@contember/engine-tenant-api 2.1.0-beta.2 → 2.2.0-alpha.1

package/dist/development/src/TenantContainer.js

@@ -16,14 +16,31 @@ import "./model/queries/apiKey/ApiKeyQuery.js";
 import { UserMailer } from "./model/mailing/UserMailer.js";
 import { ApiKeyManager } from "./model/service/apiKey/ApiKeyManager.js";
 import { ApiKeyService } from "./model/service/apiKey/ApiKeyService.js";
+import { UnpersistedApiKeyManager } from "./model/service/apiKey/UnpersistedApiKeyManager.js";
+import { CaptchaValidator } from "./model/service/captcha/CaptchaValidator.js";
+import { HCaptchaProvider } from "./model/service/captcha/HCaptchaProvider.js";
+import { RecaptchaV3Provider } from "./model/service/captcha/RecaptchaV3Provider.js";
+import { TurnstileProvider } from "./model/service/captcha/TurnstileProvider.js";
 import { IDPHandlerRegistry } from "./model/service/idp/IDPHandlerRegistry.js";
+import { IdpSessionRevalidator } from "./model/service/idp/IdpSessionRevalidator.js";
+import { BackchannelLogoutManager } from "./model/service/idp/BackchannelLogoutManager.js";
+import "./model/service/idp/IDPRevalidation.js";
 import { IDPManager } from "./model/service/idp/IDPManager.js";
+import { PersonIdentityProviderManager } from "./model/service/idp/PersonIdentityProviderManager.js";
 import { AppleProvider } from "./model/service/idp/providers/AppleProvider.js";
 import { OIDCProvider } from "./model/service/idp/providers/OIDCProvider.js";
 import { FacebookProvider } from "./model/service/idp/providers/FacebookProvider.js";
+import { AuthLogService } from "./model/service/AuthLogService.js";
+import { AuthPolicyManager } from "./model/service/AuthPolicyManager.js";
+import { AuthPolicyResolver } from "./model/service/AuthPolicyResolver.js";
+import { BackupCodeManager } from "./model/service/BackupCodeManager.js";
+import { EmailChangeManager } from "./model/service/EmailChangeManager.js";
+import { EmailOtpManager } from "./model/service/EmailOtpManager.js";
 import { EmailValidator } from "./model/service/EmailValidator.js";
+import { EmailVerificationManager } from "./model/service/EmailVerificationManager.js";
 import { IDPSignInManager } from "./model/service/IDPSignInManager.js";
 import { InviteManager } from "./model/service/InviteManager.js";
+import { LoginRiskAnalyzer } from "./model/service/LoginRiskAnalyzer.js";
 import { MailTemplateManager } from "./model/service/MailTemplateManager.js";
 import { MembershipValidator } from "./model/service/MembershipValidator.js";
 import { OtpAuthenticator } from "./model/service/OtpAuthenticator.js";
@@ -33,23 +50,30 @@ import { PasswordResetManager } from "./model/service/PasswordResetManager.js";
 import { PersonAccessManager } from "./model/service/PersonAccessManager.js";
 import { PersonManager } from "./model/service/PersonManager.js";
 import { ProjectManager } from "./model/service/ProjectManager.js";
+import { RateLimiter } from "./model/service/RateLimiter.js";
 import { ProjectMemberManager } from "./model/service/ProjectMemberManager.js";
 import { RolesManager } from "./model/service/RolesManager.js";
 import { SecretsManager } from "./model/service/SecretsManager.js";
 import { SignInManager } from "./model/service/SignInManager.js";
+import { SignOutManager } from "./model/service/SignOutManager.js";
 import { SignUpManager } from "./model/service/SignUpManager.js";
+import { HttpHibpChecker, NoopHibpChecker } from "./model/service/HibpChecker.js";
 import { CreateApiKeyMutationResolver } from "./resolvers/mutation/apiKey/CreateApiKeyMutationResolver.js";
 import { DisableApiKeyMutationResolver } from "./resolvers/mutation/apiKey/DisableApiKeyMutationResolver.js";
 import { IdentityGlobalRolesMutationResolver } from "./resolvers/mutation/identity/GlobalRolesMutationResolver.js";
 import { DisableIDPMutationResolver } from "./resolvers/mutation/idp/DisableIDPMutationResolver.js";
 import { EnableIDPMutationResolver } from "./resolvers/mutation/idp/EnableIDPMutationResolver.js";
 import { AddIDPMutationResolver } from "./resolvers/mutation/idp/AddIDPMutationResolver.js";
+import { DisconnectMyIdentityProviderMutationResolver } from "./resolvers/mutation/idp/DisconnectMyIdentityProviderMutationResolver.js";
 import { MailTemplateMutationResolver } from "./resolvers/mutation/mailTemplates/MailTemplateMutationResolver.js";
 import { ChangeProfileMutationResolver } from "./resolvers/mutation/person/ChangeProfileMutationResolver.js";
 import { ChangePasswordMutationResolver } from "./resolvers/mutation/person/ChangePasswordMutationResolver.js";
+import { EmailVerificationMutationResolver } from "./resolvers/mutation/person/EmailVerificationMutationResolver.js";
 import { IDPMutationResolver } from "./resolvers/mutation/person/IDPMutationResolver.js";
 import { InviteMutationResolver } from "./resolvers/mutation/person/InviteMutationResolver.js";
 import { OtpMutationResolver } from "./resolvers/mutation/person/OtpMutationResolver.js";
+import { EmailOtpMutationResolver } from "./resolvers/mutation/person/EmailOtpMutationResolver.js";
+import { RegenerateBackupCodesMutationResolver } from "./resolvers/mutation/person/RegenerateBackupCodesMutationResolver.js";
 import { ResetPasswordMutationResolver } from "./resolvers/mutation/person/ResetPasswordMutationResolver.js";
 import { SignInMutationResolver } from "./resolvers/mutation/person/SignInMutationResolver.js";
 import { SignOutMutationResolver } from "./resolvers/mutation/person/SignOutMutationResolver.js";
@@ -60,11 +84,14 @@ import { UpdateProjectMutationResolver } from "./resolvers/mutation/project/Upda
 import { AddProjectMemberMutationResolver } from "./resolvers/mutation/projectMember/AddProjectMemberMutationResolver.js";
 import { RemoveProjectMemberMutationResolver } from "./resolvers/mutation/projectMember/RemoveProjectMemberMutationResolver.js";
 import { UpdateProjectMemberMutationResolver } from "./resolvers/mutation/projectMember/UpdateProjectMemberMutationResolver.js";
+import { ApiKeyQueryResolver } from "./resolvers/query/ApiKeyQueryResolver.js";
+import { AuthLogQueryResolver } from "./resolvers/query/AuthLogQueryResolver.js";
 import { MeQueryResolver } from "./resolvers/query/MeQueryResolver.js";
 import { ProjectMembersQueryResolver } from "./resolvers/query/ProjectMembersQueryResolver.js";
 import { ProjectQueryResolver } from "./resolvers/query/ProjectQueryResolver.js";
 import { PersonQueryResolver } from "./resolvers/query/PersonQueryResolver.js";
 import { IdentityTypeResolver } from "./resolvers/types/IdentityTypeResolver.js";
+import { PersonTypeResolver } from "./resolvers/types/PersonTypeResolver.js";
 import { ProjectTypeResolver } from "./resolvers/types/ProjectTypeResolver.js";
 import { ResolverFactory } from "./resolvers/ResolverFactory.js";
 import { TenantResolverContextFactory } from "./resolvers/TenantResolverContextFactory.js";
@@ -76,15 +103,19 @@ import { IDPQueryResolver } from "./resolvers/query/IDPQueryResolver.js";
 import { UpdateIDPMutationResolver } from "./resolvers/mutation/idp/UpdateIDPMutationResolver.js";
 import { TenantMigrationsRunner } from "./migrations/runner.js";
 import { DisablePersonMutationResolver } from "./resolvers/mutation/person/DisablePersonMutationResolver.js";
+import { ForceSignOutMutationResolver } from "./resolvers/mutation/person/ForceSignOutMutationResolver.js";
+import { RevokeSessionMutationResolver } from "./resolvers/mutation/person/RevokeSessionMutationResolver.js";
 import { MailTemplateQueryResolver } from "./resolvers/query/MailTemplateQueryResolver.js";
 import { ConfigurationManager } from "./model/service/ConfigurationManager.js";
 import { ConfigurationMutationResolver } from "./resolvers/mutation/configuration/ConfigurationMutationResolver.js";
 import { ConfigurationQueryResolver } from "./resolvers/query/ConfigurationQueryResolver.js";
+import { AuthPolicyMutationResolver } from "./resolvers/mutation/configuration/AuthPolicyMutationResolver.js";
+import { AuthPolicyQueryResolver } from "./resolvers/query/AuthPolicyQueryResolver.js";
+import { ResetPersonMfaMutationResolver } from "./resolvers/mutation/person/ResetPersonMfaMutationResolver.js";
 import { PasswordlessMutationResolver } from "./resolvers/mutation/person/PasswordlessMutationResolver.js";
 import { PasswordlessSignInManager } from "./model/service/PasswordlessSignInManager.js";
 import { TogglePasswordlessMutationResolver } from "./resolvers/mutation/person/TogglePasswordlessMutationResolver.js";
 import { PasswordStrengthValidator } from "./model/service/PasswordStrengthValidator.js";
-import { AuthLogService } from "./model/service/AuthLogService.js";
 class TenantContainerFactory {
   constructor(providers) {
     this.providers = providers;
@@ -92,6 +123,7 @@ class TenantContainerFactory {
   create(args) {
     return this.createBuilder(args).build().pick(
       "apiKeyManager",
+      "backchannelLogoutManager",
       "projectMemberManager",
       "projectManager",
       "signUpManager",
@@ -107,39 +139,82 @@ class TenantContainerFactory {
     );
   }
   createBuilder(args) {
-    return new Builder({}).addService("providers", () => ({ ...this.providers, ...args.cryptoProviders })).addService("mailer", () => createMailer(args.mailOptions)).addService("projectSchemaResolver", () => args.projectSchemaResolver).addService("templateRenderer", () => new TemplateRenderer()).addService("accessEvaluator", ({}) => new AccessEvaluator.PermissionEvaluator(new PermissionsFactory().create())).addService("authorizator", ({ accessEvaluator }) => new Authorizator.Default(accessEvaluator)).addService("userMailer", ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer)).addService("apiKeyService", () => new ApiKeyService()).addService("apiKeyManager", ({ apiKeyService }) => new ApiKeyManager(apiKeyService)).addService("emailValidator", () => new EmailValidator()).addService("passwordStrengthValidator", () => new PasswordStrengthValidator()).addService("signUpManager", ({ emailValidator, passwordStrengthValidator }) => new SignUpManager(emailValidator, passwordStrengthValidator)).addService("passwordChangeManager", ({ providers, passwordStrengthValidator }) => new PasswordChangeManager(providers, passwordStrengthValidator)).addService("projectMemberManager", () => new ProjectMemberManager()).addService("identityFactory", ({ projectMemberManager }) => new IdentityFactory(projectMemberManager)).addService("projectScopeFactory", () => new ProjectScopeFactory(new AclSchemaAccessNodeFactory())).addService(
-      "permissionContextFactory",
-      ({ authorizator, identityFactory, projectScopeFactory, projectSchemaResolver }) => new PermissionContextFactory(authorizator, identityFactory, projectScopeFactory, projectSchemaResolver)
-    ).addService("secretManager", ({ providers }) => new SecretsManager(providers)).addService("projectManager", ({ secretManager, apiKeyService }) => new ProjectManager(secretManager, args.projectInitializer, apiKeyService)).addService("personAccessManager", ({ apiKeyManager }) => new PersonAccessManager(apiKeyManager)).addService("personManager", ({ emailValidator }) => new PersonManager(emailValidator)).addService(
-      "passwordResetManager",
-      ({ userMailer, projectManager, passwordStrengthValidator }) => new PasswordResetManager(userMailer, projectManager, passwordStrengthValidator)
-    ).addService("idpRegistry", () => {
+    return new Builder({}).addService("providers", () => ({ ...this.providers, ...args.cryptoProviders })).addService("mailer", () => createMailer(args.mailOptions)).addService("projectSchemaResolver", () => args.projectSchemaResolver).addService("templateRenderer", () => new TemplateRenderer()).addService("accessEvaluator", ({}) => new AccessEvaluator.PermissionEvaluator(new PermissionsFactory().create())).addService("authorizator", ({ accessEvaluator }) => new Authorizator.Default(accessEvaluator)).addService("userMailer", ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer)).addService("apiKeyService", () => new ApiKeyService()).addService("authPolicyResolver", () => new AuthPolicyResolver()).addService("authLogService", () => new AuthLogService()).addService("loginRiskAnalyzer", ({ providers }) => new LoginRiskAnalyzer(providers.hash)).addService("idpRegistry", () => {
       const idpRegistry = new IDPHandlerRegistry();
       idpRegistry.registerHandler("oidc", new OIDCProvider());
       idpRegistry.registerHandler("facebook", new FacebookProvider());
       idpRegistry.registerHandler("apple", new AppleProvider());
       return idpRegistry;
-    }).addService("idpSignInManager", ({ apiKeyManager, idpRegistry }) => new IDPSignInManager(apiKeyManager, idpRegistry)).addService("idpManager", ({ idpRegistry }) => new IDPManager(idpRegistry)).addService("otpAuthenticator", ({ providers }) => new OtpAuthenticator(providers)).addService("signInManager", ({ apiKeyManager, providers, otpAuthenticator }) => new SignInManager(apiKeyManager, providers, otpAuthenticator)).addService("membershipValidator", ({ projectSchemaResolver }) => new MembershipValidator(projectSchemaResolver)).addService("inviteManager", ({ providers, userMailer, projectSchemaResolver }) => new InviteManager(providers, userMailer, projectSchemaResolver)).addService("otpManager", ({ otpAuthenticator }) => new OtpManager(otpAuthenticator)).addService("mailTemplateManager", () => new MailTemplateManager()).addService("rolesManager", () => new RolesManager()).addService("configurationManager", () => new ConfigurationManager()).addService(
+    }).addService("idpSessionRevalidator", ({ idpRegistry }) => new IdpSessionRevalidator(idpRegistry)).addService("backchannelLogoutManager", ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry)).addService("unpersistedApiKeyManager", () => UnpersistedApiKeyManager.createForRootTokens({
+      tokens: args.tenantCredentials.rootTokens,
+      tokenHashes: args.tenantCredentials.rootTokenHashes
+    })).addService(
+      "apiKeyManager",
+      ({ apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator }) => new ApiKeyManager(apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator)
+    ).addService("signOutManager", ({ apiKeyManager, idpRegistry }) => new SignOutManager(apiKeyManager, idpRegistry)).addService("emailValidator", () => new EmailValidator()).addService("hibpChecker", () => new HttpHibpChecker()).addService("noopHibpChecker", () => new NoopHibpChecker()).addService("passwordStrengthValidator", ({ hibpChecker }) => new PasswordStrengthValidator(hibpChecker)).addService("captchaValidator", () => new CaptchaValidator({
