@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/dist/development/src/model/service/RateLimiter.cjs

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const RateLimitCountQuery = require("../queries/rateLimit/RateLimitCountQuery.cjs");
+const RecordRateLimitEventCommand = require("../commands/rateLimit/RecordRateLimitEventCommand.cjs");
+const interval = require("../utils/interval.cjs");
+class RateLimiter {
+  constructor(providers) {
+    this.providers = providers;
+  }
+  hashKey(key) {
+    return this.providers.hash(key, "sha256");
+  }
+  resolveWindow(scope, config) {
+    const r = config.rateLimits;
+    switch (scope) {
+      case "sign_up_per_ip":
+        return { limit: r.signUpPerIp.limit, windowSeconds: interval.intervalToSeconds(r.signUpPerIp.window) };
+      case "login_per_ip":
+        return { limit: r.loginPerIp.limit, windowSeconds: interval.intervalToSeconds(r.loginPerIp.window) };
+      case "password_reset_per_ip":
+        return { limit: r.passwordResetPerIp.limit, windowSeconds: interval.intervalToSeconds(r.passwordResetPerIp.window) };
+      case "passwordless_init_per_ip":
+        return { limit: r.passwordlessInitPerIp.limit, windowSeconds: interval.intervalToSeconds(r.passwordlessInitPerIp.window) };
+      case "email_otp_per_person":
+        return { limit: r.emailOtpPerPerson.limit, windowSeconds: interval.intervalToSeconds(r.emailOtpPerPerson.window) };
+      case "email_verification_per_ip":
+        return { limit: r.emailVerificationPerIp.limit, windowSeconds: interval.intervalToSeconds(r.emailVerificationPerIp.window) };
+    }
+  }
+  /**
+   * Check whether the next attempt fits within the configured window without
+   * recording it. Use {@link record} after a successful gating decision.
+   */
+  async check(db, scope, key, config) {
+    const { limit, windowSeconds } = this.resolveWindow(scope, config);
+    if (limit <= 0 || windowSeconds <= 0) {
+      return { ok: true };
+    }
+    const windowStart = new Date(this.providers.now().getTime() - windowSeconds * 1e3);
+    const count = await db.queryHandler.fetch(new RateLimitCountQuery.RateLimitCountQuery(scope, this.hashKey(key), windowStart));
+    if (count < limit) {
+      return { ok: true };
+    }
+    return { ok: false, retryAfterSeconds: windowSeconds };
+  }
+  async record(db, scope, key) {
+    await db.commandBus.execute(new RecordRateLimitEventCommand.RecordRateLimitEventCommand(scope, this.hashKey(key)));
+  }
+  /**
+   * Combined check + record. Returns the decision; only records on success.
+   *
+   * Not atomic: the COUNT and the INSERT are separate statements, so under
+   * concurrent requests for the same key a few attempts beyond the limit can
+   * slip through (the window is a soft ceiling). That is acceptable for abuse
+   * mitigation — do not rely on it as a hard quota.
+   */
+  async consume(db, scope, key, config) {
+    if (!key) {
+      return { ok: true };
+    }
+    const decision = await this.check(db, scope, key, config);
+    if (decision.ok) {
+      await this.record(db, scope, key);
+    }
+    return decision;
+  }
+}
+exports.RateLimiter = RateLimiter;
+//# sourceMappingURL=RateLimiter.cjs.map

package/dist/development/src/model/service/RateLimiter.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiter.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RateLimiter.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { Config } from '../type/Config.js'\nimport { RateLimitCountQuery } from '../queries/rateLimit/RateLimitCountQuery.js'\nimport { RecordRateLimitEventCommand } from '../commands/rateLimit/RecordRateLimitEventCommand.js'\nimport { RateLimitScope } from '../type/RateLimit.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nexport interface RateLimitWindow {\n\treadonly limit: number\n\treadonly window: {/* IPostgresInterval shape */}\n}\n\nexport interface RateLimitDecision {\n\treadonly ok: boolean\n\treadonly retryAfterSeconds?: number\n}\n\n/**\n * Sliding-window rate limiter backed by the `rate_limit_event` table.\n *\n * Cost: one COUNT(*) and (on success) one INSERT per check. The event row is\n * recorded only when the call passes — denied calls do not extend the window,\n * matching the spec's \"max N successful attempts per window\".\n *\n * The raw key (IP, email, ...) is hashed with the configured provider so the\n * raw value is not stored at rest. Note this is pseudonymization, not strong\n * anonymization: an unsalted SHA-256 of a low-entropy input (e.g. an IPv4\n * address) is recoverable by brute force, so treat key_hash as sensitive.\n */\nexport class RateLimiter {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'hash' | 'now'>,\n\t) {}\n\n\tprivate hashKey(key: string): Buffer {\n\t\treturn this.providers.hash(key, 'sha256')\n\t}\n\n\tprivate resolveWindow(scope: RateLimitScope, config: Config): { limit: number; windowSeconds: number } {\n\t\tconst r = config.rateLimits\n\t\tswitch (scope) {\n\t\t\tcase 'sign_up_per_ip':\n\t\t\t\treturn { limit: r.signUpPerIp.limit, windowSeconds: intervalToSeconds(r.signUpPerIp.window as any) }\n\t\t\tcase 'login_per_ip':\n\t\t\t\treturn { limit: r.loginPerIp.limit, windowSeconds: intervalToSeconds(r.loginPerIp.window as any) }\n\t\t\tcase 'password_reset_per_ip':\n\t\t\t\treturn { limit: r.passwordResetPerIp.limit, windowSeconds: intervalToSeconds(r.passwordResetPerIp.window as any) }\n\t\t\tcase 'passwordless_init_per_ip':\n\t\t\t\treturn { limit: r.passwordlessInitPerIp.limit, windowSeconds: intervalToSeconds(r.passwordlessInitPerIp.window as any) }\n\t\t\tcase 'email_otp_per_person':\n\t\t\t\treturn { limit: r.emailOtpPerPerson.limit, windowSeconds: intervalToSeconds(r.emailOtpPerPerson.window as any) }\n\t\t\tcase 'email_verification_per_ip':\n\t\t\t\treturn { limit: r.emailVerificationPerIp.limit, windowSeconds: intervalToSeconds(r.emailVerificationPerIp.window as any) }\n\t\t}\n\t}\n\n\t/**\n\t * Check whether the next attempt fits within the configured window without\n\t * recording it. Use {@link record} after a successful gating decision.