@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/model/service/RolesManager.js

@@ -1,40 +1,39 @@
 import "../type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
-import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { ResponseOk, ResponseError } from "../utils/Response.js";
 import { PatchIdentityGlobalRoles } from "../commands/identity/PatchIdentityGlobalRoles.js";
-import "../authorization/PermissionActions.js";
-import "@contember/authorization";
-import { TenantRole } from "../authorization/Roles.js";
-import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
-import "@contember/schema";
+import { GlobalRoleValidator } from "./GlobalRoleValidator.js";
 class RolesManager {
+  constructor(globalRoleValidator = new GlobalRoleValidator()) {
+    this.globalRoleValidator = globalRoleValidator;
+  }
   async addGlobalRoles(dbContext, identityId, roles) {
+    return await dbContext.transaction(async (db) => {
+      const validation = await this.validateAddedGlobalRoles(db, roles);
+      if (!validation.ok) {
+        return validation;
+      }
+      return await this.addValidatedGlobalRoles(db, identityId, roles);
+    }, { isolation: "readCommitted" });
+  }
+  async addValidatedGlobalRoles(dbContext, identityId, roles) {
     return this.patchGlobalRoles(dbContext, identityId, roles, []);
   }
+  async validateAddedGlobalRoles(dbContext, roles) {
+    const invalidRole = await this.globalRoleValidator.findInvalidRole(dbContext, roles);
+    return invalidRole === null ? new ResponseOk(null) : new ResponseError("INVALID_ROLE", `Role ${invalidRole} is not valid or globally assignable`);
+  }
   async removeGlobalRoles(dbContext, identityId, roles) {
     return this.patchGlobalRoles(dbContext, identityId, [], roles);
   }
   async patchGlobalRoles(dbContext, identityId, addRoles, removeRoles) {
-    const rolesValidationError = this.validateRoles([...addRoles, ...removeRoles]);
-    if (rolesValidationError) {
-      return rolesValidationError;
-    }
     const result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles));
     if (!result) {
       return new ResponseError("IDENTITY_NOT_FOUND", `Identity ${identityId} not found`);
     }
     return new ResponseOk(null);
   }
-  validateRoles(roles) {
-    for (const role of roles) {
-      if (!Object.values(TenantRole).includes(role)) {
-        return new ResponseError("INVALID_ROLE", `Role ${role} is not valid`);
-      }
-    }
-    return null;
-  }
 }
 export {
   RolesManager

package/dist/production/src/model/service/RolesManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"RolesManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { PatchIdentityGlobalRoles } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { TenantRole } from '../authorization'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":[],"mappings":";;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAO,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAI,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"RolesManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { PatchIdentityGlobalRoles } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { GlobalRoleValidator } from './GlobalRoleValidator.js'\nimport { Connection } from '@contember/database'\n\nexport class RolesManager {\n\tconstructor(\n\t\tprivate readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),\n\t) {\n\t}\n\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\tconst validation = await this.validateAddedGlobalRoles(db, roles)\n\t\t\tif (!validation.ok) {\n\t\t\t\treturn validation\n\t\t\t}\n\t\t\treturn await this.addValidatedGlobalRoles(db, identityId, roles)\n\t\t}, { isolation: 'readCommitted' })\n\t}\n\n\tasync addValidatedGlobalRoles(\n\t\tdbContext: DatabaseContext<Connection.TransactionLike>,\n\t\tidentityId: string,\n\t\troles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync validateAddedGlobalRoles(dbContext: DatabaseContext, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst invalidRole = await this.globalRoleValidator.findInvalidRole(dbContext, roles)\n\t\treturn invalidRole === null\n\t\t\t? new ResponseOk(null)\n\t\t\t: new ResponseError('INVALID_ROLE', `Role ${invalidRole} is not valid or globally assignable`)\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":[],"mappings":";;;;;;AAMO,MAAM,aAAa;AAAA,EACzB,YACkB,sBAA2C,IAAI,uBAC/D;AADgB,SAAA,sBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,YAAM,aAAa,MAAM,KAAK,yBAAyB,IAAI,KAAK;AAChE,UAAI,CAAC,WAAW,IAAI;AACnB,eAAO;AAAA,MACR;AACA,aAAO,MAAM,KAAK,wBAAwB,IAAI,YAAY,KAAK;AAAA,IAChE,GAAG,EAAE,WAAW,iBAAiB;AAAA,EAClC;AAAA,EAEA,MAAM,wBACL,WACA,YACA,OACgD;AAChD,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,yBAAyB,WAA4B,OAAyE;AACnI,UAAM,cAAc,MAAM,KAAK,oBAAoB,gBAAgB,WAAW,KAAK;AACnF,WAAO,gBAAgB,OACpB,IAAI,WAAW,IAAI,IACnB,IAAI,cAAc,gBAAgB,QAAQ,WAAW,sCAAsC;AAAA,EAC/F;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}

package/dist/production/src/model/service/SecretsManager.cjs

@@ -7,10 +7,12 @@ const SetProjectSecretCommand = require("../commands/project/SetProjectSecretCom
 const UpdateProjectCommand = require("../commands/project/UpdateProjectCommand.cjs");
 require("../queries/apiKey/ApiKeyQuery.cjs");
 const ProjectSecretsQuery = require("../queries/project/ProjectSecretsQuery.cjs");
+const ProjectSecretKeysQuery = require("../queries/project/ProjectSecretKeysQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 class SecretsManager {
   constructor(providers) {
@@ -19,6 +21,10 @@ class SecretsManager {
   async setSecret(dbContext, projectId, key, value) {
     await this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }]);
   }
+  /** Lists secret keys (with timestamps) without decrypting any values. */
+  async listSecretKeys(dbContext, projectId) {
+    return await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery.ProjectSecretKeysQuery(projectId));
+  }
   async readSecrets(dbContext, projectId) {
     const result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery.ProjectSecretsQuery(projectId, this.providers));
     const forUpdate = result.filter((it) => it.needsReEncrypt);

