@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/dist/development/src/model/service/EmailOtpManager.js

@@ -0,0 +1,90 @@
+import "@contember/database";
+import "../type/ApiKey.js";
+import { InvalidateTokenCommand } from "../commands/personToken/InvalidateTokenCommand.js";
+import { InvalidateEmailOtpTokensCommand } from "../commands/personToken/InvalidateEmailOtpTokensCommand.js";
+import { ClaimOtpAttemptCommand } from "../commands/personToken/ClaimOtpAttemptCommand.js";
+import { PersonTokenQuery } from "../queries/personToken/PersonTokenQuery.js";
+import { SaveEmailOtpTokenCommand } from "../commands/personToken/SaveEmailOtpTokenCommand.js";
+import { MAX_OTP_ATTEMPTS, validateToken } from "../utils/token.js";
+import { RateLimitScopes } from "../type/RateLimit.js";
+const EMAIL_OTP_EXPIRATION_MINUTES = 10;
+const EMAIL_OTP_DIGITS = 6;
+class EmailOtpManager {
+  constructor(mailer, providers, rateLimiter) {
+    this.mailer = mailer;
+    this.providers = providers;
+    this.rateLimiter = rateLimiter;
+  }
+  /**
+   * Generates a fresh code, invalidates any prior unused email-OTP tokens for the
+   * person, persists the new one and emails the code. Must run inside the request's
+   * db context (it issues commands + sends mail).
+   *
+   * Gated by the per-person `email_otp_per_person` rate limit so an attacker who
+   * knows the password cannot re-issue codes to reset the per-code 3-attempt
+   * counter, nor email-bomb a person. When the limit is hit nothing is sent and
+   * the returned decision is `ok: false` (the caller decides how to surface it);
+   * a previously emailed, still-valid code remains usable.
+   */
+  async sendCode(dbContext, person, config) {
+    const decision = await this.rateLimiter.consume(dbContext, RateLimitScopes.emailOtpPerPerson, person.id, config);
+    if (!decision.ok) {
+      return decision;
+    }
+    const code = await this.generateCode();
+    await dbContext.commandBus.execute(new InvalidateEmailOtpTokensCommand(person.id));
+    await dbContext.commandBus.execute(new SaveEmailOtpTokenCommand(person.id, code, EMAIL_OTP_EXPIRATION_MINUTES));
+    await this.mailer.sendEmailOtpEmail(dbContext, {
+      email: person.email ?? "",
+      code
+    }, {
+      variant: "",
+      projectId: null
+    });
+    return decision;
+  }
+  /**
+   * Fetches the latest unused email-OTP token for the person and validates the
+   * supplied code via the shared `'otp'` path; on success, consumes (invalidates)
+   * the token. Returns whether the code was accepted.
+   *
+   * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}
+   * — a single conditional UPDATE that increments `otp_attempts` only while it is
+   * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent
+   * writers on the row, N parallel guesses can never collectively exceed the cap;
+   * a plain read-then-increment let them all pass with a stale counter.
+   */
+  async verifyAndConsume(dbContext, person, code) {
+    const tokenResult = await dbContext.queryHandler.fetch(PersonTokenQuery.latestUnusedByPerson(person.id, "mfa_email_otp"));
+    if (!tokenResult) {
+      return false;
+    }
+    const reserved = await dbContext.commandBus.execute(new ClaimOtpAttemptCommand(tokenResult.id, MAX_OTP_ATTEMPTS));
+    if (!reserved) {
+      return false;
+    }
+    const validation = validateToken({
+      entry: tokenResult,
+      token: code,
+      now: this.providers.now(),
+      validationType: "otp"
+    });
+    if (!validation.ok) {
+      return false;
+    }
+    await dbContext.commandBus.execute(new InvalidateTokenCommand(validation.result.id));
+    return true;
+  }
+  async generateCode() {
+    const bytes = await this.providers.randomBytes(EMAIL_OTP_DIGITS);
+    let code = "";
+    for (let i = 0; i < EMAIL_OTP_DIGITS; i++) {
+      code += (bytes[i] % 10).toString();
+    }
+    return code;
+  }
+}
+export {
+  EmailOtpManager
+};
+//# sourceMappingURL=EmailOtpManager.js.map