\n\t */\n\tasync check(db: DatabaseContext, scope: RateLimitScope, key: string, config: Config): Promise<RateLimitDecision> {\n\t\tconst { limit, windowSeconds } = this.resolveWindow(scope, config)\n\t\tif (limit <= 0 || windowSeconds <= 0) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst windowStart = new Date(this.providers.now().getTime() - windowSeconds * 1000)\n\t\tconst count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowStart))\n\t\tif (count < limit) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\treturn { ok: false, retryAfterSeconds: windowSeconds }\n\t}\n\n\tasync record(db: DatabaseContext, scope: RateLimitScope, key: string): Promise<void> {\n\t\tawait db.commandBus.execute(new RecordRateLimitEventCommand(scope, this.hashKey(key)))\n\t}\n\n\t/**\n\t * Combined check + record. Returns the decision; only records on success.\n\t *\n\t * Not atomic: the COUNT and the INSERT are separate statements, so under\n\t * concurrent requests for the same key a few attempts beyond the limit can\n\t * slip through (the window is a soft ceiling). That is acceptable for abuse\n\t * mitigation — do not rely on it as a hard quota.\n\t */\n\tasync consume(db: DatabaseContext, scope: RateLimitScope, key: string | null | undefined, config: Config): Promise<RateLimitDecision> {\n\t\tif (!key) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst decision = await this.check(db, scope, key, config)\n\t\tif (decision.ok) {\n\t\t\tawait this.record(db, scope, key)\n\t\t}\n\t\treturn decision\n\t}\n}\n"],"names":["intervalToSeconds","RateLimitCountQuery","RecordRateLimitEventCommand"],"mappings":";;;;;AA8BO,MAAM,YAAY;AAAA,EACxB,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEK,QAAQ,KAAqB;AACpC,WAAO,KAAK,UAAU,KAAK,KAAK,QAAQ;AAAA,EACzC;AAAA,EAEQ,cAAc,OAAuB,QAA0D;AACtG,UAAM,IAAI,OAAO;AACjB,YAAQ,OAAA;AAAA,MACP,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,YAAY,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,YAAY,MAAa,EAAA;AAAA,MAClG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,WAAW,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,WAAW,MAAa,EAAA;AAAA,MAChG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,mBAAmB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,mBAAmB,MAAa,EAAA;AAAA,MAChH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,sBAAsB,MAAa,EAAA;AAAA,MACtH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,kBAAkB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,kBAAkB,MAAa,EAAA;AAAA,MAC9G,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,uBAAuB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,uBAAuB,MAAa,EAAA;AAAA,IAAE;AAAA,EAE5H;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,IAAqB,OAAuB,KAAa,QAA4C;AAChH,UAAM,EAAE,OAAO,cAAA,IAAkB,KAAK,cAAc,OAAO,MAAM;AACjE,QAAI,SAAS,KAAK,iBAAiB,GAAG;AACrC,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,cAAc,IAAI,KAAK,KAAK,UAAU,MAAM,QAAA,IAAY,gBAAgB,GAAI;AAClF,UAAM,QAAQ,MAAM,GAAG,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,OAAO,KAAK,QAAQ,GAAG,GAAG,WAAW,CAAC;AACxG,QAAI,QAAQ,OAAO;AAClB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,WAAO,EAAE,IAAI,OAAO,mBAAmB,cAAA;AAAA,EACxC;AAAA,EAEA,MAAM,OAAO,IAAqB,OAAuB,KAA4B;AACpF,UAAM,GAAG,WAAW,QAAQ,IAAIC,4BAAAA,4BAA4B,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,IAAqB,OAAuB,KAAgC,QAA4C;AACrI,QAAI,CAAC,KAAK;AACT,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM;AACxD,QAAI,SAAS,IAAI;AAChB,YAAM,KAAK,OAAO,IAAI,OAAO,GAAG;AAAA,IACjC;AACA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/service/RateLimiter.js

@@ -0,0 +1,69 @@
+import { RateLimitCountQuery } from "../queries/rateLimit/RateLimitCountQuery.js";
+import { RecordRateLimitEventCommand } from "../commands/rateLimit/RecordRateLimitEventCommand.js";
+import { intervalToSeconds } from "../utils/interval.js";
+class RateLimiter {
+  constructor(providers) {
+    this.providers = providers;
+  }
+  hashKey(key) {
+    return this.providers.hash(key, "sha256");
+  }
+  resolveWindow(scope, config) {
+    const r = config.rateLimits;
+    switch (scope) {
+      case "sign_up_per_ip":
+        return { limit: r.signUpPerIp.limit, windowSeconds: intervalToSeconds(r.signUpPerIp.window) };
+      case "login_per_ip":
+        return { limit: r.loginPerIp.limit, windowSeconds: intervalToSeconds(r.loginPerIp.window) };
+      case "password_reset_per_ip":
+        return { limit: r.passwordResetPerIp.limit, windowSeconds: intervalToSeconds(r.passwordResetPerIp.window) };
+      case "passwordless_init_per_ip":
+        return { limit: r.passwordlessInitPerIp.limit, windowSeconds: intervalToSeconds(r.passwordlessInitPerIp.window) };
+      case "email_otp_per_person":
+        return { limit: r.emailOtpPerPerson.limit, windowSeconds: intervalToSeconds(r.emailOtpPerPerson.window) };
+      case "email_verification_per_ip":
+        return { limit: r.emailVerificationPerIp.limit, windowSeconds: intervalToSeconds(r.emailVerificationPerIp.window) };
+    }
+  }
+  /**
+   * Check whether the next attempt fits within the configured window without
+   * recording it. Use {@link record} after a successful gating decision.
+   */
+  async check(db, scope, key, config) {
+    const { limit, windowSeconds } = this.resolveWindow(scope, config);
+    if (limit <= 0 || windowSeconds <= 0) {
+      return { ok: true };
+    }
+    const windowStart = new Date(this.providers.now().getTime() - windowSeconds * 1e3);
+    const count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowStart));
+    if (count < limit) {
+      return { ok: true };
+    }
+    return { ok: false, retryAfterSeconds: windowSeconds };
+  }
+  async record(db, scope, key) {
+    await db.commandBus.execute(new RecordRateLimitEventCommand(scope, this.hashKey(key)));
+  }
+  /**
+   * Combined check + record. Returns the decision; only records on success.
+   *
+   * Not atomic: the COUNT and the INSERT are separate statements, so under
+   * concurrent requests for the same key a few attempts beyond the limit can
+   * slip through (the window is a soft ceiling). That is acceptable for abuse
+   * mitigation — do not rely on it as a hard quota.