package/dist/production/src/model/service/SecretsManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SecretsManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { Providers } from '../providers'\nimport { ProjectSecretsQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":["ProjectSecretsQuery","SetProjectSecretCommand","UpdateProjectCommand"],"mappings":";;;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIA,oBAAAA,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;;"}
+{"version":3,"file":"SecretsManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { Providers } from '../providers.js'\nimport { ProjectSecretInfoRow, ProjectSecretKeysQuery, ProjectSecretsQuery } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\t/** Lists secret keys (with timestamps) without decrypting any values. */\n\tpublic async listSecretKeys(dbContext: DatabaseContext, projectId: string): Promise<ProjectSecretInfoRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery(projectId))\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":["ProjectSecretKeysQuery","ProjectSecretsQuery","SetProjectSecretCommand","UpdateProjectCommand"],"mappings":";;;;;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA;AAAA,EAGA,MAAa,eAAe,WAA4B,WAAoD;AAC3G,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIA,uBAAAA,uBAAuB,SAAS,CAAC;AAAA,EAChF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;;"}

package/dist/production/src/model/service/SecretsManager.js

@@ -5,10 +5,12 @@ import { SetProjectSecretCommand } from "../commands/project/SetProjectSecretCom
 import { UpdateProjectCommand } from "../commands/project/UpdateProjectCommand.js";
 import "../queries/apiKey/ApiKeyQuery.js";
 import { ProjectSecretsQuery } from "../queries/project/ProjectSecretsQuery.js";
+import { ProjectSecretKeysQuery } from "../queries/project/ProjectSecretKeysQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 class SecretsManager {
   constructor(providers) {
@@ -17,6 +19,10 @@ class SecretsManager {
   async setSecret(dbContext, projectId, key, value) {
     await this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }]);
   }
+  /** Lists secret keys (with timestamps) without decrypting any values. */
+  async listSecretKeys(dbContext, projectId) {
+    return await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery(projectId));
+  }
   async readSecrets(dbContext, projectId) {
     const result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers));
     const forUpdate = result.filter((it) => it.needsReEncrypt);

package/dist/production/src/model/service/SecretsManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecretsManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { Providers } from '../providers'\nimport { ProjectSecretsQuery } from '../queries'\nimport { DatabaseContext } from '../utils'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAI,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;"}
+{"version":3,"file":"SecretsManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { Providers } from '../providers.js'\nimport { ProjectSecretInfoRow, ProjectSecretKeysQuery, ProjectSecretsQuery } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\t/** Lists secret keys (with timestamps) without decrypting any values. */\n\tpublic async listSecretKeys(dbContext: DatabaseContext, projectId: string): Promise<ProjectSecretInfoRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery(projectId))\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA;AAAA,EAGA,MAAa,eAAe,WAA4B,WAAoD;AAC3G,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,uBAAuB,SAAS,CAAC;AAAA,EAChF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAI,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;"}

package/dist/production/src/model/service/SignInManager.cjs

@@ -2,22 +2,34 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 require("../queries/apiKey/ApiKeyQuery.cjs");
 require("@contember/database");
+require("../type/ApiKey.cjs");
+const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
 const exceptions = require("../../exceptions.cjs");
 const PersonQuery = require("../queries/person/PersonQuery.cjs");
+const LocalAuthDisablingIdpsQuery = require("../queries/idp/LocalAuthDisablingIdpsQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 const Response = require("../utils/Response.cjs");
 const AuthLogService = require("./AuthLogService.cjs");
+require("node:crypto");
+const SetMfaGraceUntilCommand = require("../commands/person/SetMfaGraceUntilCommand.cjs");
+const interval = require("../utils/interval.cjs");
 class SignInManager {
-  constructor(apiKeyManager, providers, otpAuthenticator) {
+  constructor(apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer) {
     this.apiKeyManager = apiKeyManager;
     this.providers = providers;
-    this.otpAuthenticator = otpAuthenticator;
+    this.otpManager = otpManager;
+    this.backupCodeManager = backupCodeManager;
+    this.emailOtpManager = emailOtpManager;
+    this.authPolicyResolver = authPolicyResolver;
+    this.loginRiskAnalyzer = loginRiskAnalyzer;
+    this.userMailer = userMailer;
   }
-  async signIn(dbContext, email, password, expiration, otpCode) {
+  async signIn(dbContext, email, password, expiration, otpCode, requestInfo, trustForwardedInfo, backupCode, config, geoCountry) {
     const person = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byEmail(email));
     if (person === null) {
       return new Response.ResponseError("UNKNOWN_EMAIL", `Person with email ${email} not found`, {
@@ -32,6 +44,10 @@ class SignInManager {
         personId: person.id
       })
     };
+    const exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery.LocalAuthDisablingIdpsQuery(person.id));
+    if (exclusiveIdps.length > 0) {
+      return new Response.ResponseError("IDP_REQUIRED", `Sign in using ${exclusiveIdps.join(" or ")}`, authLogData);
+    }
     if (!person.password_hash) {
       return new Response.ResponseError("NO_PASSWORD_SET", `No password set`, authLogData);
     }
@@ -42,18 +58,219 @@ class SignInManager {
     if (!passwordValid) {
       return new Response.ResponseError("INVALID_PASSWORD", `Password does not match`, authLogData);
     }
-    if (person.otp_uri && person.otp_activated_at) {
-      if (!otpCode) {
+    if (person.email_verification_required && person.email_verified_at === null) {
+      return new Response.ResponseError("EMAIL_NOT_VERIFIED", `E-mail address has not been verified`, authLogData);
+    }
+    let usedBackupCode = false;
