@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/dist/types/model/service/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/service/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAA;AACxB,cAAc,OAAO,CAAA;AAErB,cAAc,kBAAkB,CAAA;AAChC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,cAAc,CAAA;AAC5B,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,uBAAuB,CAAA;AACrC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA;AAChC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/service/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAE9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,4BAA4B,CAAA;AAC1C,cAAc,2BAA2B,CAAA;AACzC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,2BAA2B,CAAA;AACzC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA"}

package/dist/types/model/service/membershipUtils.d.ts

@@ -1,4 +1,4 @@
-import { MembershipInput, MembershipUpdateInput } from '../commands';
+import { MembershipInput, MembershipUpdateInput } from '../commands/index.js';
 import { Acl } from '@contember/schema';
 export declare const createSetMembershipVariables: (memberships: readonly Acl.Membership[]) => MembershipInput[];
 export declare const createAppendMembershipVariables: (memberships: readonly Acl.Membership[]) => MembershipInput[];

package/dist/types/model/service/membershipUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../../src/model/service/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAuB,MAAM,aAAa,CAAA;AACzF,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,eAAO,MAAM,4BAA4B,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKpG,CAAA;AACD,eAAO,MAAM,+BAA+B,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKvG,CAAA;AAED,eAAO,MAAM,4BAA4B,GACxC,gBAAgB,SAAS,GAAG,CAAC,UAAU,EAAE,EACzC,gBAAgB,SAAS,GAAG,CAAC,UAAU,EAAE,KACvC,qBAAqB,EA8BvB,CAAA"}
+{"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../../src/model/service/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAuB,MAAM,sBAAsB,CAAA;AAClG,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,eAAO,MAAM,4BAA4B,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKpG,CAAA;AACD,eAAO,MAAM,+BAA+B,GAAI,aAAa,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKvG,CAAA;AAED,eAAO,MAAM,4BAA4B,GACxC,gBAAgB,SAAS,GAAG,CAAC,UAAU,EAAE,EACzC,gBAAgB,SAAS,GAAG,CAAC,UAAU,EAAE,KACvC,qBAAqB,EA8BvB,CAAA"}

package/dist/types/model/type/AuthLog.d.ts

@@ -1,2 +1,2 @@
-export type AuthActionType = 'login' | 'create_session_token' | 'idp_login' | 'password_reset_init' | 'password_reset' | 'password_change' | 'email_change' | '2fa_disable' | '2fa_enable' | 'passwordless_login_init' | 'passwordless_login_exchange' | 'passwordless_login' | 'person_disable';
+export type AuthActionType = 'login' | 'create_session_token' | 'idp_login' | 'password_reset_init' | 'password_reset' | 'password_change' | 'email_change' | 'email_verify_init' | 'email_verify_complete' | 'email_change_init' | 'email_change_complete' | '2fa_disable' | '2fa_enable' | 'passwordless_login_init' | 'passwordless_login_exchange' | 'passwordless_login' | 'person_disable' | 'session_revoked_by_user' | 'forced_sign_out' | 'global_role_grant' | 'global_role_revoke' | 'project_membership_create' | 'project_membership_update' | 'project_membership_remove' | 'api_key_create' | 'api_key_disable' | 'idp_create' | 'idp_update' | 'idp_disable' | 'idp_enable' | 'idp_session_revalidated' | 'idp_session_revoked' | 'idp_session_revalidation_failed' | 'idp_logout_initiated' | 'idp_backchannel_logout' | 'idp_disconnect' | 'project_create' | 'project_update' | 'project_secret_change' | 'mail_template_change' | 'tenant_config_change' | 'person_invite' | 'backup_code_generated' | 'backup_code_used' | 'backup_code_regenerated' | 'email_otp_sent' | 'mfa_enrollment_required' | 'mfa_reset' | 'session_expired_idle' | 'session_policy_applied' | 'auth_policy_change' | 'unusual_login_detected' | 'step_up_required';
 //# sourceMappingURL=AuthLog.d.ts.map

package/dist/types/model/type/AuthLog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLog.d.ts","sourceRoot":"","sources":["../../../../src/model/type/AuthLog.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GACvB,OAAO,GACP,sBAAsB,GACtB,WAAW,GACX,qBAAqB,GACrB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,6BAA6B,GAC7B,oBAAoB,GACpB,gBAAgB,CAAA"}
+{"version":3,"file":"AuthLog.d.ts","sourceRoot":"","sources":["../../../../src/model/type/AuthLog.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GACvB,OAAO,GACP,sBAAsB,GACtB,WAAW,GACX,qBAAqB,GACrB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,uBAAuB,GACvB,mBAAmB,GACnB,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,6BAA6B,GAC7B,oBAAoB,GACpB,gBAAgB,GAChB,yBAAyB,GACzB,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,qBAAqB,GACrB,iCAAiC,GACjC,sBAAsB,GACtB,wBAAwB,GACxB,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,GACtB,sBAAsB,GACtB,eAAe,GACf,uBAAuB,GACvB,kBAAkB,GAClB,yBAAyB,GACzB,gBAAgB,GAChB,yBAAyB,GACzB,WAAW,GACX,sBAAsB,GACtB,wBAAwB,GACxB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,CAAA"}

package/dist/types/model/type/AuthPolicy.d.ts

@@ -0,0 +1,30 @@
+import { IPostgresInterval } from 'postgres-interval';
+export type AuthPolicyScope = 'global' | 'project';
+/** A row of the `auth_policy` table. Intervals come back as {@link IPostgresInterval}, like {@link ConfigRow}. */
+export type AuthPolicyRow = {
+    readonly id: string;
+    readonly scope: AuthPolicyScope;
+    readonly project_id: string | null;
+    readonly roles: string[];
+    readonly mfa_required: boolean | null;
+    readonly token_expiration: IPostgresInterval | null;
+    readonly idle_timeout: IPostgresInterval | null;
+    readonly grace_duration: IPostgresInterval | null;
+    readonly remember_me_allowed: boolean | null;
+    readonly created_at: Date;
+    readonly updated_at: Date;
+};
+/**
+ * The effective, aggregated policy for an identity. Shared output of
+ * {@link AuthPolicyResolver}: A06 consumes {@link mfaRequired}; A19 will consume
+ * the session fields. Where nothing matches, this is the inert baseline
+ * (`mfaRequired=false`, session fields null).
+ */
+export type EffectivePolicy = {
+    readonly mfaRequired: boolean;
+    readonly tokenExpiration: IPostgresInterval | null;
+    readonly idleTimeout: IPostgresInterval | null;
+    readonly graceDuration: IPostgresInterval | null;
+    readonly rememberMeAllowed: boolean | null;
+};
+//# sourceMappingURL=AuthPolicy.d.ts.map