+      turnstile: new TurnstileProvider(),
+      hcaptcha: new HCaptchaProvider(),
+      recaptchaV3: new RecaptchaV3Provider()
+    })).addService("rateLimiter", ({ providers }) => new RateLimiter(providers)).addService(
+      "signUpManager",
+      ({ emailValidator, passwordStrengthValidator }) => new SignUpManager(emailValidator, passwordStrengthValidator)
+    ).addService("passwordChangeManager", ({ providers, passwordStrengthValidator }) => new PasswordChangeManager(providers, passwordStrengthValidator)).addService("projectMemberManager", () => new ProjectMemberManager()).addService("identityFactory", ({ projectMemberManager }) => new IdentityFactory(projectMemberManager)).addService("projectScopeFactory", () => new ProjectScopeFactory(new AclSchemaAccessNodeFactory())).addService(
+      "permissionContextFactory",
+      ({ authorizator, identityFactory, projectScopeFactory, projectSchemaResolver }) => new PermissionContextFactory(authorizator, identityFactory, projectScopeFactory, projectSchemaResolver)
+    ).addService("secretManager", ({ providers }) => new SecretsManager(providers)).addService("projectManager", ({ secretManager, apiKeyService }) => new ProjectManager(secretManager, args.projectInitializer, apiKeyService)).addService("personAccessManager", ({ apiKeyManager }) => new PersonAccessManager(apiKeyManager)).addService("personManager", ({ emailValidator }) => new PersonManager(emailValidator)).addService(
+      "passwordResetManager",
+      ({ userMailer, projectManager, passwordStrengthValidator }) => new PasswordResetManager(userMailer, projectManager, passwordStrengthValidator)
+    ).addService(
+      "emailVerificationManager",
+      ({ userMailer, projectManager }) => new EmailVerificationManager(userMailer, projectManager)
+    ).addService(
+      "emailChangeManager",
+      ({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) => new EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory)
+    ).addService("idpSignInManager", ({ apiKeyManager, idpRegistry }) => new IDPSignInManager(apiKeyManager, idpRegistry)).addService("idpManager", ({ idpRegistry }) => new IDPManager(idpRegistry)).addService("personIdentityProviderManager", () => new PersonIdentityProviderManager()).addService("otpAuthenticator", ({ providers }) => new OtpAuthenticator(providers)).addService("otpManager", ({ otpAuthenticator, providers }) => new OtpManager(otpAuthenticator, providers)).addService("backupCodeManager", ({ providers, userMailer }) => new BackupCodeManager(userMailer, providers)).addService("emailOtpManager", ({ userMailer, providers, rateLimiter }) => new EmailOtpManager(userMailer, providers, rateLimiter)).addService("authPolicyManager", ({ projectManager }) => new AuthPolicyManager(projectManager)).addService(
+      "signInManager",
+      ({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) => new SignInManager(
+        apiKeyManager,
+        providers,
+        otpManager,
+        backupCodeManager,
+        emailOtpManager,
+        authPolicyResolver,
+        loginRiskAnalyzer,
+        userMailer
+      )
+    ).addService("membershipValidator", ({ projectSchemaResolver }) => new MembershipValidator(projectSchemaResolver)).addService("inviteManager", ({ providers, userMailer, projectSchemaResolver }) => new InviteManager(providers, userMailer, projectSchemaResolver)).addService("mailTemplateManager", () => new MailTemplateManager()).addService("rolesManager", () => new RolesManager()).addService("configurationManager", () => new ConfigurationManager()).addService(
       "passwordlessSignInManager",
-      ({ apiKeyManager, userMailer, projectManager, otpAuthenticator }) => new PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpAuthenticator)
+      ({ apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager }) => new PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager)
     ).addService(
       "identityTypeResolver",
       ({ projectMemberManager, projectManager, permissionContextFactory }) => new IdentityTypeResolver(projectMemberManager, projectManager, permissionContextFactory)
     ).addService(
       "projectTypeResolver",
-      ({ projectMemberManager, projectSchemaResolver }) => new ProjectTypeResolver(projectMemberManager, projectSchemaResolver)
-    ).addService(
+      ({ projectMemberManager, projectSchemaResolver, secretManager }) => new ProjectTypeResolver(projectMemberManager, projectSchemaResolver, secretManager)
+    ).addService("personTypeResolver", ({ personIdentityProviderManager }) => new PersonTypeResolver(personIdentityProviderManager)).addService(
       "signInResponseFactory",
       ({ permissionContextFactory, identityTypeResolver }) => new SignInResponseFactory(permissionContextFactory, identityTypeResolver)
-    ).addService("meQueryResolver", () => new MeQueryResolver()).addService("personQueryResolver", ({ personManager }) => new PersonQueryResolver(personManager)).addService("idpQueryResolver", ({ idpManager }) => new IDPQueryResolver(idpManager)).addService("projectQueryResolver", ({ projectManager }) => new ProjectQueryResolver(projectManager)).addService(
+    ).addService("meQueryResolver", () => new MeQueryResolver()).addService(
+      "personQueryResolver",
+      ({ personManager, projectManager, projectMemberManager }) => new PersonQueryResolver(personManager, projectManager, projectMemberManager)
+    ).addService("idpQueryResolver", ({ idpManager }) => new IDPQueryResolver(idpManager)).addService("projectQueryResolver", ({ projectManager }) => new ProjectQueryResolver(projectManager)).addService(
       "projectMembersQueryResolver",
       ({ projectManager, projectMemberManager }) => new ProjectMembersQueryResolver(projectManager, projectMemberManager)
-    ).addService("mailTemplateQueryResolver", () => new MailTemplateQueryResolver()).addService("signUpMutationResolver", ({ signUpManager, apiKeyManager }) => new SignUpMutationResolver(signUpManager, apiKeyManager)).addService(
+    ).addService("mailTemplateQueryResolver", () => new MailTemplateQueryResolver()).addService(
+      "signUpMutationResolver",
+      ({ signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory }) => new SignUpMutationResolver(signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory)
+    ).addService(
       "signInMutationResolver",
-      ({ signInManager, signInResponseFactory }) => new SignInMutationResolver(signInManager, signInResponseFactory)
-    ).addService("signOutMutationResolver", ({ apiKeyManager }) => new SignOutMutationResolver(apiKeyManager)).addService("changeProfileMutationResolver", ({ personManager }) => new ChangeProfileMutationResolver(personManager)).addService("changePasswordMutationResolver", ({ passwordChangeManager }) => new ChangePasswordMutationResolver(passwordChangeManager)).addService(
+      ({ signInManager, signInResponseFactory, rateLimiter }) => new SignInMutationResolver(signInManager, signInResponseFactory, rateLimiter)
+    ).addService("signOutMutationResolver", ({ signOutManager }) => new SignOutMutationResolver(signOutManager)).addService(
+      "changeProfileMutationResolver",
+      ({ personManager, emailChangeManager, permissionContextFactory }) => new ChangeProfileMutationResolver(personManager, emailChangeManager, permissionContextFactory)
+    ).addService(
+      "emailVerificationMutationResolver",
+      ({ emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter }) => new EmailVerificationMutationResolver(emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter)
+    ).addService("changePasswordMutationResolver", ({ passwordChangeManager }) => new ChangePasswordMutationResolver(passwordChangeManager)).addService(
       "resetPasswordMutationResolver",
-      ({ passwordResetManager, permissionContextFactory }) => new ResetPasswordMutationResolver(passwordResetManager, permissionContextFactory)
+      ({ passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter }) => new ResetPasswordMutationResolver(passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter)
     ).addService(
       "inviteMutationResolver",
       ({ inviteManager, projectManager, membershipValidator }) => new InviteMutationResolver(inviteManager, projectManager, membershipValidator)
@@ -155,27 +230,48 @@ class TenantContainerFactory {
     ).addService(
       "createApiKeyMutationResolver",
       ({ apiKeyManager, projectManager, membershipValidator }) => new CreateApiKeyMutationResolver(apiKeyManager, projectManager, membershipValidator)
-    ).addService("disableApiKeyMutationResolver", ({ apiKeyManager }) => new DisableApiKeyMutationResolver(apiKeyManager)).addService("otpMutationResolver", ({ otpManager }) => new OtpMutationResolver(otpManager)).addService(
+    ).addService("disableApiKeyMutationResolver", ({ apiKeyManager }) => new DisableApiKeyMutationResolver(apiKeyManager)).addService(
+      "otpMutationResolver",
+      ({ otpManager, backupCodeManager, authPolicyResolver }) => new OtpMutationResolver(otpManager, backupCodeManager, authPolicyResolver)
+    ).addService(
+      "emailOtpMutationResolver",
+      ({ emailOtpManager, backupCodeManager, authPolicyResolver }) => new EmailOtpMutationResolver(emailOtpManager, backupCodeManager, authPolicyResolver)
+    ).addService(
+      "regenerateBackupCodesMutationResolver",
+      ({ backupCodeManager }) => new RegenerateBackupCodesMutationResolver(backupCodeManager)
+    ).addService(
       "mailTemplateMutationResolver",
       ({ projectManager, mailTemplateManager }) => new MailTemplateMutationResolver(projectManager, mailTemplateManager)
     ).addService(
       "idpMutationResolver",
       ({ idpSignInManager, signInResponseFactory }) => new IDPMutationResolver(idpSignInManager, signInResponseFactory)
-    ).addService("registerIdpMutationResolver", ({ idpManager }) => new AddIDPMutationResolver(idpManager)).addService("updateIdpMutationResolver", ({ idpManager }) => new UpdateIDPMutationResolver(idpManager)).addService("disableIdpMutationResolver", ({ idpManager }) => new DisableIDPMutationResolver(idpManager)).addService("enableIdpMutationResolver", ({ idpManager }) => new EnableIDPMutationResolver(idpManager)).addService("createProjectMutationResolver", ({ projectManager }) => new CreateProjectMutationResolver(projectManager)).addService(
+    ).addService("registerIdpMutationResolver", ({ idpManager }) => new AddIDPMutationResolver(idpManager)).addService("updateIdpMutationResolver", ({ idpManager }) => new UpdateIDPMutationResolver(idpManager)).addService("disableIdpMutationResolver", ({ idpManager }) => new DisableIDPMutationResolver(idpManager)).addService("enableIdpMutationResolver", ({ idpManager }) => new EnableIDPMutationResolver(idpManager)).addService(
+      "disconnectMyIdentityProviderMutationResolver",
+      ({ personIdentityProviderManager }) => new DisconnectMyIdentityProviderMutationResolver(personIdentityProviderManager)
+    ).addService("createProjectMutationResolver", ({ projectManager }) => new CreateProjectMutationResolver(projectManager)).addService(
       "disablePersonMutationResolver",
       ({ personAccessManager, personManager }) => new DisablePersonMutationResolver(personAccessManager, personManager)
+    ).addService(
+      "forceSignOutMutationResolver",
+      ({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer)
+    ).addService(
+      "resetPersonMfaMutationResolver",
+      ({ personManager, backupCodeManager }) => new ResetPersonMfaMutationResolver(personManager, backupCodeManager)
+    ).addService(
+      "revokeSessionMutationResolver",
+      ({ apiKeyManager }) => new RevokeSessionMutationResolver(apiKeyManager)
     ).addService("updateProjectMutationResolver", ({ projectManager }) => new UpdateProjectMutationResolver(projectManager)).addService(
       "setProjectSecretMutationResolver",
       ({ projectManager, secretManager }) => new SetProjectSecretMutationResolver(projectManager, secretManager)
-    ).addService("identityGlobalRolesMutationResolver", ({ rolesManager }) => new IdentityGlobalRolesMutationResolver(rolesManager)).addService("configurationMutationResolver", ({ configurationManager }) => new ConfigurationMutationResolver(configurationManager)).addService("configurationQueryResolver", ({ configurationManager }) => new ConfigurationQueryResolver(configurationManager)).addService(
+    ).addService("identityGlobalRolesMutationResolver", ({ rolesManager }) => new IdentityGlobalRolesMutationResolver(rolesManager)).addService("configurationMutationResolver", ({ configurationManager }) => new ConfigurationMutationResolver(configurationManager)).addService("configurationQueryResolver", ({ configurationManager }) => new ConfigurationQueryResolver(configurationManager)).addService("authPolicyMutationResolver", ({ authPolicyManager }) => new AuthPolicyMutationResolver(authPolicyManager)).addService("authPolicyQueryResolver", ({ authPolicyManager }) => new AuthPolicyQueryResolver(authPolicyManager)).addService("authLogQueryResolver", () => new AuthLogQueryResolver()).addService("apiKeyQueryResolver", () => new ApiKeyQueryResolver()).addService(
       "passwordlessMutationResolver",
-      ({ passwordlessSignInManager, signInResponseFactory }) => new PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory)
+      ({ passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter }) => new PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter)
     ).addService(
       "togglePasswordlessMutationResolver",
       ({ configurationManager, personManager }) => new TogglePasswordlessMutationResolver(configurationManager, personManager)
-    ).addService("authLogService", () => new AuthLogService()).addService(
+    ).addService(
       "resolverContextFactory",
-      ({ permissionContextFactory, authLogService }) => new TenantResolverContextFactory(permissionContextFactory, authLogService)
+      ({ permissionContextFactory, authLogService, loginRiskAnalyzer }) => new TenantResolverContextFactory(permissionContextFactory, authLogService, loginRiskAnalyzer)
     ).addService("resolvers", (container) => new ResolverFactory(container).create()).addService("connection", () => args.connection).addService("readConnection", () => args.readConnection).addService(
       "databaseContext",
       ({ connection, providers }) => new DatabaseContext(connection.createClient("tenant", { module: "tenant" }), providers)

