@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/model/service/apiKey/UnpersistedApiKeyManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnpersistedApiKeyManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/UnpersistedApiKeyManager.ts"],"sourcesContent":["import { computeTokenHash, isTokenHash, timingSafeCompareHash, TokenHash } from '../../utils/index.js'\nimport { TenantRole } from '../../authorization/index.js'\nimport { VerifyResult } from './ApiKeyManager.js'\n\n/**\n * Well-known identity id used for super-admin identities authenticated via an\n * unpersisted (configured) root token. The id is stable so that audit logs and\n * created entities consistently reference the same virtual identity, even\n * though no row exists in the `identity` table.\n */\nexport const UNPERSISTED_ROOT_IDENTITY_ID = 'f3b2c4d6-0000-4000-8000-000000000001'\n\n/**\n * Well-known identity id for the pre-sign-in caller of a first-party UI served by the engine (the\n * management panel's login screen). It holds exactly {@link TenantRole.LOGIN} and exists only in\n * memory, so the surface it opens is fixed by this file rather than by whatever token an operator\n * happened to configure.\n */\nexport const UNPERSISTED_LOGIN_IDENTITY_ID = 'f3b2c4d6-0000-4000-8000-000000000002'\n\nconst unpersistedIdentityIds: ReadonlySet<string> = new Set([UNPERSISTED_ROOT_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID])\n\n/**\n * Whether an identity id is one of the virtual identities above, i.e. has no row in `identity`.\n * Anything writing a foreign key to `identity` must ask first — see `AuthLogService`.\n */\nexport const isUnpersistedIdentityId = (identityId: string | undefined): boolean => identityId !== undefined && unpersistedIdentityIds.has(identityId)\n\n/**\n * The pre-sign-in caller of an engine-served UI, as an already-verified result. There is no token to\n * present: the surface is reached by being routed there, so nothing is compared and nothing is read\n * from the database.\n */\nexport const createUnpersistedLoginVerifyResult = (): VerifyResult =>\n\tnew VerifyResult(UNPERSISTED_LOGIN_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID, [TenantRole.LOGIN], null, false)\n\nexport interface UnpersistedApiKey {\n\treadonly tokenHash: TokenHash\n\treadonly identityId: string\n\treadonly roles: readonly string[]\n}\n\n/**\n * Verifies incoming tokens against a fixed set of root tokens configured out of\n * band (env/config) instead of being stored in the database. This enables token\n * rotation without database writes and avoids persisting the token hash.\n *\n * Token hashes are compared in constant time to avoid leaking information about\n * the configured secret.\n */\nexport class UnpersistedApiKeyManager {\n\tprivate readonly apiKeys: readonly UnpersistedApiKey[]\n\n\tconstructor(apiKeys: readonly UnpersistedApiKey[] = []) {\n\t\tthis.apiKeys = apiKeys\n\t}\n\n\tget isEmpty(): boolean {\n\t\treturn this.apiKeys.length === 0\n\t}\n\n\tverify(token: string): VerifyResult | null {\n\t\tif (this.apiKeys.length === 0) {\n\t\t\treturn null\n\t\t}\n\t\tconst tokenHash = computeTokenHash(token)\n\t\t// Iterate over all configured keys (no early return) so that matching\n\t\t// remains independent of the position of the matching key.\n\t\tlet matched: UnpersistedApiKey | null = null\n\t\tfor (const apiKey of this.apiKeys) {\n\t\t\tif (timingSafeCompareHash(tokenHash, apiKey.tokenHash)) {\n\t\t\t\tmatched = apiKey\n\t\t\t}\n\t\t}\n\t\tif (matched === null) {\n\t\t\treturn null\n\t\t}\n\t\treturn new VerifyResult(\n\t\t\tmatched.identityId,\n\t\t\t// There is no persisted api_key row, so there is no api key id.\n\t\t\tmatched.identityId,\n\t\t\t[...matched.roles],\n\t\t\tnull,\n\t\t\tfalse,\n\t\t)\n\t}\n\n\tstatic createRootApiKey(tokenHash: TokenHash): UnpersistedApiKey {\n\t\treturn {\n\t\t\ttokenHash,\n\t\t\tidentityId: UNPERSISTED_ROOT_IDENTITY_ID,\n\t\t\troles: [TenantRole.SUPER_ADMIN],\n\t\t}\n\t}\n\n\t/**\n\t * Builds a manager for unpersisted super-admin root tokens from configured\n\t * plain tokens and/or pre-computed token hashes.\n\t */\n\tstatic createForRootTokens(input: {\n\t\ttokens?: readonly string[]\n\t\ttokenHashes?: readonly string[]\n\t}): UnpersistedApiKeyManager {\n\t\tconst hashes: TokenHash[] = []\n\t\tfor (const token of input.tokens ?? []) {\n\t\t\tif (token.length === 0) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\thashes.push(computeTokenHash(token))\n\t\t}\n\t\tfor (const hash of input.tokenHashes ?? []) {\n\t\t\tif (hash.length === 0) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst normalized = hash.toLowerCase()\n\t\t\tif (!isTokenHash(normalized)) {\n\t\t\t\tthrow new Error(`Invalid unpersisted root token hash: expected a 64-character sha256 hex string.`)\n\t\t\t}\n\t\t\thashes.push(normalized)\n\t\t}\n\t\treturn new UnpersistedApiKeyManager(hashes.map(it => UnpersistedApiKeyManager.createRootApiKey(it)))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAUO,MAAM,+BAA+B;AAQrC,MAAM,gCAAgC;AAE7C,MAAM,yBAA8C,oBAAI,IAAI,CAAC,8BAA8B,6BAA6B,CAAC;AAMlH,MAAM,0BAA0B,CAAC,eAA4C,eAAe,UAAa,uBAAuB,IAAI,UAAU;AAO9I,MAAM,qCAAqC,MACjD,IAAI,aAAa,+BAA+B,+BAA+B,CAAC,WAAW,KAAK,GAAG,MAAM,KAAK;AAgBxG,MAAM,yBAAyB;AAAA,EAGrC,YAAY,UAAwC,IAAI;AAFxD,kBAAA,MAAiB,SAAA;AAGhB,SAAK,UAAU;AAAA,EAChB;AAAA,EAEA,IAAI,UAAmB;AACtB,WAAO,KAAK,QAAQ,WAAW;AAAA,EAChC;AAAA,EAEA,OAAO,OAAoC;AAC1C,QAAI,KAAK,QAAQ,WAAW,GAAG;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,YAAY,iBAAiB,KAAK;AAGxC,QAAI,UAAoC;AACxC,eAAW,UAAU,KAAK,SAAS;AAClC,UAAI,sBAAsB,WAAW,OAAO,SAAS,GAAG;AACvD,kBAAU;AAAA,MACX;AAAA,IACD;AACA,QAAI,YAAY,MAAM;AACrB,aAAO;AAAA,IACR;AACA,WAAO,IAAI;AAAA,MACV,QAAQ;AAAA;AAAA,MAER,QAAQ;AAAA,MACR,CAAC,GAAG,QAAQ,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,OAAO,iBAAiB,WAAyC;AAChE,WAAO;AAAA,MACN;AAAA,MACA,YAAY;AAAA,MACZ,OAAO,CAAC,WAAW,WAAW;AAAA,IAAA;AAAA,EAEhC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,oBAAoB,OAGE;AAC5B,UAAM,SAAsB,CAAA;AAC5B,eAAW,SAAS,MAAM,UAAU,CAAA,GAAI;AACvC,UAAI,MAAM,WAAW,GAAG;AACvB;AAAA,MACD;AACA,aAAO,KAAK,iBAAiB,KAAK,CAAC;AAAA,IACpC;AACA,eAAW,QAAQ,MAAM,eAAe,CAAA,GAAI;AAC3C,UAAI,KAAK,WAAW,GAAG;AACtB;AAAA,MACD;AACA,YAAM,aAAa,KAAK,YAAA;AACxB,UAAI,CAAC,YAAY,UAAU,GAAG;AAC7B,cAAM,IAAI,MAAM,iFAAiF;AAAA,MAClG;AACA,aAAO,KAAK,UAAU;AAAA,IACvB;AACA,WAAO,IAAI,yBAAyB,OAAO,IAAI,QAAM,yBAAyB,iBAAiB,EAAE,CAAC,CAAC;AAAA,EACpG;AACD;"}