+   */
+  async consume(db, scope, key, config) {
+    if (!key) {
+      return { ok: true };
+    }
+    const decision = await this.check(db, scope, key, config);
+    if (decision.ok) {
+      await this.record(db, scope, key);
+    }
+    return decision;
+  }
+}
+export {
+  RateLimiter
+};
+//# sourceMappingURL=RateLimiter.js.map

package/dist/development/src/model/service/RateLimiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiter.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RateLimiter.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { Config } from '../type/Config.js'\nimport { RateLimitCountQuery } from '../queries/rateLimit/RateLimitCountQuery.js'\nimport { RecordRateLimitEventCommand } from '../commands/rateLimit/RecordRateLimitEventCommand.js'\nimport { RateLimitScope } from '../type/RateLimit.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nexport interface RateLimitWindow {\n\treadonly limit: number\n\treadonly window: {/* IPostgresInterval shape */}\n}\n\nexport interface RateLimitDecision {\n\treadonly ok: boolean\n\treadonly retryAfterSeconds?: number\n}\n\n/**\n * Sliding-window rate limiter backed by the `rate_limit_event` table.\n *\n * Cost: one COUNT(*) and (on success) one INSERT per check. The event row is\n * recorded only when the call passes — denied calls do not extend the window,\n * matching the spec's \"max N successful attempts per window\".\n *\n * The raw key (IP, email, ...) is hashed with the configured provider so the\n * raw value is not stored at rest. Note this is pseudonymization, not strong\n * anonymization: an unsalted SHA-256 of a low-entropy input (e.g. an IPv4\n * address) is recoverable by brute force, so treat key_hash as sensitive.\n */\nexport class RateLimiter {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'hash' | 'now'>,\n\t) {}\n\n\tprivate hashKey(key: string): Buffer {\n\t\treturn this.providers.hash(key, 'sha256')\n\t}\n\n\tprivate resolveWindow(scope: RateLimitScope, config: Config): { limit: number; windowSeconds: number } {\n\t\tconst r = config.rateLimits\n\t\tswitch (scope) {\n\t\t\tcase 'sign_up_per_ip':\n\t\t\t\treturn { limit: r.signUpPerIp.limit, windowSeconds: intervalToSeconds(r.signUpPerIp.window as any) }\n\t\t\tcase 'login_per_ip':\n\t\t\t\treturn { limit: r.loginPerIp.limit, windowSeconds: intervalToSeconds(r.loginPerIp.window as any) }\n\t\t\tcase 'password_reset_per_ip':\n\t\t\t\treturn { limit: r.passwordResetPerIp.limit, windowSeconds: intervalToSeconds(r.passwordResetPerIp.window as any) }\n\t\t\tcase 'passwordless_init_per_ip':\n\t\t\t\treturn { limit: r.passwordlessInitPerIp.limit, windowSeconds: intervalToSeconds(r.passwordlessInitPerIp.window as any) }\n\t\t\tcase 'email_otp_per_person':\n\t\t\t\treturn { limit: r.emailOtpPerPerson.limit, windowSeconds: intervalToSeconds(r.emailOtpPerPerson.window as any) }\n\t\t\tcase 'email_verification_per_ip':\n\t\t\t\treturn { limit: r.emailVerificationPerIp.limit, windowSeconds: intervalToSeconds(r.emailVerificationPerIp.window as any) }\n\t\t}\n\t}\n\n\t/**\n\t * Check whether the next attempt fits within the configured window without\n\t * recording it. Use {@link record} after a successful gating decision.\n\t */\n\tasync check(db: DatabaseContext, scope: RateLimitScope, key: string, config: Config): Promise<RateLimitDecision> {\n\t\tconst { limit, windowSeconds } = this.resolveWindow(scope, config)\n\t\tif (limit <= 0 || windowSeconds <= 0) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst windowStart = new Date(this.providers.now().getTime() - windowSeconds * 1000)\n\t\tconst count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowStart))\n\t\tif (count < limit) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\treturn { ok: false, retryAfterSeconds: windowSeconds }\n\t}\n\n\tasync record(db: DatabaseContext, scope: RateLimitScope, key: string): Promise<void> {\n\t\tawait db.commandBus.execute(new RecordRateLimitEventCommand(scope, this.hashKey(key)))\n\t}\n\n\t/**\n\t * Combined check + record. Returns the decision; only records on success.\n\t *\n\t * Not atomic: the COUNT and the INSERT are separate statements, so under\n\t * concurrent requests for the same key a few attempts beyond the limit can\n\t * slip through (the window is a soft ceiling). That is acceptable for abuse\n\t * mitigation — do not rely on it as a hard quota.\n\t */\n\tasync consume(db: DatabaseContext, scope: RateLimitScope, key: string | null | undefined, config: Config): Promise<RateLimitDecision> {\n\t\tif (!key) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst decision = await this.check(db, scope, key, config)\n\t\tif (decision.ok) {\n\t\t\tawait this.record(db, scope, key)\n\t\t}\n\t\treturn decision\n\t}\n}\n"],"names":[],"mappings":";;;AA8BO,MAAM,YAAY;AAAA,EACxB,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEK,QAAQ,KAAqB;AACpC,WAAO,KAAK,UAAU,KAAK,KAAK,QAAQ;AAAA,EACzC;AAAA,EAEQ,cAAc,OAAuB,QAA0D;AACtG,UAAM,IAAI,OAAO;AACjB,YAAQ,OAAA;AAAA,MACP,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,YAAY,OAAO,eAAe,kBAAkB,EAAE,YAAY,MAAa,EAAA;AAAA,MAClG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,WAAW,OAAO,eAAe,kBAAkB,EAAE,WAAW,MAAa,EAAA;AAAA,MAChG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,mBAAmB,OAAO,eAAe,kBAAkB,EAAE,mBAAmB,MAAa,EAAA;AAAA,MAChH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,eAAe,kBAAkB,EAAE,sBAAsB,MAAa,EAAA;AAAA,MACtH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,kBAAkB,OAAO,eAAe,kBAAkB,EAAE,kBAAkB,MAAa,EAAA;AAAA,MAC9G,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,uBAAuB,OAAO,eAAe,kBAAkB,EAAE,uBAAuB,MAAa,EAAA;AAAA,IAAE;AAAA,EAE5H;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,IAAqB,OAAuB,KAAa,QAA4C;AAChH,UAAM,EAAE,OAAO,cAAA,IAAkB,KAAK,cAAc,OAAO,MAAM;AACjE,QAAI,SAAS,KAAK,iBAAiB,GAAG;AACrC,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,cAAc,IAAI,KAAK,KAAK,UAAU,MAAM,QAAA,IAAY,gBAAgB,GAAI;AAClF,UAAM,QAAQ,MAAM,GAAG,aAAa,MAAM,IAAI,oBAAoB,OAAO,KAAK,QAAQ,GAAG,GAAG,WAAW,CAAC;AACxG,QAAI,QAAQ,OAAO;AAClB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,WAAO,EAAE,IAAI,OAAO,mBAAmB,cAAA;AAAA,EACxC;AAAA,EAEA,MAAM,OAAO,IAAqB,OAAuB,KAA4B;AACpF,UAAM,GAAG,WAAW,QAAQ,IAAI,4BAA4B,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,IAAqB,OAAuB,KAAgC,QAA4C;AACrI,QAAI,CAAC,KAAK;AACT,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM;AACxD,QAAI,SAAS,IAAI;AAChB,YAAM,KAAK,OAAO,IAAI,OAAO,GAAG;AAAA,IACjC;AACA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/service/RolesManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"RolesManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { PatchIdentityGlobalRoles } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { TenantRole } from '../authorization'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":["PatchIdentityGlobalRoles","ResponseError","ResponseOk","TenantRole"],"mappings":";;;;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAIA,yBAAAA,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAIC,SAAAA,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAOC,MAAAA,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAIF,SAAAA,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"RolesManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { PatchIdentityGlobalRoles } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { TenantRole } from '../authorization/index.js'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":["PatchIdentityGlobalRoles","ResponseError","ResponseOk","TenantRole"],"mappings":";;;;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAIA,yBAAAA,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAIC,SAAAA,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAOC,MAAAA,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAIF,SAAAA,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/service/RolesManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"RolesManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { PatchIdentityGlobalRoles } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { TenantRole } from '../authorization'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":[],"mappings":";;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAO,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAI,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"RolesManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { PatchIdentityGlobalRoles } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { TenantRole } from '../authorization/index.js'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":[],"mappings":";;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAO,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAI,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/service/SecretsManager.cjs

@@ -7,6 +7,7 @@ const SetProjectSecretCommand = require("../commands/project/SetProjectSecretCom
 const UpdateProjectCommand = require("../commands/project/UpdateProjectCommand.cjs");
 require("../queries/apiKey/ApiKeyQuery.cjs");
 const ProjectSecretsQuery = require("../queries/project/ProjectSecretsQuery.cjs");
+const ProjectSecretKeysQuery = require("../queries/project/ProjectSecretKeysQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
 require("../authorization/PermissionContext.cjs");
@@ -19,6 +20,10 @@ class SecretsManager {
   async setSecret(dbContext, projectId, key, value) {
     await this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }]);
   }
+  /** Lists secret keys (with timestamps) without decrypting any values. */
+  async listSecretKeys(dbContext, projectId) {