package/dist/types/model/type/AuthPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicy.d.ts","sourceRoot":"","sources":["../../../../src/model/type/AuthPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,SAAS,CAAA;AAElD,kHAAkH;AAClH,MAAM,MAAM,aAAa,GAAG;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,gBAAgB,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACnD,QAAQ,CAAC,YAAY,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC/C,QAAQ,CAAC,cAAc,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACjD,QAAQ,CAAC,mBAAmB,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CACzB,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,eAAe,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAClD,QAAQ,CAAC,WAAW,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC9C,QAAQ,CAAC,aAAa,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAChD,QAAQ,CAAC,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAA;CAC1C,CAAA"}

package/dist/types/model/type/Config.d.ts

@@ -1,8 +1,10 @@
-import { ConfigPolicy } from '../../schema';
+import { CaptchaProvider, ConfigPolicy } from '../../schema/index.js';
 import { IPostgresInterval } from 'postgres-interval';
-import { type Config as ConfigSchema } from '../../schema';
-import { Interval } from '../../schema/types';
+import { type Config as ConfigSchema } from '../../schema/index.js';
+import { Interval } from '../../schema/types.js';
 export type ConfigRow = {
+    signup_require_email_verification: boolean;
+    require_email_change_verification: boolean;
     passwordless_enabled: ConfigPolicy;
     passwordless_url: string | null;
     passwordless_expiration: IPostgresInterval;
@@ -13,16 +15,49 @@ export type ConfigRow = {
     password_require_special: number;
     password_pattern: string | null;
     password_check_blacklist: boolean;
+    password_check_hibp: boolean;
     login_base_backoff: IPostgresInterval;
     login_max_backoff: IPostgresInterval;
     login_attempt_window: IPostgresInterval;
     login_reveal_user_exits: boolean;
+    login_reveal_login_method: boolean;
     login_default_token_expiration: IPostgresInterval;
     login_max_token_expiration: IPostgresInterval | null;
+    login_mfa_grace_duration: IPostgresInterval;
+    login_anomaly_detection_enabled: boolean;
+    login_anomaly_history_size: number;
+    login_anomaly_email_threshold: number;
+    login_anomaly_step_up_threshold: number;
+    captcha_provider: CaptchaProvider | null;
+    captcha_secret: Buffer | null;
+    captcha_secret_version: number | null;
+    captcha_threshold: number | null;
+    captcha_protect_sign_up: boolean;
+    captcha_protect_password_reset: boolean;
+    captcha_protect_passwordless_init: boolean;
+    captcha_protect_email_verification: boolean;
+    rate_limit_sign_up_per_ip_limit: number;
+    rate_limit_sign_up_per_ip_window: IPostgresInterval;
+    rate_limit_login_per_ip_limit: number;
+    rate_limit_login_per_ip_window: IPostgresInterval;
+    rate_limit_password_reset_per_ip_limit: number;
+    rate_limit_password_reset_per_ip_window: IPostgresInterval;
+    rate_limit_passwordless_init_per_ip_limit: number;
+    rate_limit_passwordless_init_per_ip_window: IPostgresInterval;
+    rate_limit_email_otp_per_person_limit: number;
+    rate_limit_email_otp_per_person_window: IPostgresInterval;
+    rate_limit_email_verification_per_ip_limit: number;
+    rate_limit_email_verification_per_ip_window: IPostgresInterval;
 };
 export type Config = Omit<{
     [K in keyof ConfigSchema]: {
         [K2 in keyof ConfigSchema[K]]: Exclude<ConfigSchema[K][K2], Interval>;
     };
-}, '__typename'>;
+}, '__typename'> & {
+    /**
+     * Decrypted/plaintext captcha secret. Never exposed through the GraphQL
+     * schema — only the runtime validator reads it.
+     */
+    readonly captchaSecret: string | null;
+};
 //# sourceMappingURL=Config.d.ts.map

package/dist/types/model/type/Config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../../../src/model/type/Config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAA;AAC7C,MAAM,MAAM,SAAS,GAAG;IACvB,oBAAoB,EAAE,YAAY,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,uBAAuB,EAAE,iBAAiB,CAAA;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,0BAA0B,EAAE,MAAM,CAAA;IAClC,0BAA0B,EAAE,MAAM,CAAA;IAClC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wBAAwB,EAAE,MAAM,CAAA;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,wBAAwB,EAAE,OAAO,CAAA;IACjC,kBAAkB,EAAE,iBAAiB,CAAA;IACrC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,oBAAoB,EAAE,iBAAiB,CAAA;IACvC,uBAAuB,EAAE,OAAO,CAAA;IAChC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,0BAA0B,EAAE,iBAAiB,GAAG,IAAI,CAAA;CACpD,CAAA;AAED,MAAM,MAAM,MAAM,GAAG,IAAI,CACxB;KACE,CAAC,IAAI,MAAM,YAAY,GAAG;SACzB,EAAE,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;KACrE;CACD,EACD,YAAY,CACZ,CAAA"}
+{"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../../../src/model/type/Config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,MAAM,MAAM,SAAS,GAAG;IACvB,iCAAiC,EAAE,OAAO,CAAA;IAC1C,iCAAiC,EAAE,OAAO,CAAA;IAC1C,oBAAoB,EAAE,YAAY,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,uBAAuB,EAAE,iBAAiB,CAAA;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,0BAA0B,EAAE,MAAM,CAAA;IAClC,0BAA0B,EAAE,MAAM,CAAA;IAClC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wBAAwB,EAAE,MAAM,CAAA;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,wBAAwB,EAAE,OAAO,CAAA;IACjC,mBAAmB,EAAE,OAAO,CAAA;IAC5B,kBAAkB,EAAE,iBAAiB,CAAA;IACrC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,oBAAoB,EAAE,iBAAiB,CAAA;IACvC,uBAAuB,EAAE,OAAO,CAAA;IAChC,yBAAyB,EAAE,OAAO,CAAA;IAClC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,0BAA0B,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACpD,wBAAwB,EAAE,iBAAiB,CAAA;IAC3C,+BAA+B,EAAE,OAAO,CAAA;IACxC,0BAA0B,EAAE,MAAM,CAAA;IAClC,6BAA6B,EAAE,MAAM,CAAA;IACrC,+BAA+B,EAAE,MAAM,CAAA;IACvC,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAA;IACxC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,uBAAuB,EAAE,OAAO,CAAA;IAChC,8BAA8B,EAAE,OAAO,CAAA;IACvC,iCAAiC,EAAE,OAAO,CAAA;IAC1C,kCAAkC,EAAE,OAAO,CAAA;IAC3C,+BAA+B,EAAE,MAAM,CAAA;IACvC,gCAAgC,EAAE,iBAAiB,CAAA;IACnD,6BAA6B,EAAE,MAAM,CAAA;IACrC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,sCAAsC,EAAE,MAAM,CAAA;IAC9C,uCAAuC,EAAE,iBAAiB,CAAA;IAC1D,yCAAyC,EAAE,MAAM,CAAA;IACjD,0CAA0C,EAAE,iBAAiB,CAAA;IAC7D,qCAAqC,EAAE,MAAM,CAAA;IAC7C,sCAAsC,EAAE,iBAAiB,CAAA;IACzD,0CAA0C,EAAE,MAAM,CAAA;IAClD,2CAA2C,EAAE,iBAAiB,CAAA;CAC9D,CAAA;AAED,MAAM,MAAM,MAAM,GACf,IAAI,CACL;KACE,CAAC,IAAI,MAAM,YAAY,GAAG;SACzB,EAAE,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;KACrE;CACD,EACD,YAAY,CACZ,GACC;IACD;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CACrC,CAAA"}