package/dist/production/src/model/service/captcha/CaptchaValidator.cjs

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class CaptchaValidator {
+  constructor(providers) {
+    this.providers = providers;
+  }
+  /** True when the tenant has opted into captcha (provider+secret both set). */
+  isEnabled(config) {
+    return config.provider !== null && config.secret !== null && config.secret !== "";
+  }
+  /**
+   * True when captcha is configured AND enforced for the given flow. A single
+   * provider/secret is shared; `config.captcha.protect` decides per-flow which
+   * mutations actually require a token.
+   */
+  isEnabledFor(config, flow) {
+    return this.isEnabled(config) && config.protect[flow];
+  }
+  /**
+   * Extract just the captcha-relevant fields from a loaded tenant Config so
+   * services only pass what they need.
+   */
+  extractConfig(config) {
+    return {
+      provider: config.captcha.provider ?? null,
+      secret: config.captchaSecret,
+      threshold: config.captcha.threshold ?? null,
+      protect: {
+        signUp: config.captcha.protect.signUp,
+        passwordReset: config.captcha.protect.passwordReset,
+        passwordlessInit: config.captcha.protect.passwordlessInit,
+        emailVerification: config.captcha.protect.emailVerification
+      }
+    };
+  }
+  async verify(args) {
+    if (!this.isEnabled(args.config) || !args.config.provider || !args.config.secret) {
+      return { ok: true, skipped: true };
+    }
+    if (!args.token) {
+      return { ok: false, reason: "invalid", detail: "captcha token missing" };
+    }
+    const handler = this.providers[args.config.provider];
+    if (!handler) {
+      return { ok: false, reason: "verify_error", detail: `no handler registered for provider ${args.config.provider}` };
+    }
+    return await handler.verify({
+      token: args.token,
+      secret: args.config.secret,
+      remoteIp: args.remoteIp,
+      threshold: args.config.threshold
+    });
+  }
+}
+exports.CaptchaValidator = CaptchaValidator;
+//# sourceMappingURL=CaptchaValidator.cjs.map