+    let mfaSatisfiedThisRequest = false;
+    const hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at);
+    if (hasActiveTotp) {
+      if (otpCode) {
+        if (!await this.otpManager.verifyOtp(dbContext, person, otpCode)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        mfaSatisfiedThisRequest = true;
+      } else if (backupCode) {
+        if (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        usedBackupCode = true;
+        mfaSatisfiedThisRequest = true;
+      } else {
         return new Response.ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, authLogData);
       }
-      if (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {
+    } else if (person.email_otp_enabled) {
+      if (otpCode) {
+        if (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        mfaSatisfiedThisRequest = true;
+      } else if (backupCode) {
+        if (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+        }
+        usedBackupCode = true;
+        mfaSatisfiedThisRequest = true;
+      } else {
+        const emailOtpConfig = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(dbContext.providers));
+        const decision = await this.emailOtpManager.sendCode(dbContext, person, emailOtpConfig);
+        return new Response.ResponseError("OTP_REQUIRED", `2FA is enabled. OTP token is required`, {
+          emailOtpSent: decision.ok,
+          ...authLogData
+        });
+      }
+    } else {
+      const enforcement = await this.enforceMfaEnrollment(dbContext, person, otpCode, authLogData);
+      if (enforcement !== null) {
+        if ("error" in enforcement) {
+          return enforcement;
+        }
+        const riskHandled2 = await this.applyRiskPolicy(dbContext, person, {
+          config,
+          geoCountry,
+          requestInfo,
+          otpCode,
+          mfaSatisfiedThisRequest: true,
+          authLogData
+        });
+        if (riskHandled2 !== null && "error" in riskHandled2) {
+          return riskHandled2;
+        }
+        const sessionToken2 = await this.apiKeyManager.createSessionApiKey(
+          dbContext,
+          person.identity_id,
+          expiration,
+          requestInfo,
+          trustForwardedInfo
+        );
+        return new Response.ResponseOk({
+          person,
+          token: sessionToken2,
+          backupCodes: enforcement.backupCodes,
+          unusualLoginDetected: riskHandled2?.unusualLoginDetected || void 0,
+          risk: riskHandled2?.risk,
+          ...authLogData
+        });
+      }
+    }
+    const riskHandled = await this.applyRiskPolicy(dbContext, person, {
+      config,
+      geoCountry,
+      requestInfo,
+      otpCode,
+      mfaSatisfiedThisRequest,
+      authLogData
+    });
+    if (riskHandled !== null && "error" in riskHandled) {
+      return riskHandled;
+    }
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo);
+    return new Response.ResponseOk({
+      person,
+      token: sessionToken,
+      usedBackupCode,
+      unusualLoginDetected: riskHandled?.unusualLoginDetected || void 0,
+      risk: riskHandled?.risk,
+      ...authLogData
+    });
+  }
+  /**
+   * A03 — evaluate the sign-in risk score and act per policy. Returns:
+   * - `null` when anomaly detection is off or no `config` was supplied (the
+   *   default): no DB work, sign-in proceeds unchanged.
+   * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email
+   *   was sent (best-effort) but the session may still be issued.
+   * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was
+   *   supplied — reuses the email-OTP step-up channel (dispatches a code).
+   * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but
+   *   did not verify. A valid code consumes the token and the session is issued.
+   * - `{ unusualLoginDetected: false }` when the score was below every threshold.
+   *
+   * The audit entries (`unusual_login_detected`, `step_up_required`) are emitted
+   * by the resolver from the response metadata, matching the project convention.
+   */
+  async applyRiskPolicy(dbContext, person, args) {
+    const { config, geoCountry, requestInfo, otpCode, mfaSatisfiedThisRequest, authLogData } = args;
+    const policy = config?.login.anomalyDetection;
+    if (!config || !policy?.enabled) {
+      return null;
+    }
+    const assessment = await this.loginRiskAnalyzer.analyze(dbContext, person.id, {
+      geoCountry: geoCountry ?? null,
+      deviceFingerprint: this.loginRiskAnalyzer.fingerprint(requestInfo?.userAgent),
+      ip: requestInfo?.ip ?? null
+    }, policy);
+    if (assessment.action === "allow") {
+      return { unusualLoginDetected: false };
+    }
+    const riskMeta = { score: assessment.score, reasons: assessment.reasons };
+    if (assessment.action === "stepUp" && !mfaSatisfiedThisRequest) {
+      if (otpCode) {
+        if (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {
+          return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", {
+            stepUpRequired: true,
+            unusualLoginDetected: true,
+            risk: riskMeta,
+            ...authLogData
+          });
+        }
+      } else {
+        const decision = await this.emailOtpManager.sendCode(dbContext, person, config);
+        return new Response.ResponseError("OTP_REQUIRED", "Additional verification is required for this sign-in", {
+          emailOtpSent: decision.ok,
+          stepUpRequired: true,
+          unusualLoginDetected: true,
+          risk: riskMeta,
+          ...authLogData
+        });
+      }
+    }
+    await this.sendUnusualLoginEmail(dbContext, person, geoCountry ?? null, requestInfo?.ip ?? null);
+    return { unusualLoginDetected: true, risk: riskMeta };
+  }
+  async sendUnusualLoginEmail(dbContext, person, geoCountry, ip) {
+    if (!person.email) {
+      return;
+    }
+    try {
+      await this.userMailer.sendUnusualLoginEmail(dbContext, {
+        email: person.email,
+        geoCountry,
+        ipAddress: ip
+      }, { projectId: null, variant: "" });
+    } catch {
+    }
+  }
+  /**
+   * A06 enforcement for the no-active-factor case. Returns:
+   * - `null` when MFA is not required, or grace currently allows sign-in
+   *   (caller proceeds to issue a session as normal). With zero auth_policy
+   *   rows this is always the outcome — no behavior change.