package/dist/types/model/type/IdentityProvider.d.ts

@@ -8,5 +8,7 @@ export interface IdentityProviderOptions {
     autoSignUp: boolean;
     exclusive: boolean;
     initReturnsConfig: boolean;
+    requireVerifiedEmail: boolean;
+    assumeEmailVerified: boolean;
 }
 //# sourceMappingURL=IdentityProvider.d.ts.map

package/dist/types/model/type/IdentityProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../../src/model/type/IdentityProvider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,uBAAuB,CAAA;CAChC;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;CAC1B"}
+{"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../../src/model/type/IdentityProvider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,uBAAuB,CAAA;CAChC;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,mBAAmB,EAAE,OAAO,CAAA;CAC5B"}

package/dist/types/model/type/PersonToken.d.ts

@@ -1,6 +1,14 @@
 export declare namespace PersonToken {
-    type Type = 'password_reset' | 'passwordless';
+    type Type = 'password_reset' | 'passwordless' | 'mfa_email_otp' | 'email_verification' | 'email_change';
     type ValidationType = 'token' | 'otp';
+    /**
+     * Payload carried by an e-mail-bearing token: the address the token is bound
+     * to. For email_change it is the pending NEW address; for email_verification
+     * it is the address being verified at the time the token was issued.
+     */
+    interface TokenMeta {
+        email: string;
+    }
     interface Row {
         id: string;
         created_at: Date;
@@ -10,6 +18,7 @@ export declare namespace PersonToken {
         person_id: string;
         otp_hash: string | null;
         otp_attempts: number;
+        meta: TokenMeta | null;
     }
     type TokenValidationError = 'TOKEN_NOT_FOUND' | 'TOKEN_INVALID' | 'TOKEN_USED' | 'TOKEN_EXPIRED';
 }

package/dist/types/model/type/PersonToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonToken.d.ts","sourceRoot":"","sources":["../../../../src/model/type/PersonToken.ts"],"names":[],"mappings":"AAAA,yBAAiB,WAAW,CAAC;IAC5B,KAAY,IAAI,GAAG,gBAAgB,GAAG,cAAc,CAAA;IACpD,KAAY,cAAc,GAAG,OAAO,GAAG,KAAK,CAAA;IAE5C,UAAiB,GAAG;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,UAAU,EAAE,IAAI,CAAA;QAChB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAA;QACpB,UAAU,EAAE,IAAI,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,YAAY,EAAE,MAAM,CAAA;KACpB;IAED,KAAY,oBAAoB,GAC7B,iBAAiB,GACjB,eAAe,GACf,YAAY,GACZ,eAAe,CAAA;CAClB"}
+{"version":3,"file":"PersonToken.d.ts","sourceRoot":"","sources":["../../../../src/model/type/PersonToken.ts"],"names":[],"mappings":"AAAA,yBAAiB,WAAW,CAAC;IAC5B,KAAY,IAAI,GAAG,gBAAgB,GAAG,cAAc,GAAG,eAAe,GAAG,oBAAoB,GAAG,cAAc,CAAA;IAC9G,KAAY,cAAc,GAAG,OAAO,GAAG,KAAK,CAAA;IAE5C;;;;OAIG;IACH,UAAiB,SAAS;QACzB,KAAK,EAAE,MAAM,CAAA;KACb;IAED,UAAiB,GAAG;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,UAAU,EAAE,IAAI,CAAA;QAChB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAA;QACpB,UAAU,EAAE,IAAI,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KACtB;IAED,KAAY,oBAAoB,GAC7B,iBAAiB,GACjB,eAAe,GACf,YAAY,GACZ,eAAe,CAAA;CAClB"}

package/dist/types/model/type/RateLimit.d.ts

@@ -0,0 +1,10 @@
+export declare const RateLimitScopes: {
+    readonly signUpPerIp: "sign_up_per_ip";
+    readonly loginPerIp: "login_per_ip";
+    readonly passwordResetPerIp: "password_reset_per_ip";
+    readonly passwordlessInitPerIp: "passwordless_init_per_ip";
+    readonly emailOtpPerPerson: "email_otp_per_person";
+    readonly emailVerificationPerIp: "email_verification_per_ip";
+};
+export type RateLimitScope = typeof RateLimitScopes[keyof typeof RateLimitScopes];
+//# sourceMappingURL=RateLimit.d.ts.map

package/dist/types/model/type/RateLimit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimit.d.ts","sourceRoot":"","sources":["../../../../src/model/type/RateLimit.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe;;;;;;;CAOlB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA"}

package/dist/types/model/type/index.d.ts

@@ -1,6 +1,8 @@
-export * from './ApiKey';
-export * from './IdentityProvider';
-export * from './Project';
-export * from './Variables';
-export * from './PersonToken';
+export * from './ApiKey.js';
+export * from './AuthPolicy.js';
+export * from './Config.js';
+export * from './IdentityProvider.js';
+export * from './Project.js';
+export * from './Variables.js';
+export * from './PersonToken.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/type/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/type/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAA;AACxB,cAAc,oBAAoB,CAAA;AAClC,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/type/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA"}

package/dist/types/model/utils/DatabaseContext.d.ts

@@ -1,7 +1,7 @@
 import { Client, Connection } from '@contember/database';
-import { Providers } from '../providers';
-import { CommandBus } from '../commands';
-import { BatchLoaderArgs } from '../../utils/batchQuery';
+import { Providers } from '../providers.js';
+import { CommandBus } from '../commands/index.js';
+import { BatchLoaderArgs } from '../../utils/batchQuery.js';
 export declare class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {
     readonly client: Client<Conn>;
     readonly providers: Providers;