+    return await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery.ProjectSecretKeysQuery(projectId));
+  }
   async readSecrets(dbContext, projectId) {
     const result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery.ProjectSecretsQuery(projectId, this.providers));
     const forUpdate = result.filter((it) => it.needsReEncrypt);

package/dist/development/src/model/service/SecretsManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SecretsManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { Providers } from '../providers'\nimport { ProjectSecretsQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":["ProjectSecretsQuery","SetProjectSecretCommand","UpdateProjectCommand"],"mappings":";;;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,oBAAAA,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;;"}
+{"version":3,"file":"SecretsManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { Providers } from '../providers.js'\nimport { ProjectSecretInfoRow, ProjectSecretKeysQuery, ProjectSecretsQuery } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\t/** Lists secret keys (with timestamps) without decrypting any values. */\n\tpublic async listSecretKeys(dbContext: DatabaseContext, projectId: string): Promise<ProjectSecretInfoRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery(projectId))\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":["ProjectSecretKeysQuery","ProjectSecretsQuery","SetProjectSecretCommand","UpdateProjectCommand"],"mappings":";;;;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA;AAAA,EAGA,MAAa,eAAe,WAA4B,WAAoD;AAC3G,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIA,uBAAAA,uBAAuB,SAAS,CAAC;AAAA,EAChF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;;"}

package/dist/development/src/model/service/SecretsManager.js

@@ -5,6 +5,7 @@ import { SetProjectSecretCommand } from "../commands/project/SetProjectSecretCom
 import { UpdateProjectCommand } from "../commands/project/UpdateProjectCommand.js";
 import "../queries/apiKey/ApiKeyQuery.js";
 import { ProjectSecretsQuery } from "../queries/project/ProjectSecretsQuery.js";
+import { ProjectSecretKeysQuery } from "../queries/project/ProjectSecretKeysQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
 import "../authorization/PermissionContext.js";
@@ -17,6 +18,10 @@ class SecretsManager {
   async setSecret(dbContext, projectId, key, value) {
     await this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }]);
   }
+  /** Lists secret keys (with timestamps) without decrypting any values. */
+  async listSecretKeys(dbContext, projectId) {
+    return await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery(projectId));
+  }
   async readSecrets(dbContext, projectId) {
     const result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers));
     const forUpdate = result.filter((it) => it.needsReEncrypt);

package/dist/development/src/model/service/SecretsManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecretsManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { Providers } from '../providers'\nimport { ProjectSecretsQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAI,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;"}
+{"version":3,"file":"SecretsManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { Providers } from '../providers.js'\nimport { ProjectSecretInfoRow, ProjectSecretKeysQuery, ProjectSecretsQuery } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\t/** Lists secret keys (with timestamps) without decrypting any values. */\n\tpublic async listSecretKeys(dbContext: DatabaseContext, projectId: string): Promise<ProjectSecretInfoRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery(projectId))\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA;AAAA,EAGA,MAAa,eAAe,WAA4B,WAAoD;AAC3G,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,uBAAuB,SAAS,CAAC;AAAA,EAChF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAI,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;"}

package/dist/development/src/model/service/SignInManager.cjs

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../queries/apiKey/ApiKeyQuery.cjs");
 require("@contember/database");
+require("../type/ApiKey.cjs");
+const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
 const exceptions = require("../../exceptions.cjs");
 const PersonQuery = require("../queries/person/PersonQuery.cjs");
 require("../authorization/PermissionActions.cjs");
@@ -11,13 +13,21 @@ require("../authorization/PermissionsFactory.cjs");
 require("@contember/schema");
 const Response = require("../utils/Response.cjs");
 const AuthLogService = require("./AuthLogService.cjs");
+require("node:crypto");
+const SetMfaGraceUntilCommand = require("../commands/person/SetMfaGraceUntilCommand.cjs");
+const interval = require("../utils/interval.cjs");
 class SignInManager {
-  constructor(apiKeyManager, providers, otpAuthenticator) {
+  constructor(apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer) {
     this.apiKeyManager = apiKeyManager;
     this.providers = providers;
-    this.otpAuthenticator = otpAuthenticator;
+    this.otpManager = otpManager;
+    this.backupCodeManager = backupCodeManager;
+    this.emailOtpManager = emailOtpManager;
+    this.authPolicyResolver = authPolicyResolver;
+    this.loginRiskAnalyzer = loginRiskAnalyzer;
+    this.userMailer = userMailer;
   }
-  async signIn(dbContext, email, password, expiration, otpCode) {
+  async signIn(dbContext, email, password, expiration, otpCode, requestInfo, trustForwardedInfo, backupCode, config, geoCountry) {
     const person = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email));
     if (person === null) {
       return new Response.ResponseError("UNKNOWN_EMAIL", `Person with email ${email} not found`, {
@@ -42,18 +52,221 @@ class SignInManager {
     if (!passwordValid) {
       return new Response.ResponseError("INVALID_PASSWORD", `Password does not match`, authLogData);
     }
-    if (person.otp_uri && person.otp_activated_at) {
-      if (!otpCode) {
+    if (person.email_verification_required && person.email_verified_at === null) {
+      return new Response.ResponseError("EMAIL_NOT_VERIFIED", `E-mail address has not been verified`, authLogData);
+    }
+    let usedBackupCode = false;
+    let mfaSatisfiedThisRequest = false;
+    const hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at);
+    if (hasActiveTotp) {
+      if (otpCode) {
+        if (!await this.otpManager.verifyOtp(dbContext, person, otpCode)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        mfaSatisfiedThisRequest = true;
+      } else if (backupCode) {
+        if (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        usedBackupCode = true;
+        mfaSatisfiedThisRequest = true;
+      } else {
         return new Response.ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, authLogData);
       }
-      if (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {
+    } else if (person.email_otp_enabled) {
+      if (otpCode) {
+        if (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        mfaSatisfiedThisRequest = true;
+      } else if (backupCode) {
+        if (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        usedBackupCode = true;
+        mfaSatisfiedThisRequest = true;
+      } else {
+        const emailOtpConfig = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(dbContext.providers));
+        const decision = await this.emailOtpManager.sendCode(dbContext, person, emailOtpConfig);
+        return new Response.ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, {
+          emailOtpSent: decision.ok,
+          ...authLogData
+        });
+      }
+    } else {
+      const enforcement = await this.enforceMfaEnrollment(dbContext, person, otpCode, authLogData);
+      if (enforcement !== null) {
+        if ("error" in enforcement) {
+          return enforcement;
+        }
+        const riskHandled2 = await this.applyRiskPolicy(dbContext, person, {
+          config,
+          geoCountry,
+          requestInfo,
+          otpCode,
+          mfaSatisfiedThisRequest: true,
+          authLogData
+        });
+        if (riskHandled2 !== null && "error" in riskHandled2) {
+          return riskHandled2;
+        }
+        const sessionToken2 = await this.apiKeyManager.createSessionApiKey(
+          dbContext,
+          person.identity_id,
+          expiration,
+          requestInfo,
+          trustForwardedInfo
+        );
+        return new Response.ResponseOk({
+          person,
+          token: sessionToken2,
+          backupCodes: enforcement.backupCodes,
+          unusualLoginDetected: riskHandled2?.unusualLoginDetected || void 0,
+          risk: riskHandled2?.risk,
+          ...authLogData
+        });
+      }
+    }
+    const riskHandled = await this.applyRiskPolicy(dbContext, person, {
+      config,
+      geoCountry,
+      requestInfo,
+      otpCode,
+      mfaSatisfiedThisRequest,
+      authLogData
+    });
+    if (riskHandled !== null && "error" in riskHandled) {
+      return riskHandled;
+    }
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo);
+    return new Response.ResponseOk({
+      person,
+      token: sessionToken,
+      usedBackupCode,
+      unusualLoginDetected: riskHandled?.unusualLoginDetected || void 0,
+      risk: riskHandled?.risk,
+      ...authLogData
+    });
+  }
+  /**
+   * A03 — evaluate the sign-in risk score and act per policy. Returns:
+   * - `null` when anomaly detection is off or no `config` was supplied (the
+   *   default): no DB work, sign-in proceeds unchanged.