package/dist/development/src/TenantContainer.js.map

@@ -1 +1 @@
-{"version":3,"file":"TenantContainer.js","sources":["../../../../packages/engine-tenant-api/src/TenantContainer.ts"],"sourcesContent":["import { AccessEvaluator, Authorizator } from '@contember/authorization'\nimport { Connection, DatabaseConfig } from '@contember/database'\nimport { Builder } from '@contember/dic'\nimport {\n\tAclSchemaAccessNodeFactory,\n\tApiKeyManager,\n\tApiKeyService,\n\tAppleProvider,\n\tDatabaseContext,\n\tEmailValidator,\n\tFacebookProvider,\n\tIdentity,\n\tIdentityFactory,\n\tIDPHandlerRegistry,\n\tIDPManager,\n\tIDPSignInManager,\n\tInviteManager,\n\tMailTemplateManager,\n\tMembershipValidator,\n\tOIDCProvider,\n\tOtpAuthenticator,\n\tOtpManager,\n\tPasswordChangeManager,\n\tPasswordResetManager,\n\tPermissionContextFactory,\n\tPermissionsFactory,\n\tPersonAccessManager,\n\tPersonManager,\n\tProjectInitializer,\n\tProjectManager,\n\tProjectMemberManager,\n\tProjectSchemaResolver,\n\tProjectScopeFactory,\n\tProviders,\n\tRolesManager,\n\tSecretsManager,\n\tSignInManager,\n\tSignUpManager,\n\tUserMailer,\n} from './model'\nimport {\n\tAddIDPMutationResolver,\n\tAddProjectMemberMutationResolver,\n\tChangePasswordMutationResolver,\n\tChangeProfileMutationResolver,\n\tCreateApiKeyMutationResolver,\n\tCreateProjectMutationResolver,\n\tDisableApiKeyMutationResolver,\n\tDisableIDPMutationResolver,\n\tEnableIDPMutationResolver,\n\tIdentityGlobalRolesMutationResolver,\n\tIdentityTypeResolver,\n\tIDPMutationResolver,\n\tInviteMutationResolver,\n\tMailTemplateMutationResolver,\n\tMeQueryResolver,\n\tOtpMutationResolver,\n\tPersonQueryResolver,\n\tProjectMembersQueryResolver,\n\tProjectQueryResolver,\n\tProjectTypeResolver,\n\tRemoveProjectMemberMutationResolver,\n\tResetPasswordMutationResolver,\n\tResolverFactory,\n\tSetProjectSecretMutationResolver,\n\tSignInMutationResolver,\n\tSignOutMutationResolver,\n\tSignUpMutationResolver,\n\tTenantResolverContextFactory,\n\tUpdateProjectMemberMutationResolver,\n\tUpdateProjectMutationResolver,\n} from './resolvers'\nimport * as Schema from './schema'\nimport { createMailer, MailerOptions, TemplateRenderer } from './utils'\nimport { IdentityFetcher } from './bridges/system/IdentityFetcher'\nimport { SignInResponseFactory } from './resolvers/responseHelpers/SignInResponseFactory'\nimport { IDPQueryResolver } from './resolvers/query/IDPQueryResolver'\nimport { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver'\nimport { TenantCredentials, TenantMigrationsRunner } from './migrations'\nimport { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver'\nimport { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver'\nimport { ConfigurationManager } from './model/service/ConfigurationManager'\nimport { ConfigurationMutationResolver } from './resolvers/mutation/configuration/ConfigurationMutationResolver'\nimport { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQueryResolver'\nimport { PasswordlessMutationResolver } from './resolvers/mutation/person/PasswordlessMutationResolver'\nimport { PasswordlessSignInManager } from './model/service/PasswordlessSignInManager'\nimport { TogglePasswordlessMutationResolver } from './resolvers/mutation/person/TogglePasswordlessMutationResolver'\nimport { PasswordStrengthValidator } from './model/service/PasswordStrengthValidator'\nimport { AuthLogService } from './model/service/AuthLogService'\n\nexport interface TenantContainer {\n\tprojectMemberManager: ProjectMemberManager\n\tapiKeyManager: ApiKeyManager\n\tsignUpManager: SignUpManager\n\tprojectManager: ProjectManager\n\tresolvers: Schema.Resolvers\n\tresolverContextFactory: TenantResolverContextFactory\n\tauthorizator: Authorizator<Identity>\n\tidentityFetcher: IdentityFetcher\n\tdatabaseContext: DatabaseContext\n\treadDatabaseContext: DatabaseContext\n\tmigrationsRunner: TenantMigrationsRunner\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n}\n\nexport interface TenantContainerArgs {\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n\tdbCredentials: DatabaseConfig\n\tmailOptions: MailerOptions\n\tprojectSchemaResolver: ProjectSchemaResolver\n\tprojectInitializer: ProjectInitializer\n\ttenantCredentials: TenantCredentials\n\tcryptoProviders: Pick<Providers, 'encrypt' | 'decrypt'>\n}\n\nexport class TenantContainerFactory {\n\tconstructor(\n\t\tprivate readonly providers: Omit<Providers, 'encrypt' | 'decrypt'>,\n\t) {}\n\n\tcreate(args: TenantContainerArgs): TenantContainer {\n\t\treturn this.createBuilder(args)\n\t\t\t.build()\n\t\t\t.pick(\n\t\t\t\t'apiKeyManager',\n\t\t\t\t'projectMemberManager',\n\t\t\t\t'projectManager',\n\t\t\t\t'signUpManager',\n\t\t\t\t'resolvers',\n\t\t\t\t'authorizator',\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t'identityFetcher',\n\t\t\t\t'databaseContext',\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t'migrationsRunner',\n\t\t\t\t'connection',\n\t\t\t\t'readConnection',\n\t\t\t)\n\t}\n\n\tcreateBuilder(args: TenantContainerArgs) {\n\t\treturn new Builder({})\n\t\t\t.addService('providers', () => ({ ...this.providers, ...args.cryptoProviders }))\n\t\t\t.addService('mailer', () => createMailer(args.mailOptions))\n\t\t\t.addService('projectSchemaResolver', () => args.projectSchemaResolver)\n\t\t\t.addService('templateRenderer', () => new TemplateRenderer())\n\t\t\t.addService('accessEvaluator', ({}) => new AccessEvaluator.PermissionEvaluator(new PermissionsFactory().create()))\n\t\t\t.addService('authorizator', ({ accessEvaluator }) => new Authorizator.Default(accessEvaluator))\n\t\t\t.addService('userMailer', ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer))\n\t\t\t.addService('apiKeyService', () => new ApiKeyService())\n\t\t\t.addService('apiKeyManager', ({ apiKeyService }) => new ApiKeyManager(apiKeyService))\n\t\t\t.addService('emailValidator', () => new EmailValidator())\n\t\t\t.addService('passwordStrengthValidator', () => new PasswordStrengthValidator())\n\t\t\t.addService('signUpManager', ({ emailValidator, passwordStrengthValidator }) => new SignUpManager(emailValidator, passwordStrengthValidator))\n\t\t\t.addService('passwordChangeManager', ({ providers, passwordStrengthValidator }) => new PasswordChangeManager(providers, passwordStrengthValidator))\n\t\t\t.addService('projectMemberManager', () => new ProjectMemberManager())\n\t\t\t.addService('identityFactory', ({ projectMemberManager }) => new IdentityFactory(projectMemberManager))\n\t\t\t.addService('projectScopeFactory', () => new ProjectScopeFactory(new AclSchemaAccessNodeFactory()))\n\t\t\t.addService(\n\t\t\t\t'permissionContextFactory',\n\t\t\t\t({ authorizator, identityFactory, projectScopeFactory, projectSchemaResolver }) =>\n\t\t\t\t\tnew PermissionContextFactory(authorizator, identityFactory, projectScopeFactory, projectSchemaResolver),\n\t\t\t)\n\t\t\t.addService('secretManager', ({ providers }) => new SecretsManager(providers))\n\t\t\t.addService('projectManager', ({ secretManager, apiKeyService }) => new ProjectManager(secretManager, args.projectInitializer, apiKeyService))\n\t\t\t.addService('personAccessManager', ({ apiKeyManager }) => new PersonAccessManager(apiKeyManager))\n\t\t\t.addService('personManager', ({ emailValidator }) => new PersonManager(emailValidator))\n\t\t\t.addService(\n\t\t\t\t'passwordResetManager',\n\t\t\t\t({ userMailer, projectManager, passwordStrengthValidator }) => new PasswordResetManager(userMailer, projectManager, passwordStrengthValidator),\n\t\t\t)\n\t\t\t.addService('idpRegistry', () => {\n\t\t\t\tconst idpRegistry = new IDPHandlerRegistry()\n\t\t\t\tidpRegistry.registerHandler('oidc', new OIDCProvider())\n\t\t\t\tidpRegistry.registerHandler('facebook', new FacebookProvider())\n\t\t\t\tidpRegistry.registerHandler('apple', new AppleProvider())\n\t\t\t\treturn idpRegistry\n\t\t\t})\n\t\t\t.addService('idpSignInManager', ({ apiKeyManager, idpRegistry }) => new IDPSignInManager(apiKeyManager, idpRegistry))\n\t\t\t.addService('idpManager', ({ idpRegistry }) => new IDPManager(idpRegistry))\n\t\t\t.addService('otpAuthenticator', ({ providers }) => new OtpAuthenticator(providers))\n\t\t\t.addService('signInManager', ({ apiKeyManager, providers, otpAuthenticator }) => new SignInManager(apiKeyManager, providers, otpAuthenticator))\n\t\t\t.addService('membershipValidator', ({ projectSchemaResolver }) => new MembershipValidator(projectSchemaResolver))\n\t\t\t.addService('inviteManager', ({ providers, userMailer, projectSchemaResolver }) => new InviteManager(providers, userMailer, projectSchemaResolver))\n\t\t\t.addService('otpManager', ({ otpAuthenticator }) => new OtpManager(otpAuthenticator))\n\t\t\t.addService('mailTemplateManager', () => new MailTemplateManager())\n\t\t\t.addService('rolesManager', () => new RolesManager())\n\t\t\t.addService('configurationManager', () => new ConfigurationManager())\n\t\t\t.addService(\n\t\t\t\t'passwordlessSignInManager',\n\t\t\t\t({ apiKeyManager, userMailer, projectManager, otpAuthenticator }) =>\n\t\t\t\t\tnew PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpAuthenticator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'identityTypeResolver',\n\t\t\t\t({ projectMemberManager, projectManager, permissionContextFactory }) =>\n\t\t\t\t\tnew IdentityTypeResolver(projectMemberManager, projectManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'projectTypeResolver',\n\t\t\t\t({ projectMemberManager, projectSchemaResolver }) => new ProjectTypeResolver(projectMemberManager, projectSchemaResolver),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'signInResponseFactory',\n\t\t\t\t({ permissionContextFactory, identityTypeResolver }) => new SignInResponseFactory(permissionContextFactory, identityTypeResolver),\n\t\t\t)\n\t\t\t.addService('meQueryResolver', () => new MeQueryResolver())\n\t\t\t.addService('personQueryResolver', ({ personManager }) => new PersonQueryResolver(personManager))\n\t\t\t.addService('idpQueryResolver', ({ idpManager }) => new IDPQueryResolver(idpManager))\n\t\t\t.addService('projectQueryResolver', ({ projectManager }) => new ProjectQueryResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'projectMembersQueryResolver',\n\t\t\t\t({ projectManager, projectMemberManager }) => new ProjectMembersQueryResolver(projectManager, projectMemberManager),\n\t\t\t)\n\t\t\t.addService('mailTemplateQueryResolver', () => new MailTemplateQueryResolver())\n\t\t\t.addService('signUpMutationResolver', ({ signUpManager, apiKeyManager }) => new SignUpMutationResolver(signUpManager, apiKeyManager))\n\t\t\t.addService(\n\t\t\t\t'signInMutationResolver',\n\t\t\t\t({ signInManager, signInResponseFactory }) => new SignInMutationResolver(signInManager, signInResponseFactory),\n\t\t\t)\n\t\t\t.addService('signOutMutationResolver', ({ apiKeyManager }) => new SignOutMutationResolver(apiKeyManager))\n\t\t\t.addService('changeProfileMutationResolver', ({ personManager }) => new ChangeProfileMutationResolver(personManager))\n\t\t\t.addService('changePasswordMutationResolver', ({ passwordChangeManager }) => new ChangePasswordMutationResolver(passwordChangeManager))\n\t\t\t.addService(\n\t\t\t\t'resetPasswordMutationResolver',\n\t\t\t\t({ passwordResetManager, permissionContextFactory }) => new ResetPasswordMutationResolver(passwordResetManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'inviteMutationResolver',\n\t\t\t\t({ inviteManager, projectManager, membershipValidator }) => new InviteMutationResolver(inviteManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'addProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew AddProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'updateProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew UpdateProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'removeProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager }) => new RemoveProjectMemberMutationResolver(projectMemberManager, projectManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'createApiKeyMutationResolver',\n\t\t\t\t({ apiKeyManager, projectManager, membershipValidator }) => new CreateApiKeyMutationResolver(apiKeyManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService('disableApiKeyMutationResolver', ({ apiKeyManager }) => new DisableApiKeyMutationResolver(apiKeyManager))\n\t\t\t.addService('otpMutationResolver', ({ otpManager }) => new OtpMutationResolver(otpManager))\n\t\t\t.addService(\n\t\t\t\t'mailTemplateMutationResolver',\n\t\t\t\t({ projectManager, mailTemplateManager }) => new MailTemplateMutationResolver(projectManager, mailTemplateManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'idpMutationResolver',\n\t\t\t\t({ idpSignInManager, signInResponseFactory }) => new IDPMutationResolver(idpSignInManager, signInResponseFactory),\n\t\t\t)\n\t\t\t.addService('registerIdpMutationResolver', ({ idpManager }) => new AddIDPMutationResolver(idpManager))\n\t\t\t.addService('updateIdpMutationResolver', ({ idpManager }) => new UpdateIDPMutationResolver(idpManager))\n\t\t\t.addService('disableIdpMutationResolver', ({ idpManager }) => new DisableIDPMutationResolver(idpManager))\n\t\t\t.addService('enableIdpMutationResolver', ({ idpManager }) => new EnableIDPMutationResolver(idpManager))\n\t\t\t.addService('createProjectMutationResolver', ({ projectManager }) => new CreateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'disablePersonMutationResolver',\n\t\t\t\t({ personAccessManager, personManager }) => new DisablePersonMutationResolver(personAccessManager, personManager),\n\t\t\t)\n\t\t\t.addService('updateProjectMutationResolver', ({ projectManager }) => new UpdateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'setProjectSecretMutationResolver',\n\t\t\t\t({ projectManager, secretManager }) => new SetProjectSecretMutationResolver(projectManager, secretManager),\n\t\t\t)\n\t\t\t.addService('identityGlobalRolesMutationResolver', ({ rolesManager }) => new IdentityGlobalRolesMutationResolver(rolesManager))\n\t\t\t.addService('configurationMutationResolver', ({ configurationManager }) => new ConfigurationMutationResolver(configurationManager))\n\t\t\t.addService('configurationQueryResolver', ({ configurationManager }) => new ConfigurationQueryResolver(configurationManager))\n\t\t\t.addService(\n\t\t\t\t'passwordlessMutationResolver',\n\t\t\t\t({ passwordlessSignInManager, signInResponseFactory }) => new PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'togglePasswordlessMutationResolver',\n\t\t\t\t({ configurationManager, personManager }) => new TogglePasswordlessMutationResolver(configurationManager, personManager),\n\t\t\t)\n\t\t\t.addService('authLogService', () => new AuthLogService())\n\t\t\t.addService(\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t({ permissionContextFactory, authLogService }) => new TenantResolverContextFactory(permissionContextFactory, authLogService),\n\t\t\t)\n\t\t\t.addService('resolvers', container => new ResolverFactory(container).create())\n\t\t\t.addService('connection', () => args.connection)\n\t\t\t.addService('readConnection', () => args.readConnection)\n\t\t\t.addService(\n\t\t\t\t'databaseContext',\n\t\t\t\t({ connection, providers }) => new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t({ readConnection, providers }) => new DatabaseContext(readConnection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService('identityFetcher', ({ databaseContext }) => new IdentityFetcher(databaseContext.client))\n\t\t\t.addService('migrationsRunner', ({ providers }) => new TenantMigrationsRunner(args.dbCredentials, 'tenant', args.tenantCredentials, providers))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqHO,MAAM,uBAAuB;AAAA,EACnC,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,OAAO,MAA4C;AAClD,WAAO,KAAK,cAAc,IAAI,EAC5B,QACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEA,cAAc,MAA2B;AACxC,WAAO,IAAI,QAAQ,CAAA,CAAE,EACnB,WAAW,aAAa,OAAO,EAAE,GAAG,KAAK,WAAW,GAAG,KAAK,gBAAA,EAAkB,EAC9E,WAAW,UAAU,MAAM,aAAa,KAAK,WAAW,CAAC,EACzD,WAAW,yBAAyB,MAAM,KAAK,qBAAqB,EACpE,WAAW,oBAAoB,MAAM,IAAI,iBAAA,CAAkB,EAC3D,WAAW,mBAAmB,CAAC,CAAA,MAAO,IAAI,gBAAgB,oBAAoB,IAAI,mBAAA,EAAqB,OAAA,CAAQ,CAAC,EAChH,WAAW,gBAAgB,CAAC,EAAE,sBAAsB,IAAI,aAAa,QAAQ,eAAe,CAAC,EAC7F,WAAW,cAAc,CAAC,EAAE,QAAQ,iBAAA,MAAuB,IAAI,WAAW,QAAQ,gBAAgB,CAAC,EACnG,WAAW,iBAAiB,MAAM,IAAI,cAAA,CAAe,EACrD,WAAW,iBAAiB,CAAC,EAAE,cAAA,MAAoB,IAAI,cAAc,aAAa,CAAC,EACnF,WAAW,kBAAkB,MAAM,IAAI,eAAA,CAAgB,EACvD,WAAW,6BAA6B,MAAM,IAAI,0BAAA,CAA2B,EAC7E,WAAW,iBAAiB,CAAC,EAAE,gBAAgB,0BAAA,MAAgC,IAAI,cAAc,gBAAgB,yBAAyB,CAAC,EAC3I,WAAW,yBAAyB,CAAC,EAAE,WAAW,0BAAA,MAAgC,IAAI,sBAAsB,WAAW,yBAAyB,CAAC,EACjJ,WAAW,wBAAwB,MAAM,IAAI,qBAAA,CAAsB,EACnE,WAAW,mBAAmB,CAAC,EAAE,qBAAA,MAA2B,IAAI,gBAAgB,oBAAoB,CAAC,EACrG,WAAW,uBAAuB,MAAM,IAAI,oBAAoB,IAAI,2BAAA,CAA4B,CAAC,EACjG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,cAAc,iBAAiB,qBAAqB,sBAAA,MACtD,IAAI,yBAAyB,cAAc,iBAAiB,qBAAqB,qBAAqB;AAAA,IAAA,EAEvG,WAAW,iBAAiB,CAAC,EAAE,UAAA,MAAgB,IAAI,eAAe,SAAS,CAAC,EAC5E,WAAW,kBAAkB,CAAC,EAAE,eAAe,oBAAoB,IAAI,eAAe,eAAe,KAAK,oBAAoB,aAAa,CAAC,EAC5I,WAAW,uBAAuB,CAAC,EAAE,cAAA,MAAoB,IAAI,oBAAoB,aAAa,CAAC,EAC/F,WAAW,iBAAiB,CAAC,EAAE,eAAA,MAAqB,IAAI,cAAc,cAAc,CAAC,EACrF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,gBAAgB,0BAAA,MAAgC,IAAI,qBAAqB,YAAY,gBAAgB,yBAAyB;AAAA,IAAA,EAE7I,WAAW,eAAe,MAAM;AAChC,YAAM,cAAc,IAAI,mBAAA;AACxB,kBAAY,gBAAgB,QAAQ,IAAI,aAAA,CAAc;AACtD,kBAAY,gBAAgB,YAAY,IAAI,iBAAA,CAAkB;AAC9D,kBAAY,gBAAgB,SAAS,IAAI,cAAA,CAAe;AACxD,aAAO;AAAA,IACR,CAAC,EACA,WAAW,oBAAoB,CAAC,EAAE,eAAe,YAAA,MAAkB,IAAI,iBAAiB,eAAe,WAAW,CAAC,EACnH,WAAW,cAAc,CAAC,EAAE,kBAAkB,IAAI,WAAW,WAAW,CAAC,EACzE,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAI,iBAAiB,SAAS,CAAC,EACjF,WAAW,iBAAiB,CAAC,EAAE,eAAe,WAAW,iBAAA,MAAuB,IAAI,cAAc,eAAe,WAAW,gBAAgB,CAAC,EAC7I,WAAW,uBAAuB,CAAC,EAAE,sBAAA,MAA4B,IAAI,oBAAoB,qBAAqB,CAAC,EAC/G,WAAW,iBAAiB,CAAC,EAAE,WAAW,YAAY,sBAAA,MAA4B,IAAI,cAAc,WAAW,YAAY,qBAAqB,CAAC,EACjJ,WAAW,cAAc,CAAC,EAAE,uBAAuB,IAAI,WAAW,gBAAgB,CAAC,EACnF,WAAW,uBAAuB,MAAM,IAAI,qBAAqB,EACjE,WAAW,gBAAgB,MAAM,IAAI,aAAA,CAAc,EACnD,WAAW,wBAAwB,MAAM,IAAI,qBAAA,CAAsB,EACnE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,YAAY,gBAAgB,iBAAA,MAC7C,IAAI,0BAA0B,eAAe,YAAY,gBAAgB,gBAAgB;AAAA,IAAA,EAE1F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,yBAAA,MACxC,IAAI,qBAAqB,sBAAsB,gBAAgB,wBAAwB;AAAA,IAAA,EAExF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,sBAAA,MAA4B,IAAI,oBAAoB,sBAAsB,qBAAqB;AAAA,IAAA,EAExH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,qBAAA,MAA2B,IAAI,sBAAsB,0BAA0B,oBAAoB;AAAA,IAAA,EAEhI,WAAW,mBAAmB,MAAM,IAAI,gBAAA,CAAiB,EACzD,WAAW,uBAAuB,CAAC,EAAE,cAAA,MAAoB,IAAI,oBAAoB,aAAa,CAAC,EAC/F,WAAW,oBAAoB,CAAC,EAAE,WAAA,MAAiB,IAAI,iBAAiB,UAAU,CAAC,EACnF,WAAW,wBAAwB,CAAC,EAAE,eAAA,MAAqB,IAAI,qBAAqB,cAAc,CAAC,EACnG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,qBAAA,MAA2B,IAAI,4BAA4B,gBAAgB,oBAAoB;AAAA,IAAA,EAElH,WAAW,6BAA6B,MAAM,IAAI,0BAAA,CAA2B,EAC7E,WAAW,0BAA0B,CAAC,EAAE,eAAe,oBAAoB,IAAI,uBAAuB,eAAe,aAAa,CAAC,EACnI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,sBAAA,MAA4B,IAAI,uBAAuB,eAAe,qBAAqB;AAAA,IAAA,EAE7G,WAAW,2BAA2B,CAAC,EAAE,cAAA,MAAoB,IAAI,wBAAwB,aAAa,CAAC,EACvG,WAAW,iCAAiC,CAAC,EAAE,oBAAoB,IAAI,8BAA8B,aAAa,CAAC,EACnH,WAAW,kCAAkC,CAAC,EAAE,4BAA4B,IAAI,+BAA+B,qBAAqB,CAAC,EACrI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,yBAAA,MAA+B,IAAI,8BAA8B,sBAAsB,wBAAwB;AAAA,IAAA,EAExI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAI,uBAAuB,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAEzI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAI,iCAAiC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAE/F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAI,oCAAoC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAElG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,eAAA,MAAqB,IAAI,oCAAoC,sBAAsB,cAAc;AAAA,IAAA,EAE1H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAI,6BAA6B,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAE/I,WAAW,iCAAiC,CAAC,EAAE,cAAA,MAAoB,IAAI,8BAA8B,aAAa,CAAC,EACnH,WAAW,uBAAuB,CAAC,EAAE,WAAA,MAAiB,IAAI,oBAAoB,UAAU,CAAC,EACzF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,oBAAA,MAA0B,IAAI,6BAA6B,gBAAgB,mBAAmB;AAAA,IAAA,EAEjH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,kBAAkB,sBAAA,MAA4B,IAAI,oBAAoB,kBAAkB,qBAAqB;AAAA,IAAA,EAEhH,WAAW,+BAA+B,CAAC,EAAE,iBAAiB,IAAI,uBAAuB,UAAU,CAAC,EACpG,WAAW,6BAA6B,CAAC,EAAE,WAAA,MAAiB,IAAI,0BAA0B,UAAU,CAAC,EACrG,WAAW,8BAA8B,CAAC,EAAE,iBAAiB,IAAI,2BAA2B,UAAU,CAAC,EACvG,WAAW,6BAA6B,CAAC,EAAE,WAAA,MAAiB,IAAI,0BAA0B,UAAU,CAAC,EACrG,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAI,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,qBAAqB,cAAA,MAAoB,IAAI,8BAA8B,qBAAqB,aAAa;AAAA,IAAA,EAEhH,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAI,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,cAAA,MAAoB,IAAI,iCAAiC,gBAAgB,aAAa;AAAA,IAAA,EAEzG,WAAW,uCAAuC,CAAC,EAAE,aAAA,MAAmB,IAAI,oCAAoC,YAAY,CAAC,EAC7H,WAAW,iCAAiC,CAAC,EAAE,2BAA2B,IAAI,8BAA8B,oBAAoB,CAAC,EACjI,WAAW,8BAA8B,CAAC,EAAE,2BAA2B,IAAI,2BAA2B,oBAAoB,CAAC,EAC3H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,2BAA2B,sBAAA,MAA4B,IAAI,6BAA6B,2BAA2B,qBAAqB;AAAA,IAAA,EAE3I;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,cAAA,MAAoB,IAAI,mCAAmC,sBAAsB,aAAa;AAAA,IAAA,EAEvH,WAAW,kBAAkB,MAAM,IAAI,eAAA,CAAgB,EACvD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,eAAA,MAAqB,IAAI,6BAA6B,0BAA0B,cAAc;AAAA,IAAA,EAE3H,WAAW,aAAa,CAAA,cAAa,IAAI,gBAAgB,SAAS,EAAE,OAAA,CAAQ,EAC5E,WAAW,cAAc,MAAM,KAAK,UAAU,EAC9C,WAAW,kBAAkB,MAAM,KAAK,cAAc,EACtD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,UAAA,MAAgB,IAAI,gBAAgB,WAAW,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAErH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,UAAA,MAAgB,IAAI,gBAAgB,eAAe,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAE7H,WAAW,mBAAmB,CAAC,EAAE,gBAAA,MAAsB,IAAI,gBAAgB,gBAAgB,MAAM,CAAC,EAClG,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAI,uBAAuB,KAAK,eAAe,UAAU,KAAK,mBAAmB,SAAS,CAAC;AAAA,EAChJ;AACD;"}
+{"version":3,"file":"TenantContainer.js","sources":["../../../../packages/engine-tenant-api/src/TenantContainer.ts"],"sourcesContent":["import { AccessEvaluator, Authorizator } from '@contember/authorization'\nimport { Connection, DatabaseConfig } from '@contember/database'\nimport { Builder } from '@contember/dic'\nimport {\n\tAclSchemaAccessNodeFactory,\n\tApiKeyManager,\n\tApiKeyService,\n\tAppleProvider,\n\tAuthPolicyManager,\n\tAuthPolicyResolver,\n\tBackchannelLogoutManager,\n\tBackupCodeManager,\n\tCaptchaValidator,\n\tDatabaseContext,\n\tEmailChangeManager,\n\tEmailOtpManager,\n\tEmailValidator,\n\tEmailVerificationManager,\n\tFacebookProvider,\n\tHCaptchaProvider,\n\tIdentity,\n\tIdentityFactory,\n\tIDPHandlerRegistry,\n\tIDPManager,\n\tIdpSessionRevalidator,\n\tIDPSignInManager,\n\tInviteManager,\n\tLoginRiskAnalyzer,\n\tMailTemplateManager,\n\tMembershipValidator,\n\tOIDCProvider,\n\tOtpAuthenticator,\n\tOtpManager,\n\tPasswordChangeManager,\n\tPasswordResetManager,\n\tPermissionContextFactory,\n\tPermissionsFactory,\n\tPersonAccessManager,\n\tPersonIdentityProviderManager,\n\tPersonManager,\n\tProjectInitializer,\n\tProjectManager,\n\tProjectMemberManager,\n\tProjectSchemaResolver,\n\tProjectScopeFactory,\n\tProviders,\n\tRateLimiter,\n\tRecaptchaV3Provider,\n\tRolesManager,\n\tSecretsManager,\n\tSignInManager,\n\tSignOutManager,\n\tSignUpManager,\n\tTurnstileProvider,\n\tUnpersistedApiKeyManager,\n\tUserMailer,\n} from './model/index.js'\nimport { HibpChecker, HttpHibpChecker, NoopHibpChecker } from './model/service/HibpChecker.js'\nimport {\n\tAddIDPMutationResolver,\n\tAddProjectMemberMutationResolver,\n\tChangePasswordMutationResolver,\n\tChangeProfileMutationResolver,\n\tCreateApiKeyMutationResolver,\n\tCreateProjectMutationResolver,\n\tDisableApiKeyMutationResolver,\n\tDisableIDPMutationResolver,\n\tDisconnectMyIdentityProviderMutationResolver,\n\tEmailOtpMutationResolver,\n\tEmailVerificationMutationResolver,\n\tEnableIDPMutationResolver,\n\tIdentityGlobalRolesMutationResolver,\n\tIdentityTypeResolver,\n\tIDPMutationResolver,\n\tInviteMutationResolver,\n\tMailTemplateMutationResolver,\n\tMeQueryResolver,\n\tOtpMutationResolver,\n\tPersonQueryResolver,\n\tPersonTypeResolver,\n\tProjectMembersQueryResolver,\n\tProjectQueryResolver,\n\tProjectTypeResolver,\n\tRegenerateBackupCodesMutationResolver,\n\tRemoveProjectMemberMutationResolver,\n\tResetPasswordMutationResolver,\n\tResolverFactory,\n\tSetProjectSecretMutationResolver,\n\tSignInMutationResolver,\n\tSignOutMutationResolver,\n\tSignUpMutationResolver,\n\tTenantResolverContextFactory,\n\tUpdateProjectMemberMutationResolver,\n\tUpdateProjectMutationResolver,\n} from './resolvers/index.js'\nimport * as Schema from './schema/index.js'\nimport { createMailer, MailerOptions, TemplateRenderer } from './utils/index.js'\nimport { IdentityFetcher } from './bridges/system/IdentityFetcher.js'\nimport { SignInResponseFactory } from './resolvers/responseHelpers/SignInResponseFactory.js'\nimport { IDPQueryResolver } from './resolvers/query/IDPQueryResolver.js'\nimport { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver.js'\nimport { TenantCredentials, TenantMigrationsRunner } from './migrations/index.js'\nimport { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver.js'\nimport { ForceSignOutMutationResolver } from './resolvers/mutation/person/ForceSignOutMutationResolver.js'\nimport { RevokeSessionMutationResolver } from './resolvers/mutation/person/RevokeSessionMutationResolver.js'\nimport { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver.js'\nimport { ConfigurationManager } from './model/service/ConfigurationManager.js'\nimport { ConfigurationMutationResolver } from './resolvers/mutation/configuration/ConfigurationMutationResolver.js'\nimport { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQueryResolver.js'\nimport { AuthPolicyMutationResolver } from './resolvers/mutation/configuration/AuthPolicyMutationResolver.js'\nimport { AuthPolicyQueryResolver } from './resolvers/query/AuthPolicyQueryResolver.js'\nimport { ResetPersonMfaMutationResolver } from './resolvers/mutation/person/ResetPersonMfaMutationResolver.js'\nimport { AuthLogQueryResolver } from './resolvers/query/AuthLogQueryResolver.js'\nimport { ApiKeyQueryResolver } from './resolvers/query/ApiKeyQueryResolver.js'\nimport { PasswordlessMutationResolver } from './resolvers/mutation/person/PasswordlessMutationResolver.js'\nimport { PasswordlessSignInManager } from './model/service/PasswordlessSignInManager.js'\nimport { TogglePasswordlessMutationResolver } from './resolvers/mutation/person/TogglePasswordlessMutationResolver.js'\nimport { PasswordStrengthValidator } from './model/service/PasswordStrengthValidator.js'\nimport { AuthLogService } from './model/service/AuthLogService.js'\n\nexport interface TenantContainer {\n\tprojectMemberManager: ProjectMemberManager\n\tapiKeyManager: ApiKeyManager\n\tbackchannelLogoutManager: BackchannelLogoutManager\n\tsignUpManager: SignUpManager\n\tprojectManager: ProjectManager\n\tresolvers: Schema.Resolvers\n\tresolverContextFactory: TenantResolverContextFactory\n\tauthorizator: Authorizator<Identity>\n\tidentityFetcher: IdentityFetcher\n\tdatabaseContext: DatabaseContext\n\treadDatabaseContext: DatabaseContext\n\tmigrationsRunner: TenantMigrationsRunner\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n}\n\nexport interface TenantContainerArgs {\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n\tdbCredentials: DatabaseConfig\n\tmailOptions: MailerOptions\n\tprojectSchemaResolver: ProjectSchemaResolver\n\tprojectInitializer: ProjectInitializer\n\ttenantCredentials: TenantCredentials\n\tcryptoProviders: Pick<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>\n}\n\nexport class TenantContainerFactory {\n\tconstructor(\n\t\tprivate readonly providers: Omit<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>,\n\t) {}\n\n\tcreate(args: TenantContainerArgs): TenantContainer {\n\t\treturn this.createBuilder(args)\n\t\t\t.build()\n\t\t\t.pick(\n\t\t\t\t'apiKeyManager',\n\t\t\t\t'backchannelLogoutManager',\n\t\t\t\t'projectMemberManager',\n\t\t\t\t'projectManager',\n\t\t\t\t'signUpManager',\n\t\t\t\t'resolvers',\n\t\t\t\t'authorizator',\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t'identityFetcher',\n\t\t\t\t'databaseContext',\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t'migrationsRunner',\n\t\t\t\t'connection',\n\t\t\t\t'readConnection',\n\t\t\t)\n\t}\n\n\tcreateBuilder(args: TenantContainerArgs) {\n\t\treturn new Builder({})\n\t\t\t.addService('providers', () => ({ ...this.providers, ...args.cryptoProviders }))\n\t\t\t.addService('mailer', () => createMailer(args.mailOptions))\n\t\t\t.addService('projectSchemaResolver', () => args.projectSchemaResolver)\n\t\t\t.addService('templateRenderer', () => new TemplateRenderer())\n\t\t\t.addService('accessEvaluator', ({}) => new AccessEvaluator.PermissionEvaluator(new PermissionsFactory().create()))\n\t\t\t.addService('authorizator', ({ accessEvaluator }) => new Authorizator.Default(accessEvaluator))\n\t\t\t.addService('userMailer', ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer))\n\t\t\t.addService('apiKeyService', () => new ApiKeyService())\n\t\t\t.addService('authPolicyResolver', () => new AuthPolicyResolver())\n\t\t\t.addService('authLogService', () => new AuthLogService())\n\t\t\t.addService('loginRiskAnalyzer', ({ providers }) => new LoginRiskAnalyzer(providers.hash))\n\t\t\t.addService('idpRegistry', () => {\n\t\t\t\tconst idpRegistry = new IDPHandlerRegistry()\n\t\t\t\tidpRegistry.registerHandler('oidc', new OIDCProvider())\n\t\t\t\tidpRegistry.registerHandler('facebook', new FacebookProvider())\n\t\t\t\tidpRegistry.registerHandler('apple', new AppleProvider())\n\t\t\t\treturn idpRegistry\n\t\t\t})\n\t\t\t.addService('idpSessionRevalidator', ({ idpRegistry }) => new IdpSessionRevalidator(idpRegistry))\n\t\t\t.addService('backchannelLogoutManager', ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry))\n\t\t\t.addService('unpersistedApiKeyManager', () =>\n\t\t\t\tUnpersistedApiKeyManager.createForRootTokens({\n\t\t\t\t\ttokens: args.tenantCredentials.rootTokens,\n\t\t\t\t\ttokenHashes: args.tenantCredentials.rootTokenHashes,\n\t\t\t\t}))\n\t\t\t.addService(\n\t\t\t\t'apiKeyManager',\n\t\t\t\t({ apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator }) =>\n\t\t\t\t\tnew ApiKeyManager(apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator),\n\t\t\t)\n\t\t\t.addService('signOutManager', ({ apiKeyManager, idpRegistry }) => new SignOutManager(apiKeyManager, idpRegistry))\n\t\t\t.addService('emailValidator', () => new EmailValidator())\n\t\t\t.addService('hibpChecker', (): HibpChecker => new HttpHibpChecker())\n\t\t\t.addService('noopHibpChecker', (): HibpChecker => new NoopHibpChecker())\n\t\t\t.addService('passwordStrengthValidator', ({ hibpChecker }) => new PasswordStrengthValidator(hibpChecker))\n\t\t\t.addService('captchaValidator', () =>\n\t\t\t\tnew CaptchaValidator({\n\t\t\t\t\tturnstile: new TurnstileProvider(),\n\t\t\t\t\thcaptcha: new HCaptchaProvider(),\n\t\t\t\t\trecaptchaV3: new RecaptchaV3Provider(),\n\t\t\t\t}))\n\t\t\t.addService('rateLimiter', ({ providers }) => new RateLimiter(providers))\n\t\t\t.addService(\n\t\t\t\t'signUpManager',\n\t\t\t\t({ emailValidator, passwordStrengthValidator }) => new SignUpManager(emailValidator, passwordStrengthValidator),\n\t\t\t)\n\t\t\t.addService('passwordChangeManager', ({ providers, passwordStrengthValidator }) => new PasswordChangeManager(providers, passwordStrengthValidator))\n\t\t\t.addService('projectMemberManager', () => new ProjectMemberManager())\n\t\t\t.addService('identityFactory', ({ projectMemberManager }) => new IdentityFactory(projectMemberManager))\n\t\t\t.addService('projectScopeFactory', () => new ProjectScopeFactory(new AclSchemaAccessNodeFactory()))\n\t\t\t.addService(\n\t\t\t\t'permissionContextFactory',\n\t\t\t\t({ authorizator, identityFactory, projectScopeFactory, projectSchemaResolver }) =>\n\t\t\t\t\tnew PermissionContextFactory(authorizator, identityFactory, projectScopeFactory, projectSchemaResolver),\n\t\t\t)\n\t\t\t.addService('secretManager', ({ providers }) => new SecretsManager(providers))\n\t\t\t.addService('projectManager', ({ secretManager, apiKeyService }) => new ProjectManager(secretManager, args.projectInitializer, apiKeyService))\n\t\t\t.addService('personAccessManager', ({ apiKeyManager }) => new PersonAccessManager(apiKeyManager))\n\t\t\t.addService('personManager', ({ emailValidator }) => new PersonManager(emailValidator))\n\t\t\t.addService(\n\t\t\t\t'passwordResetManager',\n\t\t\t\t({ userMailer, projectManager, passwordStrengthValidator }) => new PasswordResetManager(userMailer, projectManager, passwordStrengthValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailVerificationManager',\n\t\t\t\t({ userMailer, projectManager }) => new EmailVerificationManager(userMailer, projectManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailChangeManager',\n\t\t\t\t({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) =>\n\t\t\t\t\tnew EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService('idpSignInManager', ({ apiKeyManager, idpRegistry }) => new IDPSignInManager(apiKeyManager, idpRegistry))\n\t\t\t.addService('idpManager', ({ idpRegistry }) => new IDPManager(idpRegistry))\n\t\t\t.addService('personIdentityProviderManager', () => new PersonIdentityProviderManager())\n\t\t\t.addService('otpAuthenticator', ({ providers }) => new OtpAuthenticator(providers))\n\t\t\t.addService('otpManager', ({ otpAuthenticator, providers }) => new OtpManager(otpAuthenticator, providers))\n\t\t\t.addService('backupCodeManager', ({ providers, userMailer }) => new BackupCodeManager(userMailer, providers))\n\t\t\t.addService('emailOtpManager', ({ userMailer, providers, rateLimiter }) => new EmailOtpManager(userMailer, providers, rateLimiter))\n\t\t\t.addService('authPolicyManager', ({ projectManager }) => new AuthPolicyManager(projectManager))\n\t\t\t.addService(\n\t\t\t\t'signInManager',\n\t\t\t\t({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) =>\n\t\t\t\t\tnew SignInManager(\n\t\t\t\t\t\tapiKeyManager,\n\t\t\t\t\t\tproviders,\n\t\t\t\t\t\totpManager,\n\t\t\t\t\t\tbackupCodeManager,\n\t\t\t\t\t\temailOtpManager,\n\t\t\t\t\t\tauthPolicyResolver,\n\t\t\t\t\t\tloginRiskAnalyzer,\n\t\t\t\t\t\tuserMailer,\n\t\t\t\t\t),\n\t\t\t)\n\t\t\t.addService('membershipValidator', ({ projectSchemaResolver }) => new MembershipValidator(projectSchemaResolver))\n\t\t\t.addService('inviteManager', ({ providers, userMailer, projectSchemaResolver }) => new InviteManager(providers, userMailer, projectSchemaResolver))\n\t\t\t.addService('mailTemplateManager', () => new MailTemplateManager())\n\t\t\t.addService('rolesManager', () => new RolesManager())\n\t\t\t.addService('configurationManager', () => new ConfigurationManager())\n\t\t\t.addService(\n\t\t\t\t'passwordlessSignInManager',\n\t\t\t\t({ apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager }) =>\n\t\t\t\t\tnew PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'identityTypeResolver',\n\t\t\t\t({ projectMemberManager, projectManager, permissionContextFactory }) =>\n\t\t\t\t\tnew IdentityTypeResolver(projectMemberManager, projectManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'projectTypeResolver',\n\t\t\t\t({ projectMemberManager, projectSchemaResolver, secretManager }) =>\n\t\t\t\t\tnew ProjectTypeResolver(projectMemberManager, projectSchemaResolver, secretManager),\n\t\t\t)\n\t\t\t.addService('personTypeResolver', ({ personIdentityProviderManager }) => new PersonTypeResolver(personIdentityProviderManager))\n\t\t\t.addService(\n\t\t\t\t'signInResponseFactory',\n\t\t\t\t({ permissionContextFactory, identityTypeResolver }) => new SignInResponseFactory(permissionContextFactory, identityTypeResolver),\n\t\t\t)\n\t\t\t.addService('meQueryResolver', () => new MeQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'personQueryResolver',\n\t\t\t\t({ personManager, projectManager, projectMemberManager }) => new PersonQueryResolver(personManager, projectManager, projectMemberManager),\n\t\t\t)\n\t\t\t.addService('idpQueryResolver', ({ idpManager }) => new IDPQueryResolver(idpManager))\n\t\t\t.addService('projectQueryResolver', ({ projectManager }) => new ProjectQueryResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'projectMembersQueryResolver',\n\t\t\t\t({ projectManager, projectMemberManager }) => new ProjectMembersQueryResolver(projectManager, projectMemberManager),\n\t\t\t)\n\t\t\t.addService('mailTemplateQueryResolver', () => new MailTemplateQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'signUpMutationResolver',\n\t\t\t\t({ signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory }) =>\n\t\t\t\t\tnew SignUpMutationResolver(signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'signInMutationResolver',\n\t\t\t\t({ signInManager, signInResponseFactory, rateLimiter }) => new SignInMutationResolver(signInManager, signInResponseFactory, rateLimiter),\n\t\t\t)\n\t\t\t.addService('signOutMutationResolver', ({ signOutManager }) => new SignOutMutationResolver(signOutManager))\n\t\t\t.addService(\n\t\t\t\t'changeProfileMutationResolver',\n\t\t\t\t({ personManager, emailChangeManager, permissionContextFactory }) =>\n\t\t\t\t\tnew ChangeProfileMutationResolver(personManager, emailChangeManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailVerificationMutationResolver',\n\t\t\t\t({ emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew EmailVerificationMutationResolver(emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService('changePasswordMutationResolver', ({ passwordChangeManager }) => new ChangePasswordMutationResolver(passwordChangeManager))\n\t\t\t.addService(\n\t\t\t\t'resetPasswordMutationResolver',\n\t\t\t\t({ passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew ResetPasswordMutationResolver(passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'inviteMutationResolver',\n\t\t\t\t({ inviteManager, projectManager, membershipValidator }) => new InviteMutationResolver(inviteManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'addProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew AddProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'updateProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew UpdateProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'removeProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager }) => new RemoveProjectMemberMutationResolver(projectMemberManager, projectManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'createApiKeyMutationResolver',\n\t\t\t\t({ apiKeyManager, projectManager, membershipValidator }) => new CreateApiKeyMutationResolver(apiKeyManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService('disableApiKeyMutationResolver', ({ apiKeyManager }) => new DisableApiKeyMutationResolver(apiKeyManager))\n\t\t\t.addService(\n\t\t\t\t'otpMutationResolver',\n\t\t\t\t({ otpManager, backupCodeManager, authPolicyResolver }) => new OtpMutationResolver(otpManager, backupCodeManager, authPolicyResolver),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailOtpMutationResolver',\n\t\t\t\t({ emailOtpManager, backupCodeManager, authPolicyResolver }) =>\n\t\t\t\t\tnew EmailOtpMutationResolver(emailOtpManager, backupCodeManager, authPolicyResolver),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'regenerateBackupCodesMutationResolver',\n\t\t\t\t({ backupCodeManager }) => new RegenerateBackupCodesMutationResolver(backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'mailTemplateMutationResolver',\n\t\t\t\t({ projectManager, mailTemplateManager }) => new MailTemplateMutationResolver(projectManager, mailTemplateManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'idpMutationResolver',\n\t\t\t\t({ idpSignInManager, signInResponseFactory }) => new IDPMutationResolver(idpSignInManager, signInResponseFactory),\n\t\t\t)\n\t\t\t.addService('registerIdpMutationResolver', ({ idpManager }) => new AddIDPMutationResolver(idpManager))\n\t\t\t.addService('updateIdpMutationResolver', ({ idpManager }) => new UpdateIDPMutationResolver(idpManager))\n\t\t\t.addService('disableIdpMutationResolver', ({ idpManager }) => new DisableIDPMutationResolver(idpManager))\n\t\t\t.addService('enableIdpMutationResolver', ({ idpManager }) => new EnableIDPMutationResolver(idpManager))\n\t\t\t.addService(\n\t\t\t\t'disconnectMyIdentityProviderMutationResolver',\n\t\t\t\t({ personIdentityProviderManager }) => new DisconnectMyIdentityProviderMutationResolver(personIdentityProviderManager),\n\t\t\t)\n\t\t\t.addService('createProjectMutationResolver', ({ projectManager }) => new CreateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'disablePersonMutationResolver',\n\t\t\t\t({ personAccessManager, personManager }) => new DisablePersonMutationResolver(personAccessManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'forceSignOutMutationResolver',\n\t\t\t\t({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'resetPersonMfaMutationResolver',\n\t\t\t\t({ personManager, backupCodeManager }) => new ResetPersonMfaMutationResolver(personManager, backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'revokeSessionMutationResolver',\n\t\t\t\t({ apiKeyManager }) => new RevokeSessionMutationResolver(apiKeyManager),\n\t\t\t)\n\t\t\t.addService('updateProjectMutationResolver', ({ projectManager }) => new UpdateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'setProjectSecretMutationResolver',\n\t\t\t\t({ projectManager, secretManager }) => new SetProjectSecretMutationResolver(projectManager, secretManager),\n\t\t\t)\n\t\t\t.addService('identityGlobalRolesMutationResolver', ({ rolesManager }) => new IdentityGlobalRolesMutationResolver(rolesManager))\n\t\t\t.addService('configurationMutationResolver', ({ configurationManager }) => new ConfigurationMutationResolver(configurationManager))\n\t\t\t.addService('configurationQueryResolver', ({ configurationManager }) => new ConfigurationQueryResolver(configurationManager))\n\t\t\t.addService('authPolicyMutationResolver', ({ authPolicyManager }) => new AuthPolicyMutationResolver(authPolicyManager))\n\t\t\t.addService('authPolicyQueryResolver', ({ authPolicyManager }) => new AuthPolicyQueryResolver(authPolicyManager))\n\t\t\t.addService('authLogQueryResolver', () => new AuthLogQueryResolver())\n\t\t\t.addService('apiKeyQueryResolver', () => new ApiKeyQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'passwordlessMutationResolver',\n\t\t\t\t({ passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'togglePasswordlessMutationResolver',\n\t\t\t\t({ configurationManager, personManager }) => new TogglePasswordlessMutationResolver(configurationManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t({ permissionContextFactory, authLogService, loginRiskAnalyzer }) =>\n\t\t\t\t\tnew TenantResolverContextFactory(permissionContextFactory, authLogService, loginRiskAnalyzer),\n\t\t\t)\n\t\t\t.addService('resolvers', container => new ResolverFactory(container).create())\n\t\t\t.addService('connection', () => args.connection)\n\t\t\t.addService('readConnection', () => args.readConnection)\n\t\t\t.addService(\n\t\t\t\t'databaseContext',\n\t\t\t\t({ connection, providers }) => new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t({ readConnection, providers }) => new DatabaseContext(readConnection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService('identityFetcher', ({ databaseContext }) => new IdentityFetcher(databaseContext.client))\n\t\t\t.addService('migrationsRunner', ({ providers }) => new TenantMigrationsRunner(args.dbCredentials, 'tenant', args.tenantCredentials, providers))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoJO,MAAM,uBAAuB;AAAA,EACnC,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,OAAO,MAA4C;AAClD,WAAO,KAAK,cAAc,IAAI,EAC5B,QACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEA,cAAc,MAA2B;AACxC,WAAO,IAAI,QAAQ,CAAA,CAAE,EACnB,WAAW,aAAa,OAAO,EAAE,GAAG,KAAK,WAAW,GAAG,KAAK,gBAAA,EAAkB,EAC9E,WAAW,UAAU,MAAM,aAAa,KAAK,WAAW,CAAC,EACzD,WAAW,yBAAyB,MAAM,KAAK,qBAAqB,EACpE,WAAW,oBAAoB,MAAM,IAAI,iBAAA,CAAkB,EAC3D,WAAW,mBAAmB,CAAC,CAAA,MAAO,IAAI,gBAAgB,oBAAoB,IAAI,mBAAA,EAAqB,QAAQ,CAAC,EAChH,WAAW,gBAAgB,CAAC,EAAE,sBAAsB,IAAI,aAAa,QAAQ,eAAe,CAAC,EAC7F,WAAW,cAAc,CAAC,EAAE,QAAQ,uBAAuB,IAAI,WAAW,QAAQ,gBAAgB,CAAC,EACnG,WAAW,iBAAiB,MAAM,IAAI,eAAe,EACrD,WAAW,sBAAsB,MAAM,IAAI,mBAAA,CAAoB,EAC/D,WAAW,kBAAkB,MAAM,IAAI,eAAA,CAAgB,EACvD,WAAW,qBAAqB,CAAC,EAAE,gBAAgB,IAAI,kBAAkB,UAAU,IAAI,CAAC,EACxF,WAAW,eAAe,MAAM;AAChC,YAAM,cAAc,IAAI,mBAAA;AACxB,kBAAY,gBAAgB,QAAQ,IAAI,aAAA,CAAc;AACtD,kBAAY,gBAAgB,YAAY,IAAI,iBAAA,CAAkB;AAC9D,kBAAY,gBAAgB,SAAS,IAAI,cAAA,CAAe;AACxD,aAAO;AAAA,IACR,CAAC,EACA,WAAW,yBAAyB,CAAC,EAAE,YAAA,MAAkB,IAAI,sBAAsB,WAAW,CAAC,EAC/F,WAAW,4BAA4B,CAAC,EAAE,YAAA,MAAkB,IAAI,yBAAyB,WAAW,CAAC,EACrG,WAAW,4BAA4B,MACvC,yBAAyB,oBAAoB;AAAA,MAC5C,QAAQ,KAAK,kBAAkB;AAAA,MAC/B,aAAa,KAAK,kBAAkB;AAAA,IAAA,CACpC,CAAC,EACF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,oBAAoB,gBAAgB,0BAA0B,sBAAA,MAC/E,IAAI,cAAc,eAAe,oBAAoB,gBAAgB,0BAA0B,qBAAqB;AAAA,IAAA,EAErH,WAAW,kBAAkB,CAAC,EAAE,eAAe,YAAA,MAAkB,IAAI,eAAe,eAAe,WAAW,CAAC,EAC/G,WAAW,kBAAkB,MAAM,IAAI,gBAAgB,EACvD,WAAW,eAAe,MAAmB,IAAI,iBAAiB,EAClE,WAAW,mBAAmB,MAAmB,IAAI,iBAAiB,EACtE,WAAW,6BAA6B,CAAC,EAAE,kBAAkB,IAAI,0BAA0B,WAAW,CAAC,EACvG,WAAW,oBAAoB,MAC/B,IAAI,iBAAiB;AAAA,MACpB,WAAW,IAAI,kBAAA;AAAA,MACf,UAAU,IAAI,iBAAA;AAAA,MACd,aAAa,IAAI,oBAAA;AAAA,IAAoB,CACrC,CAAC,EACF,WAAW,eAAe,CAAC,EAAE,UAAA,MAAgB,IAAI,YAAY,SAAS,CAAC,EACvE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,0BAAA,MAAgC,IAAI,cAAc,gBAAgB,yBAAyB;AAAA,IAAA,EAE9G,WAAW,yBAAyB,CAAC,EAAE,WAAW,gCAAgC,IAAI,sBAAsB,WAAW,yBAAyB,CAAC,EACjJ,WAAW,wBAAwB,MAAM,IAAI,qBAAA,CAAsB,EACnE,WAAW,mBAAmB,CAAC,EAAE,2BAA2B,IAAI,gBAAgB,oBAAoB,CAAC,EACrG,WAAW,uBAAuB,MAAM,IAAI,oBAAoB,IAAI,2BAAA,CAA4B,CAAC,EACjG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,cAAc,iBAAiB,qBAAqB,sBAAA,MACtD,IAAI,yBAAyB,cAAc,iBAAiB,qBAAqB,qBAAqB;AAAA,IAAA,EAEvG,WAAW,iBAAiB,CAAC,EAAE,UAAA,MAAgB,IAAI,eAAe,SAAS,CAAC,EAC5E,WAAW,kBAAkB,CAAC,EAAE,eAAe,oBAAoB,IAAI,eAAe,eAAe,KAAK,oBAAoB,aAAa,CAAC,EAC5I,WAAW,uBAAuB,CAAC,EAAE,cAAA,MAAoB,IAAI,oBAAoB,aAAa,CAAC,EAC/F,WAAW,iBAAiB,CAAC,EAAE,eAAA,MAAqB,IAAI,cAAc,cAAc,CAAC,EACrF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,gBAAgB,0BAAA,MAAgC,IAAI,qBAAqB,YAAY,gBAAgB,yBAAyB;AAAA,IAAA,EAE7I;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,eAAA,MAAqB,IAAI,yBAAyB,YAAY,cAAc;AAAA,IAAA,EAE3F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,gBAAgB,gBAAgB,eAAe,yBAAA,MAC7D,IAAI,mBAAmB,YAAY,gBAAgB,gBAAgB,eAAe,wBAAwB;AAAA,IAAA,EAE3G,WAAW,oBAAoB,CAAC,EAAE,eAAe,YAAA,MAAkB,IAAI,iBAAiB,eAAe,WAAW,CAAC,EACnH,WAAW,cAAc,CAAC,EAAE,YAAA,MAAkB,IAAI,WAAW,WAAW,CAAC,EACzE,WAAW,iCAAiC,MAAM,IAAI,8BAAA,CAA+B,EACrF,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAI,iBAAiB,SAAS,CAAC,EACjF,WAAW,cAAc,CAAC,EAAE,kBAAkB,UAAA,MAAgB,IAAI,WAAW,kBAAkB,SAAS,CAAC,EACzG,WAAW,qBAAqB,CAAC,EAAE,WAAW,WAAA,MAAiB,IAAI,kBAAkB,YAAY,SAAS,CAAC,EAC3G,WAAW,mBAAmB,CAAC,EAAE,YAAY,WAAW,kBAAkB,IAAI,gBAAgB,YAAY,WAAW,WAAW,CAAC,EACjI,WAAW,qBAAqB,CAAC,EAAE,eAAA,MAAqB,IAAI,kBAAkB,cAAc,CAAC,EAC7F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,WAAW,YAAY,mBAAmB,iBAAiB,oBAAoB,mBAAmB,WAAA,MACnH,IAAI;AAAA,QACH;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IACD,EAED,WAAW,uBAAuB,CAAC,EAAE,sBAAA,MAA4B,IAAI,oBAAoB,qBAAqB,CAAC,EAC/G,WAAW,iBAAiB,CAAC,EAAE,WAAW,YAAY,sBAAA,MAA4B,IAAI,cAAc,WAAW,YAAY,qBAAqB,CAAC,EACjJ,WAAW,uBAAuB,MAAM,IAAI,oBAAA,CAAqB,EACjE,WAAW,gBAAgB,MAAM,IAAI,aAAA,CAAc,EACnD,WAAW,wBAAwB,MAAM,IAAI,qBAAA,CAAsB,EACnE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,YAAY,gBAAgB,YAAY,kBAAA,MACzD,IAAI,0BAA0B,eAAe,YAAY,gBAAgB,YAAY,iBAAiB;AAAA,IAAA,EAEvG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,yBAAA,MACxC,IAAI,qBAAqB,sBAAsB,gBAAgB,wBAAwB;AAAA,IAAA,EAExF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,uBAAuB,cAAA,MAC/C,IAAI,oBAAoB,sBAAsB,uBAAuB,aAAa;AAAA,IAAA,EAEnF,WAAW,sBAAsB,CAAC,EAAE,8BAAA,MAAoC,IAAI,mBAAmB,6BAA6B,CAAC,EAC7H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,qBAAA,MAA2B,IAAI,sBAAsB,0BAA0B,oBAAoB;AAAA,IAAA,EAEhI,WAAW,mBAAmB,MAAM,IAAI,gBAAA,CAAiB,EACzD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,qBAAA,MAA2B,IAAI,oBAAoB,eAAe,gBAAgB,oBAAoB;AAAA,IAAA,EAExI,WAAW,oBAAoB,CAAC,EAAE,WAAA,MAAiB,IAAI,iBAAiB,UAAU,CAAC,EACnF,WAAW,wBAAwB,CAAC,EAAE,eAAA,MAAqB,IAAI,qBAAqB,cAAc,CAAC,EACnG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,qBAAA,MAA2B,IAAI,4BAA4B,gBAAgB,oBAAoB;AAAA,IAAA,EAElH,WAAW,6BAA6B,MAAM,IAAI,0BAAA,CAA2B,EAC7E;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,eAAe,kBAAkB,aAAa,0BAA0B,yBAAA,MACzF,IAAI,uBAAuB,eAAe,eAAe,kBAAkB,aAAa,0BAA0B,wBAAwB;AAAA,IAAA,EAE3I;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,uBAAuB,YAAA,MAAkB,IAAI,uBAAuB,eAAe,uBAAuB,WAAW;AAAA,IAAA,EAEvI,WAAW,2BAA2B,CAAC,EAAE,eAAA,MAAqB,IAAI,wBAAwB,cAAc,CAAC,EACzG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,oBAAoB,yBAAA,MACrC,IAAI,8BAA8B,eAAe,oBAAoB,wBAAwB;AAAA,IAAA,EAE9F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,0BAA0B,kBAAkB,YAAA,MACxE,IAAI,kCAAkC,0BAA0B,0BAA0B,kBAAkB,WAAW;AAAA,IAAA,EAExH,WAAW,kCAAkC,CAAC,EAAE,sBAAA,MAA4B,IAAI,+BAA+B,qBAAqB,CAAC,EACrI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,0BAA0B,kBAAkB,YAAA,MACpE,IAAI,8BAA8B,sBAAsB,0BAA0B,kBAAkB,WAAW;AAAA,IAAA,EAEhH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAI,uBAAuB,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAEzI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAI,iCAAiC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAE/F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAI,oCAAoC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAElG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,eAAA,MAAqB,IAAI,oCAAoC,sBAAsB,cAAc;AAAA,IAAA,EAE1H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAI,6BAA6B,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAE/I,WAAW,iCAAiC,CAAC,EAAE,cAAA,MAAoB,IAAI,8BAA8B,aAAa,CAAC,EACnH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,mBAAmB,mBAAA,MAAyB,IAAI,oBAAoB,YAAY,mBAAmB,kBAAkB;AAAA,IAAA,EAEpI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,iBAAiB,mBAAmB,mBAAA,MACtC,IAAI,yBAAyB,iBAAiB,mBAAmB,kBAAkB;AAAA,IAAA,EAEpF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,kBAAA,MAAwB,IAAI,sCAAsC,iBAAiB;AAAA,IAAA,EAEtF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,oBAAA,MAA0B,IAAI,6BAA6B,gBAAgB,mBAAmB;AAAA,IAAA,EAEjH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,kBAAkB,sBAAA,MAA4B,IAAI,oBAAoB,kBAAkB,qBAAqB;AAAA,IAAA,EAEhH,WAAW,+BAA+B,CAAC,EAAE,WAAA,MAAiB,IAAI,uBAAuB,UAAU,CAAC,EACpG,WAAW,6BAA6B,CAAC,EAAE,iBAAiB,IAAI,0BAA0B,UAAU,CAAC,EACrG,WAAW,8BAA8B,CAAC,EAAE,WAAA,MAAiB,IAAI,2BAA2B,UAAU,CAAC,EACvG,WAAW,6BAA6B,CAAC,EAAE,WAAA,MAAiB,IAAI,0BAA0B,UAAU,CAAC,EACrG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,8BAAA,MAAoC,IAAI,6CAA6C,6BAA6B;AAAA,IAAA,EAErH,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAI,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,qBAAqB,cAAA,MAAoB,IAAI,8BAA8B,qBAAqB,aAAa;AAAA,IAAA,EAEhH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,eAAe,WAAA,MAAiB,IAAI,6BAA6B,eAAe,eAAe,UAAU;AAAA,IAAA,EAE3H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,kBAAA,MAAwB,IAAI,+BAA+B,eAAe,iBAAiB;AAAA,IAAA,EAE7G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,cAAA,MAAoB,IAAI,8BAA8B,aAAa;AAAA,IAAA,EAEtE,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAI,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,cAAA,MAAoB,IAAI,iCAAiC,gBAAgB,aAAa;AAAA,IAAA,EAEzG,WAAW,uCAAuC,CAAC,EAAE,aAAA,MAAmB,IAAI,oCAAoC,YAAY,CAAC,EAC7H,WAAW,iCAAiC,CAAC,EAAE,2BAA2B,IAAI,8BAA8B,oBAAoB,CAAC,EACjI,WAAW,8BAA8B,CAAC,EAAE,2BAA2B,IAAI,2BAA2B,oBAAoB,CAAC,EAC3H,WAAW,8BAA8B,CAAC,EAAE,wBAAwB,IAAI,2BAA2B,iBAAiB,CAAC,EACrH,WAAW,2BAA2B,CAAC,EAAE,wBAAwB,IAAI,wBAAwB,iBAAiB,CAAC,EAC/G,WAAW,wBAAwB,MAAM,IAAI,qBAAA,CAAsB,EACnE,WAAW,uBAAuB,MAAM,IAAI,oBAAA,CAAqB,EACjE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,2BAA2B,uBAAuB,kBAAkB,YAAA,MACtE,IAAI,6BAA6B,2BAA2B,uBAAuB,kBAAkB,WAAW;AAAA,IAAA,EAEjH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,cAAA,MAAoB,IAAI,mCAAmC,sBAAsB,aAAa;AAAA,IAAA,EAEvH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,gBAAgB,kBAAA,MAC5C,IAAI,6BAA6B,0BAA0B,gBAAgB,iBAAiB;AAAA,IAAA,EAE7F,WAAW,aAAa,CAAA,cAAa,IAAI,gBAAgB,SAAS,EAAE,OAAA,CAAQ,EAC5E,WAAW,cAAc,MAAM,KAAK,UAAU,EAC9C,WAAW,kBAAkB,MAAM,KAAK,cAAc,EACtD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,UAAA,MAAgB,IAAI,gBAAgB,WAAW,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAErH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,UAAA,MAAgB,IAAI,gBAAgB,eAAe,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAE7H,WAAW,mBAAmB,CAAC,EAAE,gBAAA,MAAsB,IAAI,gBAAgB,gBAAgB,MAAM,CAAC,EAClG,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAI,uBAAuB,KAAK,eAAe,UAAU,KAAK,mBAAmB,SAAS,CAAC;AAAA,EAChJ;AACD;"}