package/dist/types/model/utils/DatabaseContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DatabaseContext.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/DatabaseContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAA+B,MAAM,wBAAwB,CAAA;AAErF,qBAAa,eAAe,CAAC,IAAI,SAAS,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc;aAI7E,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;aACpB,SAAS,EAAE,SAAS;IAJrC,OAAO,CAAC,OAAO,CAAkE;gBAGhE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EACpB,SAAS,EAAE,SAAS;IAIrC,IAAW,UAAU,qBAEpB;IAED,IAAW,YAAY,iGAEtB;IAEY,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAOtG,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,sBAAsB,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAM7G,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CAS5G"}
+{"version":3,"file":"DatabaseContext.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/DatabaseContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,eAAe,EAA+B,MAAM,2BAA2B,CAAA;AAExF,qBAAa,eAAe,CAAC,IAAI,SAAS,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc;aAI7E,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;aACpB,SAAS,EAAE,SAAS;IAJrC,OAAO,CAAC,OAAO,CAAkE;gBAGhE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EACpB,SAAS,EAAE,SAAS;IAIrC,IAAW,UAAU,qBAEpB;IAED,IAAW,YAAY,iGAEtB;IAEY,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAOtG,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,sBAAsB,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAM7G,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;CAS5G"}

package/dist/types/model/utils/index.d.ts

@@ -1,3 +1,3 @@
-export * from './DatabaseContext';
-export * from './token';
+export * from './DatabaseContext.js';
+export * from './token.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAA;AACpC,cAAc,YAAY,CAAA"}

package/dist/types/model/utils/interval.d.ts

@@ -1,3 +1,9 @@
 import { IPostgresInterval } from 'postgres-interval';
+/**
+ * Serializes an interval into a Postgres-acceptable string literal for use as a
+ * query parameter (e.g. writing into an INTERVAL column). `postgres-interval`
+ * instances expose `toPostgres()`; we fall back to a seconds literal otherwise.
+ */
+export declare const intervalToPostgres: (interval: IPostgresInterval) => string;
 export declare const intervalToSeconds: (interval: IPostgresInterval) => number;
 //# sourceMappingURL=interval.d.ts.map

package/dist/types/model/utils/interval.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interval.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/interval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,eAAO,MAAM,iBAAiB,GAAI,UAAU,iBAAiB,KAAG,MAW/D,CAAA"}
+{"version":3,"file":"interval.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/interval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,iBAAiB,KAAG,MAKhE,CAAA;AAED,eAAO,MAAM,iBAAiB,GAAI,UAAU,iBAAiB,KAAG,MAW/D,CAAA"}

package/dist/types/model/utils/token.d.ts

@@ -1,12 +1,19 @@
-import { FixedLengthHexString } from './hex';
-import { PersonToken } from '../type';
-import { Response } from './Response';
+import { FixedLengthHexString } from './hex.js';
+import { PersonToken } from '../type/index.js';
+import { Response } from './Response.js';
 export declare const generateToken: (generator: {
     randomBytes: (bytes: number) => Promise<Buffer>;
 }) => Promise<string>;
 export type TokenHash = FixedLengthHexString<64>;
 export declare const computeTokenHash: (token: string) => TokenHash;
 export declare const isTokenHash: (token: string) => token is TokenHash;
+export declare const MAX_OTP_ATTEMPTS = 3;
+/**
+ * Constant-time comparison of two token hashes. Both inputs are expected to be
+ * 64-character hex strings (sha256). Returns false on any length mismatch
+ * without leaking timing information about the matching prefix.
+ */
+export declare const timingSafeCompareHash: (a: TokenHash, b: TokenHash) => boolean;
 export declare const validateToken: ({ entry, validationType, token, now }: {
     entry: PersonToken.Row | null;
     validationType: PersonToken.ValidationType;

package/dist/types/model/utils/token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAA0B,MAAM,OAAO,CAAA;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAErC,OAAO,EAAE,QAAQ,EAA6B,MAAM,YAAY,CAAA;AAEhE,eAAO,MAAM,aAAa,GAAU,WAAW;IAC9C,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/C,KAAG,OAAO,CAAC,MAAM,CAEjB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;AAEhD,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,SAKhD,CAAA;AAED,eAAO,MAAM,WAAW,GAAI,OAAO,MAAM,KAAG,KAAK,IAAI,SAA8C,CAAA;AAInG,eAAO,MAAM,aAAa,GAAI,uCAAuC;IACpE,KAAK,EAAE,WAAW,CAAC,GAAG,GAAG,IAAI,CAAA;IAC7B,cAAc,EAAE,WAAW,CAAC,cAAc,CAAA;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,IAAI,CAAA;CACT,KAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,oBAAoB,CAkC7D,CAAA"}
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAA0B,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,OAAO,EAAE,QAAQ,EAA6B,MAAM,eAAe,CAAA;AAEnE,eAAO,MAAM,aAAa,GAAU,WAAW;IAC9C,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/C,KAAG,OAAO,CAAC,MAAM,CAEjB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;AAEhD,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,SAKhD,CAAA;AAED,eAAO,MAAM,WAAW,GAAI,OAAO,MAAM,KAAG,KAAK,IAAI,SAA8C,CAAA;AAEnG,eAAO,MAAM,gBAAgB,IAAI,CAAA;AAEjC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,GAAG,SAAS,EAAE,GAAG,SAAS,KAAG,OAOlE,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,uCAAuC;IACpE,KAAK,EAAE,WAAW,CAAC,GAAG,GAAG,IAAI,CAAA;IAC7B,cAAc,EAAE,WAAW,CAAC,cAAc,CAAA;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,IAAI,CAAA;CACT,KAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,oBAAoB,CAkC7D,CAAA"}

package/dist/types/resolvers/Resolver.d.ts

@@ -1,4 +1,4 @@
-import * as Schema from '../schema';
+import * as Schema from '../schema/index.js';
 import { IResolvers } from '@graphql-tools/utils';
 export interface IgnoreIndex {
     [key: string]: any;

package/dist/types/resolvers/Resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Resolver.d.ts","sourceRoot":"","sources":["../../../src/resolvers/Resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,MAAM,WAAW,WAAW;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAED,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC3C,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG,WAAW,CAAA;IAC1C,QAAQ,EAAE,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAA;CAChD"}
+{"version":3,"file":"Resolver.d.ts","sourceRoot":"","sources":["../../../src/resolvers/Resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,MAAM,WAAW,WAAW;IAC3B,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CAClB;AAED,MAAM,WAAW,QAAS,SAAQ,UAAU;IAC3C,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG,WAAW,CAAA;IAC1C,QAAQ,EAAE,MAAM,CAAC,iBAAiB,GAAG,WAAW,CAAA;CAChD"}