+   * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email
+   *   was sent (best-effort) but the session may still be issued.
+   * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was
+   *   supplied — reuses the email-OTP step-up channel (dispatches a code).
+   * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but
+   *   did not verify. A valid code consumes the token and the session is issued.
+   * - `{ unusualLoginDetected: false }` when the score was below every threshold.
+   *
+   * The audit entries (`unusual_login_detected`, `step_up_required`) are emitted
+   * by the resolver from the response metadata, matching the project convention.
+   */
+  async applyRiskPolicy(dbContext, person, args) {
+    const { config, geoCountry, requestInfo, otpCode, mfaSatisfiedThisRequest, authLogData } = args;
+    const policy = config?.login.anomalyDetection;
+    if (!config || !policy?.enabled) {
+      return null;
+    }
+    const assessment = await this.loginRiskAnalyzer.analyze(dbContext, person.id, {
+      geoCountry: geoCountry ?? null,
+      deviceFingerprint: this.loginRiskAnalyzer.fingerprint(requestInfo?.userAgent),
+      ip: requestInfo?.ip ?? null
+    }, policy);
+    if (assessment.action === "allow") {
+      return { unusualLoginDetected: false };
+    }
+    const riskMeta = { score: assessment.score, reasons: assessment.reasons };
+    if (assessment.action === "stepUp" && !mfaSatisfiedThisRequest) {
+      if (otpCode) {
+        if (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", {
+            stepUpRequired: true,
+            unusualLoginDetected: true,
+            risk: riskMeta,
+            ...authLogData
+          });
+        }
+      } else {
+        const decision = await this.emailOtpManager.sendCode(dbContext, person, config);
+        return new Response.ResponseError("OTP_REQUIRED", "Additional verification is required for this sign-in", {
+          emailOtpSent: decision.ok,
+          stepUpRequired: true,
+          unusualLoginDetected: true,
+          risk: riskMeta,
+          ...authLogData
+        });
+      }
+    }
+    await this.sendUnusualLoginEmail(dbContext, person, geoCountry ?? null, requestInfo?.ip ?? null);
+    return { unusualLoginDetected: true, risk: riskMeta };
+  }
+  async sendUnusualLoginEmail(dbContext, person, geoCountry, ip) {
+    if (!person.email) {
+      return;
+    }
+    try {
+      await this.userMailer.sendUnusualLoginEmail(dbContext, {
+        email: person.email,
+        geoCountry,
+        ipAddress: ip
+      }, { projectId: null, variant: "" });
+    } catch {
+    }
+  }
+  /**
+   * A06 enforcement for the no-active-factor case. Returns:
+   * - `null` when MFA is not required, or grace currently allows sign-in
+   *   (caller proceeds to issue a session as normal). With zero auth_policy
+   *   rows this is always the outcome — no behavior change.
+   * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to
+   *   enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.
+   * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP
+   *   promoted to active); caller issues the session.
+   */
+  async enforceMfaEnrollment(dbContext, person, otpCode, authLogData) {
+    const policy = await this.authPolicyResolver.resolveForIdentity(dbContext, person.identity_id, person.roles);
+    if (!policy.mfaRequired) {
+      return null;
+    }
+    const now = this.providers.now();
+    let graceSeconds;
+    if (policy.graceDuration !== null) {
+      graceSeconds = interval.intervalToSeconds(policy.graceDuration);
+    } else {
+      const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(dbContext.providers));
+      graceSeconds = interval.intervalToSeconds(config.login.mfaGraceDuration);
+    }
+    if (person.mfa_grace_until !== null) {
+      if (person.mfa_grace_until.getTime() > now.getTime()) {
+        return null;
+      }
+    } else if (graceSeconds > 0) {
+      const graceUntil = new Date(now.getTime() + graceSeconds * 1e3);
+      await dbContext.commandBus.execute(new SetMfaGraceUntilCommand.SetMfaGraceUntilCommand(person.id, graceUntil));
+      return null;
+    }
+    if (otpCode && person.otp_pending_secret) {
+      if (!await this.otpManager.verifyPendingOtp(person, otpCode)) {
         return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
       }
+      const promoted = await this.otpManager.confirmOtp(dbContext, person);
+      if (!promoted) {
+        return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+      }
+      const backupCodes = await this.backupCodeManager.generate(dbContext, person.id);
+      return { backupCodes };
     }
-    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
-    return new Response.ResponseOk({ person, token: sessionToken, ...authLogData });
+    const otp = await this.otpManager.prepareOtp(dbContext, person, "Contember");
+    const mfaEnrollment = { otpUri: otp.uri, otpSecret: otp.secret };
+    return new Response.ResponseError("MFA_ENROLLMENT_REQUIRED", "MFA enrollment is required", {
+      mfaEnrollmentRequired: true,
+      mfaEnrollment,
+      ...authLogData
+    });
   }
-  async createSessionToken(dbContext, personIdentifier, expiration, verifier) {
+  async createSessionToken(dbContext, personIdentifier, expiration, verifier, requestInfo, trustForwardedInfo) {
     const person = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byUniqueIdentifier(personIdentifier));
     if (person === null) {
       if (personIdentifier.type === "email") {
@@ -81,7 +294,7 @@ class SignInManager {
       });
     }
     await verifier?.(person);
-    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo);
     return new Response.ResponseOk({
       person,
       token: sessionToken,

package/dist/development/src/model/service/SignInManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, SignInErrorCode } from '../../schema'\nimport { ApiKeyManager, OtpAuthenticator } from '../service'\nimport { PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ImplementationException } from '../../exceptions'\nimport { AuthLogService } from './AuthLogService'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\tif (person.otp_uri && person.otp_activated_at) {\n\t\t\tif (!otpCode) {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\n\t\t\tif (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\n\t\treturn new ResponseOk({ person, token: sessionToken, ...authLogData })\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":["PersonQuery","ResponseError","AuthLogService","ResponseOk","ImplementationException"],"mappings":";;;;;;;;;;;;;AASA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,kBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,WAA4B,OAAe,UAAkB,YAAqB,SAA2C;AACzI,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMA,wBAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAACA,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAID,SAAAA,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIA,SAAAA,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAEA,QAAI,OAAO,WAAW,OAAO,kBAAkB;AAC9C,UAAI,CAAC,SAAS;AACb,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAEA,UAAI,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,OAAO,GAAG;AACtE,eAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AAAA,IACD;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAE3G,WAAO,IAAIE,SAAAA,WAAW,EAAE,QAAQ,OAAO,cAAc,GAAG,aAAa;AAAA,EACtE;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMH,wBAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAID,SAAAA,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAIE,WAAAA,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIH,SAAAA,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAC3G,WAAO,IAAIC,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAACD,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;;"}