package/dist/development/src/bridges/system/IdentityFetcher.cjs

@@ -12,10 +12,12 @@ require("../../model/queries/apiKey/ApiKeyQuery.cjs");
 const PersonByIdentityBatchQuery = require("../../model/queries/person/PersonByIdentityBatchQuery.cjs");
 const IdentityQuery = require("../../model/queries/identity/IdentityQuery.cjs");
 require("node:assert");
+require("../../model/service/idp/IDPRevalidation.cjs");
 require("../../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
 require("../../model/service/idp/providers/OIDCTypes.cjs");
+require("jose");
 require("../../model/service/idp/providers/FacebookProvider.cjs");
 require("../../model/service/AuthLogService.cjs");
 require("@contember/schema-utils");

package/dist/development/src/bridges/system/IdentityFetcher.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityFetcher.cjs","sources":["../../../../../../packages/engine-tenant-api/src/bridges/system/IdentityFetcher.ts"],"sourcesContent":["import { Client } from '@contember/database'\nimport { IdentityQuery, PersonByIdentityBatchQuery } from '../../model'\n\nexport class IdentityFetcher {\n\tconstructor(\n\t\tprivate client: Client,\n\t) {\n\t}\n\n\tpublic async fetchIdentities(ids: string[]): Promise<Identity[]> {\n\t\tconst queryHandler = this.client.createQueryHandler()\n\t\tconst persons = await queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\tconst personIds = new Set(persons.map(it => it.identity_id))\n\t\tconst otherIdentityIds = ids.filter(it => !personIds.has(it))\n\t\tconst otherIdentities = await queryHandler.fetch(new IdentityQuery(otherIdentityIds))\n\n\t\treturn [\n\t\t\t...persons.map(\n\t\t\t\tit =>\n\t\t\t\t\tnew PersonIdentity(it.identity_id, {\n\t\t\t\t\t\tid: it.id,\n\t\t\t\t\t\tname: it.name ?? 'unnamed',\n\t\t\t\t\t}),\n\t\t\t),\n\t\t\t...otherIdentities.map(it => new ApiKeyIdentity(it.id, it.description)),\n\t\t]\n\t}\n}\n\nexport type Identity = PersonIdentity | ApiKeyIdentity\n\nexport class PersonIdentity {\n\tpublic readonly type = 'person' as const\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly person: {\n\t\t\tid: string\n\t\t\tname: string\n\t\t},\n\t) {}\n}\n\nexport class ApiKeyIdentity {\n\tpublic readonly type = 'apiKey' as const\n\n\tconstructor(public readonly identityId: string, public readonly description: string) {}\n}\n"],"names":["PersonByIdentityBatchQuery","IdentityQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAGO,MAAM,gBAAgB;AAAA,EAC5B,YACS,QACP;AADO,SAAA,SAAA;AAAA,EAET;AAAA,EAEA,MAAa,gBAAgB,KAAoC;AAChE,UAAM,eAAe,KAAK,OAAO,mBAAA;AACjC,UAAM,UAAU,MAAM,aAAa,MAAM,IAAIA,2BAAAA,2BAA2B,GAAG,CAAC;AAC5E,UAAM,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAA,OAAM,GAAG,WAAW,CAAC;AAC3D,UAAM,mBAAmB,IAAI,OAAO,CAAA,OAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AAC5D,UAAM,kBAAkB,MAAM,aAAa,MAAM,IAAIC,cAAAA,cAAc,gBAAgB,CAAC;AAEpF,WAAO;AAAA,MACN,GAAG,QAAQ;AAAA,QACV,CAAA,OACC,IAAI,eAAe,GAAG,aAAa;AAAA,UAClC,IAAI,GAAG;AAAA,UACP,MAAM,GAAG,QAAQ;AAAA,QAAA,CACjB;AAAA,MAAA;AAAA,MAEH,GAAG,gBAAgB,IAAI,CAAA,OAAM,IAAI,eAAe,GAAG,IAAI,GAAG,WAAW,CAAC;AAAA,IAAA;AAAA,EAExE;AACD;AAIO,MAAM,eAAe;AAAA,EAG3B,YACiB,YACA,QAIf;AALe,SAAA,aAAA;AACA,SAAA,SAAA;AAJjB,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAQpB;AACJ;AAEO,MAAM,eAAe;AAAA,EAG3B,YAA4B,YAAoC,aAAqB;AAAzD,SAAA,aAAA;AAAoC,SAAA,cAAA;AAFhE,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAE+D;AACvF;;;;"}
+{"version":3,"file":"IdentityFetcher.cjs","sources":["../../../../../../packages/engine-tenant-api/src/bridges/system/IdentityFetcher.ts"],"sourcesContent":["import { Client } from '@contember/database'\nimport { IdentityQuery, PersonByIdentityBatchQuery } from '../../model/index.js'\n\nexport class IdentityFetcher {\n\tconstructor(\n\t\tprivate client: Client,\n\t) {\n\t}\n\n\tpublic async fetchIdentities(ids: string[]): Promise<Identity[]> {\n\t\tconst queryHandler = this.client.createQueryHandler()\n\t\tconst persons = await queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\tconst personIds = new Set(persons.map(it => it.identity_id))\n\t\tconst otherIdentityIds = ids.filter(it => !personIds.has(it))\n\t\tconst otherIdentities = await queryHandler.fetch(new IdentityQuery(otherIdentityIds))\n\n\t\treturn [\n\t\t\t...persons.map(\n\t\t\t\tit =>\n\t\t\t\t\tnew PersonIdentity(it.identity_id, {\n\t\t\t\t\t\tid: it.id,\n\t\t\t\t\t\tname: it.name ?? 'unnamed',\n\t\t\t\t\t}),\n\t\t\t),\n\t\t\t...otherIdentities.map(it => new ApiKeyIdentity(it.id, it.description)),\n\t\t]\n\t}\n}\n\nexport type Identity = PersonIdentity | ApiKeyIdentity\n\nexport class PersonIdentity {\n\tpublic readonly type = 'person' as const\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly person: {\n\t\t\tid: string\n\t\t\tname: string\n\t\t},\n\t) {}\n}\n\nexport class ApiKeyIdentity {\n\tpublic readonly type = 'apiKey' as const\n\n\tconstructor(public readonly identityId: string, public readonly description: string) {}\n}\n"],"names":["PersonByIdentityBatchQuery","IdentityQuery"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAGO,MAAM,gBAAgB;AAAA,EAC5B,YACS,QACP;AADO,SAAA,SAAA;AAAA,EAET;AAAA,EAEA,MAAa,gBAAgB,KAAoC;AAChE,UAAM,eAAe,KAAK,OAAO,mBAAA;AACjC,UAAM,UAAU,MAAM,aAAa,MAAM,IAAIA,2BAAAA,2BAA2B,GAAG,CAAC;AAC5E,UAAM,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAA,OAAM,GAAG,WAAW,CAAC;AAC3D,UAAM,mBAAmB,IAAI,OAAO,CAAA,OAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AAC5D,UAAM,kBAAkB,MAAM,aAAa,MAAM,IAAIC,cAAAA,cAAc,gBAAgB,CAAC;AAEpF,WAAO;AAAA,MACN,GAAG,QAAQ;AAAA,QACV,CAAA,OACC,IAAI,eAAe,GAAG,aAAa;AAAA,UAClC,IAAI,GAAG;AAAA,UACP,MAAM,GAAG,QAAQ;AAAA,QAAA,CACjB;AAAA,MAAA;AAAA,MAEH,GAAG,gBAAgB,IAAI,CAAA,OAAM,IAAI,eAAe,GAAG,IAAI,GAAG,WAAW,CAAC;AAAA,IAAA;AAAA,EAExE;AACD;AAIO,MAAM,eAAe;AAAA,EAG3B,YACiB,YACA,QAIf;AALe,SAAA,aAAA;AACA,SAAA,SAAA;AAJjB,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAQpB;AACJ;AAEO,MAAM,eAAe;AAAA,EAG3B,YAA4B,YAAoC,aAAqB;AAAzD,SAAA,aAAA;AAAoC,SAAA,cAAA;AAFhE,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAE+D;AACvF;;;;"}

package/dist/development/src/bridges/system/IdentityFetcher.js

@@ -10,10 +10,12 @@ import "../../model/queries/apiKey/ApiKeyQuery.js";
 import { PersonByIdentityBatchQuery } from "../../model/queries/person/PersonByIdentityBatchQuery.js";
 import { IdentityQuery } from "../../model/queries/identity/IdentityQuery.js";
 import "node:assert";
+import "../../model/service/idp/IDPRevalidation.js";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
 import "../../model/service/idp/providers/OIDCTypes.js";
+import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
 import "@contember/schema-utils";