package/dist/development/src/model/service/EmailOtpManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailOtpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailOtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries/index.js'\nimport { DatabaseContext, MAX_OTP_ATTEMPTS, validateToken } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ClaimOtpAttemptCommand, InvalidateEmailOtpTokensCommand, InvalidateTokenCommand, SaveEmailOtpTokenCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { RateLimitDecision, RateLimiter } from './RateLimiter.js'\nimport { RateLimitScopes } from '../type/RateLimit.js'\nimport { Config } from '../type/Config.js'\n\n/** Email-OTP codes are short-lived numeric codes delivered by email. */\nconst EMAIL_OTP_EXPIRATION_MINUTES = 10\nconst EMAIL_OTP_DIGITS = 6\n\n/**\n * Email OTP as a second factor (A05). Opt-in per person via\n * `person_mfa.email_otp_enabled`. The emitted code is a 6-digit numeric code,\n * transported through a short-lived `mfa_email_otp` person_token (the code's hash\n * lives in `otp_hash`), validated through the shared `'otp'` token path (max 3\n * attempts). Behavior for anyone who hasn't enabled it is unchanged.\n */\nexport class EmailOtpManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly providers: Pick<Providers, 'randomBytes' | 'now' | 'uuid'>,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\t/**\n\t * Generates a fresh code, invalidates any prior unused email-OTP tokens for the\n\t * person, persists the new one and emails the code. Must run inside the request's\n\t * db context (it issues commands + sends mail).\n\t *\n\t * Gated by the per-person `email_otp_per_person` rate limit so an attacker who\n\t * knows the password cannot re-issue codes to reset the per-code 3-attempt\n\t * counter, nor email-bomb a person. When the limit is hit nothing is sent and\n\t * the returned decision is `ok: false` (the caller decides how to surface it);\n\t * a previously emailed, still-valid code remains usable.\n\t */\n\tasync sendCode(dbContext: DatabaseContext, person: PersonRow, config: Config): Promise<RateLimitDecision> {\n\t\tconst decision = await this.rateLimiter.consume(dbContext, RateLimitScopes.emailOtpPerPerson, person.id, config)\n\t\tif (!decision.ok) {\n\t\t\treturn decision\n\t\t}\n\t\tconst code = await this.generateCode()\n\t\t// Only the latest emailed code may ever verify.\n\t\tawait dbContext.commandBus.execute(new InvalidateEmailOtpTokensCommand(person.id))\n\t\tawait dbContext.commandBus.execute(new SaveEmailOtpTokenCommand(person.id, code, EMAIL_OTP_EXPIRATION_MINUTES))\n\t\tawait this.mailer.sendEmailOtpEmail(dbContext, {\n\t\t\temail: person.email ?? '',\n\t\t\tcode,\n\t\t}, {\n\t\t\tvariant: '',\n\t\t\tprojectId: null,\n\t\t})\n\t\treturn decision\n\t}\n\n\t/**\n\t * Fetches the latest unused email-OTP token for the person and validates the\n\t * supplied code via the shared `'otp'` path; on success, consumes (invalidates)\n\t * the token. Returns whether the code was accepted.\n\t *\n\t * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}\n\t * — a single conditional UPDATE that increments `otp_attempts` only while it is\n\t * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent\n\t * writers on the row, N parallel guesses can never collectively exceed the cap;\n\t * a plain read-then-increment let them all pass with a stale counter.\n\t */\n\tasync verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean> {\n\t\tconst tokenResult = await dbContext.queryHandler.fetch(PersonTokenQuery.latestUnusedByPerson(person.id, 'mfa_email_otp'))\n\t\tif (!tokenResult) {\n\t\t\treturn false\n\t\t}\n\t\t// Atomically reserve a guess slot before comparing the code. A false result\n\t\t// means the token was already used/replaced or the attempt cap is exhausted.\n\t\tconst reserved = await dbContext.commandBus.execute(new ClaimOtpAttemptCommand(tokenResult.id, MAX_OTP_ATTEMPTS))\n\t\tif (!reserved) {\n\t\t\treturn false\n\t\t}\n\t\t// otp_hash and expires_at are immutable for a token, so validating against the\n\t\t// pre-claim snapshot is correct; the attempt has already been counted.\n\t\tconst validation = validateToken({\n\t\t\tentry: tokenResult,\n\t\t\ttoken: code,\n\t\t\tnow: this.providers.now(),\n\t\t\tvalidationType: 'otp',\n\t\t})\n\t\tif (!validation.ok) {\n\t\t\treturn false\n\t\t}\n\t\tawait dbContext.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\treturn true\n\t}\n\n\tprivate async generateCode(): Promise<string> {\n\t\t// Rejection-free uniform-ish digits is acceptable here: this is a second factor\n\t\t// behind a valid password, short-lived, and capped at 3 attempts.\n\t\tconst bytes = await this.providers.randomBytes(EMAIL_OTP_DIGITS)\n\t\tlet code = ''\n\t\tfor (let i = 0; i < EMAIL_OTP_DIGITS; i++) {\n\t\t\tcode += (bytes[i] % 10).toString()\n\t\t}\n\t\treturn code\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AAWA,MAAM,+BAA+B;AACrC,MAAM,mBAAmB;AASlB,MAAM,gBAAgB;AAAA,EAC5B,YACkB,QACA,WACA,aAChB;AAHgB,SAAA,SAAA;AACA,SAAA,YAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaH,MAAM,SAAS,WAA4B,QAAmB,QAA4C;AACzG,UAAM,WAAW,MAAM,KAAK,YAAY,QAAQ,WAAW,gBAAgB,mBAAmB,OAAO,IAAI,MAAM;AAC/G,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,aAAA;AAExB,UAAM,UAAU,WAAW,QAAQ,IAAI,gCAAgC,OAAO,EAAE,CAAC;AACjF,UAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,OAAO,IAAI,MAAM,4BAA4B,CAAC;AAC9G,UAAM,KAAK,OAAO,kBAAkB,WAAW;AAAA,MAC9C,OAAO,OAAO,SAAS;AAAA,MACvB;AAAA,IAAA,GACE;AAAA,MACF,SAAS;AAAA,MACT,WAAW;AAAA,IAAA,CACX;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,iBAAiB,WAA4B,QAAmB,MAAgC;AACrG,UAAM,cAAc,MAAM,UAAU,aAAa,MAAM,iBAAiB,qBAAqB,OAAO,IAAI,eAAe,CAAC;AACxH,QAAI,CAAC,aAAa;AACjB,aAAO;AAAA,IACR;AAGA,UAAM,WAAW,MAAM,UAAU,WAAW,QAAQ,IAAI,uBAAuB,YAAY,IAAI,gBAAgB,CAAC;AAChH,QAAI,CAAC,UAAU;AACd,aAAO;AAAA,IACR;AAGA,UAAM,aAAa,cAAc;AAAA,MAChC,OAAO;AAAA,MACP,OAAO;AAAA,MACP,KAAK,KAAK,UAAU,IAAA;AAAA,MACpB,gBAAgB;AAAA,IAAA,CAChB;AACD,QAAI,CAAC,WAAW,IAAI;AACnB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAI,uBAAuB,WAAW,OAAO,EAAE,CAAC;AACnF,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,eAAgC;AAG7C,UAAM,QAAQ,MAAM,KAAK,UAAU,YAAY,gBAAgB;AAC/D,QAAI,OAAO;AACX,aAAS,IAAI,GAAG,IAAI,kBAAkB,KAAK;AAC1C,eAAS,MAAM,CAAC,IAAI,IAAI,SAAA;AAAA,IACzB;AACA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/service/EmailValidator.cjs

