@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/development/src/migrations/snapshot.js

@@ -14,7 +14,50 @@ CREATE TYPE "auth_log_type" AS ENUM (
     'passwordless_login_init',
     'passwordless_login_exchange',
     'passwordless_login',
-    'person_disable'
+    'person_disable',
+    'session_revoked_by_user',
+    'forced_sign_out',
+    'global_role_grant',
+    'global_role_revoke',
+    'project_membership_create',
+    'project_membership_update',
+    'project_membership_remove',
+    'api_key_create',
+    'api_key_disable',
+    'idp_create',
+    'idp_update',
+    'idp_disable',
+    'idp_enable',
+    'project_create',
+    'project_update',
+    'project_secret_change',
+    'mail_template_change',
+    'tenant_config_change',
+    'person_invite',
+    'backup_code_generated',
+    'backup_code_used',
+    'backup_code_regenerated',
+    'email_otp_sent',
+    'mfa_enrollment_required',
+    'mfa_reset',
+    'session_expired_idle',
+    'session_policy_applied',
+    'auth_policy_change',
+    'email_verify_init',
+    'email_verify_complete',
+    'email_change_init',
+    'email_change_complete',
+    'idp_session_revalidated',
+    'idp_session_revoked',
+    'idp_session_revalidation_failed',
+    'unusual_login_detected',
+    'step_up_required',
+    'idp_logout_initiated',
+    'idp_backchannel_logout',
+    'idp_role_mapped',
+    'idp_role_mapping_failed',
+    'person_enable',
+    'custom_role_change'
 );
 CREATE TYPE "config_policy" AS ENUM (
     'always',
@@ -27,7 +70,10 @@ CREATE TYPE "config_singleton" AS ENUM (
 );
 CREATE TYPE "person_token_type" AS ENUM (
     'password_reset',
-    'passwordless'
+    'passwordless',
+    'mfa_email_otp',
+    'email_verification',
+    'email_change'
 );
 CREATE FUNCTION "project_deleted"() RETURNS "trigger"
     LANGUAGE "plpgsql"
@@ -63,7 +109,29 @@ CREATE TABLE "api_key" (
     "expires_at" timestamp with time zone,
     "created_at" timestamp with time zone NOT NULL,
     "expiration" integer,
-    "disabled_at" timestamp with time zone
+    "disabled_at" timestamp with time zone,
+    "last_ip" "inet",
+    "last_user_agent" "text",
+    "last_used_at" timestamp with time zone,
+    "created_ip" "inet",
+    "created_user_agent" "text",
+    "trust_forwarded_info" boolean DEFAULT false NOT NULL,
+    "issued_at" timestamp with time zone,
+    "idle_timeout" interval,
+    "max_expires_at" timestamp with time zone
+);
+CREATE TABLE "auth_policy" (
+    "id" "uuid" NOT NULL,
+    "scope" "text" NOT NULL,
+    "project_id" "uuid",
+    "roles" "text"[] NOT NULL,
+    "mfa_required" boolean,
+    "token_expiration" interval,
+    "idle_timeout" interval,
+    "remember_me_allowed" boolean,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "updated_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "grace_duration" interval
 );
 CREATE TABLE "config" (
     "id" "config_singleton" DEFAULT 'singleton'::"config_singleton" NOT NULL,
@@ -82,7 +150,49 @@ CREATE TABLE "config" (
     "login_attempt_window" interval DEFAULT '00:05:00'::interval NOT NULL,
     "login_reveal_user_exits" boolean DEFAULT true NOT NULL,
     "login_default_token_expiration" interval DEFAULT '00:30:00'::interval NOT NULL,
-    "login_max_token_expiration" interval DEFAULT '6 mons'::interval
+    "login_max_token_expiration" interval DEFAULT '6 mons'::interval,
+    "password_check_hibp" boolean DEFAULT false NOT NULL,
+    "captcha_provider" "text",
+    "captcha_secret" "bytea",
+    "captcha_secret_version" integer,
+    "captcha_threshold" double precision,
+    "rate_limit_sign_up_per_ip_limit" integer DEFAULT 0 NOT NULL,
+    "rate_limit_sign_up_per_ip_window" interval DEFAULT '01:00:00'::interval NOT NULL,
+    "rate_limit_login_per_ip_limit" integer DEFAULT 0 NOT NULL,
+    "rate_limit_login_per_ip_window" interval DEFAULT '01:00:00'::interval NOT NULL,
+    "rate_limit_password_reset_per_ip_limit" integer DEFAULT 0 NOT NULL,
+    "rate_limit_password_reset_per_ip_window" interval DEFAULT '01:00:00'::interval NOT NULL,
+    "rate_limit_passwordless_init_per_ip_limit" integer DEFAULT 0 NOT NULL,
+    "rate_limit_passwordless_init_per_ip_window" interval DEFAULT '01:00:00'::interval NOT NULL,
+    "login_reveal_login_method" boolean DEFAULT true NOT NULL,
+    "login_mfa_grace_duration" interval DEFAULT '00:00:00'::interval NOT NULL,
+    "rate_limit_email_otp_per_person_limit" integer DEFAULT 10 NOT NULL,
+    "rate_limit_email_otp_per_person_window" interval DEFAULT '00:10:00'::interval NOT NULL,
+    "signup_require_email_verification" boolean DEFAULT false NOT NULL,
+    "require_email_change_verification" boolean DEFAULT false NOT NULL,
+    "rate_limit_email_verification_per_ip_limit" integer DEFAULT 0 NOT NULL,
+    "rate_limit_email_verification_per_ip_window" interval DEFAULT '01:00:00'::interval NOT NULL,
+    "captcha_protect_sign_up" boolean DEFAULT true NOT NULL,
+    "captcha_protect_password_reset" boolean DEFAULT true NOT NULL,
+    "captcha_protect_passwordless_init" boolean DEFAULT true NOT NULL,
+    "captcha_protect_email_verification" boolean DEFAULT false NOT NULL,
+    "login_anomaly_detection_enabled" boolean DEFAULT false NOT NULL,
+    "login_anomaly_history_size" integer DEFAULT 10 NOT NULL,
+    "login_anomaly_email_threshold" integer DEFAULT 1 NOT NULL,
+    "login_anomaly_step_up_threshold" integer DEFAULT 3 NOT NULL,
+    "panel_global_roles" "text"[] DEFAULT '{super_admin,project_admin}'::"text"[] NOT NULL,
+    "panel_project_roles" "text"[] DEFAULT '{admin}'::"text"[] NOT NULL,
+    CONSTRAINT "config_captcha_complete" CHECK ((("captcha_provider" IS NULL) OR (("captcha_secret" IS NOT NULL) AND ("captcha_secret_version" IS NOT NULL)))),
+    CONSTRAINT "config_captcha_provider_check" CHECK ((("captcha_provider" IS NULL) OR ("captcha_provider" = ANY (ARRAY['turnstile'::"text", 'hcaptcha'::"text", 'recaptchaV3'::"text"]))))
+);
+CREATE TABLE "custom_role" (
+    "id" "uuid" NOT NULL,
+    "slug" "text" NOT NULL,
+    "description" "text",
+    "grants" "jsonb" NOT NULL,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "updated_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    CONSTRAINT "custom_role_grants_check" CHECK (("jsonb_typeof"("grants") = 'array'::"text"))
 );
 CREATE TABLE "identity" (
     "id" "uuid" NOT NULL,
@@ -99,7 +209,22 @@ CREATE TABLE "identity_provider" (
     "disabled_at" timestamp with time zone,
     "auto_sign_up" boolean DEFAULT false NOT NULL,
     "exclusive" boolean DEFAULT false,
-    "init_returns_config" boolean DEFAULT false NOT NULL
+    "init_returns_config" boolean DEFAULT false NOT NULL,
+    "require_verified_email" boolean DEFAULT false NOT NULL,
+    "assume_email_verified" boolean DEFAULT false NOT NULL,
+    "disable_local_authentication" boolean DEFAULT false NOT NULL
+);
+CREATE TABLE "idp_session" (
+    "id" "uuid" NOT NULL,
+    "api_key_id" "uuid" NOT NULL,
+    "identity_provider_id" "uuid" NOT NULL,
+    "idp_session_id" "text",
+    "tokens" "bytea",
+    "tokens_version" integer,
+    "idp_expires_at" timestamp with time zone,
+    "token_obtained_at" timestamp with time zone,