package/dist/development/src/bridges/system/IdentityFetcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityFetcher.js","sources":["../../../../../../packages/engine-tenant-api/src/bridges/system/IdentityFetcher.ts"],"sourcesContent":["import { Client } from '@contember/database'\nimport { IdentityQuery, PersonByIdentityBatchQuery } from '../../model'\n\nexport class IdentityFetcher {\n\tconstructor(\n\t\tprivate client: Client,\n\t) {\n\t}\n\n\tpublic async fetchIdentities(ids: string[]): Promise<Identity[]> {\n\t\tconst queryHandler = this.client.createQueryHandler()\n\t\tconst persons = await queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\tconst personIds = new Set(persons.map(it => it.identity_id))\n\t\tconst otherIdentityIds = ids.filter(it => !personIds.has(it))\n\t\tconst otherIdentities = await queryHandler.fetch(new IdentityQuery(otherIdentityIds))\n\n\t\treturn [\n\t\t\t...persons.map(\n\t\t\t\tit =>\n\t\t\t\t\tnew PersonIdentity(it.identity_id, {\n\t\t\t\t\t\tid: it.id,\n\t\t\t\t\t\tname: it.name ?? 'unnamed',\n\t\t\t\t\t}),\n\t\t\t),\n\t\t\t...otherIdentities.map(it => new ApiKeyIdentity(it.id, it.description)),\n\t\t]\n\t}\n}\n\nexport type Identity = PersonIdentity | ApiKeyIdentity\n\nexport class PersonIdentity {\n\tpublic readonly type = 'person' as const\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly person: {\n\t\t\tid: string\n\t\t\tname: string\n\t\t},\n\t) {}\n}\n\nexport class ApiKeyIdentity {\n\tpublic readonly type = 'apiKey' as const\n\n\tconstructor(public readonly identityId: string, public readonly description: string) {}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAGO,MAAM,gBAAgB;AAAA,EAC5B,YACS,QACP;AADO,SAAA,SAAA;AAAA,EAET;AAAA,EAEA,MAAa,gBAAgB,KAAoC;AAChE,UAAM,eAAe,KAAK,OAAO,mBAAA;AACjC,UAAM,UAAU,MAAM,aAAa,MAAM,IAAI,2BAA2B,GAAG,CAAC;AAC5E,UAAM,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAA,OAAM,GAAG,WAAW,CAAC;AAC3D,UAAM,mBAAmB,IAAI,OAAO,CAAA,OAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AAC5D,UAAM,kBAAkB,MAAM,aAAa,MAAM,IAAI,cAAc,gBAAgB,CAAC;AAEpF,WAAO;AAAA,MACN,GAAG,QAAQ;AAAA,QACV,CAAA,OACC,IAAI,eAAe,GAAG,aAAa;AAAA,UAClC,IAAI,GAAG;AAAA,UACP,MAAM,GAAG,QAAQ;AAAA,QAAA,CACjB;AAAA,MAAA;AAAA,MAEH,GAAG,gBAAgB,IAAI,CAAA,OAAM,IAAI,eAAe,GAAG,IAAI,GAAG,WAAW,CAAC;AAAA,IAAA;AAAA,EAExE;AACD;AAIO,MAAM,eAAe;AAAA,EAG3B,YACiB,YACA,QAIf;AALe,SAAA,aAAA;AACA,SAAA,SAAA;AAJjB,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAQpB;AACJ;AAEO,MAAM,eAAe;AAAA,EAG3B,YAA4B,YAAoC,aAAqB;AAAzD,SAAA,aAAA;AAAoC,SAAA,cAAA;AAFhE,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAE+D;AACvF;"}
+{"version":3,"file":"IdentityFetcher.js","sources":["../../../../../../packages/engine-tenant-api/src/bridges/system/IdentityFetcher.ts"],"sourcesContent":["import { Client } from '@contember/database'\nimport { IdentityQuery, PersonByIdentityBatchQuery } from '../../model/index.js'\n\nexport class IdentityFetcher {\n\tconstructor(\n\t\tprivate client: Client,\n\t) {\n\t}\n\n\tpublic async fetchIdentities(ids: string[]): Promise<Identity[]> {\n\t\tconst queryHandler = this.client.createQueryHandler()\n\t\tconst persons = await queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\tconst personIds = new Set(persons.map(it => it.identity_id))\n\t\tconst otherIdentityIds = ids.filter(it => !personIds.has(it))\n\t\tconst otherIdentities = await queryHandler.fetch(new IdentityQuery(otherIdentityIds))\n\n\t\treturn [\n\t\t\t...persons.map(\n\t\t\t\tit =>\n\t\t\t\t\tnew PersonIdentity(it.identity_id, {\n\t\t\t\t\t\tid: it.id,\n\t\t\t\t\t\tname: it.name ?? 'unnamed',\n\t\t\t\t\t}),\n\t\t\t),\n\t\t\t...otherIdentities.map(it => new ApiKeyIdentity(it.id, it.description)),\n\t\t]\n\t}\n}\n\nexport type Identity = PersonIdentity | ApiKeyIdentity\n\nexport class PersonIdentity {\n\tpublic readonly type = 'person' as const\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly person: {\n\t\t\tid: string\n\t\t\tname: string\n\t\t},\n\t) {}\n}\n\nexport class ApiKeyIdentity {\n\tpublic readonly type = 'apiKey' as const\n\n\tconstructor(public readonly identityId: string, public readonly description: string) {}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAGO,MAAM,gBAAgB;AAAA,EAC5B,YACS,QACP;AADO,SAAA,SAAA;AAAA,EAET;AAAA,EAEA,MAAa,gBAAgB,KAAoC;AAChE,UAAM,eAAe,KAAK,OAAO,mBAAA;AACjC,UAAM,UAAU,MAAM,aAAa,MAAM,IAAI,2BAA2B,GAAG,CAAC;AAC5E,UAAM,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAA,OAAM,GAAG,WAAW,CAAC;AAC3D,UAAM,mBAAmB,IAAI,OAAO,CAAA,OAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AAC5D,UAAM,kBAAkB,MAAM,aAAa,MAAM,IAAI,cAAc,gBAAgB,CAAC;AAEpF,WAAO;AAAA,MACN,GAAG,QAAQ;AAAA,QACV,CAAA,OACC,IAAI,eAAe,GAAG,aAAa;AAAA,UAClC,IAAI,GAAG;AAAA,UACP,MAAM,GAAG,QAAQ;AAAA,QAAA,CACjB;AAAA,MAAA;AAAA,MAEH,GAAG,gBAAgB,IAAI,CAAA,OAAM,IAAI,eAAe,GAAG,IAAI,GAAG,WAAW,CAAC;AAAA,IAAA;AAAA,EAExE;AACD;AAIO,MAAM,eAAe;AAAA,EAG3B,YACiB,YACA,QAIf;AALe,SAAA,aAAA;AACA,SAAA,SAAA;AAJjB,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAQpB;AACJ;AAEO,MAAM,eAAe;AAAA,EAG3B,YAA4B,YAAoC,aAAqB;AAAzD,SAAA,aAAA;AAAoC,SAAA,cAAA;AAFhE,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAE+D;AACvF;"}

package/dist/development/src/migrations/2020-06-08-134000-tenant-credentials.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"2020-06-08-134000-tenant-credentials.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2020-06-08-134000-tenant-credentials.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\nimport { createCredentials } from './tenantCredentials'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tawait createCredentials(builder, args)\n}\n"],"names":["createCredentials"],"mappings":";;AAIA,eAAA,iCAA8B,SAA2B,MAA2B;AACnF,QAAMA,kBAAAA,kBAAkB,SAAS,IAAI;AACtC;;"}
+{"version":3,"file":"2020-06-08-134000-tenant-credentials.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2020-06-08-134000-tenant-credentials.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tawait createCredentials(builder, args)\n}\n"],"names":["createCredentials"],"mappings":";;AAIA,eAAA,iCAA8B,SAA2B,MAA2B;AACnF,QAAMA,kBAAAA,kBAAkB,SAAS,IAAI;AACtC;;"}

package/dist/development/src/migrations/2020-06-08-134000-tenant-credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"2020-06-08-134000-tenant-credentials.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2020-06-08-134000-tenant-credentials.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\nimport { createCredentials } from './tenantCredentials'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,iCAA8B,SAA2B,MAA2B;AACnF,QAAM,kBAAkB,SAAS,IAAI;AACtC;"}
+{"version":3,"file":"2020-06-08-134000-tenant-credentials.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2020-06-08-134000-tenant-credentials.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,iCAA8B,SAA2B,MAA2B;AACnF,QAAM,kBAAkB,SAAS,IAAI;AACtC;"}

package/dist/development/src/migrations/2026-05-12-120000-api-key-session-tracking.cjs

@@ -0,0 +1,23 @@
+"use strict";
+const sql = `
+ALTER TABLE "api_key"
+	ADD COLUMN "last_ip" INET,
+	ADD COLUMN "last_user_agent" TEXT,
+	ADD COLUMN "last_used_at" TIMESTAMPTZ,
+	ADD COLUMN "created_ip" INET,
+	ADD COLUMN "created_user_agent" TEXT;
+
+ALTER TYPE "auth_log_type" ADD VALUE 'session_revoked_by_user';
+ALTER TYPE "auth_log_type" ADD VALUE 'forced_sign_out';
+
+ALTER TABLE "person_auth_log"
+	ADD COLUMN "target_person_id" UUID REFERENCES "person"("id") ON DELETE SET NULL;
+
+CREATE INDEX "person_auth_log_target_person_id_created_at_idx"
+	ON "person_auth_log" ("target_person_id", "created_at" DESC);
+`;
+async function _20260512120000apikeysessiontracking(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260512120000apikeysessiontracking;
+//# sourceMappingURL=2026-05-12-120000-api-key-session-tracking.cjs.map

package/dist/development/src/migrations/2026-05-12-120000-api-key-session-tracking.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-12-120000-api-key-session-tracking.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-12-120000-api-key-session-tracking.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\nALTER TABLE \"api_key\"\n\tADD COLUMN \"last_ip\" INET,\n\tADD COLUMN \"last_user_agent\" TEXT,\n\tADD COLUMN \"last_used_at\" TIMESTAMPTZ,\n\tADD COLUMN \"created_ip\" INET,\n\tADD COLUMN \"created_user_agent\" TEXT;\n\nALTER TYPE \"auth_log_type\" ADD VALUE 'session_revoked_by_user';\nALTER TYPE \"auth_log_type\" ADD VALUE 'forced_sign_out';\n\nALTER TABLE \"person_auth_log\"\n\tADD COLUMN \"target_person_id\" UUID REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\n\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\"\n\tON \"person_auth_log\" (\"target_person_id\", \"created_at\" DESC);\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBZ,eAAA,qCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/development/src/migrations/2026-05-12-120000-api-key-session-tracking.js

@@ -0,0 +1,24 @@
+const sql = `
+ALTER TABLE "api_key"
+	ADD COLUMN "last_ip" INET,
+	ADD COLUMN "last_user_agent" TEXT,
+	ADD COLUMN "last_used_at" TIMESTAMPTZ,
+	ADD COLUMN "created_ip" INET,
+	ADD COLUMN "created_user_agent" TEXT;
+
+ALTER TYPE "auth_log_type" ADD VALUE 'session_revoked_by_user';
+ALTER TYPE "auth_log_type" ADD VALUE 'forced_sign_out';
+
+ALTER TABLE "person_auth_log"
+	ADD COLUMN "target_person_id" UUID REFERENCES "person"("id") ON DELETE SET NULL;
+
+CREATE INDEX "person_auth_log_target_person_id_created_at_idx"
+	ON "person_auth_log" ("target_person_id", "created_at" DESC);
+`;
+async function _20260512120000apikeysessiontracking(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260512120000apikeysessiontracking as default
+};
+//# sourceMappingURL=2026-05-12-120000-api-key-session-tracking.js.map

package/dist/development/src/migrations/2026-05-12-120000-api-key-session-tracking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-12-120000-api-key-session-tracking.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-12-120000-api-key-session-tracking.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\nALTER TABLE \"api_key\"\n\tADD COLUMN \"last_ip\" INET,\n\tADD COLUMN \"last_user_agent\" TEXT,\n\tADD COLUMN \"last_used_at\" TIMESTAMPTZ,\n\tADD COLUMN \"created_ip\" INET,\n\tADD COLUMN \"created_user_agent\" TEXT;\n\nALTER TYPE \"auth_log_type\" ADD VALUE 'session_revoked_by_user';\nALTER TYPE \"auth_log_type\" ADD VALUE 'forced_sign_out';\n\nALTER TABLE \"person_auth_log\"\n\tADD COLUMN \"target_person_id\" UUID REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\n\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\"\n\tON \"person_auth_log\" (\"target_person_id\", \"created_at\" DESC);\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkBZ,eAAA,qCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/development/src/migrations/2026-05-12-130000-api-key-trust-forwarded-info.cjs

@@ -0,0 +1,10 @@
+"use strict";
+const sql = `
+ALTER TABLE "api_key"
+	ADD COLUMN "trust_forwarded_info" BOOLEAN NOT NULL DEFAULT false;
+`;
+async function _20260512130000apikeytrustforwardedinfo(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260512130000apikeytrustforwardedinfo;
+//# sourceMappingURL=2026-05-12-130000-api-key-trust-forwarded-info.cjs.map

package/dist/development/src/migrations/2026-05-12-130000-api-key-trust-forwarded-info.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-12-130000-api-key-trust-forwarded-info.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-12-130000-api-key-trust-forwarded-info.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\nALTER TABLE \"api_key\"\n\tADD COLUMN \"trust_forwarded_info\" BOOLEAN NOT NULL DEFAULT false;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAKZ,eAAA,wCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/development/src/migrations/2026-05-12-130000-api-key-trust-forwarded-info.js

@@ -0,0 +1,11 @@
+const sql = `
+ALTER TABLE "api_key"
+	ADD COLUMN "trust_forwarded_info" BOOLEAN NOT NULL DEFAULT false;
+`;
+async function _20260512130000apikeytrustforwardedinfo(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260512130000apikeytrustforwardedinfo as default
+};
+//# sourceMappingURL=2026-05-12-130000-api-key-trust-forwarded-info.js.map

package/dist/development/src/migrations/2026-05-12-130000-api-key-trust-forwarded-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-12-130000-api-key-trust-forwarded-info.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-12-130000-api-key-trust-forwarded-info.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\nALTER TABLE \"api_key\"\n\tADD COLUMN \"trust_forwarded_info\" BOOLEAN NOT NULL DEFAULT false;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAKZ,eAAA,wCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}