@@ -4,6 +4,7 @@ const email = require("../utils/email.cjs");
 const Response = require("../utils/Response.cjs");
 require("../queries/apiKey/ApiKeyQuery.cjs");
 require("@contember/database");
+require("../type/ApiKey.cjs");
 const PersonQuery = require("../queries/person/PersonQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
@@ -15,14 +16,13 @@ class EmailValidator {
     if (!email.validateEmail(email$1.trim())) {
       return new Response.ResponseError("INVALID_EMAIL_FORMAT", "E-mail address is not in a valid format");
     }
-    if (await this.isEmailAlreadyUsed(db, email$1)) {
+    if (await this.findExistingPerson(db, email$1) !== null) {
       return new Response.ResponseError("EMAIL_ALREADY_EXISTS", `User with email ${email$1} already exists`);
     }
     return null;
   }
-  async isEmailAlreadyUsed(db, email2) {
-    const personOrNull = await db.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email2));
-    return personOrNull !== null;
+  async findExistingPerson(db, email2) {
+    return await db.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email2));
   }
 }
 exports.EmailValidator = EmailValidator;

package/dist/development/src/model/service/EmailValidator.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"EmailValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailValidator.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { validateEmail } from '../utils/email'\nimport { ResponseError } from '../utils/Response'\nimport { PersonQuery } from '../queries'\n\nexport class EmailValidator {\n\tpublic async validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\t\tif (await this.isEmailAlreadyUsed(db, email)) {\n\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)\n\t\t}\n\t\treturn null\n\t}\n\n\tprivate async isEmailAlreadyUsed(db: DatabaseContext, email: string): Promise<boolean> {\n\t\tconst personOrNull = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\treturn personOrNull !== null\n\t}\n}\n\nexport type EmailValidatorError =\n\t| 'EMAIL_ALREADY_EXISTS'\n\t| 'INVALID_EMAIL_FORMAT'\n"],"names":["email","validateEmail","ResponseError","PersonQuery"],"mappings":";;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,MAAa,cAAc,IAAqBA,SAAmE;AAClH,QAAI,CAACC,MAAAA,cAAcD,QAAM,KAAA,CAAM,GAAG;AACjC,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AACA,QAAI,MAAM,KAAK,mBAAmB,IAAIF,OAAK,GAAG;AAC7C,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,mBAAmBF,OAAK,iBAAiB;AAAA,IAC3F;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,mBAAmB,IAAqBA,QAAiC;AACtF,UAAM,eAAe,MAAM,GAAG,aAAa,MAAMG,wBAAY,QAAQH,MAAK,CAAC;AAC3E,WAAO,iBAAiB;AAAA,EACzB;AACD;;"}
+{"version":3,"file":"EmailValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailValidator.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { validateEmail } from '../utils/email.js'\nimport { ResponseError } from '../utils/Response.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\n\nexport class EmailValidator {\n\tpublic async validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\t\tif (await this.findExistingPerson(db, email) !== null) {\n\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)\n\t\t}\n\t\treturn null\n\t}\n\n\tpublic async findExistingPerson(db: DatabaseContext, email: string): Promise<PersonRow | null> {\n\t\treturn await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t}\n}\n\nexport type EmailValidatorError =\n\t| 'EMAIL_ALREADY_EXISTS'\n\t| 'INVALID_EMAIL_FORMAT'\n"],"names":["email","validateEmail","ResponseError","PersonQuery"],"mappings":";;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,MAAa,cAAc,IAAqBA,SAAmE;AAClH,QAAI,CAACC,MAAAA,cAAcD,QAAM,KAAA,CAAM,GAAG;AACjC,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AACA,QAAI,MAAM,KAAK,mBAAmB,IAAIF,OAAK,MAAM,MAAM;AACtD,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,mBAAmBF,OAAK,iBAAiB;AAAA,IAC3F;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,mBAAmB,IAAqBA,QAA0C;AAC9F,WAAO,MAAM,GAAG,aAAa,MAAMG,YAAAA,YAAY,QAAQH,MAAK,CAAC;AAAA,EAC9D;AACD;;"}

package/dist/development/src/model/service/EmailValidator.js

@@ -2,6 +2,7 @@ import { validateEmail } from "../utils/email.js";
 import { ResponseError } from "../utils/Response.js";
 import "../queries/apiKey/ApiKeyQuery.js";
 import "@contember/database";
+import "../type/ApiKey.js";
 import { PersonQuery } from "../queries/person/PersonQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
@@ -13,14 +14,13 @@ class EmailValidator {
     if (!validateEmail(email.trim())) {
       return new ResponseError("INVALID_EMAIL_FORMAT", "E-mail address is not in a valid format");
     }
-    if (await this.isEmailAlreadyUsed(db, email)) {
+    if (await this.findExistingPerson(db, email) !== null) {
       return new ResponseError("EMAIL_ALREADY_EXISTS", `User with email ${email} already exists`);
     }
     return null;
   }
-  async isEmailAlreadyUsed(db, email) {
-    const personOrNull = await db.queryHandler.fetch(PersonQuery.byEmail(email));
-    return personOrNull !== null;
+  async findExistingPerson(db, email) {
+    return await db.queryHandler.fetch(PersonQuery.byEmail(email));
   }
 }
 export {