package/dist/production/src/model/service/captcha/CaptchaValidator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CaptchaValidator.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/CaptchaValidator.ts"],"sourcesContent":["import { Config } from '../../type/Config.js'\nimport { CaptchaProvider as CaptchaProviderKey } from '../../../schema/index.js'\nimport { CaptchaProviderHandler, CaptchaVerifyResult } from './CaptchaProvider.js'\n\n/** Mutations that can be individually gated by captcha (config.captcha.protect). */\nexport type CaptchaProtectedFlow = 'signUp' | 'passwordReset' | 'passwordlessInit' | 'emailVerification'\n\nexport interface CaptchaConfig {\n\treadonly provider: CaptchaProviderKey | null\n\treadonly secret: string | null\n\treadonly threshold: number | null\n\treadonly protect: Record<CaptchaProtectedFlow, boolean>\n}\n\nexport class CaptchaValidator {\n\tconstructor(\n\t\tprivate readonly providers: Record<CaptchaProviderKey, CaptchaProviderHandler>,\n\t) {}\n\n\t/** True when the tenant has opted into captcha (provider+secret both set). */\n\tpublic isEnabled(config: CaptchaConfig): boolean {\n\t\treturn config.provider !== null && config.secret !== null && config.secret !== ''\n\t}\n\n\t/**\n\t * True when captcha is configured AND enforced for the given flow. A single\n\t * provider/secret is shared; `config.captcha.protect` decides per-flow which\n\t * mutations actually require a token.\n\t */\n\tpublic isEnabledFor(config: CaptchaConfig, flow: CaptchaProtectedFlow): boolean {\n\t\treturn this.isEnabled(config) && config.protect[flow]\n\t}\n\n\t/**\n\t * Extract just the captcha-relevant fields from a loaded tenant Config so\n\t * services only pass what they need.\n\t */\n\tpublic extractConfig(config: Config): CaptchaConfig {\n\t\treturn {\n\t\t\tprovider: config.captcha.provider ?? null,\n\t\t\tsecret: config.captchaSecret,\n\t\t\tthreshold: config.captcha.threshold ?? null,\n\t\t\tprotect: {\n\t\t\t\tsignUp: config.captcha.protect.signUp,\n\t\t\t\tpasswordReset: config.captcha.protect.passwordReset,\n\t\t\t\tpasswordlessInit: config.captcha.protect.passwordlessInit,\n\t\t\t\temailVerification: config.captcha.protect.emailVerification,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync verify(args: {\n\t\tconfig: CaptchaConfig\n\t\ttoken: string | null | undefined\n\t\tremoteIp?: string\n\t}): Promise<CaptchaVerifyResult | { ok: true; skipped: true }> {\n\t\tif (!this.isEnabled(args.config) || !args.config.provider || !args.config.secret) {\n\t\t\treturn { ok: true, skipped: true }\n\t\t}\n\t\tif (!args.token) {\n\t\t\treturn { ok: false, reason: 'invalid', detail: 'captcha token missing' }\n\t\t}\n\t\tconst handler = this.providers[args.config.provider]\n\t\tif (!handler) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: `no handler registered for provider ${args.config.provider}` }\n\t\t}\n\t\treturn await handler.verify({\n\t\t\ttoken: args.token,\n\t\t\tsecret: args.config.secret,\n\t\t\tremoteIp: args.remoteIp,\n\t\t\tthreshold: args.config.threshold,\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;AAcO,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA;AAAA,EAGI,UAAU,QAAgC;AAChD,WAAO,OAAO,aAAa,QAAQ,OAAO,WAAW,QAAQ,OAAO,WAAW;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOO,aAAa,QAAuB,MAAqC;AAC/E,WAAO,KAAK,UAAU,MAAM,KAAK,OAAO,QAAQ,IAAI;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,cAAc,QAA+B;AACnD,WAAO;AAAA,MACN,UAAU,OAAO,QAAQ,YAAY;AAAA,MACrC,QAAQ,OAAO;AAAA,MACf,WAAW,OAAO,QAAQ,aAAa;AAAA,MACvC,SAAS;AAAA,QACR,QAAQ,OAAO,QAAQ,QAAQ;AAAA,QAC/B,eAAe,OAAO,QAAQ,QAAQ;AAAA,QACtC,kBAAkB,OAAO,QAAQ,QAAQ;AAAA,QACzC,mBAAmB,OAAO,QAAQ,QAAQ;AAAA,MAAA;AAAA,IAC3C;AAAA,EAEF;AAAA,EAEA,MAAM,OAAO,MAIkD;AAC9D,QAAI,CAAC,KAAK,UAAU,KAAK,MAAM,KAAK,CAAC,KAAK,OAAO,YAAY,CAAC,KAAK,OAAO,QAAQ;AACjF,aAAO,EAAE,IAAI,MAAM,SAAS,KAAA;AAAA,IAC7B;AACA,QAAI,CAAC,KAAK,OAAO;AAChB,aAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,QAAQ,wBAAA;AAAA,IAChD;AACA,UAAM,UAAU,KAAK,UAAU,KAAK,OAAO,QAAQ;AACnD,QAAI,CAAC,SAAS;AACb,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,sCAAsC,KAAK,OAAO,QAAQ,GAAA;AAAA,IAC/G;AACA,WAAO,MAAM,QAAQ,OAAO;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,OAAO;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,IAAA,CACvB;AAAA,EACF;AACD;;"}

package/dist/production/src/model/service/captcha/CaptchaValidator.js

@@ -0,0 +1,56 @@
+class CaptchaValidator {
+  constructor(providers) {
+    this.providers = providers;
+  }
+  /** True when the tenant has opted into captcha (provider+secret both set). */
+  isEnabled(config) {
+    return config.provider !== null && config.secret !== null && config.secret !== "";
+  }
+  /**
+   * True when captcha is configured AND enforced for the given flow. A single
+   * provider/secret is shared; `config.captcha.protect` decides per-flow which
+   * mutations actually require a token.
+   */
+  isEnabledFor(config, flow) {
+    return this.isEnabled(config) && config.protect[flow];
+  }
+  /**
+   * Extract just the captcha-relevant fields from a loaded tenant Config so
+   * services only pass what they need.
+   */
+  extractConfig(config) {
+    return {
+      provider: config.captcha.provider ?? null,
+      secret: config.captchaSecret,
+      threshold: config.captcha.threshold ?? null,
+      protect: {
+        signUp: config.captcha.protect.signUp,
+        passwordReset: config.captcha.protect.passwordReset,
+        passwordlessInit: config.captcha.protect.passwordlessInit,
+        emailVerification: config.captcha.protect.emailVerification
+      }
+    };
+  }
+  async verify(args) {
+    if (!this.isEnabled(args.config) || !args.config.provider || !args.config.secret) {
+      return { ok: true, skipped: true };
+    }
+    if (!args.token) {
+      return { ok: false, reason: "invalid", detail: "captcha token missing" };
+    }
+    const handler = this.providers[args.config.provider];
+    if (!handler) {
+      return { ok: false, reason: "verify_error", detail: `no handler registered for provider ${args.config.provider}` };
+    }
+    return await handler.verify({
+      token: args.token,
+      secret: args.config.secret,
+      remoteIp: args.remoteIp,
+      threshold: args.config.threshold
+    });
+  }
+}
+export {
+  CaptchaValidator
+};
+//# sourceMappingURL=CaptchaValidator.js.map