+   * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to
+   *   enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.
+   * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP
+   *   promoted to active); caller issues the session.
+   */
+  async enforceMfaEnrollment(dbContext, person, otpCode, authLogData) {
+    const policy = await this.authPolicyResolver.resolveForIdentity(dbContext, person.identity_id, person.roles);
+    if (!policy.mfaRequired) {
+      return null;
+    }
+    let graceSeconds;
+    if (policy.graceDuration !== null) {
+      graceSeconds = interval.intervalToSeconds(policy.graceDuration);
+    } else {
+      const config = await dbContext.queryHandler.fetch(new ConfigurationQuery.ConfigurationQuery(dbContext.providers));
+      graceSeconds = interval.intervalToSeconds(config.login.mfaGraceDuration);
+    }
+    if (person.mfa_grace_until !== null) {
+      if (person.is_in_grace) {
+        return null;
+      }
+    } else if (graceSeconds > 0) {
+      await dbContext.commandBus.execute(new SetMfaGraceUntilCommand.SetMfaGraceUntilCommand(person.id, graceSeconds));
+      return null;
+    }
+    if (otpCode && person.otp_pending_secret) {
+      if (!await this.otpManager.verifyPendingOtp(person, otpCode)) {
         return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
       }
+      const promoted = await this.otpManager.confirmOtp(dbContext, person);
+      if (!promoted) {
+        return new Response.ResponseError("INVALID_OTP_TOKEN", "OTP token validation has failed", authLogData);
+      }
+      const backupCodes = await this.backupCodeManager.generate(dbContext, person.id);
+      return { backupCodes };
     }
-    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
-    return new Response.ResponseOk({ person, token: sessionToken, ...authLogData });
+    const otp = await this.otpManager.prepareOtp(dbContext, person, "Contember");
+    const mfaEnrollment = { otpUri: otp.uri, otpSecret: otp.secret };
+    return new Response.ResponseError("MFA_ENROLLMENT_REQUIRED", "MFA enrollment is required", {
+      mfaEnrollmentRequired: true,
+      mfaEnrollment,
+      ...authLogData
+    });
   }
-  async createSessionToken(dbContext, personIdentifier, expiration, verifier) {
+  async createSessionToken(dbContext, personIdentifier, expiration, verifier, requestInfo, trustForwardedInfo) {
     const person = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byUniqueIdentifier(personIdentifier));
     if (person === null) {
       if (personIdentifier.type === "email") {
@@ -81,7 +298,7 @@ class SignInManager {
       });
     }
     await verifier?.(person);
-    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration);
+    const sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo);
     return new Response.ResponseOk({
       person,
       token: sessionToken,

package/dist/production/src/model/service/SignInManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, SignInErrorCode } from '../../schema'\nimport { ApiKeyManager, OtpAuthenticator } from '../service'\nimport { PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries'\nimport { Providers } from '../providers'\nimport { DatabaseContext } from '../utils'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { ImplementationException } from '../../exceptions'\nimport { AuthLogService } from './AuthLogService'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpAuthenticator: OtpAuthenticator,\n\t) {}\n\n\tasync signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\tif (person.otp_uri && person.otp_activated_at) {\n\t\t\tif (!otpCode) {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\n\t\t\tif (!this.otpAuthenticator.validate({ uri: person.otp_uri }, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\n\t\treturn new ResponseOk({ person, token: sessionToken, ...authLogData })\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":["PersonQuery","ResponseError","AuthLogService","ResponseOk","ImplementationException"],"mappings":";;;;;;;;;;;;;AASA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,kBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,WAA4B,OAAe,UAAkB,YAAqB,SAA2C;AACzI,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMA,wBAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAACA,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAID,SAAAA,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIA,SAAAA,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAEA,QAAI,OAAO,WAAW,OAAO,kBAAkB;AAC9C,UAAI,CAAC,SAAS;AACb,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAEA,UAAI,CAAC,KAAK,iBAAiB,SAAS,EAAE,KAAK,OAAO,WAAW,OAAO,GAAG;AACtE,eAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AAAA,IACD;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAE3G,WAAO,IAAIE,SAAAA,WAAW,EAAE,QAAQ,OAAO,cAAc,GAAG,aAAa;AAAA,EACtE;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMH,wBAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAID,SAAAA,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAIE,WAAAA,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIH,SAAAA,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,UAAU;AAC3G,WAAO,IAAIC,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAACD,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;;"}