package/dist/development/src/model/service/EmailValidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"EmailValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailValidator.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { validateEmail } from '../utils/email'\nimport { ResponseError } from '../utils/Response'\nimport { PersonQuery } from '../queries'\n\nexport class EmailValidator {\n\tpublic async validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\t\tif (await this.isEmailAlreadyUsed(db, email)) {\n\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)\n\t\t}\n\t\treturn null\n\t}\n\n\tprivate async isEmailAlreadyUsed(db: DatabaseContext, email: string): Promise<boolean> {\n\t\tconst personOrNull = await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t\treturn personOrNull !== null\n\t}\n}\n\nexport type EmailValidatorError =\n\t| 'EMAIL_ALREADY_EXISTS'\n\t| 'INVALID_EMAIL_FORMAT'\n"],"names":[],"mappings":";;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,MAAa,cAAc,IAAqB,OAAmE;AAClH,QAAI,CAAC,cAAc,MAAM,KAAA,CAAM,GAAG;AACjC,aAAO,IAAI,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AACA,QAAI,MAAM,KAAK,mBAAmB,IAAI,KAAK,GAAG;AAC7C,aAAO,IAAI,cAAc,wBAAwB,mBAAmB,KAAK,iBAAiB;AAAA,IAC3F;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,mBAAmB,IAAqB,OAAiC;AACtF,UAAM,eAAe,MAAM,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAC3E,WAAO,iBAAiB;AAAA,EACzB;AACD;"}
+{"version":3,"file":"EmailValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailValidator.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { validateEmail } from '../utils/email.js'\nimport { ResponseError } from '../utils/Response.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\n\nexport class EmailValidator {\n\tpublic async validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\t\tif (await this.findExistingPerson(db, email) !== null) {\n\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)\n\t\t}\n\t\treturn null\n\t}\n\n\tpublic async findExistingPerson(db: DatabaseContext, email: string): Promise<PersonRow | null> {\n\t\treturn await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t}\n}\n\nexport type EmailValidatorError =\n\t| 'EMAIL_ALREADY_EXISTS'\n\t| 'INVALID_EMAIL_FORMAT'\n"],"names":[],"mappings":";;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,MAAa,cAAc,IAAqB,OAAmE;AAClH,QAAI,CAAC,cAAc,MAAM,KAAA,CAAM,GAAG;AACjC,aAAO,IAAI,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AACA,QAAI,MAAM,KAAK,mBAAmB,IAAI,KAAK,MAAM,MAAM;AACtD,aAAO,IAAI,cAAc,wBAAwB,mBAAmB,KAAK,iBAAiB;AAAA,IAC3F;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,mBAAmB,IAAqB,OAA0C;AAC9F,WAAO,MAAM,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAAA,EAC9D;AACD;"}

package/dist/development/src/model/service/EmailVerificationManager.cjs

@@ -0,0 +1,94 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Response = require("../utils/Response.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../type/ApiKey.cjs");
+const exceptions = require("../../exceptions.cjs");
+const PersonQuery = require("../queries/person/PersonQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/PermissionsFactory.cjs");
+require("@contember/schema");
+const getPreferredProject = require("./helpers/getPreferredProject.cjs");
+const token = require("../utils/token.cjs");
+const MarkEmailVerifiedCommand = require("../commands/person/MarkEmailVerifiedCommand.cjs");
+const CreatePersonTokenCommand = require("../commands/personToken/CreatePersonTokenCommand.cjs");
+const InvalidateTokenCommand = require("../commands/personToken/InvalidateTokenCommand.cjs");
+const PersonTokenQuery = require("../queries/personToken/PersonTokenQuery.cjs");
+const NextMailAttemptQuery = require("../queries/authLog/NextMailAttemptQuery.cjs");
+const AuthLogService = require("./AuthLogService.cjs");
+class EmailVerificationManager {
+  constructor(mailer, projectManager) {
+    this.mailer = mailer;
+    this.projectManager = projectManager;
+  }
+  /**
+   * Sends a verification mail unless the per-email backoff says to hold off.
+   * Returns whether a mail was actually sent, so the caller only records an
+   * `email_verify_init` audit entry for mails that really went out — otherwise
+   * a throttled attempt would both tell the user to check their inbox and log
+   * a phantom init that pushes the backoff out further.
+   */
+  async sendVerificationEmail(dbContext, permissionContext, person, mailOptions = {}) {
+    if (!person.email) {
+      throw new exceptions.ImplementationException();
+    }
+    const nextAllowed = await dbContext.queryHandler.fetch(
+      new NextMailAttemptQuery.NextMailAttemptQuery(person.email, "email_verify_init", "email_verify_complete")
+    );
+    if (nextAllowed > dbContext.providers.now()) {
+      return false;
+    }
+    const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.CreatePersonTokenCommand.createEmailVerificationRequest(person.id, person.email));
+    const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+    const project = getPreferredProject.getPreferredProject(projects, mailOptions.project ?? null);
+    await this.mailer.sendEmailVerificationEmail(
+      dbContext,
+      {
+        email: person.email,
+        token: result.token,
+        project: project?.name,
+        projectSlug: project?.slug
+      },
+      {
+        variant: mailOptions.mailVariant || "",
+        projectId: project?.id ?? null
+      }
+    );
+    return true;
+  }
+  async verifyEmail(dbContext, token$1) {
+    const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byToken(token$1, "email_verification"));
+    const validation = token.validateToken({ entry: tokenRow, token: token$1, now: dbContext.providers.now(), validationType: "token" });
+    if (!validation.ok) {
+      return new Response.ResponseError(validation.error, validation.errorMessage, {
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag(
+          tokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {}
+        )
+      });
+    }
+    const authLogData = new AuthLogService.AuthLogService.Bag({
+      personId: validation.result.person_id,
+      tokenId: validation.result.id
+    });
+    const person = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byId(validation.result.person_id));
+    if (!person) {
+      throw new exceptions.ImplementationException();
+    }
+    const issuedFor = validation.result.meta?.email;
+    if (issuedFor != null && issuedFor !== person.email) {
+      return new Response.ResponseError("TOKEN_INVALID", "Verification token was issued for a different e-mail address", {
+        [AuthLogService.AuthLogService.Key]: authLogData
+      });
+    }
+    return await dbContext.transaction(async (db) => {
+      await db.commandBus.execute(new InvalidateTokenCommand.InvalidateTokenCommand(validation.result.id));
+      await db.commandBus.execute(new MarkEmailVerifiedCommand.MarkEmailVerifiedCommand(validation.result.person_id));
+      return new Response.ResponseOk({ [AuthLogService.AuthLogService.Key]: authLogData });
+    });
+  }
+}
+exports.EmailVerificationManager = EmailVerificationManager;
+//# sourceMappingURL=EmailVerificationManager.cjs.map