package/dist/types/resolvers/ResolverFactory.d.ts

@@ -1,15 +1,22 @@
-import { AddIDPMutationResolver, AddProjectMemberMutationResolver, ChangePasswordMutationResolver, ChangeProfileMutationResolver, CreateApiKeyMutationResolver, CreateProjectMutationResolver, DisableApiKeyMutationResolver, DisableIDPMutationResolver, EnableIDPMutationResolver, IdentityGlobalRolesMutationResolver, IDPMutationResolver, InviteMutationResolver, MailTemplateMutationResolver, OtpMutationResolver, RemoveProjectMemberMutationResolver, ResetPasswordMutationResolver, SetProjectSecretMutationResolver, SignInMutationResolver, SignOutMutationResolver, SignUpMutationResolver, UpdateProjectMemberMutationResolver, UpdateProjectMutationResolver } from './mutation';
-import { Resolvers } from '../schema';
-import { MeQueryResolver, PersonQueryResolver, ProjectMembersQueryResolver, ProjectQueryResolver } from './query';
-import { IdentityTypeResolver, ProjectTypeResolver } from './types';
-import { IDPQueryResolver } from './query/IDPQueryResolver';
-import { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver';
-import { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver';
-import { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver';
-import { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver';
-import { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver';
-import { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver';
-import { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver';
+import { AddIDPMutationResolver, AddProjectMemberMutationResolver, ChangePasswordMutationResolver, ChangeProfileMutationResolver, CreateApiKeyMutationResolver, CreateProjectMutationResolver, DisableApiKeyMutationResolver, DisableIDPMutationResolver, EmailOtpMutationResolver, EnableIDPMutationResolver, IdentityGlobalRolesMutationResolver, IDPMutationResolver, InviteMutationResolver, MailTemplateMutationResolver, OtpMutationResolver, RegenerateBackupCodesMutationResolver, RemoveProjectMemberMutationResolver, ResetPasswordMutationResolver, SetProjectSecretMutationResolver, SignInMutationResolver, SignOutMutationResolver, SignUpMutationResolver, UpdateProjectMemberMutationResolver, UpdateProjectMutationResolver } from './mutation/index.js';
+import { Resolvers } from '../schema/index.js';
+import { ApiKeyQueryResolver, AuthLogQueryResolver, MeQueryResolver, PersonQueryResolver, ProjectMembersQueryResolver, ProjectQueryResolver } from './query/index.js';
+import { DisconnectMyIdentityProviderMutationResolver } from './mutation/idp/index.js';
+import { IdentityTypeResolver, PersonTypeResolver, ProjectTypeResolver } from './types/index.js';
+import { IDPQueryResolver } from './query/IDPQueryResolver.js';
+import { UpdateIDPMutationResolver } from './mutation/idp/UpdateIDPMutationResolver.js';
+import { DisablePersonMutationResolver } from './mutation/person/DisablePersonMutationResolver.js';
+import { ForceSignOutMutationResolver } from './mutation/person/ForceSignOutMutationResolver.js';
+import { RevokeSessionMutationResolver } from './mutation/person/RevokeSessionMutationResolver.js';
+import { MailTemplateQueryResolver } from './query/MailTemplateQueryResolver.js';
+import { ConfigurationMutationResolver } from './mutation/configuration/ConfigurationMutationResolver.js';
+import { ConfigurationQueryResolver } from './query/ConfigurationQueryResolver.js';
+import { AuthPolicyMutationResolver } from './mutation/configuration/AuthPolicyMutationResolver.js';
+import { AuthPolicyQueryResolver } from './query/AuthPolicyQueryResolver.js';
+import { ResetPersonMfaMutationResolver } from './mutation/person/ResetPersonMfaMutationResolver.js';
+import { PasswordlessMutationResolver } from './mutation/person/PasswordlessMutationResolver.js';
+import { TogglePasswordlessMutationResolver } from './mutation/person/TogglePasswordlessMutationResolver.js';
+import { EmailVerificationMutationResolver } from './mutation/person/EmailVerificationMutationResolver.js';
 declare class ResolverFactory {
     private readonly resolvers;
     constructor(resolvers: {
@@ -25,13 +32,18 @@ declare class ResolverFactory {
         changeProfileMutationResolver: ChangeProfileMutationResolver;
         changePasswordMutationResolver: ChangePasswordMutationResolver;
         resetPasswordMutationResolver: ResetPasswordMutationResolver;
+        emailVerificationMutationResolver: EmailVerificationMutationResolver;
         idpMutationResolver: IDPMutationResolver;
         registerIdpMutationResolver: AddIDPMutationResolver;
         disableIdpMutationResolver: DisableIDPMutationResolver;
         enableIdpMutationResolver: EnableIDPMutationResolver;
         updateIdpMutationResolver: UpdateIDPMutationResolver;
+        disconnectMyIdentityProviderMutationResolver: DisconnectMyIdentityProviderMutationResolver;
         passwordlessMutationResolver: PasswordlessMutationResolver;
         disablePersonMutationResolver: DisablePersonMutationResolver;
+        forceSignOutMutationResolver: ForceSignOutMutationResolver;
+        resetPersonMfaMutationResolver: ResetPersonMfaMutationResolver;
+        revokeSessionMutationResolver: RevokeSessionMutationResolver;
         inviteMutationResolver: InviteMutationResolver;
         addProjectMemberMutationResolver: AddProjectMemberMutationResolver;
         updateProjectMemberMutationResolver: UpdateProjectMemberMutationResolver;
@@ -39,15 +51,22 @@ declare class ResolverFactory {
         createApiKeyMutationResolver: CreateApiKeyMutationResolver;
         disableApiKeyMutationResolver: DisableApiKeyMutationResolver;
         otpMutationResolver: OtpMutationResolver;
+        emailOtpMutationResolver: EmailOtpMutationResolver;
+        regenerateBackupCodesMutationResolver: RegenerateBackupCodesMutationResolver;
         mailTemplateMutationResolver: MailTemplateMutationResolver;
         createProjectMutationResolver: CreateProjectMutationResolver;
         setProjectSecretMutationResolver: SetProjectSecretMutationResolver;
         updateProjectMutationResolver: UpdateProjectMutationResolver;
         identityTypeResolver: IdentityTypeResolver;
+        personTypeResolver: PersonTypeResolver;
         projectTypeResolver: ProjectTypeResolver;
         identityGlobalRolesMutationResolver: IdentityGlobalRolesMutationResolver;
         configurationMutationResolver: ConfigurationMutationResolver;
         configurationQueryResolver: ConfigurationQueryResolver;
+        authPolicyMutationResolver: AuthPolicyMutationResolver;
+        authPolicyQueryResolver: AuthPolicyQueryResolver;
+        authLogQueryResolver: AuthLogQueryResolver;
+        apiKeyQueryResolver: ApiKeyQueryResolver;
         togglePasswordlessMutationResolver: TogglePasswordlessMutationResolver;
     });
     create(): Resolvers & {