+{"version":3,"file":"SignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, MfaEnrollment, SignInErrorCode } from '../../schema/index.js'\nimport { ApiKeyManager, AuthPolicyResolver, BackupCodeManager, EmailOtpManager, LoginRiskAnalyzer, OtpManager } from '../service/index.js'\nimport { ConfigurationQuery, LocalAuthDisablingIdpsQuery, PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries/index.js'\nimport { Config } from '../type/Config.js'\nimport { Providers } from '../providers.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ApiKeyRequestInfo, SetMfaGraceUntilCommand } from '../commands/index.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly emailOtpManager: EmailOtpManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t\tprivate readonly loginRiskAnalyzer: LoginRiskAnalyzer,\n\t\tprivate readonly userMailer: UserMailer,\n\t) {}\n\n\tasync signIn(\n\t\tdbContext: DatabaseContext,\n\t\temail: string,\n\t\tpassword: string,\n\t\texpiration?: number,\n\t\totpCode?: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t\tbackupCode?: string,\n\t\tconfig?: Config,\n\t\tgeoCountry?: string,\n\t): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\t// Refused before the password is even looked at: for a person federated\n\t\t// through a provider with `disableLocalAuthentication`, a password is not a\n\t\t// credential this tenant accepts, however it got set.\n\t\tconst exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id))\n\t\tif (exclusiveIdps.length > 0) {\n\t\t\treturn new ResponseError('IDP_REQUIRED', `Sign in using ${exclusiveIdps.join(' or ')}`, authLogData)\n\t\t}\n\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\t// Block sign-in for accounts that were created while email verification\n\t\t// was required but never proved ownership. Accounts predating the\n\t\t// requirement carry email_verification_required = false and pass through.\n\t\tif (person.email_verification_required && person.email_verified_at === null) {\n\t\t\treturn new ResponseError('EMAIL_NOT_VERIFIED', `E-mail address has not been verified`, authLogData)\n\t\t}\n\n\t\tlet usedBackupCode = false\n\t\t// Whether a second factor was actively proven in THIS request. Anomaly\n\t\t// step-up (A03) reuses this: a login that already cleared a second factor\n\t\t// is not asked to step up again.\n\t\tlet mfaSatisfiedThisRequest = false\n\t\tconst hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at)\n\t\tif (hasActiveTotp) {\n\t\t\t// Active TOTP takes precedence (A07 path, unchanged).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.otpManager.verifyOtp(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\t\t} else if (person.email_otp_enabled) {\n\t\t\t// No active TOTP, but email OTP is enabled (A05).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\t// Dispatch a fresh code and ask the client to retry with otpToken. Reuses\n\t\t\t\t// the existing OTP_REQUIRED contract so clients that already handle it work.\n\t\t\t\t// The send is rate-limited per person; when throttled nothing is emailed\n\t\t\t\t// (emailOtpSent: false) but a previously emailed code stays valid.\n\t\t\t\t// Independent fetch (not the passed-in `config`): the email-OTP send is\n\t\t\t\t// rate-limited by the live config and this branch never reaches the\n\t\t\t\t// anomaly analyzer, so query shape stays as before A03.\n\t\t\t\tconst emailOtpConfig = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, emailOtpConfig)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t} else {\n\t\t\t// No active factor at all (A06). Enforce MFA if a matching auth_policy\n\t\t\t// requires it. With no policy rows configured this resolves to\n\t\t\t// mfaRequired=false and sign-in proceeds exactly as before.\n\t\t\tconst enforcement = await this.enforceMfaEnrollment(dbContext, person, otpCode, authLogData)\n\t\t\tif (enforcement !== null) {\n\t\t\t\tif ('error' in enforcement) {\n\t\t\t\t\treturn enforcement\n\t\t\t\t}\n\t\t\t\t// Enrollment completed in this request (pending TOTP promoted to active),\n\t\t\t\t// so MFA is definitively satisfied — anomaly step-up cannot apply.\n\t\t\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\t\t\tconfig,\n\t\t\t\t\tgeoCountry,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\totpCode,\n\t\t\t\t\tmfaSatisfiedThisRequest: true,\n\t\t\t\t\tauthLogData,\n\t\t\t\t})\n\t\t\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\t\t\treturn riskHandled\n\t\t\t\t}\n\t\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(\n\t\t\t\t\tdbContext,\n\t\t\t\t\tperson.identity_id,\n\t\t\t\t\texpiration,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\ttrustForwardedInfo,\n\t\t\t\t)\n\t\t\t\treturn new ResponseOk({\n\t\t\t\t\tperson,\n\t\t\t\t\ttoken: sessionToken,\n\t\t\t\t\tbackupCodes: enforcement.backupCodes,\n\t\t\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected || undefined,\n\t\t\t\t\trisk: riskHandled?.risk,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\tconfig,\n\t\t\tgeoCountry,\n\t\t\trequestInfo,\n\t\t\totpCode,\n\t\t\tmfaSatisfiedThisRequest,\n\t\t\tauthLogData,\n\t\t})\n\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\treturn riskHandled\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\tusedBackupCode,\n\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected || undefined,\n\t\t\trisk: riskHandled?.risk,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\t/**\n\t * A03 — evaluate the sign-in risk score and act per policy. Returns:\n\t * - `null` when anomaly detection is off or no `config` was supplied (the\n\t *   default): no DB work, sign-in proceeds unchanged.