package/dist/development/src/model/service/EmailVerificationManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailVerificationManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailVerificationManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { PersonToken } from '../type/index.js'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailVerificationManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\t/**\n\t * Sends a verification mail unless the per-email backoff says to hold off.\n\t * Returns whether a mail was actually sent, so the caller only records an\n\t * `email_verify_init` audit entry for mails that really went out — otherwise\n\t * a throttled attempt would both tell the user to check their inbox and log\n\t * a phantom init that pushes the backoff out further.\n\t */\n\tpublic async sendVerificationEmail(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<boolean> {\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Per-email exponential backoff on outbound mails, so a resend button\n\t\t// (or an attacker poking the endpoint) can't be used to flood the\n\t\t// mailbox. Reuses the login_* backoff config against person_auth_log.\n\t\tconst nextAllowed = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(person.email, 'email_verify_init', 'email_verify_complete'),\n\t\t)\n\t\tif (nextAllowed > dbContext.providers.now()) {\n\t\t\treturn false\n\t\t}\n\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createEmailVerificationRequest(person.id, person.email))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait this.mailer.sendEmailVerificationEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t\treturn true\n\t}\n\n\tpublic async verifyEmail(dbContext: DatabaseContext, token: string): Promise<VerifyEmailResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_verification'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Carry whatever we know about the subject so the audit log can tie the\n\t\t\t// failure to a person/token even on an invalid/expired token (matches\n\t\t\t// PasswordResetManager — see email_verify_complete audit entry).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\t// Bind the token to the address it was issued for: if the person's e-mail\n\t\t// changed after the token was minted (an admin profile edit, or a separate\n\t\t// email-change flow), a stale verification link must not stamp the new,\n\t\t// unproven address as verified. Tokens issued before this binding carry no\n\t\t// email payload — fall back to the legacy behaviour for those.\n\t\tconst issuedFor = validation.result.meta?.email\n\t\tif (issuedFor != null && issuedFor !== person.email) {\n\t\t\treturn new ResponseError('TOKEN_INVALID', 'Verification token was issued for a different e-mail address', {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn await dbContext.transaction(async db => {\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(validation.result.person_id))\n\t\t\treturn new ResponseOk({ [AuthLogService.Key]: authLogData })\n\t\t})\n\t}\n}\n\nexport type VerifyEmailResponse = Response<\n\t{ [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":["ImplementationException","NextMailAttemptQuery","CreatePersonTokenCommand","getPreferredProject","token","PersonTokenQuery","validateToken","ResponseError","AuthLogService","PersonQuery","InvalidateTokenCommand","MarkEmailVerifiedCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAoBO,MAAM,yBAAyB;AAAA,EACrC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,sBACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACR;AACnB,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,IAAIA,WAAAA,wBAAA;AAAA,IACX;AAKA,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAIC,0CAAqB,OAAO,OAAO,qBAAqB,uBAAuB;AAAA,IAAA;AAEpF,QAAI,cAAc,UAAU,UAAU,IAAA,GAAO;AAC5C,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQC,yBAAAA,yBAAyB,+BAA+B,OAAO,IAAI,OAAO,KAAK,CAAC;AAClI,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUC,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA;AAAA,MAEvB;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAC3B;AAED,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,YAAY,WAA4BC,SAA6C;AACjG,UAAM,WAAW,MAAM,UAAU,aAAa,MAAMC,iBAAAA,iBAAiB,QAAQD,SAAO,oBAAoB,CAAC;AACzG,UAAM,aAAaE,MAAAA,cAAc,EAAE,OAAO,UAAA,OAAUF,SAAO,KAAK,UAAU,UAAU,IAAA,GAAO,gBAAgB,SAAS;AACpH,QAAI,CAAC,WAAW,IAAI;AAInB,aAAO,IAAIG,SAAAA,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAIA,eAAAA,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMC,wBAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIT,WAAAA,wBAAA;AAAA,IACX;AAMA,UAAM,YAAY,WAAW,OAAO,MAAM;AAC1C,QAAI,aAAa,QAAQ,cAAc,OAAO,OAAO;AACpD,aAAO,IAAIO,SAAAA,cAAc,iBAAiB,gEAAgE;AAAA,QACzG,CAACC,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,YAAM,GAAG,WAAW,QAAQ,IAAIE,uBAAAA,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,YAAM,GAAG,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,WAAW,OAAO,SAAS,CAAC;AACrF,aAAO,IAAIC,SAAAA,WAAW,EAAE,CAACJ,eAAAA,eAAe,GAAG,GAAG,aAAa;AAAA,IAC5D,CAAC;AAAA,EACF;AACD;;"}