+    "last_validated_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL
 );
 CREATE TABLE "mail_template" (
     "id" "uuid" NOT NULL,
@@ -116,12 +241,13 @@ CREATE TABLE "person" (
     "email" "text",
     "password_hash" "text",
     "identity_id" "uuid" NOT NULL,
-    "otp_uri" "text",
-    "otp_activated_at" timestamp with time zone,
     "name" "text",
     "idp_only" boolean DEFAULT false NOT NULL,
     "disabled_at" timestamp with time zone,
     "passwordless_enabled" boolean,
+    "mfa_grace_until" timestamp with time zone,
+    "email_verified_at" timestamp with time zone,
+    "email_verification_required" boolean DEFAULT false NOT NULL,
     CONSTRAINT "idp_only_no_email" CHECK ((("idp_only" = false) OR (("idp_only" = true) AND ("email" IS NULL))))
 );
 CREATE TABLE "person_auth_log" (
@@ -138,7 +264,18 @@ CREATE TABLE "person_auth_log" (
     "ip_address" "inet",
     "user_agent" "text",
     "identity_provider_id" "uuid",
-    "metadata" "jsonb"
+    "metadata" "jsonb",
+    "target_person_id" "uuid",
+    "event_data" "jsonb",
+    "geo_country" "text",
+    "device_fingerprint" "text"
+);
+CREATE TABLE "person_backup_code" (
+    "id" "uuid" NOT NULL,
+    "person_id" "uuid" NOT NULL,
+    "code_hash" "text" NOT NULL,
+    "used_at" timestamp with time zone,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL
 );
 CREATE TABLE "person_identity_provider" (
     "id" "uuid" NOT NULL,
@@ -147,6 +284,16 @@ CREATE TABLE "person_identity_provider" (
     "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
     "external_identifier" "text" NOT NULL
 );
+CREATE TABLE "person_mfa" (
+    "person_id" "uuid" NOT NULL,
+    "totp_secret" "bytea",
+    "totp_secret_version" integer,
+    "totp_activated_at" timestamp with time zone,
+    "totp_pending_secret" "bytea",
+    "totp_pending_version" integer,
+    "totp_pending_created_at" timestamp with time zone,
+    "email_otp_enabled" boolean DEFAULT false NOT NULL
+);
 CREATE TABLE "person_token" (
     "id" "uuid" NOT NULL,
     "token_hash" "text" NOT NULL,
@@ -156,7 +303,8 @@ CREATE TABLE "person_token" (
     "used_at" timestamp with time zone,
     "type" "person_token_type" DEFAULT 'password_reset'::"person_token_type" NOT NULL,
     "otp_hash" "text",
-    "otp_attempts" integer DEFAULT 0 NOT NULL
+    "otp_attempts" integer DEFAULT 0 NOT NULL,
+    "meta" "jsonb"
 );
 CREATE TABLE "project" (
     "id" "uuid" NOT NULL,
@@ -186,10 +334,22 @@ CREATE TABLE "project_secret" (
     "value" "bytea" NOT NULL,
     "version" smallint NOT NULL
 );
+CREATE TABLE "rate_limit_event" (
+    "id" "uuid" NOT NULL,
+    "scope" "text" NOT NULL,
+    "key_hash" "bytea" NOT NULL,
+    "occurred_at" timestamp with time zone DEFAULT "now"() NOT NULL
+);
 ALTER TABLE ONLY "api_key"
     ADD CONSTRAINT "api_key_id" PRIMARY KEY ("id");
+ALTER TABLE ONLY "auth_policy"
+    ADD CONSTRAINT "auth_policy_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "config"
     ADD CONSTRAINT "config_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "custom_role"
+    ADD CONSTRAINT "custom_role_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "custom_role"
+    ADD CONSTRAINT "custom_role_slug_key" UNIQUE ("slug");
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "email_unique" UNIQUE ("email");
 ALTER TABLE ONLY "identity"
@@ -198,16 +358,22 @@ ALTER TABLE ONLY "identity_provider"
     ADD CONSTRAINT "identity_provider_id" PRIMARY KEY ("id");
 ALTER TABLE ONLY "identity_provider"
     ADD CONSTRAINT "identity_provider_slug_key" UNIQUE ("slug");
+ALTER TABLE ONLY "idp_session"
+    ADD CONSTRAINT "idp_session_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "mail_template"
     ADD CONSTRAINT "mail_template_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person_auth_log"
     ADD CONSTRAINT "person_auth_log_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person_backup_code"
+    ADD CONSTRAINT "person_backup_code_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "person_id" PRIMARY KEY ("id");
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "person_identity_id_key" UNIQUE ("identity_id");
 ALTER TABLE ONLY "person_identity_provider"
     ADD CONSTRAINT "person_identity_provider_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "person_mfa"
+    ADD CONSTRAINT "person_mfa_pkey" PRIMARY KEY ("person_id");
 ALTER TABLE ONLY "person_token"
     ADD CONSTRAINT "person_password_reset_id" PRIMARY KEY ("id");
 ALTER TABLE ONLY "project"
@@ -220,13 +386,21 @@ ALTER TABLE ONLY "project_membership_variable"
     ADD CONSTRAINT "project_membership_variable_unique" UNIQUE ("membership_id", "variable");
 ALTER TABLE ONLY "project_secret"
     ADD CONSTRAINT "project_secret_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "rate_limit_event"
+    ADD CONSTRAINT "rate_limit_event_pkey" PRIMARY KEY ("id");
 CREATE INDEX "api_key_identity_id" ON "api_key" USING "btree" ("identity_id");
 CREATE UNIQUE INDEX "api_key_token_hash" ON "api_key" USING "btree" ("token_hash");
+CREATE INDEX "auth_policy_project_id_idx" ON "auth_policy" USING "btree" ("project_id");
 CREATE INDEX "identity_parent_id" ON "identity" USING "btree" ("parent_id");
+CREATE UNIQUE INDEX "idp_session_api_key_id" ON "idp_session" USING "btree" ("api_key_id");
+CREATE INDEX "idp_session_sid" ON "idp_session" USING "btree" ("identity_provider_id", "idp_session_id");
 CREATE UNIQUE INDEX "mail_template_identifier" ON "mail_template" USING "btree" ("project_id", "mail_type", "variant") WHERE ("project_id" IS NOT NULL);
 CREATE UNIQUE INDEX "mail_template_identifier_global" ON "mail_template" USING "btree" ("mail_type", "variant") WHERE ("project_id" IS NULL);
 CREATE INDEX "mail_template_project_index" ON "mail_template" USING "btree" ("project_id");
-CREATE INDEX "person_auth_log_person_input_identifier_created_at_idx" ON "person_auth_log" USING "btree" ("person_input_identifier", "created_at" DESC);
+CREATE INDEX "person_auth_log_person_id_created_at_idx" ON "person_auth_log" USING "btree" ("person_id", "created_at" DESC);
+CREATE INDEX "person_auth_log_person_input_identifier_created_at_idx" ON "person_auth_log" USING "btree" ("person_input_identifier", "created_at" DESC) WHERE (("type" = 'login'::"auth_log_type") AND ("success" = false));
+CREATE INDEX "person_auth_log_target_person_id_created_at_idx" ON "person_auth_log" USING "btree" ("target_person_id", "created_at" DESC);
+CREATE INDEX "person_backup_code_person_id_idx" ON "person_backup_code" USING "btree" ("person_id");
 CREATE INDEX "person_identity_id" ON "person" USING "btree" ("identity_id");
 CREATE UNIQUE INDEX "person_identity_provider_identifier" ON "person_identity_provider" USING "btree" ("identity_provider_id", "external_identifier");
 CREATE INDEX "person_identity_provider_person_id" ON "person_identity_provider" USING "btree" ("person_id");
@@ -237,13 +411,21 @@ CREATE UNIQUE INDEX "project_membership_unique" ON "project_membership" USING "b
 CREATE INDEX "project_secret_project_index" ON "project_secret" USING "btree" ("project_id");
 CREATE UNIQUE INDEX "project_secret_unique" ON "project_secret" USING "btree" ("project_id", "key");