+{"version":3,"file":"SignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, MfaEnrollment, SignInErrorCode } from '../../schema/index.js'\nimport { ApiKeyManager, AuthPolicyResolver, BackupCodeManager, EmailOtpManager, LoginRiskAnalyzer, OtpManager } from '../service/index.js'\nimport { ConfigurationQuery, PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries/index.js'\nimport { Config } from '../type/Config.js'\nimport { Providers } from '../providers.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ApiKeyRequestInfo, SetMfaGraceUntilCommand } from '../commands/index.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly emailOtpManager: EmailOtpManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t\tprivate readonly loginRiskAnalyzer: LoginRiskAnalyzer,\n\t\tprivate readonly userMailer: UserMailer,\n\t) {}\n\n\tasync signIn(\n\t\tdbContext: DatabaseContext,\n\t\temail: string,\n\t\tpassword: string,\n\t\texpiration?: number,\n\t\totpCode?: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t\tbackupCode?: string,\n\t\tconfig?: Config,\n\t\tgeoCountry?: string,\n\t): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\t// Block sign-in for accounts that were created while email verification\n\t\t// was required but never proved ownership. Accounts predating the\n\t\t// requirement carry email_verification_required = false and pass through.\n\t\tif (person.email_verification_required && person.email_verified_at === null) {\n\t\t\treturn new ResponseError('EMAIL_NOT_VERIFIED', `E-mail address has not been verified`, authLogData)\n\t\t}\n\n\t\tlet usedBackupCode = false\n\t\t// Whether a second factor was actively proven in THIS request. Anomaly\n\t\t// step-up (A03) reuses this: a login that already cleared a second factor\n\t\t// is not asked to step up again.\n\t\tlet mfaSatisfiedThisRequest = false\n\t\tconst hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at)\n\t\tif (hasActiveTotp) {\n\t\t\t// Active TOTP takes precedence (A07 path, unchanged).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.otpManager.verifyOtp(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\t\t} else if (person.email_otp_enabled) {\n\t\t\t// No active TOTP, but email OTP is enabled (A05).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\t// Dispatch a fresh code and ask the client to retry with otpToken. Reuses\n\t\t\t\t// the existing OTP_REQUIRED contract so clients that already handle it work.\n\t\t\t\t// The send is rate-limited per person; when throttled nothing is emailed\n\t\t\t\t// (emailOtpSent: false) but a previously emailed code stays valid.\n\t\t\t\t// Independent fetch (not the passed-in `config`): the email-OTP send is\n\t\t\t\t// rate-limited by the live config and this branch never reaches the\n\t\t\t\t// anomaly analyzer, so query shape stays as before A03.\n\t\t\t\tconst emailOtpConfig = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, emailOtpConfig)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t} else {\n\t\t\t// No active factor at all (A06). Enforce MFA if a matching auth_policy\n\t\t\t// requires it. With no policy rows configured this resolves to\n\t\t\t// mfaRequired=false and sign-in proceeds exactly as before.\n\t\t\tconst enforcement = await this.enforceMfaEnrollment(dbContext, person, otpCode, authLogData)\n\t\t\tif (enforcement !== null) {\n\t\t\t\tif ('error' in enforcement) {\n\t\t\t\t\treturn enforcement\n\t\t\t\t}\n\t\t\t\t// Enrollment completed in this request (pending TOTP promoted to active),\n\t\t\t\t// so MFA is definitively satisfied — anomaly step-up cannot apply.\n\t\t\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\t\t\tconfig,\n\t\t\t\t\tgeoCountry,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\totpCode,\n\t\t\t\t\tmfaSatisfiedThisRequest: true,\n\t\t\t\t\tauthLogData,\n\t\t\t\t})\n\t\t\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\t\t\treturn riskHandled\n\t\t\t\t}\n\t\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(\n\t\t\t\t\tdbContext,\n\t\t\t\t\tperson.identity_id,\n\t\t\t\t\texpiration,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\ttrustForwardedInfo,\n\t\t\t\t)\n\t\t\t\treturn new ResponseOk({\n\t\t\t\t\tperson,\n\t\t\t\t\ttoken: sessionToken,\n\t\t\t\t\tbackupCodes: enforcement.backupCodes,\n\t\t\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected || undefined,\n\t\t\t\t\trisk: riskHandled?.risk,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\tconfig,\n\t\t\tgeoCountry,\n\t\t\trequestInfo,\n\t\t\totpCode,\n\t\t\tmfaSatisfiedThisRequest,\n\t\t\tauthLogData,\n\t\t})\n\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\treturn riskHandled\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\tusedBackupCode,\n\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected || undefined,\n\t\t\trisk: riskHandled?.risk,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\t/**\n\t * A03 — evaluate the sign-in risk score and act per policy. Returns:\n\t * - `null` when anomaly detection is off or no `config` was supplied (the\n\t *   default): no DB work, sign-in proceeds unchanged.\n\t * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email\n\t *   was sent (best-effort) but the session may still be issued.\n\t * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was\n\t *   supplied — reuses the email-OTP step-up channel (dispatches a code).\n\t * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but\n\t *   did not verify. A valid code consumes the token and the session is issued.\n\t * - `{ unusualLoginDetected: false }` when the score was below every threshold.\n\t *\n\t * The audit entries (`unusual_login_detected`, `step_up_required`) are emitted\n\t * by the resolver from the response metadata, matching the project convention.\n\t */\n\tprivate async applyRiskPolicy(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\targs: {\n\t\t\tconfig?: Config\n\t\t\tgeoCountry?: string\n\t\t\trequestInfo?: ApiKeyRequestInfo\n\t\t\totpCode?: string\n\t\t\tmfaSatisfiedThisRequest: boolean\n\t\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag }\n\t\t},\n\t): Promise<RiskPolicyOutcome> {\n\t\tconst { config, geoCountry, requestInfo, otpCode, mfaSatisfiedThisRequest, authLogData } = args\n\t\tconst policy = config?.login.anomalyDetection\n\t\tif (!config || !policy?.enabled) {\n\t\t\treturn null\n\t\t}\n\n\t\tconst assessment = await this.loginRiskAnalyzer.analyze(dbContext, person.id, {\n\t\t\tgeoCountry: geoCountry ?? null,\n\t\t\tdeviceFingerprint: this.loginRiskAnalyzer.fingerprint(requestInfo?.userAgent),\n\t\t\tip: requestInfo?.ip ?? null,\n\t\t}, policy)\n\n\t\tif (assessment.action === 'allow') {\n\t\t\treturn { unusualLoginDetected: false }\n\t\t}\n\n\t\tconst riskMeta = { score: assessment.score, reasons: assessment.reasons }\n\n\t\tif (assessment.action === 'stepUp' && !mfaSatisfiedThisRequest) {\n\t\t\t// Reuse the existing email-OTP step-up channel. This is independent of\n\t\t\t// `person.email_otp_enabled`, which gates email OTP only as the *primary*\n\t\t\t// second factor (A05); the step-up challenge stands on its own, so a person\n\t\t\t// with no standing MFA can still complete it. Without consuming the code\n\t\t\t// here, such a person would never satisfy the step-up and would loop on\n\t\t\t// OTP_REQUIRED forever (the score is unchanged on every retry).