package/dist/types/resolvers/ResolverFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ResolverFactory.d.ts","sourceRoot":"","sources":["../../../src/resolvers/ResolverFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,sBAAsB,EACtB,gCAAgC,EAChC,8BAA8B,EAC9B,6BAA6B,EAC7B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,EAC5B,mBAAmB,EACnB,mCAAmC,EACnC,6BAA6B,EAC7B,gCAAgC,EAChC,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mCAAmC,EACnC,6BAA6B,EAC7B,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AACjH,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAA;AACpF,OAAO,EAAE,6BAA6B,EAAE,MAAM,iDAAiD,CAAA;AAC/F,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAA;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wDAAwD,CAAA;AACtG,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,gDAAgD,CAAA;AAC7F,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAA;AAEzG,cAAM,eAAe;IAEnB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE;QAC3B,eAAe,EAAE,eAAe,CAAA;QAChC,mBAAmB,EAAE,mBAAmB,CAAA;QACxC,oBAAoB,EAAE,oBAAoB,CAAA;QAC1C,2BAA2B,EAAE,2BAA2B,CAAA;QACxD,gBAAgB,EAAE,gBAAgB,CAAA;QAClC,yBAAyB,EAAE,yBAAyB,CAAA;QAEpD,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,uBAAuB,EAAE,uBAAuB,CAAA;QAChD,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,8BAA8B,EAAE,8BAA8B,CAAA;QAC9D,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,mBAAmB,EAAE,mBAAmB,CAAA;QACxC,2BAA2B,EAAE,sBAAsB,CAAA;QACnD,0BAA0B,EAAE,0BAA0B,CAAA;QACtD,yBAAyB,EAAE,yBAAyB,CAAA;QACpD,yBAAyB,EAAE,yBAAyB,CAAA;QACpD,4BAA4B,EAAE,4BAA4B,CAAA;QAE1D,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,gCAAgC,EAAE,gCAAgC,CAAA;QAClE,mCAAmC,EAAE,mCAAmC,CAAA;QACxE,mCAAmC,EAAE,mCAAmC,CAAA;QAExE,4BAA4B,EAAE,4BAA4B,CAAA;QAC1D,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,mBAAmB,EAAE,mBAAmB,CAAA;QAExC,4BAA4B,EAAE,4BAA4B,CAAA;QAE1D,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,gCAAgC,EAAE,gCAAgC,CAAA;QAClE,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,oBAAoB,EAAE,oBAAoB,CAAA;QAC1C,mBAAmB,EAAE,mBAAmB,CAAA;QAExC,mCAAmC,EAAE,mCAAmC,CAAA;QAExE,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,0BAA0B,EAAE,0BAA0B,CAAA;QAEtD,kCAAkC,EAAE,kCAAkC,CAAA;KACtE;IAGF,MAAM,IAAI,SAAS,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;KAAE;CAqG7G;AAED,kBAAU,eAAe,CAAC;IACzB,KAAY,iBAAiB,GAAG;QAC/B,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAA;KACvB,CAAA;CACD;AAED,OAAO,EAAE,eAAe,EAAE,CAAA"}
+{"version":3,"file":"ResolverFactory.d.ts","sourceRoot":"","sources":["../../../src/resolvers/ResolverFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,sBAAsB,EACtB,gCAAgC,EAChC,8BAA8B,EAC9B,6BAA6B,EAC7B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,EACzB,mCAAmC,EACnC,mBAAmB,EACnB,sBAAsB,EACtB,4BAA4B,EAC5B,mBAAmB,EACnB,qCAAqC,EACrC,mCAAmC,EACnC,6BAA6B,EAC7B,gCAAgC,EAChC,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,mCAAmC,EACnC,6BAA6B,EAC7B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EACN,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,EACpB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,4CAA4C,EAAE,MAAM,yBAAyB,CAAA;AACtF,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEhG,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,6CAA6C,CAAA;AACvF,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAA;AAChG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAA;AAClG,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,2DAA2D,CAAA;AACzG,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAA;AAClF,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAA;AACnG,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AAC5E,OAAO,EAAE,8BAA8B,EAAE,MAAM,qDAAqD,CAAA;AACpG,OAAO,EAAE,4BAA4B,EAAE,MAAM,mDAAmD,CAAA;AAChG,OAAO,EAAE,kCAAkC,EAAE,MAAM,yDAAyD,CAAA;AAC5G,OAAO,EAAE,iCAAiC,EAAE,MAAM,wDAAwD,CAAA;AAE1G,cAAM,eAAe;IAEnB,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE;QAC3B,eAAe,EAAE,eAAe,CAAA;QAChC,mBAAmB,EAAE,mBAAmB,CAAA;QACxC,oBAAoB,EAAE,oBAAoB,CAAA;QAC1C,2BAA2B,EAAE,2BAA2B,CAAA;QACxD,gBAAgB,EAAE,gBAAgB,CAAA;QAClC,yBAAyB,EAAE,yBAAyB,CAAA;QAEpD,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,uBAAuB,EAAE,uBAAuB,CAAA;QAChD,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,8BAA8B,EAAE,8BAA8B,CAAA;QAC9D,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,iCAAiC,EAAE,iCAAiC,CAAA;QACpE,mBAAmB,EAAE,mBAAmB,CAAA;QACxC,2BAA2B,EAAE,sBAAsB,CAAA;QACnD,0BAA0B,EAAE,0BAA0B,CAAA;QACtD,yBAAyB,EAAE,yBAAyB,CAAA;QACpD,yBAAyB,EAAE,yBAAyB,CAAA;QACpD,4CAA4C,EAAE,4CAA4C,CAAA;QAC1F,4BAA4B,EAAE,4BAA4B,CAAA;QAE1D,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,4BAA4B,EAAE,4BAA4B,CAAA;QAC1D,8BAA8B,EAAE,8BAA8B,CAAA;QAC9D,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,sBAAsB,EAAE,sBAAsB,CAAA;QAC9C,gCAAgC,EAAE,gCAAgC,CAAA;QAClE,mCAAmC,EAAE,mCAAmC,CAAA;QACxE,mCAAmC,EAAE,mCAAmC,CAAA;QAExE,4BAA4B,EAAE,4BAA4B,CAAA;QAC1D,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,mBAAmB,EAAE,mBAAmB,CAAA;QACxC,wBAAwB,EAAE,wBAAwB,CAAA;QAClD,qCAAqC,EAAE,qCAAqC,CAAA;QAE5E,4BAA4B,EAAE,4BAA4B,CAAA;QAE1D,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,gCAAgC,EAAE,gCAAgC,CAAA;QAClE,6BAA6B,EAAE,6BAA6B,CAAA;QAE5D,oBAAoB,EAAE,oBAAoB,CAAA;QAC1C,kBAAkB,EAAE,kBAAkB,CAAA;QACtC,mBAAmB,EAAE,mBAAmB,CAAA;QAExC,mCAAmC,EAAE,mCAAmC,CAAA;QAExE,6BAA6B,EAAE,6BAA6B,CAAA;QAC5D,0BAA0B,EAAE,0BAA0B,CAAA;QAEtD,0BAA0B,EAAE,0BAA0B,CAAA;QACtD,uBAAuB,EAAE,uBAAuB,CAAA;QAEhD,oBAAoB,EAAE,oBAAoB,CAAA;QAC1C,mBAAmB,EAAE,mBAAmB,CAAA;QAExC,kCAAkC,EAAE,kCAAkC,CAAA;KACtE;IAGF,MAAM,IAAI,SAAS,GAAG;QAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA;KAAE;CAsI7G;AAED,kBAAU,eAAe,CAAC;IACzB,KAAY,iBAAiB,GAAG;QAC/B,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAA;KACvB,CAAA;CACD;AAED,OAAO,EAAE,eAAe,EAAE,CAAA"}