package/dist/production/src/model/service/captcha/CaptchaValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CaptchaValidator.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/CaptchaValidator.ts"],"sourcesContent":["import { Config } from '../../type/Config.js'\nimport { CaptchaProvider as CaptchaProviderKey } from '../../../schema/index.js'\nimport { CaptchaProviderHandler, CaptchaVerifyResult } from './CaptchaProvider.js'\n\n/** Mutations that can be individually gated by captcha (config.captcha.protect). */\nexport type CaptchaProtectedFlow = 'signUp' | 'passwordReset' | 'passwordlessInit' | 'emailVerification'\n\nexport interface CaptchaConfig {\n\treadonly provider: CaptchaProviderKey | null\n\treadonly secret: string | null\n\treadonly threshold: number | null\n\treadonly protect: Record<CaptchaProtectedFlow, boolean>\n}\n\nexport class CaptchaValidator {\n\tconstructor(\n\t\tprivate readonly providers: Record<CaptchaProviderKey, CaptchaProviderHandler>,\n\t) {}\n\n\t/** True when the tenant has opted into captcha (provider+secret both set). */\n\tpublic isEnabled(config: CaptchaConfig): boolean {\n\t\treturn config.provider !== null && config.secret !== null && config.secret !== ''\n\t}\n\n\t/**\n\t * True when captcha is configured AND enforced for the given flow. A single\n\t * provider/secret is shared; `config.captcha.protect` decides per-flow which\n\t * mutations actually require a token.\n\t */\n\tpublic isEnabledFor(config: CaptchaConfig, flow: CaptchaProtectedFlow): boolean {\n\t\treturn this.isEnabled(config) && config.protect[flow]\n\t}\n\n\t/**\n\t * Extract just the captcha-relevant fields from a loaded tenant Config so\n\t * services only pass what they need.\n\t */\n\tpublic extractConfig(config: Config): CaptchaConfig {\n\t\treturn {\n\t\t\tprovider: config.captcha.provider ?? null,\n\t\t\tsecret: config.captchaSecret,\n\t\t\tthreshold: config.captcha.threshold ?? null,\n\t\t\tprotect: {\n\t\t\t\tsignUp: config.captcha.protect.signUp,\n\t\t\t\tpasswordReset: config.captcha.protect.passwordReset,\n\t\t\t\tpasswordlessInit: config.captcha.protect.passwordlessInit,\n\t\t\t\temailVerification: config.captcha.protect.emailVerification,\n\t\t\t},\n\t\t}\n\t}\n\n\tasync verify(args: {\n\t\tconfig: CaptchaConfig\n\t\ttoken: string | null | undefined\n\t\tremoteIp?: string\n\t}): Promise<CaptchaVerifyResult | { ok: true; skipped: true }> {\n\t\tif (!this.isEnabled(args.config) || !args.config.provider || !args.config.secret) {\n\t\t\treturn { ok: true, skipped: true }\n\t\t}\n\t\tif (!args.token) {\n\t\t\treturn { ok: false, reason: 'invalid', detail: 'captcha token missing' }\n\t\t}\n\t\tconst handler = this.providers[args.config.provider]\n\t\tif (!handler) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: `no handler registered for provider ${args.config.provider}` }\n\t\t}\n\t\treturn await handler.verify({\n\t\t\ttoken: args.token,\n\t\t\tsecret: args.config.secret,\n\t\t\tremoteIp: args.remoteIp,\n\t\t\tthreshold: args.config.threshold,\n\t\t})\n\t}\n}\n"],"names":[],"mappings":"AAcO,MAAM,iBAAiB;AAAA,EAC7B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA;AAAA,EAGI,UAAU,QAAgC;AAChD,WAAO,OAAO,aAAa,QAAQ,OAAO,WAAW,QAAQ,OAAO,WAAW;AAAA,EAChF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOO,aAAa,QAAuB,MAAqC;AAC/E,WAAO,KAAK,UAAU,MAAM,KAAK,OAAO,QAAQ,IAAI;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMO,cAAc,QAA+B;AACnD,WAAO;AAAA,MACN,UAAU,OAAO,QAAQ,YAAY;AAAA,MACrC,QAAQ,OAAO;AAAA,MACf,WAAW,OAAO,QAAQ,aAAa;AAAA,MACvC,SAAS;AAAA,QACR,QAAQ,OAAO,QAAQ,QAAQ;AAAA,QAC/B,eAAe,OAAO,QAAQ,QAAQ;AAAA,QACtC,kBAAkB,OAAO,QAAQ,QAAQ;AAAA,QACzC,mBAAmB,OAAO,QAAQ,QAAQ;AAAA,MAAA;AAAA,IAC3C;AAAA,EAEF;AAAA,EAEA,MAAM,OAAO,MAIkD;AAC9D,QAAI,CAAC,KAAK,UAAU,KAAK,MAAM,KAAK,CAAC,KAAK,OAAO,YAAY,CAAC,KAAK,OAAO,QAAQ;AACjF,aAAO,EAAE,IAAI,MAAM,SAAS,KAAA;AAAA,IAC7B;AACA,QAAI,CAAC,KAAK,OAAO;AAChB,aAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,QAAQ,wBAAA;AAAA,IAChD;AACA,UAAM,UAAU,KAAK,UAAU,KAAK,OAAO,QAAQ;AACnD,QAAI,CAAC,SAAS;AACb,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,sCAAsC,KAAK,OAAO,QAAQ,GAAA;AAAA,IAC/G;AACA,WAAO,MAAM,QAAQ,OAAO;AAAA,MAC3B,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK,OAAO;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,WAAW,KAAK,OAAO;AAAA,IAAA,CACvB;AAAA,EACF;AACD;"}

package/dist/production/src/model/service/captcha/HCaptchaProvider.cjs

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class HCaptchaProvider {
+  constructor(endpoint = "https://hcaptcha.com/siteverify", fetchImpl = fetch) {
+    this.endpoint = endpoint;
+    this.fetchImpl = fetchImpl;
+  }
+  async verify({ token, secret, remoteIp }) {
+    const body = new URLSearchParams({ secret, response: token });
+    if (remoteIp) {
+      body.set("remoteip", remoteIp);
+    }
+    let payload;
+    try {
+      const response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      });
+      payload = await response.json();
+    } catch (e) {
+      return { ok: false, reason: "verify_error", detail: e instanceof Error ? e.message : String(e) };
+    }
+    if (payload.success) {
+      return { ok: true };
+    }
+    return { ok: false, reason: "invalid", detail: (payload["error-codes"] ?? []).join(",") };
+  }
+}
+exports.HCaptchaProvider = HCaptchaProvider;
+//# sourceMappingURL=HCaptchaProvider.cjs.map