\n\t\t\tif (otpCode) {\n\t\t\t\t// Retry leg: the client resent the emailed code as otpToken. Mirror the\n\t\t\t\t// A05 contract — an invalid code is rejected (not re-sent); the per-code\n\t\t\t\t// 3-attempt cap still applies, and a fresh code is issued only when the\n\t\t\t\t// client retries without a code.\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\t// A failed *forced* second factor is itself an anomaly signal — carry the\n\t\t\t\t\t// step-up/risk metadata so the resolver still emits unusual_login_detected\n\t\t\t\t\t// + step_up_required with the score/reasons, rather than logging it as an\n\t\t\t\t\t// ordinary mistyped-OTP login indistinguishable from a normal 2FA typo.\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t\t...authLogData,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\t// Step-up satisfied this request — fall through to notify + allow below.\n\t\t\t} else {\n\t\t\t\t// First leg: dispatch a code and ask the client to retry with otpToken.\n\t\t\t\t// Rate-limited per person; a previously emailed code stays valid when throttled.\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, config)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', 'Additional verification is required for this sign-in', {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\t// action === 'email', or step-up satisfied (already this request, or just now\n\t\t// via the emailed code): notify the person of the unusual sign-in. A failed\n\t\t// email must never block sign-in.\n\t\tawait this.sendUnusualLoginEmail(dbContext, person, geoCountry ?? null, requestInfo?.ip ?? null)\n\t\treturn { unusualLoginDetected: true, risk: riskMeta }\n\t}\n\n\tprivate async sendUnusualLoginEmail(dbContext: DatabaseContext, person: PersonRow, geoCountry: string | null, ip: string | null): Promise<void> {\n\t\tif (!person.email) {\n\t\t\t// No address to notify (e.g. an IDP-only person) — nothing to send.\n\t\t\treturn\n\t\t}\n\t\ttry {\n\t\t\tawait this.userMailer.sendUnusualLoginEmail(dbContext, {\n\t\t\t\temail: person.email,\n\t\t\t\tgeoCountry,\n\t\t\t\tipAddress: ip,\n\t\t\t}, { projectId: null, variant: '' })\n\t\t} catch {\n\t\t\t// ignore — informational only\n\t\t}\n\t}\n\n\t/**\n\t * A06 enforcement for the no-active-factor case. Returns:\n\t * - `null` when MFA is not required, or grace currently allows sign-in\n\t *   (caller proceeds to issue a session as normal). With zero auth_policy\n\t *   rows this is always the outcome — no behavior change.\n\t * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to\n\t *   enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.\n\t * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP\n\t *   promoted to active); caller issues the session.\n\t */\n\tprivate async enforceMfaEnrollment(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\totpCode: string | undefined,\n\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag },\n\t): Promise<\n\t\t| null\n\t\t| ResponseError<SignInErrorCode, {\n\t\t\temailOtpSent?: boolean\n\t\t\tmfaEnrollmentRequired?: boolean\n\t\t\tmfaEnrollment?: MfaEnrollment\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}>\n\t\t| { backupCodes: string[] }\n\t> {\n\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(dbContext, person.identity_id, person.roles)\n\t\tif (!policy.mfaRequired) {\n\t\t\treturn null\n\t\t}\n\n\t\tconst now = this.providers.now()\n\n\t\t// Resolve the effective grace duration (seconds). A per-policy override\n\t\t// wins; otherwise we fall back to the global config default. Only fetch the\n\t\t// config when the override is absent, to keep query shapes minimal.\n\t\tlet graceSeconds: number\n\t\tif (policy.graceDuration !== null) {\n\t\t\tgraceSeconds = intervalToSeconds(policy.graceDuration)\n\t\t} else {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\tgraceSeconds = intervalToSeconds(config.login.mfaGraceDuration)\n\t\t}\n\n\t\t// Grace handling. Default grace duration is 0 (immediate enforcement), so\n\t\t// by default neither branch below opens a window.\n\t\tif (person.mfa_grace_until !== null) {\n\t\t\tif (person.mfa_grace_until.getTime() > now.getTime()) {\n\t\t\t\t// Still inside an open grace window — allow sign-in.\n\t\t\t\treturn null\n\t\t\t}\n\t\t\t// Grace expired → fall through to enforcement.\n\t\t} else if (graceSeconds > 0) {\n\t\t\t// Open the grace window now and allow this sign-in.\n\t\t\tconst graceUntil = new Date(now.getTime() + graceSeconds * 1000)\n\t\t\tawait dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceUntil))\n\t\t\treturn null\n\t\t}\n\n\t\t// Enforce.\n\t\tif (otpCode && person.otp_pending_secret) {\n\t\t\t// Enrollment completion: verify against the pending secret, then promote.\n\t\t\tif (!await this.otpManager.verifyPendingOtp(person, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst promoted = await this.otpManager.confirmOtp(dbContext, person)\n\t\t\tif (!promoted) {\n\t\t\t\t// Lost a concurrent enrollment-completion race: the pending secret was\n\t\t\t\t// already promoted by the other request (which issued the backup codes).\n\t\t\t\t// Don't regenerate here — that would invalidate the codes already\n\t\t\t\t// returned. TOTP is now active, so a retry signs in via the normal path.\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst backupCodes = await this.backupCodeManager.generate(dbContext, person.id)\n\t\t\treturn { backupCodes }\n\t\t}\n\n\t\t// Provision a fresh pending TOTP secret and ask the client to enroll.\n\t\tconst otp = await this.otpManager.prepareOtp(dbContext, person, 'Contember')\n\t\tconst mfaEnrollment: MfaEnrollment = { otpUri: otp.uri, otpSecret: otp.secret }\n\t\treturn new ResponseError('MFA_ENROLLMENT_REQUIRED', 'MFA enrollment is required', {\n\t\t\tmfaEnrollmentRequired: true,\n\t\t\tmfaEnrollment,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\n/** A03: greppable payload describing why a sign-in scored as unusual. */\nexport interface RiskMeta {\n\treadonly score: number\n\treadonly reasons: readonly string[]\n}\n\n/**\n * Result of {@link SignInManager.applyRiskPolicy}: `null` = feature off / no\n * config; a metadata object when the session may still be issued; a\n * `ResponseError` when step-up blocks the session.