 CREATE UNIQUE INDEX "project_slug" ON "project" USING "btree" ("slug");
+CREATE INDEX "rate_limit_event_lookup" ON "rate_limit_event" USING "btree" ("scope", "key_hash", "occurred_at" DESC);
+CREATE INDEX "rate_limit_event_occurred_at_brin" ON "rate_limit_event" USING "brin" ("occurred_at");
 CREATE TRIGGER "project_deleted" AFTER DELETE ON "project" FOR EACH ROW EXECUTE FUNCTION "project_deleted"();
 CREATE TRIGGER "project_secret_updated" AFTER INSERT OR DELETE OR UPDATE ON "project_secret" FOR EACH ROW EXECUTE FUNCTION "project_secret_updated"();
 CREATE TRIGGER "project_updated" BEFORE INSERT OR UPDATE OF "name", "slug", "config" ON "project" FOR EACH ROW EXECUTE FUNCTION "project_updated"();
 ALTER TABLE ONLY "api_key"
     ADD CONSTRAINT "api_key_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
+ALTER TABLE ONLY "auth_policy"
+    ADD CONSTRAINT "auth_policy_project_id_fkey" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "identity"
     ADD CONSTRAINT "identity_parent_id_fkey" FOREIGN KEY ("parent_id") REFERENCES "identity"("id");
+ALTER TABLE ONLY "idp_session"
+    ADD CONSTRAINT "idp_session_api_key" FOREIGN KEY ("api_key_id") REFERENCES "api_key"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "idp_session"
+    ADD CONSTRAINT "idp_session_idp" FOREIGN KEY ("identity_provider_id") REFERENCES "identity_provider"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "mail_template"
     ADD CONSTRAINT "mail_template_project" FOREIGN KEY ("project_id") REFERENCES "project"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "person_auth_log"
@@ -254,12 +436,18 @@ ALTER TABLE ONLY "person_auth_log"
     ADD CONSTRAINT "person_auth_log_person_id_fkey" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE SET NULL;
 ALTER TABLE ONLY "person_auth_log"
     ADD CONSTRAINT "person_auth_log_person_token_id_fkey" FOREIGN KEY ("person_token_id") REFERENCES "person_token"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_auth_log"
+    ADD CONSTRAINT "person_auth_log_target_person_id_fkey" FOREIGN KEY ("target_person_id") REFERENCES "person"("id") ON DELETE SET NULL;
+ALTER TABLE ONLY "person_backup_code"
+    ADD CONSTRAINT "person_backup_code_person_id_fkey" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "person_identity_id_fkey" FOREIGN KEY ("identity_id") REFERENCES "identity"("id");
 ALTER TABLE ONLY "person_identity_provider"
     ADD CONSTRAINT "person_identity_provider_idp" FOREIGN KEY ("identity_provider_id") REFERENCES "identity_provider"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "person_identity_provider"
     ADD CONSTRAINT "person_identity_provider_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
+ALTER TABLE ONLY "person_mfa"
+    ADD CONSTRAINT "person_mfa_person_id_fkey" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "person_token"
     ADD CONSTRAINT "person_password_reset_person" FOREIGN KEY ("person_id") REFERENCES "person"("id") ON DELETE CASCADE;
 ALTER TABLE ONLY "project_membership"

package/dist/development/src/migrations/snapshot.js.map

@@ -1 +1 @@
-{"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\nimport { createCredentials } from './tenantCredentials'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n    'login',\n    'create_session_token',\n    'idp_login',\n    'password_reset_init',\n    'password_reset',\n    'password_change',\n    'email_change',\n    '2fa_disable',\n    '2fa_enable',\n    'passwordless_login_init',\n    'passwordless_login_exchange',\n    'passwordless_login',\n    'person_disable'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n    'always',\n    'never',\n    'optIn',\n    'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n    'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n    'password_reset',\n    'passwordless'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"expiration\" integer,\n    \"disabled_at\" timestamp with time zone\n);\nCREATE TABLE \"config\" (\n    \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n    \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n    \"passwordless_url\" \"text\",\n    \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n    \"password_min_length\" integer DEFAULT 8 NOT NULL,\n    \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n    \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n    \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n    \"password_require_special\" integer DEFAULT 0 NOT NULL,\n    \"password_pattern\" \"text\",\n    \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n    \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n    \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n    \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n    \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n    \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n    \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval\n);\nCREATE TABLE \"identity\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"parent_id\" \"uuid\",\n    \"roles\" \"jsonb\" NOT NULL,\n    \"description\" \"text\",\n    \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"configuration\" \"jsonb\" NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n    \"exclusive\" boolean DEFAULT false,\n    \"init_returns_config\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\",\n    \"mail_type\" \"text\" NOT NULL,\n    \"variant\" \"text\" NOT NULL,\n    \"subject\" \"text\" NOT NULL,\n    \"content\" \"text\" NOT NULL,\n    \"use_layout\" boolean NOT NULL,\n    \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"email\" \"text\",\n    \"password_hash\" \"text\",\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"otp_uri\" \"text\",\n    \"otp_activated_at\" timestamp with time zone,\n    \"name\" \"text\",\n    \"idp_only\" boolean DEFAULT false NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"passwordless_enabled\" boolean,\n    CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"invoked_by_id\" \"uuid\",\n    \"person_id\" \"uuid\",\n    \"person_token_id\" \"uuid\",\n    \"person_input_identifier\" \"text\",\n    \"type\" \"auth_log_type\" NOT NULL,\n    \"success\" boolean NOT NULL,\n    \"error_code\" \"text\",\n    \"error_message\" \"text\",\n    \"ip_address\" \"inet\",\n    \"user_agent\" \"text\",\n    \"identity_provider_id\" \"uuid\",\n    \"metadata\" \"jsonb\"\n);\nCREATE TABLE \"person_identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"identity_provider_id\" \"uuid\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_token\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"used_at\" timestamp with time zone,\n    \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n    \"otp_hash\" \"text\",\n    \"otp_attempts\" integer DEFAULT 0 NOT NULL\n);\nCREATE TABLE \"project\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"name\" \"text\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n    \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"membership_id\" \"uuid\" NOT NULL,\n    \"variable\" \"text\" NOT NULL,\n    \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"key\" \"text\" NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"updated_at\" timestamp with time zone NOT NULL,\n    \"value\" \"bytea\" NOT NULL,\n    \"version\" smallint NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n    ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n    ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC);\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAuRZ;AAEA,QAAM,kBAAkB,SAAS,IAAI;AACtC;"}
