await this.getStoredProjectsMemberships(dbContext, project, identity, undefined)\n\t}\n\n\tasync getStoredProjectsMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst memberships = await dbContext.queryHandler.fetch(\n\t\t\tnew ProjectMembershipByIdentityQuery(project, [identity.id]),\n\t\t)\n\t\tif (verifier === undefined) {\n\t\t\treturn memberships\n\t\t}\n\t\treturn await this.filterMemberships(memberships, verifier)\n\t}\n\n\tprivate getImplicitProjectMemberships(identity: { id: string; roles?: readonly string[] }): readonly Acl.Membership[] {\n\t\tif (identity.roles?.includes(TenantRole.SUPER_ADMIN) || identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {\n\t\t\treturn [{ role: ProjectRole.ADMIN, variables: [] }]\n\t\t}\n\t\treturn []\n\t}\n\n\tasync getProjectMembers(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\taccessVerifier: AccessVerifier,\n\t\tinput: ProjectMembersInput,\n\t): Promise<GetProjectMembersResponse> {\n\t\treturn dbContext.transaction(async db => {\n\t\t\tconst members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))\n\t\t\tconst memberships = await db.queryHandler.fetch(\n\t\t\t\tnew ProjectMembershipByIdentityQuery(\n\t\t\t\t\t{ id: projectId },\n\t\t\t\t\tmembers.map(it => it.id),\n\t\t\t\t),\n\t\t\t)\n\t\t\tconst filteredMemberships = await this.filterMemberships(memberships, accessVerifier)\n\t\t\tconst byIdentity = indexListBy(filteredMemberships, 'identityId')\n\t\t\treturn members\n\t\t\t\t.map(it => (byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null))\n\t\t\t\t.filter(notEmpty)\n\t\t})\n\t}\n\n\tprivate async filterMemberships<T extends Acl.Membership>(\n\t\tmemberships: readonly T[],\n\t\tverifier: AccessVerifier,\n\t): Promise<T[]> {\n\t\tconst filteredMemberships: T[] = []\n\t\tnextMembership: for (const membership of memberships) {\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst variables: { values: Acl.MembershipVariable['values']; name: string }[] = []\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)\n\t\t\t\tif (values.length === 0) {\n\t\t\t\t\tcontinue nextMembership\n\t\t\t\t}\n\t\t\t\tvariables.push({ name: variable.name, values })\n\t\t\t}\n\t\t\tfilteredMemberships.push({ ...membership, variables })\n\t\t}\n\n\t\treturn filteredMemberships\n\t}\n\n\tprivate async filterProjectMembershipVariableValues(\n\t\tmembership: Acl.Membership,\n\t\tvariable: Acl.MembershipVariable,\n\t\tverifier: AccessVerifier,\n\t): Promise<Acl.MembershipVariable['values']> {\n\t\tconst values = await Promise.all(\n\t\t\tvariable.values.map(async (value): Promise<string | null> => {\n\t\t\t\tconst subMembership = {\n\t\t\t\t\trole: membership.role,\n\t\t\t\t\tvariables: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: variable.name,\n\t\t\t\t\t\t\tvalues: [value],\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t}\n\n\t\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership])))) {\n\t\t\t\t\treturn null\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t}),\n\t\t)\n\t\treturn values.filter(notEmpty)\n\t}\n}\n\nexport type