package/dist/production/src/model/service/captcha/HCaptchaProvider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"HCaptchaProvider.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/HCaptchaProvider.ts"],"sourcesContent":["import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js'\n\n/** hCaptcha. Binary success/failure — `threshold` is ignored. */\nexport class HCaptchaProvider implements CaptchaProviderHandler {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://hcaptcha.com/siteverify',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t) {}\n\n\tasync verify({ token, secret, remoteIp }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult> {\n\t\tconst body = new URLSearchParams({ secret, response: token })\n\t\tif (remoteIp) {\n\t\t\tbody.set('remoteip', remoteIp)\n\t\t}\n\t\tlet payload: { success?: boolean; 'error-codes'?: string[] }\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(this.endpoint, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: { 'content-type': 'application/x-www-form-urlencoded' },\n\t\t\t\tbody,\n\t\t\t})\n\t\t\tpayload = await response.json() as typeof payload\n\t\t} catch (e) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: e instanceof Error ? e.message : String(e) }\n\t\t}\n\t\tif (payload.success) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\treturn { ok: false, reason: 'invalid', detail: (payload['error-codes'] ?? []).join(',') }\n\t}\n}\n"],"names":[],"mappings":";;AAGO,MAAM,iBAAmD;AAAA,EAC/D,YACkB,WAAmB,mCACnB,YAA0B,OAC1C;AAFgB,SAAA,WAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,EAAE,OAAO,QAAQ,YAA6D;AAC1F,UAAM,OAAO,IAAI,gBAAgB,EAAE,QAAQ,UAAU,OAAO;AAC5D,QAAI,UAAU;AACb,WAAK,IAAI,YAAY,QAAQ;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAA;AAAA,QAC3B;AAAA,MAAA,CACA;AACD,gBAAU,MAAM,SAAS,KAAA;AAAA,IAC1B,SAAS,GAAG;AACX,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA;AAAA,IAC9F;AACA,QAAI,QAAQ,SAAS;AACpB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,SAAS,QAAQ,aAAa,KAAK,CAAA,GAAI,KAAK,GAAG,EAAA;AAAA,EACvF;AACD;;"}

package/dist/production/src/model/service/captcha/HCaptchaProvider.js

@@ -0,0 +1,31 @@
+class HCaptchaProvider {
+  constructor(endpoint = "https://hcaptcha.com/siteverify", fetchImpl = fetch) {
+    this.endpoint = endpoint;
+    this.fetchImpl = fetchImpl;
+  }
+  async verify({ token, secret, remoteIp }) {
+    const body = new URLSearchParams({ secret, response: token });
+    if (remoteIp) {
+      body.set("remoteip", remoteIp);
+    }
+    let payload;
+    try {
+      const response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      });
+      payload = await response.json();
+    } catch (e) {
+      return { ok: false, reason: "verify_error", detail: e instanceof Error ? e.message : String(e) };
+    }
+    if (payload.success) {
+      return { ok: true };
+    }
+    return { ok: false, reason: "invalid", detail: (payload["error-codes"] ?? []).join(",") };
+  }
+}
+export {
+  HCaptchaProvider
+};
+//# sourceMappingURL=HCaptchaProvider.js.map

package/dist/production/src/model/service/captcha/HCaptchaProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"HCaptchaProvider.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/HCaptchaProvider.ts"],"sourcesContent":["import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js'\n\n/** hCaptcha. Binary success/failure — `threshold` is ignored. */\nexport class HCaptchaProvider implements CaptchaProviderHandler {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://hcaptcha.com/siteverify',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t) {}\n\n\tasync verify({ token, secret, remoteIp }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult> {\n\t\tconst body = new URLSearchParams({ secret, response: token })\n\t\tif (remoteIp) {\n\t\t\tbody.set('remoteip', remoteIp)\n\t\t}\n\t\tlet payload: { success?: boolean; 'error-codes'?: string[] }\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(this.endpoint, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: { 'content-type': 'application/x-www-form-urlencoded' },\n\t\t\t\tbody,\n\t\t\t})\n\t\t\tpayload = await response.json() as typeof payload\n\t\t} catch (e) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: e instanceof Error ? e.message : String(e) }\n\t\t}\n\t\tif (payload.success) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\treturn { ok: false, reason: 'invalid', detail: (payload['error-codes'] ?? []).join(',') }\n\t}\n}\n"],"names":[],"mappings":"AAGO,MAAM,iBAAmD;AAAA,EAC/D,YACkB,WAAmB,mCACnB,YAA0B,OAC1C;AAFgB,SAAA,WAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,EAAE,OAAO,QAAQ,YAA6D;AAC1F,UAAM,OAAO,IAAI,gBAAgB,EAAE,QAAQ,UAAU,OAAO;AAC5D,QAAI,UAAU;AACb,WAAK,IAAI,YAAY,QAAQ;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAA;AAAA,QAC3B;AAAA,MAAA,CACA;AACD,gBAAU,MAAM,SAAS,KAAA;AAAA,IAC1B,SAAS,GAAG;AACX,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA;AAAA,IAC9F;AACA,QAAI,QAAQ,SAAS;AACpB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,SAAS,QAAQ,aAAa,KAAK,CAAA,GAAI,KAAK,GAAG,EAAA;AAAA,EACvF;AACD;"}

package/dist/production/src/model/service/captcha/RecaptchaV3Provider.cjs

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const DEFAULT_THRESHOLD = 0.5;
+class RecaptchaV3Provider {
+  constructor(endpoint = "https://www.google.com/recaptcha/api/siteverify", fetchImpl = fetch) {
+    this.endpoint = endpoint;
+    this.fetchImpl = fetchImpl;
+  }
+  async verify({ token, secret, remoteIp, threshold }) {
+    const body = new URLSearchParams({ secret, response: token });
+    if (remoteIp) {
+      body.set("remoteip", remoteIp);
+    }
+    let payload;
+    try {
+      const response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      });
+      payload = await response.json();
+    } catch (e) {
+      return { ok: false, reason: "verify_error", detail: e instanceof Error ? e.message : String(e) };
+    }
+    if (!payload.success) {
+      return { ok: false, reason: "invalid", detail: (payload["error-codes"] ?? []).join(",") };
+    }
+    const score = payload.score ?? 0;
+    const gate = threshold ?? DEFAULT_THRESHOLD;
+    if (score < gate) {
+      return { ok: false, reason: "low_score", detail: `score=${score} < ${gate}` };
+    }
+    return { ok: true, score };
+  }
+}
+exports.RecaptchaV3Provider = RecaptchaV3Provider;
+//# sourceMappingURL=RecaptchaV3Provider.cjs.map