+{"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n    'login',\n    'create_session_token',\n    'idp_login',\n    'password_reset_init',\n    'password_reset',\n    'password_change',\n    'email_change',\n    '2fa_disable',\n    '2fa_enable',\n    'passwordless_login_init',\n    'passwordless_login_exchange',\n    'passwordless_login',\n    'person_disable',\n    'session_revoked_by_user',\n    'forced_sign_out',\n    'global_role_grant',\n    'global_role_revoke',\n    'project_membership_create',\n    'project_membership_update',\n    'project_membership_remove',\n    'api_key_create',\n    'api_key_disable',\n    'idp_create',\n    'idp_update',\n    'idp_disable',\n    'idp_enable',\n    'project_create',\n    'project_update',\n    'project_secret_change',\n    'mail_template_change',\n    'tenant_config_change',\n    'person_invite',\n    'backup_code_generated',\n    'backup_code_used',\n    'backup_code_regenerated',\n    'email_otp_sent',\n    'mfa_enrollment_required',\n    'mfa_reset',\n    'session_expired_idle',\n    'session_policy_applied',\n    'auth_policy_change',\n    'email_verify_init',\n    'email_verify_complete',\n    'email_change_init',\n    'email_change_complete',\n    'idp_session_revalidated',\n    'idp_session_revoked',\n    'idp_session_revalidation_failed',\n    'unusual_login_detected',\n    'step_up_required',\n    'idp_logout_initiated',\n    'idp_backchannel_logout',\n    'idp_role_mapped',\n    'idp_role_mapping_failed',\n    'person_enable',\n    'custom_role_change'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n    'always',\n    'never',\n    'optIn',\n    'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n    'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n    'password_reset',\n    'passwordless',\n    'mfa_email_otp',\n    'email_verification',\n    'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n    LANGUAGE \"plpgsql\"\n    AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"expiration\" integer,\n    \"disabled_at\" timestamp with time zone,\n    \"last_ip\" \"inet\",\n    \"last_user_agent\" \"text\",\n    \"last_used_at\" timestamp with time zone,\n    \"created_ip\" \"inet\",\n    \"created_user_agent\" \"text\",\n    \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n    \"issued_at\" timestamp with time zone,\n    \"idle_timeout\" interval,\n    \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"scope\" \"text\" NOT NULL,\n    \"project_id\" \"uuid\",\n    \"roles\" \"text\"[] NOT NULL,\n    \"mfa_required\" boolean,\n    \"token_expiration\" interval,\n    \"idle_timeout\" interval,\n    \"remember_me_allowed\" boolean,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n    \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n    \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n    \"passwordless_url\" \"text\",\n    \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n    \"password_min_length\" integer DEFAULT 8 NOT NULL,\n    \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n    \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n    \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n    \"password_require_special\" integer DEFAULT 0 NOT NULL,\n    \"password_pattern\" \"text\",\n    \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n    \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n    \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n    \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n    \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n    \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n    \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n    \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n    \"captcha_provider\" \"text\",\n    \"captcha_secret\" \"bytea\",\n    \"captcha_secret_version\" integer,\n    \"captcha_threshold\" double precision,\n    \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n    \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n    \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n    \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n    \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n    \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n    \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n    \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n    \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n    \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n    \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n    \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n    \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n    \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n    \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n    \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n    \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n    \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n    \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n    \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n    \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n    \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n    \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n    \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n    \"panel_global_roles\" \"text\"[] DEFAULT '{super_admin,project_admin}'::\"text\"[] NOT NULL,\n    \"panel_project_roles\" \"text\"[] DEFAULT '{admin}'::\"text\"[] NOT NULL,\n    CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n    CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"custom_role\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"description\" \"text\",\n    \"grants\" \"jsonb\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    CONSTRAINT \"custom_role_grants_check\" CHECK ((\"jsonb_typeof\"(\"grants\") = 'array'::\"text\"))\n);\nCREATE TABLE \"identity\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"parent_id\" \"uuid\",\n    \"roles\" \"jsonb\" NOT NULL,\n    \"description\" \"text\",\n    \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"type\" \"text\" NOT NULL,\n    \"configuration\" \"jsonb\" NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n    \"exclusive\" boolean DEFAULT false,\n    \"init_returns_config\" boolean DEFAULT false NOT NULL,\n    \"require_verified_email\" boolean DEFAULT false NOT NULL,\n    \"assume_email_verified\" boolean DEFAULT false NOT NULL,\n    \"disable_local_authentication\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"api_key_id\" \"uuid\" NOT NULL,\n    \"identity_provider_id\" \"uuid\" NOT NULL,\n    \"idp_session_id\" \"text\",\n    \"tokens\" \"bytea\",\n    \"tokens_version\" integer,\n    \"idp_expires_at\" timestamp with time zone,\n    \"token_obtained_at\" timestamp with time zone,\n    \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\",\n    \"mail_type\" \"text\" NOT NULL,\n    \"variant\" \"text\" NOT NULL,\n    \"subject\" \"text\" NOT NULL,\n    \"content\" \"text\" NOT NULL,\n    \"use_layout\" boolean NOT NULL,\n    \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"email\" \"text\",\n    \"password_hash\" \"text\",\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"name\" \"text\",\n    \"idp_only\" boolean DEFAULT false NOT NULL,\n    \"disabled_at\" timestamp with time zone,\n    \"passwordless_enabled\" boolean,\n    \"mfa_grace_until\" timestamp with time zone,\n    \"email_verified_at\" timestamp with time zone,\n    \"email_verification_required\" boolean DEFAULT false NOT NULL,\n    CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"invoked_by_id\" \"uuid\",\n    \"person_id\" \"uuid\",\n    \"person_token_id\" \"uuid\",\n    \"person_input_identifier\" \"text\",\n    \"type\" \"auth_log_type\" NOT NULL,\n    \"success\" boolean NOT NULL,\n    \"error_code\" \"text\",\n    \"error_message\" \"text\",\n    \"ip_address\" \"inet\",\n    \"user_agent\" \"text\",\n    \"identity_provider_id\" \"uuid\",\n    \"metadata\" \"jsonb\",\n    \"target_person_id\" \"uuid\",\n    \"event_data\" \"jsonb\",\n    \"geo_country\" \"text\",\n    \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"code_hash\" \"text\" NOT NULL,\n    \"used_at\" timestamp with time zone,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"identity_provider_id\" \"uuid\" NOT NULL,\n    \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n    \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n    \"person_id\" \"uuid\" NOT NULL,\n    \"totp_secret\" \"bytea\",\n    \"totp_secret_version\" integer,\n    \"totp_activated_at\" timestamp with time zone,\n    \"totp_pending_secret\" \"bytea\",\n    \"totp_pending_version\" integer,\n    \"totp_pending_created_at\" timestamp with time zone,\n    \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"token_hash\" \"text\" NOT NULL,\n    \"person_id\" \"uuid\" NOT NULL,\n    \"expires_at\" timestamp with time zone NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"used_at\" timestamp with time zone,\n    \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n    \"otp_hash\" \"text\",\n    \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n    \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"name\" \"text\" NOT NULL,\n    \"slug\" \"text\" NOT NULL,\n    \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n    \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"identity_id\" \"uuid\" NOT NULL,\n    \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"membership_id\" \"uuid\" NOT NULL,\n    \"variable\" \"text\" NOT NULL,\n    \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"project_id\" \"uuid\" NOT NULL,\n    \"key\" \"text\" NOT NULL,\n    \"created_at\" timestamp with time zone NOT NULL,\n    \"updated_at\" timestamp with time zone NOT NULL,\n    \"value\" \"bytea\" NOT NULL,\n    \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n    \"id\" \"uuid\" NOT NULL,\n    \"scope\" \"text\" NOT NULL,\n    \"key_hash\" \"bytea\" NOT NULL,\n    \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n    ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n    ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"custom_role\"\n    ADD CONSTRAINT \"custom_role_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"custom_role\"\n    ADD CONSTRAINT \"custom_role_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n    ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n    ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n    ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n    ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n    ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n    ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n    ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n    ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n    ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n    ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n    ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n    ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n    ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n    ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n    ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n    ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n    ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n    ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n    ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n    ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n    ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAmdZ;AAEA,QAAM,kBAAkB,SAAS,IAAI;AACtC;"}

package/dist/development/src/migrations/tenantCredentials.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"tenantCredentials.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/tenantCredentials.ts"],"sourcesContent":["import { escapeValue, MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\n\nexport const createCredentials = async (builder: MigrationBuilder, args: TenantMigrationArgs) => {\n\tconst credentials = await args.getCredentials()\n\tif (credentials.loginTokenHash) {\n\t\tconst tokenHash = credentials.loginTokenHash\n\t\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t    INSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (${escapeValue(args.providers.uuid())}, NULL, '[\"login\"]'::JSONB, 'Login key', now()) RETURNING id\n\t\t\t)\n\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\tFROM identity\n\t\t\t`)\n\t}\n\n\tif (!credentials.rootTokenHash) {\n\t\tthrow 'Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.'\n\t}\n\n\tif (credentials.rootEmail && !credentials.rootPasswordBcrypted) {\n\t\tthrow 'Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.'\n\t}\n\tconst rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || 'root@localhost' : null\n\tconst rootPasswordHash = credentials.rootPasswordBcrypted || null\n\n\tconst rootTokenHash = credentials.rootTokenHash\n\n\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t\tINSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (\n\t\t\t\t\t\t${escapeValue(args.providers.uuid())},\n\t\t\t\t\t\tNULL,\n\t\t\t\t\t\t'[\"super_admin\"]'::JSONB\n\t\t\t\t\t\t\t|| (CASE WHEN ${escapeValue(rootEmail)} IS NOT NULL THEN '[\"person\"]'::JSONB ELSE '[]'::JSONB END),\n\t\t\t\t\t\t'Superadmin',\n\t\t\t\t\t\tnow()\n\t\t\t\t\t) RETURNING id\n\t\t\t),\n\t\t\tperson AS (\n\t\t\t\tINSERT INTO person(id, email, password_hash, identity_id)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootEmail)}, ${escapeValue(rootPasswordHash)}, identity.id\n\t\t\t\tFROM identity\n\t\t\t\tWHERE ${escapeValue(rootEmail)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t),\n\t\t\tapi_key AS (\n\t\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\t\tFROM identity WHERE ${escapeValue(rootTokenHash)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t)\n\t\t\tSELECT * FROM person, api_key\n\t\t`)\n}\n"],"names":["escapeValue"],"mappings":";;;AAGO,MAAM,oBAAoB,OAAO,SAA2B,SAA8B;AAChG,QAAM,cAAc,MAAM,KAAK,eAAA;AAC/B,MAAI,YAAY,gBAAgB;AAC/B,UAAM,YAAY,YAAY;AAC9B,YAAQ,IAAI;AAAA;AAAA;AAAA,cAGAA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,YAGpCA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAKA,+BAAY,SAAS,CAAC;AAAA;AAAA,IAErE;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,eAAe;AAC/B,UAAM;AAAA,EACP;AAEA,MAAI,YAAY,aAAa,CAAC,YAAY,sBAAsB;AAC/D,UAAM;AAAA,EACP;AACA,QAAM,YAAY,YAAY,uBAAuB,YAAY,aAAa,mBAAmB;AACjG,QAAM,mBAAmB,YAAY,wBAAwB;AAE7D,QAAM,gBAAgB,YAAY;AAElC,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,QAILA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,uBAGnBA,mBAAAA,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAOhCA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAKA,mBAAAA,YAAY,SAAS,CAAC,KAAKA,mBAAAA,YAAY,gBAAgB,CAAC;AAAA;AAAA,YAEhGA,mBAAAA,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,aAKrBA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAKA,+BAAY,aAAa,CAAC;AAAA,0BACpDA,mBAAAA,YAAY,aAAa,CAAC;AAAA;AAAA;AAAA;AAAA,GAIjD;AACH;;"}
+{"version":3,"file":"tenantCredentials.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/tenantCredentials.ts"],"sourcesContent":["import { escapeValue, MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\n\nexport const createCredentials = async (builder: MigrationBuilder, args: TenantMigrationArgs) => {\n\tconst credentials = await args.getCredentials()\n\tif (credentials.loginTokenHash) {\n\t\tconst tokenHash = credentials.loginTokenHash\n\t\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t    INSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (${escapeValue(args.providers.uuid())}, NULL, '[\"login\"]'::JSONB, 'Login key', now()) RETURNING id\n\t\t\t)\n\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\tFROM identity\n\t\t\t`)\n\t}\n\n\tif (!credentials.rootTokenHash) {\n\t\tthrow 'Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.'\n\t}\n\n\tif (credentials.rootEmail && !credentials.rootPasswordBcrypted) {\n\t\tthrow 'Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.'\n\t}\n\tconst rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || 'root@localhost' : null\n\tconst rootPasswordHash = credentials.rootPasswordBcrypted || null\n\n\tconst rootTokenHash = credentials.rootTokenHash\n\n\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t\tINSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (\n\t\t\t\t\t\t${escapeValue(args.providers.uuid())},\n\t\t\t\t\t\tNULL,\n\t\t\t\t\t\t'[\"super_admin\"]'::JSONB\n\t\t\t\t\t\t\t|| (CASE WHEN ${escapeValue(rootEmail)} IS NOT NULL THEN '[\"person\"]'::JSONB ELSE '[]'::JSONB END),\n\t\t\t\t\t\t'Superadmin',\n\t\t\t\t\t\tnow()\n\t\t\t\t\t) RETURNING id\n\t\t\t),\n\t\t\tperson AS (\n\t\t\t\tINSERT INTO person(id, email, password_hash, identity_id)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootEmail)}, ${escapeValue(rootPasswordHash)}, identity.id\n\t\t\t\tFROM identity\n\t\t\t\tWHERE ${escapeValue(rootEmail)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t),\n\t\t\tapi_key AS (\n\t\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\t\tFROM identity WHERE ${escapeValue(rootTokenHash)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t)\n\t\t\tSELECT * FROM person, api_key\n\t\t`)\n}\n"],"names":["escapeValue"],"mappings":";;;AAGO,MAAM,oBAAoB,OAAO,SAA2B,SAA8B;AAChG,QAAM,cAAc,MAAM,KAAK,eAAA;AAC/B,MAAI,YAAY,gBAAgB;AAC/B,UAAM,YAAY,YAAY;AAC9B,YAAQ,IAAI;AAAA;AAAA;AAAA,cAGAA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,YAGpCA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAKA,+BAAY,SAAS,CAAC;AAAA;AAAA,IAErE;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,eAAe;AAC/B,UAAM;AAAA,EACP;AAEA,MAAI,YAAY,aAAa,CAAC,YAAY,sBAAsB;AAC/D,UAAM;AAAA,EACP;AACA,QAAM,YAAY,YAAY,uBAAuB,YAAY,aAAa,mBAAmB;AACjG,QAAM,mBAAmB,YAAY,wBAAwB;AAE7D,QAAM,gBAAgB,YAAY;AAElC,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,QAILA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,uBAGnBA,mBAAAA,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAOhCA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAKA,mBAAAA,YAAY,SAAS,CAAC,KAAKA,mBAAAA,YAAY,gBAAgB,CAAC;AAAA;AAAA,YAEhGA,mBAAAA,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,aAKrBA,mBAAAA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAKA,+BAAY,aAAa,CAAC;AAAA,0BACpDA,mBAAAA,YAAY,aAAa,CAAC;AAAA;AAAA;AAAA;AAAA,GAIjD;AACH;;"}

package/dist/development/src/migrations/tenantCredentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenantCredentials.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/tenantCredentials.ts"],"sourcesContent":["import { escapeValue, MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types'\n\nexport const createCredentials = async (builder: MigrationBuilder, args: TenantMigrationArgs) => {\n\tconst credentials = await args.getCredentials()\n\tif (credentials.loginTokenHash) {\n\t\tconst tokenHash = credentials.loginTokenHash\n\t\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t    INSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (${escapeValue(args.providers.uuid())}, NULL, '[\"login\"]'::JSONB, 'Login key', now()) RETURNING id\n\t\t\t)\n\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\tFROM identity\n\t\t\t`)\n\t}\n\n\tif (!credentials.rootTokenHash) {\n\t\tthrow 'Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.'\n\t}\n\n\tif (credentials.rootEmail && !credentials.rootPasswordBcrypted) {\n\t\tthrow 'Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.'\n\t}\n\tconst rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || 'root@localhost' : null\n\tconst rootPasswordHash = credentials.rootPasswordBcrypted || null\n\n\tconst rootTokenHash = credentials.rootTokenHash\n\n\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t\tINSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (\n\t\t\t\t\t\t${escapeValue(args.providers.uuid())},\n\t\t\t\t\t\tNULL,\n\t\t\t\t\t\t'[\"super_admin\"]'::JSONB\n\t\t\t\t\t\t\t|| (CASE WHEN ${escapeValue(rootEmail)} IS NOT NULL THEN '[\"person\"]'::JSONB ELSE '[]'::JSONB END),\n\t\t\t\t\t\t'Superadmin',\n\t\t\t\t\t\tnow()\n\t\t\t\t\t) RETURNING id\n\t\t\t),\n\t\t\tperson AS (\n\t\t\t\tINSERT INTO person(id, email, password_hash, identity_id)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootEmail)}, ${escapeValue(rootPasswordHash)}, identity.id\n\t\t\t\tFROM identity\n\t\t\t\tWHERE ${escapeValue(rootEmail)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t),\n\t\t\tapi_key AS (\n\t\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\t\tFROM identity WHERE ${escapeValue(rootTokenHash)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t)\n\t\t\tSELECT * FROM person, api_key\n\t\t`)\n}\n"],"names":[],"mappings":";AAGO,MAAM,oBAAoB,OAAO,SAA2B,SAA8B;AAChG,QAAM,cAAc,MAAM,KAAK,eAAA;AAC/B,MAAI,YAAY,gBAAgB;AAC/B,UAAM,YAAY,YAAY;AAC9B,YAAQ,IAAI;AAAA;AAAA;AAAA,cAGA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,YAGpC,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAK,YAAY,SAAS,CAAC;AAAA;AAAA,IAErE;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,eAAe;AAC/B,UAAM;AAAA,EACP;AAEA,MAAI,YAAY,aAAa,CAAC,YAAY,sBAAsB;AAC/D,UAAM;AAAA,EACP;AACA,QAAM,YAAY,YAAY,uBAAuB,YAAY,aAAa,mBAAmB;AACjG,QAAM,mBAAmB,YAAY,wBAAwB;AAE7D,QAAM,gBAAgB,YAAY;AAElC,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,QAIL,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,uBAGnB,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAOhC,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAK,YAAY,SAAS,CAAC,KAAK,YAAY,gBAAgB,CAAC;AAAA;AAAA,YAEhG,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,aAKrB,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAK,YAAY,aAAa,CAAC;AAAA,0BACpD,YAAY,aAAa,CAAC;AAAA;AAAA;AAAA;AAAA,GAIjD;AACH;"}