package/dist/types/resolvers/TenantResolverContext.d.ts

@@ -1,8 +1,15 @@
-import { DatabaseContext, Identity, PermissionContext } from '../model';
+import { DatabaseContext, Identity, PermissionContext } from '../model/index.js';
 import { Logger } from '@contember/logger';
-import { AuthLogService } from '../model/service/AuthLogService';
+import { AuthLogService } from '../model/service/AuthLogService.js';
+export interface TenantResolverHttpInfo {
+    readonly ip: string;
+    readonly userAgent?: string;
+    /** A03: country from the trusted reverse-proxy geo header, when present + trusted. */
+    readonly geoCountry?: string;
+}
 export interface TenantResolverContext {
     readonly apiKeyId: string;
+    readonly trustForwardedInfo: boolean;
     readonly permissionContext: PermissionContext;
     readonly identity: Identity;
     readonly isAllowed: PermissionContext['isAllowed'];
@@ -10,5 +17,6 @@ export interface TenantResolverContext {
     readonly db: DatabaseContext;
     readonly logger: Logger;
     readonly logAuthAction: (entry: AuthLogService.LogArgs) => Promise<void>;
+    readonly httpInfo: TenantResolverHttpInfo;
 }
 //# sourceMappingURL=TenantResolverContext.d.ts.map

package/dist/types/resolvers/TenantResolverContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TenantResolverContext.d.ts","sourceRoot":"","sources":["../../../src/resolvers/TenantResolverContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAEhE,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;IAClD,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAA;IAC1D,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACxE"}
+{"version":3,"file":"TenantResolverContext.d.ts","sourceRoot":"","sources":["../../../src/resolvers/TenantResolverContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAEnE,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAA;IACpC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAA;IAC7C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC,WAAW,CAAC,CAAA;IAClD,QAAQ,CAAC,aAAa,EAAE,iBAAiB,CAAC,eAAe,CAAC,CAAA;IAC1D,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACxE,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAA;CACzC"}

package/dist/types/resolvers/TenantResolverContextFactory.d.ts

@@ -1,32 +1,41 @@
-import { TenantResolverContext } from './TenantResolverContext';
-import { DatabaseContext, PermissionContext, PermissionContextFactory } from '../model';
+import { TenantResolverContext } from './TenantResolverContext.js';
+import { DatabaseContext, LoginRiskAnalyzer, PermissionContext, PermissionContextFactory } from '../model/index.js';
 import { Logger } from '@contember/logger';
-import { AuthLogService } from '../model/service/AuthLogService';
-export declare const createResolverContext: (permissionContext: PermissionContext, apiKeyId: string) => {
+import { AuthLogService } from '../model/service/AuthLogService.js';
+export declare const createResolverContext: (permissionContext: PermissionContext, apiKeyId: string, trustForwardedInfo?: boolean) => {
     apiKeyId: string;
+    trustForwardedInfo: boolean;
     permissionContext: PermissionContext;
-    identity: import("..").Identity;
+    identity: import("../index.js").Identity;
     isAllowed: <Meta extends {} | undefined>({ scope, action, }: {
-        scope?: import("@contember/authorization").AuthorizationScope<import("..").Identity>;
+        scope?: import("@contember/authorization").AuthorizationScope<import("../index.js").Identity>;
         action: import("@contember/authorization").Authorizator.Action<Meta>;
     }) => Promise<boolean>;
     requireAccess: <Meta extends {} | undefined>({ scope, action, message, }: {
-        scope?: import("@contember/authorization").AuthorizationScope<import("..").Identity>;
+        scope?: import("@contember/authorization").AuthorizationScope<import("../index.js").Identity>;
         action: import("@contember/authorization").Authorizator.Action<Meta>;
         message?: string;
     }) => Promise<void>;
+    httpInfo: {
+        ip: string;
+    };
 };
 export declare class TenantResolverContextFactory {
     private readonly permissionContextFactory;
     private readonly authLogService;
-    constructor(permissionContextFactory: PermissionContextFactory, authLogService: AuthLogService);
+    private readonly loginRiskAnalyzer;
+    constructor(permissionContextFactory: PermissionContextFactory, authLogService: AuthLogService, loginRiskAnalyzer: LoginRiskAnalyzer);
     create(authContext: {
         apiKeyId: string;
         identityId: string;
         roles: string[];
+        trustForwardedInfo?: boolean;
     }, httpInfo: {
         ip: string;
         userAgent?: string;
+        forwarderIp?: string;
+        forwarderUserAgent?: string;
+        geoCountry?: string;
     }, db: DatabaseContext, logger: Logger): TenantResolverContext;
 }
 //# sourceMappingURL=TenantResolverContextFactory.d.ts.map

package/dist/types/resolvers/TenantResolverContextFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TenantResolverContextFactory.d.ts","sourceRoot":"","sources":["../../../src/resolvers/TenantResolverContextFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAC/D,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAA;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAEhE,eAAO,MAAM,qBAAqB,GAAI,mBAAmB,iBAAiB,EAAE,UAAU,MAAM;;;;;aAkBhF,CAAC;;;;aAaR,CAAJ;;eAGE,CAAF;;CA1BA,CAAA;AAED,qBAAa,4BAA4B;IAEvC,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc;gBADd,wBAAwB,EAAE,wBAAwB,EAClD,cAAc,EAAE,cAAc;IAGzC,MAAM,CACZ,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAA;KAAE,EACtE,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5C,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,GACZ,qBAAqB;CAkBxB"}
+{"version":3,"file":"TenantResolverContextFactory.d.ts","sourceRoot":"","sources":["../../../src/resolvers/TenantResolverContextFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AACnH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AAEnE,eAAO,MAAM,qBAAqB,GAAI,mBAAmB,iBAAiB,EAAE,UAAU,MAAM,EAAE,4BAA0B;;;;;;aAgBxG,CAAC;;;;aAUE,CAAC;;eAGW,CAAC;;;;;CAnB/B,CAAA;AAED,qBAAa,4BAA4B;IAEvC,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,wBAAwB,EAAE,wBAAwB,EAClD,cAAc,EAAE,cAAc,EAC9B,iBAAiB,EAAE,iBAAiB;IAG/C,MAAM,CACZ,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,EACpG,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,EACpH,EAAE,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,GACZ,qBAAqB;CA8BxB"}