package/dist/development/src/model/service/EmailVerificationManager.js

@@ -0,0 +1,94 @@
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../type/ApiKey.js";
+import { ImplementationException } from "../../exceptions.js";
+import { PersonQuery } from "../queries/person/PersonQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/PermissionsFactory.js";
+import "@contember/schema";
+import { getPreferredProject } from "./helpers/getPreferredProject.js";
+import { validateToken } from "../utils/token.js";
+import { MarkEmailVerifiedCommand } from "../commands/person/MarkEmailVerifiedCommand.js";
+import { CreatePersonTokenCommand } from "../commands/personToken/CreatePersonTokenCommand.js";
+import { InvalidateTokenCommand } from "../commands/personToken/InvalidateTokenCommand.js";
+import { PersonTokenQuery } from "../queries/personToken/PersonTokenQuery.js";
+import { NextMailAttemptQuery } from "../queries/authLog/NextMailAttemptQuery.js";
+import { AuthLogService } from "./AuthLogService.js";
+class EmailVerificationManager {
+  constructor(mailer, projectManager) {
+    this.mailer = mailer;
+    this.projectManager = projectManager;
+  }
+  /**
+   * Sends a verification mail unless the per-email backoff says to hold off.
+   * Returns whether a mail was actually sent, so the caller only records an
+   * `email_verify_init` audit entry for mails that really went out — otherwise
+   * a throttled attempt would both tell the user to check their inbox and log
+   * a phantom init that pushes the backoff out further.
+   */
+  async sendVerificationEmail(dbContext, permissionContext, person, mailOptions = {}) {
+    if (!person.email) {
+      throw new ImplementationException();
+    }
+    const nextAllowed = await dbContext.queryHandler.fetch(
+      new NextMailAttemptQuery(person.email, "email_verify_init", "email_verify_complete")
+    );
+    if (nextAllowed > dbContext.providers.now()) {
+      return false;
+    }
+    const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createEmailVerificationRequest(person.id, person.email));
+    const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+    const project = getPreferredProject(projects, mailOptions.project ?? null);
+    await this.mailer.sendEmailVerificationEmail(
+      dbContext,
+      {
+        email: person.email,
+        token: result.token,
+        project: project?.name,
+        projectSlug: project?.slug
+      },
+      {
+        variant: mailOptions.mailVariant || "",
+        projectId: project?.id ?? null
+      }
+    );
+    return true;
+  }
+  async verifyEmail(dbContext, token) {
+    const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, "email_verification"));
+    const validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: "token" });
+    if (!validation.ok) {
+      return new ResponseError(validation.error, validation.errorMessage, {
+        [AuthLogService.Key]: new AuthLogService.Bag(
+          tokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {}
+        )
+      });
+    }
+    const authLogData = new AuthLogService.Bag({
+      personId: validation.result.person_id,
+      tokenId: validation.result.id
+    });
+    const person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id));
+    if (!person) {
+      throw new ImplementationException();
+    }
+    const issuedFor = validation.result.meta?.email;
+    if (issuedFor != null && issuedFor !== person.email) {
+      return new ResponseError("TOKEN_INVALID", "Verification token was issued for a different e-mail address", {
+        [AuthLogService.Key]: authLogData
+      });
+    }
+    return await dbContext.transaction(async (db) => {
+      await db.commandBus.execute(new InvalidateTokenCommand(validation.result.id));
+      await db.commandBus.execute(new MarkEmailVerifiedCommand(validation.result.person_id));
+      return new ResponseOk({ [AuthLogService.Key]: authLogData });
+    });
+  }
+}
+export {
+  EmailVerificationManager
+};
+//# sourceMappingURL=EmailVerificationManager.js.map

package/dist/development/src/model/service/EmailVerificationManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailVerificationManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailVerificationManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { PersonToken } from '../type/index.js'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailVerificationManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\t/**\n\t * Sends a verification mail unless the per-email backoff says to hold off.\n\t * Returns whether a mail was actually sent, so the caller only records an\n\t * `email_verify_init` audit entry for mails that really went out — otherwise\n\t * a throttled attempt would both tell the user to check their inbox and log\n\t * a phantom init that pushes the backoff out further.\n\t */\n\tpublic async sendVerificationEmail(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<boolean> {\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Per-email exponential backoff on outbound mails, so a resend button\n\t\t// (or an attacker poking the endpoint) can't be used to flood the\n\t\t// mailbox. Reuses the login_* backoff config against person_auth_log.\n\t\tconst nextAllowed = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(person.email, 'email_verify_init', 'email_verify_complete'),\n\t\t)\n\t\tif (nextAllowed > dbContext.providers.now()) {\n\t\t\treturn false\n\t\t}\n\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createEmailVerificationRequest(person.id, person.email))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait this.mailer.sendEmailVerificationEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t\treturn true\n\t}\n\n\tpublic async verifyEmail(dbContext: DatabaseContext, token: string): Promise<VerifyEmailResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_verification'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Carry whatever we know about the subject so the audit log can tie the\n\t\t\t// failure to a person/token even on an invalid/expired token (matches\n\t\t\t// PasswordResetManager — see email_verify_complete audit entry).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\t// Bind the token to the address it was issued for: if the person's e-mail\n\t\t// changed after the token was minted (an admin profile edit, or a separate\n\t\t// email-change flow), a stale verification link must not stamp the new,\n\t\t// unproven address as verified. Tokens issued before this binding carry no\n\t\t// email payload — fall back to the legacy behaviour for those.\n\t\tconst issuedFor = validation.result.meta?.email\n\t\tif (issuedFor != null && issuedFor !== person.email) {\n\t\t\treturn new ResponseError('TOKEN_INVALID', 'Verification token was issued for a different e-mail address', {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn await dbContext.transaction(async db => {\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(validation.result.person_id))\n\t\t\treturn new ResponseOk({ [AuthLogService.Key]: authLogData })\n\t\t})\n\t}\n}\n\nexport type VerifyEmailResponse = Response<\n\t{ [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAoBO,MAAM,yBAAyB;AAAA,EACrC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,sBACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACR;AACnB,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,IAAI,wBAAA;AAAA,IACX;AAKA,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAI,qBAAqB,OAAO,OAAO,qBAAqB,uBAAuB;AAAA,IAAA;AAEpF,QAAI,cAAc,UAAU,UAAU,IAAA,GAAO;AAC5C,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,yBAAyB,+BAA+B,OAAO,IAAI,OAAO,KAAK,CAAC;AAClI,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA;AAAA,MAEvB;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAC3B;AAED,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,YAAY,WAA4B,OAA6C;AACjG,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,iBAAiB,QAAQ,OAAO,oBAAoB,CAAC;AACzG,UAAM,aAAa,cAAc,EAAE,OAAO,UAAU,OAAO,KAAK,UAAU,UAAU,IAAA,GAAO,gBAAgB,SAAS;AACpH,QAAI,CAAC,WAAW,IAAI;AAInB,aAAO,IAAI,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAI,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAA;AAAA,IACX;AAMA,UAAM,YAAY,WAAW,OAAO,MAAM;AAC1C,QAAI,aAAa,QAAQ,cAAc,OAAO,OAAO;AACpD,aAAO,IAAI,cAAc,iBAAiB,gEAAgE;AAAA,QACzG,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,YAAM,GAAG,WAAW,QAAQ,IAAI,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,YAAM,GAAG,WAAW,QAAQ,IAAI,yBAAyB,WAAW,OAAO,SAAS,CAAC;AACrF,aAAO,IAAI,WAAW,EAAE,CAAC,eAAe,GAAG,GAAG,aAAa;AAAA,IAC5D,CAAC;AAAA,EACF;AACD;"}