\n */\ntype RiskPolicyOutcome =\n\t| null\n\t| { unusualLoginDetected: boolean; risk?: RiskMeta }\n\t| ResponseError<SignInErrorCode, {\n\t\temailOtpSent?: boolean\n\t\tstepUpRequired?: boolean\n\t\tunusualLoginDetected?: boolean\n\t\trisk?: RiskMeta\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t/** True when MFA was satisfied by consuming a backup code (instead of a TOTP token). */\n\treadonly usedBackupCode?: boolean\n\t/** Set when sign-in completed an MFA enrollment (A06): the freshly issued backup codes, shown once. */\n\treadonly backupCodes?: string[]\n\t/** A03: true when this sign-in scored as unusual and an UNUSUAL_LOGIN email was sent. */\n\treadonly unusualLoginDetected?: boolean\n\t/** A03: the risk score + reasons, recorded in the `unusual_login_detected` audit `event_data`. */\n\treadonly risk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t/** Set on an OTP_REQUIRED error when an email-OTP code was just dispatched (A05). */\n\temailOtpSent?: boolean\n\t/** Set on a MFA_ENROLLMENT_REQUIRED error (A06): triggers the `mfa_enrollment_required` audit. */\n\tmfaEnrollmentRequired?: boolean\n\t/** Set on a MFA_ENROLLMENT_REQUIRED error (A06): the pending secret the client must enroll. */\n\tmfaEnrollment?: MfaEnrollment\n\t/** Set on an OTP_REQUIRED error raised by A03 anomaly step-up: triggers the `step_up_required` audit. */\n\tstepUpRequired?: boolean\n\t/** A03: true when the sign-in scored as unusual (triggers the `unusual_login_detected` audit). */\n\tunusualLoginDetected?: boolean\n\t/** A03: the risk score + reasons, recorded in the audit `event_data`. */\n\trisk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":["PersonQuery","ResponseError","AuthLogService","ConfigurationQuery","riskHandled","sessionToken","ResponseOk","intervalToSeconds","SetMfaGraceUntilCommand","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;AAaA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,YACA,mBACA,iBACA,oBACA,mBACA,YAChB;AARgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,kBAAA;AACA,SAAA,qBAAA;AACA,SAAA,oBAAA;AACA,SAAA,aAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,WACA,OACA,UACA,YACA,SACA,aACA,oBACA,YACA,QACA,YAC0B;AAC1B,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMA,wBAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAACA,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAID,SAAAA,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIA,SAAAA,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAKA,QAAI,OAAO,+BAA+B,OAAO,sBAAsB,MAAM;AAC5E,aAAO,IAAIA,SAAAA,cAAc,sBAAsB,wCAAwC,WAAW;AAAA,IACnG;AAEA,QAAI,iBAAiB;AAIrB,QAAI,0BAA0B;AAC9B,UAAM,gBAAgB,QAAQ,OAAO,cAAc,OAAO,gBAAgB;AAC1E,QAAI,eAAe;AAElB,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,WAAW,UAAU,WAAW,QAAQ,OAAO,GAAG;AACjE,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AACN,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAAA,IACD,WAAW,OAAO,mBAAmB;AAEpC,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAC7E,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AAQN,cAAM,iBAAiB,MAAM,UAAU,aAAa,MAAM,IAAIE,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AACrG,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,cAAc;AACtF,eAAO,IAAIF,SAAAA,cAAc,gBAAgB,yCAAyC;AAAA,UACjF,cAAc,SAAS;AAAA,UACvB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD,OAAO;AAIN,YAAM,cAAc,MAAM,KAAK,qBAAqB,WAAW,QAAQ,SAAS,WAAW;AAC3F,UAAI,gBAAgB,MAAM;AACzB,YAAI,WAAW,aAAa;AAC3B,iBAAO;AAAA,QACR;AAGA,cAAMG,eAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,UACjE;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,yBAAyB;AAAA,UACzB;AAAA,QAAA,CACA;AACD,YAAIA,iBAAgB,QAAQ,WAAWA,cAAa;AACnD,iBAAOA;AAAAA,QACR;AACA,cAAMC,gBAAe,MAAM,KAAK,cAAc;AAAA,UAC7C;AAAA,UACA,OAAO;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,QAAA;AAED,eAAO,IAAIC,SAAAA,WAAW;AAAA,UACrB;AAAA,UACA,OAAOD;AAAAA,UACP,aAAa,YAAY;AAAA,UACzB,sBAAsBD,cAAa,wBAAwB;AAAA,UAC3D,MAAMA,cAAa;AAAA,UACnB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAEA,UAAM,cAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACA;AACD,QAAI,gBAAgB,QAAQ,WAAW,aAAa;AACnD,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAE5I,WAAO,IAAIE,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,sBAAsB,aAAa,wBAAwB;AAAA,MAC3D,MAAM,aAAa;AAAA,MACnB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAc,gBACb,WACA,QACA,MAQ6B;AAC7B,UAAM,EAAE,QAAQ,YAAY,aAAa,SAAS,yBAAyB,gBAAgB;AAC3F,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,CAAC,UAAU,CAAC,QAAQ,SAAS;AAChC,aAAO;AAAA,IACR;AAEA,UAAM,aAAa,MAAM,KAAK,kBAAkB,QAAQ,WAAW,OAAO,IAAI;AAAA,MAC7E,YAAY,cAAc;AAAA,MAC1B,mBAAmB,KAAK,kBAAkB,YAAY,aAAa,SAAS;AAAA,MAC5E,IAAI,aAAa,MAAM;AAAA,IAAA,GACrB,MAAM;AAET,QAAI,WAAW,WAAW,SAAS;AAClC,aAAO,EAAE,sBAAsB,MAAA;AAAA,IAChC;AAEA,UAAM,WAAW,EAAE,OAAO,WAAW,OAAO,SAAS,WAAW,QAAA;AAEhE,QAAI,WAAW,WAAW,YAAY,CAAC,yBAAyB;AAO/D,UAAI,SAAS;AAKZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAK7E,iBAAO,IAAIL,SAAAA,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,gBAAgB;AAAA,YAChB,sBAAsB;AAAA,YACtB,MAAM;AAAA,YACN,GAAG;AAAA,UAAA,CACH;AAAA,QACF;AAAA,MAED,OAAO;AAGN,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,MAAM;AAC9E,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,wDAAwD;AAAA,UAChG,cAAc,SAAS;AAAA,UACvB,gBAAgB;AAAA,UAChB,sBAAsB;AAAA,UACtB,MAAM;AAAA,UACN,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAKA,UAAM,KAAK,sBAAsB,WAAW,QAAQ,cAAc,MAAM,aAAa,MAAM,IAAI;AAC/F,WAAO,EAAE,sBAAsB,MAAM,MAAM,SAAA;AAAA,EAC5C;AAAA,EAEA,MAAc,sBAAsB,WAA4B,QAAmB,YAA2B,IAAkC;AAC/I,QAAI,CAAC,OAAO,OAAO;AAElB;AAAA,IACD;AACA,QAAI;AACH,YAAM,KAAK,WAAW,sBAAsB,WAAW;AAAA,QACtD,OAAO,OAAO;AAAA,QACd;AAAA,QACA,WAAW;AAAA,MAAA,GACT,EAAE,WAAW,MAAM,SAAS,IAAI;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,qBACb,WACA,QACA,SACA,aAUC;AACD,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,WAAW,OAAO,aAAa,OAAO,KAAK;AAC3G,QAAI,CAAC,OAAO,aAAa;AACxB,aAAO;AAAA,IACR;AAEA,UAAM,MAAM,KAAK,UAAU,IAAA;AAK3B,QAAI;AACJ,QAAI,OAAO,kBAAkB,MAAM;AAClC,qBAAeM,SAAAA,kBAAkB,OAAO,aAAa;AAAA,IACtD,OAAO;AACN,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIJ,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AAC7F,qBAAeI,SAAAA,kBAAkB,OAAO,MAAM,gBAAgB;AAAA,IAC/D;AAIA,QAAI,OAAO,oBAAoB,MAAM;AACpC,UAAI,OAAO,gBAAgB,QAAA,IAAY,IAAI,WAAW;AAErD,eAAO;AAAA,MACR;AAAA,IAED,WAAW,eAAe,GAAG;AAE5B,YAAM,aAAa,IAAI,KAAK,IAAI,QAAA,IAAY,eAAe,GAAI;AAC/D,YAAM,UAAU,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,OAAO,IAAI,UAAU,CAAC;AACrF,aAAO;AAAA,IACR;AAGA,QAAI,WAAW,OAAO,oBAAoB;AAEzC,UAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,OAAO,GAAG;AAC7D,eAAO,IAAIP,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,WAAW,MAAM,KAAK,WAAW,WAAW,WAAW,MAAM;AACnE,UAAI,CAAC,UAAU;AAKd,eAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,WAAW,OAAO,EAAE;AAC9E,aAAO,EAAE,YAAA;AAAA,IACV;AAGA,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,WAAW,QAAQ,WAAW;AAC3E,UAAM,gBAA+B,EAAE,QAAQ,IAAI,KAAK,WAAW,IAAI,OAAA;AACvE,WAAO,IAAIA,SAAAA,cAAc,2BAA2B,8BAA8B;AAAA,MACjF,uBAAuB;AAAA,MACvB;AAAA,MACA,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACA,aACA,oBACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMD,wBAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAID,SAAAA,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAIO,WAAAA,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIR,SAAAA,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAC5I,WAAO,IAAII,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAACJ,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;;"}