\n\t * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email\n\t *   was sent (best-effort) but the session may still be issued.\n\t * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was\n\t *   supplied — reuses the email-OTP step-up channel (dispatches a code).\n\t * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but\n\t *   did not verify. A valid code consumes the token and the session is issued.\n\t * - `{ unusualLoginDetected: false }` when the score was below every threshold.\n\t *\n\t * The audit entries (`unusual_login_detected`, `step_up_required`) are emitted\n\t * by the resolver from the response metadata, matching the project convention.\n\t */\n\tprivate async applyRiskPolicy(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\targs: {\n\t\t\tconfig?: Config\n\t\t\tgeoCountry?: string\n\t\t\trequestInfo?: ApiKeyRequestInfo\n\t\t\totpCode?: string\n\t\t\tmfaSatisfiedThisRequest: boolean\n\t\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag }\n\t\t},\n\t): Promise<RiskPolicyOutcome> {\n\t\tconst { config, geoCountry, requestInfo, otpCode, mfaSatisfiedThisRequest, authLogData } = args\n\t\tconst policy = config?.login.anomalyDetection\n\t\tif (!config || !policy?.enabled) {\n\t\t\treturn null\n\t\t}\n\n\t\tconst assessment = await this.loginRiskAnalyzer.analyze(dbContext, person.id, {\n\t\t\tgeoCountry: geoCountry ?? null,\n\t\t\tdeviceFingerprint: this.loginRiskAnalyzer.fingerprint(requestInfo?.userAgent),\n\t\t\tip: requestInfo?.ip ?? null,\n\t\t}, policy)\n\n\t\tif (assessment.action === 'allow') {\n\t\t\treturn { unusualLoginDetected: false }\n\t\t}\n\n\t\tconst riskMeta = { score: assessment.score, reasons: assessment.reasons }\n\n\t\tif (assessment.action === 'stepUp' && !mfaSatisfiedThisRequest) {\n\t\t\t// Reuse the existing email-OTP step-up channel. This is independent of\n\t\t\t// `person.email_otp_enabled`, which gates email OTP only as the *primary*\n\t\t\t// second factor (A05); the step-up challenge stands on its own, so a person\n\t\t\t// with no standing MFA can still complete it. Without consuming the code\n\t\t\t// here, such a person would never satisfy the step-up and would loop on\n\t\t\t// OTP_REQUIRED forever (the score is unchanged on every retry).\n\t\t\tif (otpCode) {\n\t\t\t\t// Retry leg: the client resent the emailed code as otpToken. Mirror the\n\t\t\t\t// A05 contract — an invalid code is rejected (not re-sent); the per-code\n\t\t\t\t// 3-attempt cap still applies, and a fresh code is issued only when the\n\t\t\t\t// client retries without a code.\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\t// A failed *forced* second factor is itself an anomaly signal — carry the\n\t\t\t\t\t// step-up/risk metadata so the resolver still emits unusual_login_detected\n\t\t\t\t\t// + step_up_required with the score/reasons, rather than logging it as an\n\t\t\t\t\t// ordinary mistyped-OTP login indistinguishable from a normal 2FA typo.\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t\t...authLogData,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\t// Step-up satisfied this request — fall through to notify + allow below.\n\t\t\t} else {\n\t\t\t\t// First leg: dispatch a code and ask the client to retry with otpToken.\n\t\t\t\t// Rate-limited per person; a previously emailed code stays valid when throttled.\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, config)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', 'Additional verification is required for this sign-in', {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\t// action === 'email', or step-up satisfied (already this request, or just now\n\t\t// via the emailed code): notify the person of the unusual sign-in. A failed\n\t\t// email must never block sign-in.\n\t\tawait this.sendUnusualLoginEmail(dbContext, person, geoCountry ?? null, requestInfo?.ip ?? null)\n\t\treturn { unusualLoginDetected: true, risk: riskMeta }\n\t}\n\n\tprivate async sendUnusualLoginEmail(dbContext: DatabaseContext, person: PersonRow, geoCountry: string | null, ip: string | null): Promise<void> {\n\t\tif (!person.email) {\n\t\t\t// No address to notify (e.g. an IDP-only person) — nothing to send.\n\t\t\treturn\n\t\t}\n\t\ttry {\n\t\t\tawait this.userMailer.sendUnusualLoginEmail(dbContext, {\n\t\t\t\temail: person.email,\n\t\t\t\tgeoCountry,\n\t\t\t\tipAddress: ip,\n\t\t\t}, { projectId: null, variant: '' })\n\t\t} catch {\n\t\t\t// ignore — informational only\n\t\t}\n\t}\n\n\t/**\n\t * A06 enforcement for the no-active-factor case. Returns:\n\t * - `null` when MFA is not required, or grace currently allows sign-in\n\t *   (caller proceeds to issue a session as normal). With zero auth_policy\n\t *   rows this is always the outcome — no behavior change.\n\t * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to\n\t *   enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.\n\t * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP\n\t *   promoted to active); caller issues the session.