package/dist/development/src/model/service/HibpChecker.cjs

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const crypto = require("node:crypto");
+class HttpHibpChecker {
+  constructor(endpoint = "https://api.pwnedpasswords.com/range/", fetchImpl = fetch, timeoutMs = 1500) {
+    this.endpoint = endpoint;
+    this.fetchImpl = fetchImpl;
+    this.timeoutMs = timeoutMs;
+  }
+  async isCompromised(password) {
+    const sha1 = crypto.createHash("sha1").update(password, "utf8").digest("hex").toUpperCase();
+    const prefix = sha1.slice(0, 5);
+    const suffix = sha1.slice(5);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const response = await this.fetchImpl(`${this.endpoint}${prefix}`, {
+        headers: { "Add-Padding": "true" },
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        return false;
+      }
+      const body = await response.text();
+      for (const line of body.split("\n")) {
+        const [hashSuffix, countStr] = line.trim().split(":");
+        if (hashSuffix === suffix && Number(countStr) > 0) {
+          return true;
+        }
+      }
+      return false;
+    } catch {
+      return false;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+}
+class NoopHibpChecker {
+  async isCompromised(_password) {
+    return false;
+  }
+}
+exports.HttpHibpChecker = HttpHibpChecker;
+exports.NoopHibpChecker = NoopHibpChecker;
+//# sourceMappingURL=HibpChecker.cjs.map

package/dist/development/src/model/service/HibpChecker.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"HibpChecker.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/HibpChecker.ts"],"sourcesContent":["import { createHash } from 'node:crypto'\n\n/**\n * Looks up a password in the Have-I-Been-Pwned passwords corpus using its\n * k-anonymity API: the client sends only the first 5 hex chars of the SHA-1\n * hash, the server returns all matching suffixes plus counts.\n *\n * https://haveibeenpwned.com/API/v3#PwnedPasswords\n *\n * Implementations are expected to be fail-open: when the upstream is down or\n * misbehaves, `isCompromised` should resolve to `false`, never throw.\n */\nexport interface HibpChecker {\n\tisCompromised(password: string): Promise<boolean>\n}\n\nexport class HttpHibpChecker implements HibpChecker {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://api.pwnedpasswords.com/range/',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t\tprivate readonly timeoutMs: number = 1500,\n\t) {}\n\n\tasync isCompromised(password: string): Promise<boolean> {\n\t\tconst sha1 = createHash('sha1').update(password, 'utf8').digest('hex').toUpperCase()\n\t\tconst prefix = sha1.slice(0, 5)\n\t\tconst suffix = sha1.slice(5)\n\t\tconst controller = new AbortController()\n\t\tconst timer = setTimeout(() => controller.abort(), this.timeoutMs)\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(`${this.endpoint}${prefix}`, {\n\t\t\t\theaders: { 'Add-Padding': 'true' },\n\t\t\t\tsignal: controller.signal,\n\t\t\t})\n\t\t\tif (!response.ok) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst body = await response.text()\n\t\t\tfor (const line of body.split('\\n')) {\n\t\t\t\tconst [hashSuffix, countStr] = line.trim().split(':')\n\t\t\t\tif (hashSuffix === suffix && Number(countStr) > 0) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn false\n\t\t} catch {\n\t\t\treturn false\n\t\t} finally {\n\t\t\tclearTimeout(timer)\n\t\t}\n\t}\n}\n\n/** Disabled checker — used when HIBP integration is turned off in tenant config. */\nexport class NoopHibpChecker implements HibpChecker {\n\tasync isCompromised(_password: string): Promise<boolean> {\n\t\treturn false\n\t}\n}\n"],"names":["createHash"],"mappings":";;;AAgBO,MAAM,gBAAuC;AAAA,EACnD,YACkB,WAAmB,yCACnB,YAA0B,OAC1B,YAAoB,MACpC;AAHgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,cAAc,UAAoC;AACvD,UAAM,OAAOA,OAAAA,WAAW,MAAM,EAAE,OAAO,UAAU,MAAM,EAAE,OAAO,KAAK,EAAE,YAAA;AACvE,UAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAC9B,UAAM,SAAS,KAAK,MAAM,CAAC;AAC3B,UAAM,aAAa,IAAI,gBAAA;AACvB,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAA,GAAS,KAAK,SAAS;AACjE,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,GAAG,MAAM,IAAI;AAAA,QAClE,SAAS,EAAE,eAAe,OAAA;AAAA,QAC1B,QAAQ,WAAW;AAAA,MAAA,CACnB;AACD,UAAI,CAAC,SAAS,IAAI;AACjB,eAAO;AAAA,MACR;AACA,YAAM,OAAO,MAAM,SAAS,KAAA;AAC5B,iBAAW,QAAQ,KAAK,MAAM,IAAI,GAAG;AACpC,cAAM,CAAC,YAAY,QAAQ,IAAI,KAAK,KAAA,EAAO,MAAM,GAAG;AACpD,YAAI,eAAe,UAAU,OAAO,QAAQ,IAAI,GAAG;AAClD,iBAAO;AAAA,QACR;AAAA,MACD;AACA,aAAO;AAAA,IACR,QAAQ;AACP,aAAO;AAAA,IACR,UAAA;AACC,mBAAa,KAAK;AAAA,IACnB;AAAA,EACD;AACD;AAGO,MAAM,gBAAuC;AAAA,EACnD,MAAM,cAAc,WAAqC;AACxD,WAAO;AAAA,EACR;AACD;;;"}