+{"version":3,"file":"tenantCredentials.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/tenantCredentials.ts"],"sourcesContent":["import { escapeValue, MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\n\nexport const createCredentials = async (builder: MigrationBuilder, args: TenantMigrationArgs) => {\n\tconst credentials = await args.getCredentials()\n\tif (credentials.loginTokenHash) {\n\t\tconst tokenHash = credentials.loginTokenHash\n\t\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t    INSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (${escapeValue(args.providers.uuid())}, NULL, '[\"login\"]'::JSONB, 'Login key', now()) RETURNING id\n\t\t\t)\n\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(tokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\tFROM identity\n\t\t\t`)\n\t}\n\n\tif (!credentials.rootTokenHash) {\n\t\tthrow 'Please specify a root token using CONTEMBER_ROOT_TOKEN env variable.'\n\t}\n\n\tif (credentials.rootEmail && !credentials.rootPasswordBcrypted) {\n\t\tthrow 'Please specify a root password using CONTEMBER_ROOT_PASSWORD env variable.'\n\t}\n\tconst rootEmail = credentials.rootPasswordBcrypted ? credentials.rootEmail || 'root@localhost' : null\n\tconst rootPasswordHash = credentials.rootPasswordBcrypted || null\n\n\tconst rootTokenHash = credentials.rootTokenHash\n\n\tbuilder.sql(`\n\t\t\tWITH identity AS (\n\t\t\t\tINSERT INTO identity(id, parent_id, roles, description, created_at)\n\t\t\t\tVALUES (\n\t\t\t\t\t\t${escapeValue(args.providers.uuid())},\n\t\t\t\t\t\tNULL,\n\t\t\t\t\t\t'[\"super_admin\"]'::JSONB\n\t\t\t\t\t\t\t|| (CASE WHEN ${escapeValue(rootEmail)} IS NOT NULL THEN '[\"person\"]'::JSONB ELSE '[]'::JSONB END),\n\t\t\t\t\t\t'Superadmin',\n\t\t\t\t\t\tnow()\n\t\t\t\t\t) RETURNING id\n\t\t\t),\n\t\t\tperson AS (\n\t\t\t\tINSERT INTO person(id, email, password_hash, identity_id)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootEmail)}, ${escapeValue(rootPasswordHash)}, identity.id\n\t\t\t\tFROM identity\n\t\t\t\tWHERE ${escapeValue(rootEmail)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t),\n\t\t\tapi_key AS (\n\t\t\t\tINSERT INTO api_key (id, token_hash, type, identity_id, disabled_at, expires_at, expiration, created_at)\n\t\t\t\tSELECT ${escapeValue(args.providers.uuid())}, ${escapeValue(rootTokenHash)}, 'permanent', identity.id, NULL, NULL, NULL, now()\n\t\t\t\tFROM identity WHERE ${escapeValue(rootTokenHash)} IS NOT NULL\n\t\t\t    RETURNING id\n\t\t\t)\n\t\t\tSELECT * FROM person, api_key\n\t\t`)\n}\n"],"names":[],"mappings":";AAGO,MAAM,oBAAoB,OAAO,SAA2B,SAA8B;AAChG,QAAM,cAAc,MAAM,KAAK,eAAA;AAC/B,MAAI,YAAY,gBAAgB;AAC/B,UAAM,YAAY,YAAY;AAC9B,YAAQ,IAAI;AAAA;AAAA;AAAA,cAGA,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,YAGpC,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAK,YAAY,SAAS,CAAC;AAAA;AAAA,IAErE;AAAA,EACH;AAEA,MAAI,CAAC,YAAY,eAAe;AAC/B,UAAM;AAAA,EACP;AAEA,MAAI,YAAY,aAAa,CAAC,YAAY,sBAAsB;AAC/D,UAAM;AAAA,EACP;AACA,QAAM,YAAY,YAAY,uBAAuB,YAAY,aAAa,mBAAmB;AACjG,QAAM,mBAAmB,YAAY,wBAAwB;AAE7D,QAAM,gBAAgB,YAAY;AAElC,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA,QAIL,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC;AAAA;AAAA;AAAA,uBAGnB,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAOhC,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAK,YAAY,SAAS,CAAC,KAAK,YAAY,gBAAgB,CAAC;AAAA;AAAA,YAEhG,YAAY,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,aAKrB,YAAY,KAAK,UAAU,KAAA,CAAM,CAAC,KAAK,YAAY,aAAa,CAAC;AAAA,0BACpD,YAAY,aAAa,CAAC;AAAA;AAAA;AAAA;AAAA,GAIjD;AACH;"}

package/dist/development/src/model/authorization/AclSchemaAccessNodeFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AclSchemaAccessNodeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["MembershipMatcher","memberships","DirectPermissionsAccessNode","PermissionActions"],"mappings":";;;;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAC9E,UAAM,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAIA,kBAAAA,kBAAkB,YAAY,IAAI,CAAA,QAAO;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA,CAAE;AAAA,MAAA,EACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAC,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE;AACtF,UAAM,OAAO,IAAIC,wDAAA;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAMC,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAMA,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAMA,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,GAAG,QAAQ;AAC7D,WAAK,MAAMA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAC9D,WAAK,MAAMA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAChE,WAAK,MAAMA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAMA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAAA,IAC/D;AAEA,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"AclSchemaAccessNodeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions.js'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher.js'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode.js'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["MembershipMatcher","memberships","DirectPermissionsAccessNode","PermissionActions"],"mappings":";;;;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAC9E,UAAM,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAIA,kBAAAA,kBAAkB,YAAY,IAAI,CAAA,QAAO;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA,CAAE;AAAA,MAAA,EACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAC,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE;AACtF,UAAM,OAAO,IAAIC,wDAAA;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAMC,kBAAAA,kBAAkB,cAAc,CAAA,CAAE,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAMA,kBAAAA,kBAAkB,wBAAwB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAMA,kBAAAA,kBAAkB,mBAAmB,CAAA,CAAE,GAAG,QAAQ;AAC7D,WAAK,MAAMA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAC9D,WAAK,MAAMA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAChE,WAAK,MAAMA,kBAAAA,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAMA,kBAAAA,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAAA,IAC/D;AAEA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/authorization/AclSchemaAccessNodeFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"AclSchemaAccessNodeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["memberships"],"mappings":";;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAC9E,UAAM,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAI,kBAAkB,YAAY,IAAI,CAAA,QAAO;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA,CAAE;AAAA,MAAA,EACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAA,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE;AACtF,UAAM,OAAO,IAAI,4BAAA;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAM,kBAAkB,cAAc,CAAA,CAAE,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAM,kBAAkB,wBAAwB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAM,kBAAkB,mBAAmB,CAAA,CAAE,GAAG,QAAQ;AAC7D,WAAK,MAAM,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAC9D,WAAK,MAAM,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAChE,WAAK,MAAM,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAM,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAAA,IAC/D;AAEA,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"AclSchemaAccessNodeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/AclSchemaAccessNodeFactory.ts"],"sourcesContent":["import { AccessNode } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions.js'\nimport { Acl } from '@contember/schema'\nimport { MembershipMatcher } from './MembershipMatcher.js'\nimport { DirectPermissionsAccessNode } from './DirectPermissionsAccessNode.js'\n\nexport class AclSchemaAccessNodeFactory {\n\tcreate(schema: Acl.Schema, memberships: readonly Acl.Membership[]): AccessNode {\n\t\tconst createVerifier = (getRule: (permissions: Acl.TenantPermissions) => Acl.MembershipMatchRule) => {\n\t\t\tconst membershipMatcher = new MembershipMatcher(memberships.map(it => ({\n\t\t\t\t...it,\n\t\t\t\tmatchRule: getRule(schema.roles[it.role]?.tenant ?? {}),\n\t\t\t})))\n\n\t\t\treturn ({ memberships }: { memberships: readonly Acl.Membership[] }) => {\n\t\t\t\treturn memberships.every(it => membershipMatcher.matches(it))\n\t\t\t}\n\t\t}\n\n\t\tconst membershipRoles = memberships.map(it => schema.roles[it.role]).filter(it => !!it)\n\t\tconst node = new DirectPermissionsAccessNode()\n\n\t\tif (membershipRoles.some(it => it.tenant?.invite)) {\n\t\t\tconst verifier = createVerifier(it => it.invite && it.invite !== true ? it.invite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.unmanagedInvite)) {\n\t\t\tconst verifier = createVerifier(it => it.unmanagedInvite && it.unmanagedInvite !== true ? it.unmanagedInvite : it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PERSON_INVITE_UNMANAGED([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.manage)) {\n\t\t\tconst verifier = createVerifier(it => it.manage ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_ADD_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_UPDATE_MEMBER([]), verifier)\n\t\t\tnode.allow(PermissionActions.PROJECT_REMOVE_MEMBER([]), verifier)\n\t\t}\n\n\t\tif (membershipRoles.some(it => it.tenant?.view)) {\n\t\t\tconst verifier = createVerifier(it => it.view ?? {})\n\t\t\tnode.allow(PermissionActions.PROJECT_VIEW_MEMBER([]), verifier)\n\t\t}\n\n\t\treturn node\n\t}\n}\n"],"names":["memberships"],"mappings":";;;AAMO,MAAM,2BAA2B;AAAA,EACvC,OAAO,QAAoB,aAAoD;AAC9E,UAAM,iBAAiB,CAAC,YAA6E;AACpG,YAAM,oBAAoB,IAAI,kBAAkB,YAAY,IAAI,CAAA,QAAO;AAAA,QACtE,GAAG;AAAA,QACH,WAAW,QAAQ,OAAO,MAAM,GAAG,IAAI,GAAG,UAAU,CAAA,CAAE;AAAA,MAAA,EACrD,CAAC;AAEH,aAAO,CAAC,EAAE,aAAAA,mBAA8D;AACvE,eAAOA,aAAY,MAAM,CAAA,OAAM,kBAAkB,QAAQ,EAAE,CAAC;AAAA,MAC7D;AAAA,IACD;AAEA,UAAM,kBAAkB,YAAY,IAAI,CAAA,OAAM,OAAO,MAAM,GAAG,IAAI,CAAC,EAAE,OAAO,CAAA,OAAM,CAAC,CAAC,EAAE;AACtF,UAAM,OAAO,IAAI,4BAAA;AAEjB,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,GAAG,WAAW,OAAO,GAAG,SAAS,GAAG,UAAU,CAAA,CAAE;AACnG,WAAK,MAAM,kBAAkB,cAAc,CAAA,CAAE,GAAG,QAAQ;AAAA,IACzD;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,eAAe,GAAG;AAC3D,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,mBAAmB,GAAG,oBAAoB,OAAO,GAAG,kBAAkB,GAAG,UAAU,CAAA,CAAE;AAC9H,WAAK,MAAM,kBAAkB,wBAAwB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACnE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,MAAM,GAAG;AAClD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,UAAU,EAAE;AACrD,WAAK,MAAM,kBAAkB,mBAAmB,CAAA,CAAE,GAAG,QAAQ;AAC7D,WAAK,MAAM,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAC9D,WAAK,MAAM,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAChE,WAAK,MAAM,kBAAkB,sBAAsB,CAAA,CAAE,GAAG,QAAQ;AAAA,IACjE;AAEA,QAAI,gBAAgB,KAAK,CAAA,OAAM,GAAG,QAAQ,IAAI,GAAG;AAChD,YAAM,WAAW,eAAe,CAAA,OAAM,GAAG,QAAQ,EAAE;AACnD,WAAK,MAAM,kBAAkB,oBAAoB,CAAA,CAAE,GAAG,QAAQ;AAAA,IAC/D;AAEA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/authorization/CustomRoleAuthorizator.cjs

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const authorization = require("@contember/authorization");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../type/ApiKey.cjs");
+const CustomRolesQuery = require("../queries/customRole/CustomRolesQuery.cjs");
+require("./PermissionActions.cjs");
+const IdentityScope = require("./IdentityScope.cjs");
+const CustomRolePermissions = require("./CustomRolePermissions.cjs");
+require("./PermissionContext.cjs");
+require("./TargetIdentityPermission.cjs");
+require("@contember/schema");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class CustomRolePermissionCache {
+  constructor(db) {
+    this.db = db;
+    __publicField(this, "loading");
+  }
+  /**
+   * One query, two maps. `projectScoped` holds only the grants that carry their own project
+   * filter, because the scope itself is not passed down to `Permissions.isAllowed`.
+   */
+  load() {
+    this.loading ?? (this.loading = this.db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery()).then((rows) => ({
+      global: CustomRolePermissions.buildCustomRolePermissions(rows),
+      projectScoped: CustomRolePermissions.buildCustomRolePermissions(rows, { projectScoped: true })
+    })));
+    return this.loading;
+  }
+}
+const isProjectBoundedScope = (scope) => !(scope instanceof authorization.AuthorizationScope.Global) && !(scope instanceof IdentityScope.IdentityScope);
+class CustomRoleAuthorizator {
+  constructor(inner, db, customRoleCache = new CustomRolePermissionCache(db)) {
+    this.inner = inner;
+    this.customRoleCache = customRoleCache;
+  }
+  /**
+   * Loads the definitions up front so no later check has to query mid-transaction —
+   * that would need a second pooled connection while the first one is pinned. No-op
+   * for identities carrying only built-in roles.
+   */
+  async preload(roles) {
+    if (roles.some((role) => !CustomRolePermissions.BUILTIN_TENANT_ROLES.has(role))) {
+      await this.customRoleCache.load();
+    }
+  }
+  async isAllowed(identity, scope, action) {
+    if (await this.inner.isAllowed(identity, scope, action)) {
+      return true;
+    }
+    const customRoles = identity.roles.filter((role) => !CustomRolePermissions.BUILTIN_TENANT_ROLES.has(role));
+    if (customRoles.length === 0) {
+      return false;
+    }
+    const loaded = await this.customRoleCache.load();
+    const permissions = isProjectBoundedScope(scope) ? loaded.projectScoped : loaded.global;
+    return customRoles.some((role) => permissions.isAllowed(role, action.resource, action.privilege, action.meta));
+  }
+}
+exports.CustomRoleAuthorizator = CustomRoleAuthorizator;
+exports.CustomRolePermissionCache = CustomRolePermissionCache;
+//# sourceMappingURL=CustomRoleAuthorizator.cjs.map