package/dist/production/src/model/service/captcha/RecaptchaV3Provider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecaptchaV3Provider.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/RecaptchaV3Provider.ts"],"sourcesContent":["import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js'\n\nconst DEFAULT_THRESHOLD = 0.5\n\n/**\n * Google reCAPTCHA v3 — score-based. Falls back to DEFAULT_THRESHOLD when no\n * config-level threshold is set.\n */\nexport class RecaptchaV3Provider implements CaptchaProviderHandler {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://www.google.com/recaptcha/api/siteverify',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t) {}\n\n\tasync verify({ token, secret, remoteIp, threshold }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult> {\n\t\tconst body = new URLSearchParams({ secret, response: token })\n\t\tif (remoteIp) {\n\t\t\tbody.set('remoteip', remoteIp)\n\t\t}\n\t\tlet payload: { success?: boolean; score?: number; 'error-codes'?: string[] }\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(this.endpoint, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: { 'content-type': 'application/x-www-form-urlencoded' },\n\t\t\t\tbody,\n\t\t\t})\n\t\t\tpayload = await response.json() as typeof payload\n\t\t} catch (e) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: e instanceof Error ? e.message : String(e) }\n\t\t}\n\t\tif (!payload.success) {\n\t\t\treturn { ok: false, reason: 'invalid', detail: (payload['error-codes'] ?? []).join(',') }\n\t\t}\n\t\tconst score = payload.score ?? 0\n\t\tconst gate = threshold ?? DEFAULT_THRESHOLD\n\t\tif (score < gate) {\n\t\t\treturn { ok: false, reason: 'low_score', detail: `score=${score} < ${gate}` }\n\t\t}\n\t\treturn { ok: true, score }\n\t}\n}\n"],"names":[],"mappings":";;AAEA,MAAM,oBAAoB;AAMnB,MAAM,oBAAsD;AAAA,EAClE,YACkB,WAAmB,mDACnB,YAA0B,OAC1C;AAFgB,SAAA,WAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,aAA8D;AACrG,UAAM,OAAO,IAAI,gBAAgB,EAAE,QAAQ,UAAU,OAAO;AAC5D,QAAI,UAAU;AACb,WAAK,IAAI,YAAY,QAAQ;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAA;AAAA,QAC3B;AAAA,MAAA,CACA;AACD,gBAAU,MAAM,SAAS,KAAA;AAAA,IAC1B,SAAS,GAAG;AACX,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA;AAAA,IAC9F;AACA,QAAI,CAAC,QAAQ,SAAS;AACrB,aAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,SAAS,QAAQ,aAAa,KAAK,CAAA,GAAI,KAAK,GAAG,EAAA;AAAA,IACvF;AACA,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,OAAO,aAAa;AAC1B,QAAI,QAAQ,MAAM;AACjB,aAAO,EAAE,IAAI,OAAO,QAAQ,aAAa,QAAQ,SAAS,KAAK,MAAM,IAAI,GAAA;AAAA,IAC1E;AACA,WAAO,EAAE,IAAI,MAAM,MAAA;AAAA,EACpB;AACD;;"}

package/dist/production/src/model/service/captcha/RecaptchaV3Provider.js

@@ -0,0 +1,37 @@
+const DEFAULT_THRESHOLD = 0.5;
+class RecaptchaV3Provider {
+  constructor(endpoint = "https://www.google.com/recaptcha/api/siteverify", fetchImpl = fetch) {
+    this.endpoint = endpoint;
+    this.fetchImpl = fetchImpl;
+  }
+  async verify({ token, secret, remoteIp, threshold }) {
+    const body = new URLSearchParams({ secret, response: token });
+    if (remoteIp) {
+      body.set("remoteip", remoteIp);
+    }
+    let payload;
+    try {
+      const response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      });
+      payload = await response.json();
+    } catch (e) {
+      return { ok: false, reason: "verify_error", detail: e instanceof Error ? e.message : String(e) };
+    }
+    if (!payload.success) {
+      return { ok: false, reason: "invalid", detail: (payload["error-codes"] ?? []).join(",") };
+    }
+    const score = payload.score ?? 0;
+    const gate = threshold ?? DEFAULT_THRESHOLD;
+    if (score < gate) {
+      return { ok: false, reason: "low_score", detail: `score=${score} < ${gate}` };
+    }
+    return { ok: true, score };
+  }
+}
+export {
+  RecaptchaV3Provider
+};
+//# sourceMappingURL=RecaptchaV3Provider.js.map

package/dist/production/src/model/service/captcha/RecaptchaV3Provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecaptchaV3Provider.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/RecaptchaV3Provider.ts"],"sourcesContent":["import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js'\n\nconst DEFAULT_THRESHOLD = 0.5\n\n/**\n * Google reCAPTCHA v3 — score-based. Falls back to DEFAULT_THRESHOLD when no\n * config-level threshold is set.\n */\nexport class RecaptchaV3Provider implements CaptchaProviderHandler {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://www.google.com/recaptcha/api/siteverify',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t) {}\n\n\tasync verify({ token, secret, remoteIp, threshold }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult> {\n\t\tconst body = new URLSearchParams({ secret, response: token })\n\t\tif (remoteIp) {\n\t\t\tbody.set('remoteip', remoteIp)\n\t\t}\n\t\tlet payload: { success?: boolean; score?: number; 'error-codes'?: string[] }\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(this.endpoint, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: { 'content-type': 'application/x-www-form-urlencoded' },\n\t\t\t\tbody,\n\t\t\t})\n\t\t\tpayload = await response.json() as typeof payload\n\t\t} catch (e) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: e instanceof Error ? e.message : String(e) }\n\t\t}\n\t\tif (!payload.success) {\n\t\t\treturn { ok: false, reason: 'invalid', detail: (payload['error-codes'] ?? []).join(',') }\n\t\t}\n\t\tconst score = payload.score ?? 0\n\t\tconst gate = threshold ?? DEFAULT_THRESHOLD\n\t\tif (score < gate) {\n\t\t\treturn { ok: false, reason: 'low_score', detail: `score=${score} < ${gate}` }\n\t\t}\n\t\treturn { ok: true, score }\n\t}\n}\n"],"names":[],"mappings":"AAEA,MAAM,oBAAoB;AAMnB,MAAM,oBAAsD;AAAA,EAClE,YACkB,WAAmB,mDACnB,YAA0B,OAC1C;AAFgB,SAAA,WAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,EAAE,OAAO,QAAQ,UAAU,aAA8D;AACrG,UAAM,OAAO,IAAI,gBAAgB,EAAE,QAAQ,UAAU,OAAO;AAC5D,QAAI,UAAU;AACb,WAAK,IAAI,YAAY,QAAQ;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAA;AAAA,QAC3B;AAAA,MAAA,CACA;AACD,gBAAU,MAAM,SAAS,KAAA;AAAA,IAC1B,SAAS,GAAG;AACX,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA;AAAA,IAC9F;AACA,QAAI,CAAC,QAAQ,SAAS;AACrB,aAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,SAAS,QAAQ,aAAa,KAAK,CAAA,GAAI,KAAK,GAAG,EAAA;AAAA,IACvF;AACA,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,OAAO,aAAa;AAC1B,QAAI,QAAQ,MAAM;AACjB,aAAO,EAAE,IAAI,OAAO,QAAQ,aAAa,QAAQ,SAAS,KAAK,MAAM,IAAI,GAAA;AAAA,IAC1E;AACA,WAAO,EAAE,IAAI,MAAM,MAAA;AAAA,EACpB;AACD;"}