package/dist/development/src/model/service/HibpChecker.js

@@ -0,0 +1,46 @@
+import { createHash } from "node:crypto";
+class HttpHibpChecker {
+  constructor(endpoint = "https://api.pwnedpasswords.com/range/", fetchImpl = fetch, timeoutMs = 1500) {
+    this.endpoint = endpoint;
+    this.fetchImpl = fetchImpl;
+    this.timeoutMs = timeoutMs;
+  }
+  async isCompromised(password) {
+    const sha1 = createHash("sha1").update(password, "utf8").digest("hex").toUpperCase();
+    const prefix = sha1.slice(0, 5);
+    const suffix = sha1.slice(5);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    try {
+      const response = await this.fetchImpl(`${this.endpoint}${prefix}`, {
+        headers: { "Add-Padding": "true" },
+        signal: controller.signal
+      });
+      if (!response.ok) {
+        return false;
+      }
+      const body = await response.text();
+      for (const line of body.split("\n")) {
+        const [hashSuffix, countStr] = line.trim().split(":");
+        if (hashSuffix === suffix && Number(countStr) > 0) {
+          return true;
+        }
+      }
+      return false;
+    } catch {
+      return false;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+}
+class NoopHibpChecker {
+  async isCompromised(_password) {
+    return false;
+  }
+}
+export {
+  HttpHibpChecker,
+  NoopHibpChecker
+};
+//# sourceMappingURL=HibpChecker.js.map

package/dist/development/src/model/service/HibpChecker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HibpChecker.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/HibpChecker.ts"],"sourcesContent":["import { createHash } from 'node:crypto'\n\n/**\n * Looks up a password in the Have-I-Been-Pwned passwords corpus using its\n * k-anonymity API: the client sends only the first 5 hex chars of the SHA-1\n * hash, the server returns all matching suffixes plus counts.\n *\n * https://haveibeenpwned.com/API/v3#PwnedPasswords\n *\n * Implementations are expected to be fail-open: when the upstream is down or\n * misbehaves, `isCompromised` should resolve to `false`, never throw.\n */\nexport interface HibpChecker {\n\tisCompromised(password: string): Promise<boolean>\n}\n\nexport class HttpHibpChecker implements HibpChecker {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://api.pwnedpasswords.com/range/',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t\tprivate readonly timeoutMs: number = 1500,\n\t) {}\n\n\tasync isCompromised(password: string): Promise<boolean> {\n\t\tconst sha1 = createHash('sha1').update(password, 'utf8').digest('hex').toUpperCase()\n\t\tconst prefix = sha1.slice(0, 5)\n\t\tconst suffix = sha1.slice(5)\n\t\tconst controller = new AbortController()\n\t\tconst timer = setTimeout(() => controller.abort(), this.timeoutMs)\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(`${this.endpoint}${prefix}`, {\n\t\t\t\theaders: { 'Add-Padding': 'true' },\n\t\t\t\tsignal: controller.signal,\n\t\t\t})\n\t\t\tif (!response.ok) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst body = await response.text()\n\t\t\tfor (const line of body.split('\\n')) {\n\t\t\t\tconst [hashSuffix, countStr] = line.trim().split(':')\n\t\t\t\tif (hashSuffix === suffix && Number(countStr) > 0) {\n\t\t\t\t\treturn true\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn false\n\t\t} catch {\n\t\t\treturn false\n\t\t} finally {\n\t\t\tclearTimeout(timer)\n\t\t}\n\t}\n}\n\n/** Disabled checker — used when HIBP integration is turned off in tenant config. */\nexport class NoopHibpChecker implements HibpChecker {\n\tasync isCompromised(_password: string): Promise<boolean> {\n\t\treturn false\n\t}\n}\n"],"names":[],"mappings":";AAgBO,MAAM,gBAAuC;AAAA,EACnD,YACkB,WAAmB,yCACnB,YAA0B,OAC1B,YAAoB,MACpC;AAHgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,cAAc,UAAoC;AACvD,UAAM,OAAO,WAAW,MAAM,EAAE,OAAO,UAAU,MAAM,EAAE,OAAO,KAAK,EAAE,YAAA;AACvE,UAAM,SAAS,KAAK,MAAM,GAAG,CAAC;AAC9B,UAAM,SAAS,KAAK,MAAM,CAAC;AAC3B,UAAM,aAAa,IAAI,gBAAA;AACvB,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAA,GAAS,KAAK,SAAS;AACjE,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,GAAG,KAAK,QAAQ,GAAG,MAAM,IAAI;AAAA,QAClE,SAAS,EAAE,eAAe,OAAA;AAAA,QAC1B,QAAQ,WAAW;AAAA,MAAA,CACnB;AACD,UAAI,CAAC,SAAS,IAAI;AACjB,eAAO;AAAA,MACR;AACA,YAAM,OAAO,MAAM,SAAS,KAAA;AAC5B,iBAAW,QAAQ,KAAK,MAAM,IAAI,GAAG;AACpC,cAAM,CAAC,YAAY,QAAQ,IAAI,KAAK,KAAA,EAAO,MAAM,GAAG;AACpD,YAAI,eAAe,UAAU,OAAO,QAAQ,IAAI,GAAG;AAClD,iBAAO;AAAA,QACR;AAAA,MACD;AACA,aAAO;AAAA,IACR,QAAQ;AACP,aAAO;AAAA,IACR,UAAA;AACC,mBAAa,KAAK;AAAA,IACnB;AAAA,EACD;AACD;AAGO,MAAM,gBAAuC;AAAA,EACnD,MAAM,cAAc,WAAqC;AACxD,WAAO;AAAA,EACR;AACD;"}