package/dist/types/resolvers/errorUtils.d.ts

@@ -1,4 +1,4 @@
-import { ResponseError } from '../model/utils/Response';
+import { ResponseError } from '../model/utils/Response.js';
 type Error<T> = {
     code: T;
     developerMessage: string;

package/dist/types/resolvers/errorUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errorUtils.d.ts","sourceRoot":"","sources":["../../../src/resolvers/errorUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAEvD,KAAK,KAAK,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAA;AACrD,KAAK,aAAa,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,IAAI;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;CAAE,CAAA;AAEnG,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,SAAS,EAAE,GAAG,SAAS,EACtF,aAAa,EAAE,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,GACnC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AACzB,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;AAiBhH,eAAO,MAAM,6BAA6B,GAAI,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,MAAM,KAAG,aAAa,CAAC,CAAC,CACb,CAAA"}
+{"version":3,"file":"errorUtils.d.ts","sourceRoot":"","sources":["../../../src/resolvers/errorUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D,KAAK,KAAK,CAAC,CAAC,IAAI;IAAE,IAAI,EAAE,CAAC,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,CAAA;AACrD,KAAK,aAAa,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,IAAI;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;CAAE,CAAA;AAEnG,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,SAAS,EAAE,GAAG,SAAS,EACtF,aAAa,EAAE,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,GACnC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;AACzB,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,gBAAgB,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,CAAA;AAiBhH,eAAO,MAAM,6BAA6B,GAAI,KAAK,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,MAAM,KAAG,aAAa,CAAC,CAAC,CACb,CAAA"}

package/dist/types/resolvers/index.d.ts

@@ -1,7 +1,7 @@
-export * from './mutation';
-export * from './query';
-export * from './types';
-export * from './TenantResolverContext';
-export * from './ResolverFactory';
-export * from './TenantResolverContextFactory';
+export * from './mutation/index.js';
+export * from './query/index.js';
+export * from './types/index.js';
+export * from './TenantResolverContext.js';
+export * from './ResolverFactory.js';
+export * from './TenantResolverContextFactory.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/resolvers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/resolvers/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA;AAC1B,cAAc,SAAS,CAAA;AACvB,cAAc,SAAS,CAAA;AACvB,cAAc,yBAAyB,CAAA;AACvC,cAAc,mBAAmB,CAAA;AACjC,cAAc,gCAAgC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/resolvers/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,kBAAkB,CAAA;AAChC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,sBAAsB,CAAA;AACpC,cAAc,mCAAmC,CAAA"}

package/dist/types/resolvers/membershipUtils.d.ts

@@ -1,5 +1,5 @@
-import { MembershipValidationError } from '../model/service/MembershipValidator';
-import { MembershipValidationError as MembershipValidationErrorSchema } from '../schema';
+import { MembershipValidationError } from '../model/service/MembershipValidator.js';
+import { MembershipValidationError as MembershipValidationErrorSchema } from '../schema/index.js';
 export type MembershipErrorCode = 'INVALID_MEMBERSHIP' | 'ROLE_NOT_FOUND' | 'VARIABLE_EMPTY' | 'VARIABLE_NOT_FOUND';
 export interface MembershipErrorVariable {
     code: MembershipErrorCode;

package/dist/types/resolvers/membershipUtils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../src/resolvers/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAiC,MAAM,sCAAsC,CAAA;AAC/G,OAAO,EAAE,yBAAyB,IAAI,+BAA+B,EAAiC,MAAM,WAAW,CAAA;AAEvH,MAAM,MAAM,mBAAmB,GAC5B,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,CAAA;AAEvB,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,mBAAmB,CAAA;IACzB,oBAAoB,CAAC,EAAE,+BAA+B,EAAE,CAAA;IACxD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;CACxB;AAED,eAAO,MAAM,qCAAqC,GACjD,QAAQ,yBAAyB,EAAE,KACjC,uBAAuB,EAyEzB,CAAA"}
+{"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../src/resolvers/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAiC,MAAM,yCAAyC,CAAA;AAClH,OAAO,EAAE,yBAAyB,IAAI,+BAA+B,EAAiC,MAAM,oBAAoB,CAAA;AAEhI,MAAM,MAAM,mBAAmB,GAC5B,oBAAoB,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,CAAA;AAEvB,MAAM,WAAW,uBAAuB;IACvC,IAAI,EAAE,mBAAmB,CAAA;IACzB,oBAAoB,CAAC,EAAE,+BAA+B,EAAE,CAAA;IACxD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,EAAE,MAAM,CAAA;CACxB;AAED,eAAO,MAAM,qCAAqC,GACjD,QAAQ,yBAAyB,EAAE,KACjC,uBAAuB,EAyEzB,CAAA"}

package/dist/types/resolvers/mutation/apiKey/CreateApiKeyMutationResolver.d.ts

@@ -1,13 +1,13 @@
-import { CreateApiKeyResponse, MutationCreateApiKeyArgs, MutationCreateGlobalApiKeyArgs, MutationResolvers } from '../../../schema';
+import { CreateApiKeyResponse, MutationCreateApiKeyArgs, MutationCreateGlobalApiKeyArgs, MutationResolvers } from '../../../schema/index.js';
 import { GraphQLResolveInfo } from 'graphql';
-import { TenantResolverContext } from '../../TenantResolverContext';
-import { ApiKeyManager, MembershipValidator, ProjectManager } from '../../../model';
+import { TenantResolverContext } from '../../TenantResolverContext.js';
+import { ApiKeyManager, MembershipValidator, ProjectManager } from '../../../model/index.js';
 export declare class CreateApiKeyMutationResolver implements MutationResolvers {
     private readonly apiKeyManager;
     private readonly projectManager;
     private readonly membershipValidator;
     constructor(apiKeyManager: ApiKeyManager, projectManager: ProjectManager, membershipValidator: MembershipValidator);
-    createApiKey(parent: any, { projectSlug, memberships, description, tokenHash }: MutationCreateApiKeyArgs, context: TenantResolverContext, info: GraphQLResolveInfo): Promise<CreateApiKeyResponse>;
-    createGlobalApiKey(parent: any, { roles, description, tokenHash }: MutationCreateGlobalApiKeyArgs, context: TenantResolverContext, info: GraphQLResolveInfo): Promise<CreateApiKeyResponse>;
+    createApiKey(parent: any, { projectSlug, memberships, description, tokenHash, options }: MutationCreateApiKeyArgs, context: TenantResolverContext, info: GraphQLResolveInfo): Promise<CreateApiKeyResponse>;
+    createGlobalApiKey(parent: any, { roles, description, tokenHash, options }: MutationCreateGlobalApiKeyArgs, context: TenantResolverContext, info: GraphQLResolveInfo): Promise<CreateApiKeyResponse>;
 }
 //# sourceMappingURL=CreateApiKeyMutationResolver.d.ts.map