package/dist/production/src/model/service/captcha/TurnstileProvider.cjs

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+class TurnstileProvider {
+  constructor(endpoint = "https://challenges.cloudflare.com/turnstile/v0/siteverify", fetchImpl = fetch) {
+    this.endpoint = endpoint;
+    this.fetchImpl = fetchImpl;
+  }
+  async verify({ token, secret, remoteIp }) {
+    const body = new URLSearchParams({ secret, response: token });
+    if (remoteIp) {
+      body.set("remoteip", remoteIp);
+    }
+    let payload;
+    try {
+      const response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      });
+      payload = await response.json();
+    } catch (e) {
+      return { ok: false, reason: "verify_error", detail: e instanceof Error ? e.message : String(e) };
+    }
+    if (payload.success) {
+      return { ok: true };
+    }
+    const codes = payload["error-codes"] ?? [];
+    if (codes.includes("timeout-or-duplicate") || codes.includes("invalid-input-response")) {
+      return { ok: false, reason: "expired", detail: codes.join(",") };
+    }
+    return { ok: false, reason: "invalid", detail: codes.join(",") };
+  }
+}
+exports.TurnstileProvider = TurnstileProvider;
+//# sourceMappingURL=TurnstileProvider.cjs.map

package/dist/production/src/model/service/captcha/TurnstileProvider.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TurnstileProvider.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/TurnstileProvider.ts"],"sourcesContent":["import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js'\n\n/**\n * Cloudflare Turnstile. Binary success/failure — `threshold` is ignored.\n * https://developers.cloudflare.com/turnstile/get-started/server-side-validation/\n */\nexport class TurnstileProvider implements CaptchaProviderHandler {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://challenges.cloudflare.com/turnstile/v0/siteverify',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t) {}\n\n\tasync verify({ token, secret, remoteIp }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult> {\n\t\tconst body = new URLSearchParams({ secret, response: token })\n\t\tif (remoteIp) {\n\t\t\tbody.set('remoteip', remoteIp)\n\t\t}\n\t\tlet payload: { success?: boolean; 'error-codes'?: string[] }\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(this.endpoint, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: { 'content-type': 'application/x-www-form-urlencoded' },\n\t\t\t\tbody,\n\t\t\t})\n\t\t\tpayload = await response.json() as typeof payload\n\t\t} catch (e) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: e instanceof Error ? e.message : String(e) }\n\t\t}\n\t\tif (payload.success) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst codes = payload['error-codes'] ?? []\n\t\tif (codes.includes('timeout-or-duplicate') || codes.includes('invalid-input-response')) {\n\t\t\treturn { ok: false, reason: 'expired', detail: codes.join(',') }\n\t\t}\n\t\treturn { ok: false, reason: 'invalid', detail: codes.join(',') }\n\t}\n}\n"],"names":[],"mappings":";;AAMO,MAAM,kBAAoD;AAAA,EAChE,YACkB,WAAmB,6DACnB,YAA0B,OAC1C;AAFgB,SAAA,WAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,EAAE,OAAO,QAAQ,YAA6D;AAC1F,UAAM,OAAO,IAAI,gBAAgB,EAAE,QAAQ,UAAU,OAAO;AAC5D,QAAI,UAAU;AACb,WAAK,IAAI,YAAY,QAAQ;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAA;AAAA,QAC3B;AAAA,MAAA,CACA;AACD,gBAAU,MAAM,SAAS,KAAA;AAAA,IAC1B,SAAS,GAAG;AACX,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA;AAAA,IAC9F;AACA,QAAI,QAAQ,SAAS;AACpB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,QAAQ,QAAQ,aAAa,KAAK,CAAA;AACxC,QAAI,MAAM,SAAS,sBAAsB,KAAK,MAAM,SAAS,wBAAwB,GAAG;AACvF,aAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,QAAQ,MAAM,KAAK,GAAG,EAAA;AAAA,IAC9D;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,QAAQ,MAAM,KAAK,GAAG,EAAA;AAAA,EAC9D;AACD;;"}

package/dist/production/src/model/service/captcha/TurnstileProvider.js

@@ -0,0 +1,35 @@
+class TurnstileProvider {
+  constructor(endpoint = "https://challenges.cloudflare.com/turnstile/v0/siteverify", fetchImpl = fetch) {
+    this.endpoint = endpoint;
+    this.fetchImpl = fetchImpl;
+  }
+  async verify({ token, secret, remoteIp }) {
+    const body = new URLSearchParams({ secret, response: token });
+    if (remoteIp) {
+      body.set("remoteip", remoteIp);
+    }
+    let payload;
+    try {
+      const response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body
+      });
+      payload = await response.json();
+    } catch (e) {
+      return { ok: false, reason: "verify_error", detail: e instanceof Error ? e.message : String(e) };
+    }
+    if (payload.success) {
+      return { ok: true };
+    }
+    const codes = payload["error-codes"] ?? [];
+    if (codes.includes("timeout-or-duplicate") || codes.includes("invalid-input-response")) {
+      return { ok: false, reason: "expired", detail: codes.join(",") };
+    }
+    return { ok: false, reason: "invalid", detail: codes.join(",") };
+  }
+}
+export {
+  TurnstileProvider
+};
+//# sourceMappingURL=TurnstileProvider.js.map