AddProjectMemberResponse = Response<null, AddProjectMemberErrorCode>\n\nexport type GetProjectMembersResponse = {\n\tidentity: { id: string }\n\tmemberships: readonly Acl.Membership[]\n}[]\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAqB;AAAA,EACjC,MAAM,iBACL,WACA,WACA,YACA,aACoC;AACpC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,GAAG,WAAW;AAAA,QAC1B,IAAI,wBAAwB,WAAW,YAAY,6BAA6B,WAAW,CAAC;AAAA,MAAA;AAAA,IAE9F,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,oBACL,WACA,WACA,YACA,aACuC;AACvC,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,YAAY,WAAW,CAAC;AAAA,IAAA;AAAA,EAE5G;AAAA,EAEA,MAAM,oBAAoB,WAA4B,WAAmB,YAA0D;AAClI,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,UAAU,CAAC;AAAA,IAAA;AAAA,EAE/F;AAAA,EAEA,MAAM,yBACL,WACA,SACA,UACA,UACqC;AACrC,WAAO;AAAA,MACN,GAAG,KAAK,8BAA8B,QAAQ;AAAA,MAC9C,GAAG,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,QAAQ;AAAA,IAAA;AAAA,EAEnF;AAAA,EAEA,MAAM,+BACL,WACA,SACA,UACqC;AACrC,UAAM,WAAW,KAAK,8BAA8B,QAAQ;AAC5D,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,MAAS;AAAA,EACvF;AAAA,EAEA,MAAM,6BACL,WACA,SACA,UACA,UACqC;AACrC,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAI,iCAAiC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,IAAA;AAE5D,QAAI,aAAa,QAAW;AAC3B,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,kBAAkB,aAAa,QAAQ;AAAA,EAC1D;AAAA,EAEQ,8BAA8B,UAAgF;AACrH,QAAI,SAAS,OAAO,SAAS,WAAW,WAAW,KAAK,SAAS,OAAO,SAAS,WAAW,aAAa,GAAG;AAC3G,aAAO,CAAC,EAAE,MAAM,YAAY,OAAO,WAAW,CAAA,GAAI;AAAA,IACnD;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAM,kBACL,WACA,WACA,gBACA,OACqC;AACrC,WAAO,UAAU,YAAY,OAAM,OAAM;AACxC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,CAAC;AACrF,YAAM,cAAc,MAAM,GAAG,aAAa;AAAA,QACzC,IAAI;AAAA,UACH,EAAE,IAAI,UAAA;AAAA,UACN,QAAQ,IAAI,CAAA,OAAM,GAAG,EAAE;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,sBAAsB,MAAM,KAAK,kBAAkB,aAAa,cAAc;AACpF,YAAM,aAAa,YAAY,qBAAqB,YAAY;AAChE,aAAO,QACL,IAAI,CAAA,OAAO,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa,WAAW,GAAG,EAAE,EAAA,IAAM,IAAK,EACvF,OAAO,QAAQ;AAAA,IAClB,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,aACA,UACe;AACf,UAAM,sBAA2B,CAAA;AACjC,mBAAgB,YAAW,cAAc,aAAa;AACrD,UAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,EAAE,MAAM,WAAW,MAAM,WAAW,GAAC,CAAG,CAAC,CAAC,GAAI;AACzG;AAAA,MACD;AACA,YAAM,YAA0E,CAAA;AAChF,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,SAAS,MAAM,KAAK,sCAAsC,YAAY,UAAU,QAAQ;AAC9F,YAAI,OAAO,WAAW,GAAG;AACxB,mBAAS;AAAA,QACV;AACA,kBAAU,KAAK,EAAE,MAAM,SAAS,MAAM,QAAQ;AAAA,MAC/C;AACA,0BAAoB,KAAK,EAAE,GAAG,YAAY,WAAW;AAAA,IACtD;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,sCACb,YACA,UACA,UAC4C;AAC5C,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC5B,SAAS,OAAO,IAAI,OAAO,UAAkC;AAC5D,cAAM,gBAAgB;AAAA,UACrB,MAAM,WAAW;AAAA,UACjB,WAAW;AAAA,YACV;AAAA,cACC,MAAM,SAAS;AAAA,cACf,QAAQ,CAAC,KAAK;AAAA,YAAA;AAAA,UACf;AAAA,QACD;AAGD,YAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,aAAa,CAAC,CAAC,GAAI;AAC9E,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,MACR,CAAC;AAAA,IAAA;AAEF,WAAO,OAAO,OAAO,QAAQ;AAAA,EAC9B;AACD;"}