\n\t */\n\tprivate async enforceMfaEnrollment(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\totpCode: string | undefined,\n\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag },\n\t): Promise<\n\t\t| null\n\t\t| ResponseError<SignInErrorCode, {\n\t\t\temailOtpSent?: boolean\n\t\t\tmfaEnrollmentRequired?: boolean\n\t\t\tmfaEnrollment?: MfaEnrollment\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}>\n\t\t| { backupCodes: string[] }\n\t> {\n\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(dbContext, person.identity_id, person.roles)\n\t\tif (!policy.mfaRequired) {\n\t\t\treturn null\n\t\t}\n\n\t\t// Resolve the effective grace duration (seconds). A per-policy override\n\t\t// wins; otherwise we fall back to the global config default. Only fetch the\n\t\t// config when the override is absent, to keep query shapes minimal.\n\t\tlet graceSeconds: number\n\t\tif (policy.graceDuration !== null) {\n\t\t\tgraceSeconds = intervalToSeconds(policy.graceDuration)\n\t\t} else {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\tgraceSeconds = intervalToSeconds(config.login.mfaGraceDuration)\n\t\t}\n\n\t\t// Grace handling. Default grace duration is 0 (immediate enforcement), so\n\t\t// by default neither branch below opens a window. Whether we're still inside\n\t\t// an open window is decided on the DB clock (PersonRow.is_in_grace, evaluated\n\t\t// against now()); the null check below only distinguishes \"never opened\" from\n\t\t// \"opened (and possibly expired)\". See engine-tenant-api/CLAUDE.md.\n\t\tif (person.mfa_grace_until !== null) {\n\t\t\tif (person.is_in_grace) {\n\t\t\t\t// Still inside an open grace window — allow sign-in.\n\t\t\t\treturn null\n\t\t\t}\n\t\t\t// Grace expired → fall through to enforcement.\n\t\t} else if (graceSeconds > 0) {\n\t\t\t// Open the grace window (now() + graceSeconds on the DB clock) and allow this sign-in.\n\t\t\tawait dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceSeconds))\n\t\t\treturn null\n\t\t}\n\n\t\t// Enforce.\n\t\tif (otpCode && person.otp_pending_secret) {\n\t\t\t// Enrollment completion: verify against the pending secret, then promote.\n\t\t\tif (!await this.otpManager.verifyPendingOtp(person, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst promoted = await this.otpManager.confirmOtp(dbContext, person)\n\t\t\tif (!promoted) {\n\t\t\t\t// Lost a concurrent enrollment-completion race: the pending secret was\n\t\t\t\t// already promoted by the other request (which issued the backup codes).\n\t\t\t\t// Don't regenerate here — that would invalidate the codes already\n\t\t\t\t// returned. TOTP is now active, so a retry signs in via the normal path.\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst backupCodes = await this.backupCodeManager.generate(dbContext, person.id)\n\t\t\treturn { backupCodes }\n\t\t}\n\n\t\t// Provision a fresh pending TOTP secret and ask the client to enroll.\n\t\tconst otp = await this.otpManager.prepareOtp(dbContext, person, 'Contember')\n\t\tconst mfaEnrollment: MfaEnrollment = { otpUri: otp.uri, otpSecret: otp.secret }\n\t\treturn new ResponseError('MFA_ENROLLMENT_REQUIRED', 'MFA enrollment is required', {\n\t\t\tmfaEnrollmentRequired: true,\n\t\t\tmfaEnrollment,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\n/** A03: greppable payload describing why a sign-in scored as unusual. */\nexport interface RiskMeta {\n\treadonly score: number\n\treadonly reasons: readonly string[]\n}\n\n/**\n * Result of {@link SignInManager.applyRiskPolicy}: `null` = feature off / no\n * config; a metadata object when the session may still be issued; a\n * `ResponseError` when step-up blocks the session.\n */\ntype RiskPolicyOutcome =\n\t| null\n\t| { unusualLoginDetected: boolean; risk?: RiskMeta }\n\t| ResponseError<SignInErrorCode, {\n\t\temailOtpSent?: boolean\n\t\tstepUpRequired?: boolean\n\t\tunusualLoginDetected?: boolean\n\t\trisk?: RiskMeta\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t/** True when MFA was satisfied by consuming a backup code (instead of a TOTP token). */\n\treadonly usedBackupCode?: boolean\n\t/** Set when sign-in completed an MFA enrollment (A06): the freshly issued backup codes, shown once. */\n\treadonly backupCodes?: string[]\n\t/** A03: true when this sign-in scored as unusual and an UNUSUAL_LOGIN email was sent. */\n\treadonly unusualLoginDetected?: boolean\n\t/** A03: the risk score + reasons, recorded in the `unusual_login_detected` audit `event_data`. */\n\treadonly risk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t/** Set on an OTP_REQUIRED error when an email-OTP code was just dispatched (A05). */\n\temailOtpSent?: boolean\n\t/** Set on a MFA_ENROLLMENT_REQUIRED error (A06): triggers the `mfa_enrollment_required` audit. */\n\tmfaEnrollmentRequired?: boolean\n\t/** Set on a MFA_ENROLLMENT_REQUIRED error (A06): the pending secret the client must enroll. */\n\tmfaEnrollment?: MfaEnrollment\n\t/** Set on an OTP_REQUIRED error raised by A03 anomaly step-up: triggers the `step_up_required` audit. */\n\tstepUpRequired?: boolean\n\t/** A03: true when the sign-in scored as unusual (triggers the `unusual_login_detected` audit). */\n\tunusualLoginDetected?: boolean\n\t/** A03: the risk score + reasons, recorded in the audit `event_data`. */\n\trisk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":["PersonQuery","ResponseError","AuthLogService","LocalAuthDisablingIdpsQuery","ConfigurationQuery","riskHandled","sessionToken","ResponseOk","intervalToSeconds","SetMfaGraceUntilCommand","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;AAaA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,YACA,mBACA,iBACA,oBACA,mBACA,YAChB;AARgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,kBAAA;AACA,SAAA,qBAAA;AACA,SAAA,oBAAA;AACA,SAAA,aAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,WACA,OACA,UACA,YACA,SACA,aACA,oBACA,YACA,QACA,YAC0B;AAC1B,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMA,wBAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAACA,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAKF,UAAM,gBAAgB,MAAM,UAAU,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,OAAO,EAAE,CAAC;AACnG,QAAI,cAAc,SAAS,GAAG;AAC7B,aAAO,IAAIF,SAAAA,cAAc,gBAAgB,iBAAiB,cAAc,KAAK,MAAM,CAAC,IAAI,WAAW;AAAA,IACpG;AAEA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAIA,SAAAA,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIA,SAAAA,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAKA,QAAI,OAAO,+BAA+B,OAAO,sBAAsB,MAAM;AAC5E,aAAO,IAAIA,SAAAA,cAAc,sBAAsB,wCAAwC,WAAW;AAAA,IACnG;AAEA,QAAI,iBAAiB;AAIrB,QAAI,0BAA0B;AAC9B,UAAM,gBAAgB,QAAQ,OAAO,cAAc,OAAO,gBAAgB;AAC1E,QAAI,eAAe;AAElB,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,WAAW,UAAU,WAAW,QAAQ,OAAO,GAAG;AACjE,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AACN,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAAA,IACD,WAAW,OAAO,mBAAmB;AAEpC,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAC7E,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AAQN,cAAM,iBAAiB,MAAM,UAAU,aAAa,MAAM,IAAIG,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AACrG,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,cAAc;AACtF,eAAO,IAAIH,SAAAA,cAAc,gBAAgB,yCAAyC;AAAA,UACjF,cAAc,SAAS;AAAA,UACvB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD,OAAO;AAIN,YAAM,cAAc,MAAM,KAAK,qBAAqB,WAAW,QAAQ,SAAS,WAAW;AAC3F,UAAI,gBAAgB,MAAM;AACzB,YAAI,WAAW,aAAa;AAC3B,iBAAO;AAAA,QACR;AAGA,cAAMI,eAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,UACjE;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,yBAAyB;AAAA,UACzB;AAAA,QAAA,CACA;AACD,YAAIA,iBAAgB,QAAQ,WAAWA,cAAa;AACnD,iBAAOA;AAAAA,QACR;AACA,cAAMC,gBAAe,MAAM,KAAK,cAAc;AAAA,UAC7C;AAAA,UACA,OAAO;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,QAAA;AAED,eAAO,IAAIC,SAAAA,WAAW;AAAA,UACrB;AAAA,UACA,OAAOD;AAAAA,UACP,aAAa,YAAY;AAAA,UACzB,sBAAsBD,cAAa,wBAAwB;AAAA,UAC3D,MAAMA,cAAa;AAAA,UACnB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAEA,UAAM,cAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACA;AACD,QAAI,gBAAgB,QAAQ,WAAW,aAAa;AACnD,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAE5I,WAAO,IAAIE,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,sBAAsB,aAAa,wBAAwB;AAAA,MAC3D,MAAM,aAAa;AAAA,MACnB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAc,gBACb,WACA,QACA,MAQ6B;AAC7B,UAAM,EAAE,QAAQ,YAAY,aAAa,SAAS,yBAAyB,gBAAgB;AAC3F,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,CAAC,UAAU,CAAC,QAAQ,SAAS;AAChC,aAAO;AAAA,IACR;AAEA,UAAM,aAAa,MAAM,KAAK,kBAAkB,QAAQ,WAAW,OAAO,IAAI;AAAA,MAC7E,YAAY,cAAc;AAAA,MAC1B,mBAAmB,KAAK,kBAAkB,YAAY,aAAa,SAAS;AAAA,MAC5E,IAAI,aAAa,MAAM;AAAA,IAAA,GACrB,MAAM;AAET,QAAI,WAAW,WAAW,SAAS;AAClC,aAAO,EAAE,sBAAsB,MAAA;AAAA,IAChC;AAEA,UAAM,WAAW,EAAE,OAAO,WAAW,OAAO,SAAS,WAAW,QAAA;AAEhE,QAAI,WAAW,WAAW,YAAY,CAAC,yBAAyB;AAO/D,UAAI,SAAS;AAKZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAK7E,iBAAO,IAAIN,SAAAA,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,gBAAgB;AAAA,YAChB,sBAAsB;AAAA,YACtB,MAAM;AAAA,YACN,GAAG;AAAA,UAAA,CACH;AAAA,QACF;AAAA,MAED,OAAO;AAGN,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,MAAM;AAC9E,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,wDAAwD;AAAA,UAChG,cAAc,SAAS;AAAA,UACvB,gBAAgB;AAAA,UAChB,sBAAsB;AAAA,UACtB,MAAM;AAAA,UACN,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAKA,UAAM,KAAK,sBAAsB,WAAW,QAAQ,cAAc,MAAM,aAAa,MAAM,IAAI;AAC/F,WAAO,EAAE,sBAAsB,MAAM,MAAM,SAAA;AAAA,EAC5C;AAAA,EAEA,MAAc,sBAAsB,WAA4B,QAAmB,YAA2B,IAAkC;AAC/I,QAAI,CAAC,OAAO,OAAO;AAElB;AAAA,IACD;AACA,QAAI;AACH,YAAM,KAAK,WAAW,sBAAsB,WAAW;AAAA,QACtD,OAAO,OAAO;AAAA,QACd;AAAA,QACA,WAAW;AAAA,MAAA,GACT,EAAE,WAAW,MAAM,SAAS,IAAI;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,qBACb,WACA,QACA,SACA,aAUC;AACD,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,WAAW,OAAO,aAAa,OAAO,KAAK;AAC3G,QAAI,CAAC,OAAO,aAAa;AACxB,aAAO;AAAA,IACR;AAKA,QAAI;AACJ,QAAI,OAAO,kBAAkB,MAAM;AAClC,qBAAeO,SAAAA,kBAAkB,OAAO,aAAa;AAAA,IACtD,OAAO;AACN,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIJ,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AAC7F,qBAAeI,SAAAA,kBAAkB,OAAO,MAAM,gBAAgB;AAAA,IAC/D;AAOA,QAAI,OAAO,oBAAoB,MAAM;AACpC,UAAI,OAAO,aAAa;AAEvB,eAAO;AAAA,MACR;AAAA,IAED,WAAW,eAAe,GAAG;AAE5B,YAAM,UAAU,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,OAAO,IAAI,YAAY,CAAC;AACvF,aAAO;AAAA,IACR;AAGA,QAAI,WAAW,OAAO,oBAAoB;AAEzC,UAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,OAAO,GAAG;AAC7D,eAAO,IAAIR,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,WAAW,MAAM,KAAK,WAAW,WAAW,WAAW,MAAM;AACnE,UAAI,CAAC,UAAU;AAKd,eAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,WAAW,OAAO,EAAE;AAC9E,aAAO,EAAE,YAAA;AAAA,IACV;AAGA,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,WAAW,QAAQ,WAAW;AAC3E,UAAM,gBAA+B,EAAE,QAAQ,IAAI,KAAK,WAAW,IAAI,OAAA;AACvE,WAAO,IAAIA,SAAAA,cAAc,2BAA2B,8BAA8B;AAAA,MACjF,uBAAuB;AAAA,MACvB;AAAA,MACA,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACA,aACA,oBACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMD,wBAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAID,SAAAA,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAIQ,WAAAA,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIT,SAAAA,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAC5I,WAAO,IAAIK,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;;"}