package/dist/production/src/model/service/captcha/TurnstileProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TurnstileProvider.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/captcha/TurnstileProvider.ts"],"sourcesContent":["import { CaptchaProviderHandler, CaptchaVerifyArgs, CaptchaVerifyResult } from './CaptchaProvider.js'\n\n/**\n * Cloudflare Turnstile. Binary success/failure — `threshold` is ignored.\n * https://developers.cloudflare.com/turnstile/get-started/server-side-validation/\n */\nexport class TurnstileProvider implements CaptchaProviderHandler {\n\tconstructor(\n\t\tprivate readonly endpoint: string = 'https://challenges.cloudflare.com/turnstile/v0/siteverify',\n\t\tprivate readonly fetchImpl: typeof fetch = fetch,\n\t) {}\n\n\tasync verify({ token, secret, remoteIp }: CaptchaVerifyArgs): Promise<CaptchaVerifyResult> {\n\t\tconst body = new URLSearchParams({ secret, response: token })\n\t\tif (remoteIp) {\n\t\t\tbody.set('remoteip', remoteIp)\n\t\t}\n\t\tlet payload: { success?: boolean; 'error-codes'?: string[] }\n\t\ttry {\n\t\t\tconst response = await this.fetchImpl(this.endpoint, {\n\t\t\t\tmethod: 'POST',\n\t\t\t\theaders: { 'content-type': 'application/x-www-form-urlencoded' },\n\t\t\t\tbody,\n\t\t\t})\n\t\t\tpayload = await response.json() as typeof payload\n\t\t} catch (e) {\n\t\t\treturn { ok: false, reason: 'verify_error', detail: e instanceof Error ? e.message : String(e) }\n\t\t}\n\t\tif (payload.success) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst codes = payload['error-codes'] ?? []\n\t\tif (codes.includes('timeout-or-duplicate') || codes.includes('invalid-input-response')) {\n\t\t\treturn { ok: false, reason: 'expired', detail: codes.join(',') }\n\t\t}\n\t\treturn { ok: false, reason: 'invalid', detail: codes.join(',') }\n\t}\n}\n"],"names":[],"mappings":"AAMO,MAAM,kBAAoD;AAAA,EAChE,YACkB,WAAmB,6DACnB,YAA0B,OAC1C;AAFgB,SAAA,WAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,EAAE,OAAO,QAAQ,YAA6D;AAC1F,UAAM,OAAO,IAAI,gBAAgB,EAAE,QAAQ,UAAU,OAAO;AAC5D,QAAI,UAAU;AACb,WAAK,IAAI,YAAY,QAAQ;AAAA,IAC9B;AACA,QAAI;AACJ,QAAI;AACH,YAAM,WAAW,MAAM,KAAK,UAAU,KAAK,UAAU;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAA;AAAA,QAC3B;AAAA,MAAA,CACA;AACD,gBAAU,MAAM,SAAS,KAAA;AAAA,IAC1B,SAAS,GAAG;AACX,aAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,EAAA;AAAA,IAC9F;AACA,QAAI,QAAQ,SAAS;AACpB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,QAAQ,QAAQ,aAAa,KAAK,CAAA;AACxC,QAAI,MAAM,SAAS,sBAAsB,KAAK,MAAM,SAAS,wBAAwB,GAAG;AACvF,aAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,QAAQ,MAAM,KAAK,GAAG,EAAA;AAAA,IAC9D;AACA,WAAO,EAAE,IAAI,OAAO,QAAQ,WAAW,QAAQ,MAAM,KAAK,GAAG,EAAA;AAAA,EAC9D;AACD;"}

package/dist/production/src/model/service/helpers/getPreferredProject.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"getPreferredProject.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":";;AAEO,MAAM,sBAAsB,CAAC,UAAqB,yBAAwD;AAChH,MAAI,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACA,SAAO;AACR;;"}
+{"version":3,"file":"getPreferredProject.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type/index.js'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":";;AAEO,MAAM,sBAAsB,CAAC,UAAqB,yBAAwD;AAChH,MAAI,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACA,SAAO;AACR;;"}

package/dist/production/src/model/service/helpers/getPreferredProject.js.map

@@ -1 +1 @@
-{"version":3,"file":"getPreferredProject.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":"AAEO,MAAM,sBAAsB,CAAC,UAAqB,yBAAwD;AAChH,MAAI,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACA,SAAO;AACR;"}
+{"version":3,"file":"getPreferredProject.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/getPreferredProject.ts"],"sourcesContent":["import { Project } from '../../type/index.js'\n\nexport const getPreferredProject = (projects: Project[], preferredProjectSlug: string | null): Project | null => {\n\tif (projects.length === 1) {\n\t\treturn projects[0]\n\t}\n\tif (preferredProjectSlug) {\n\t\treturn projects.find(it => it.slug === preferredProjectSlug) || null\n\t}\n\treturn null\n}\n"],"names":[],"mappings":"AAEO,MAAM,sBAAsB,CAAC,UAAqB,yBAAwD;AAChH,MAAI,SAAS,WAAW,GAAG;AAC1B,WAAO,SAAS,CAAC;AAAA,EAClB;AACA,MAAI,sBAAsB;AACzB,WAAO,SAAS,KAAK,CAAA,OAAM,GAAG,SAAS,oBAAoB,KAAK;AAAA,EACjE;AACA,SAAO;AACR;"}

package/dist/production/src/model/service/helpers/isPasswordlessEnabled.cjs

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const isPasswordlessEnabled = (globalValue, personValue) => {
+  switch (globalValue) {
+    case "always":
+      return true;
+    case "never":
+      return false;
+    case "optIn":
+      return personValue === true;
+    case "optOut":
+      return personValue !== false;
+  }
+};
+exports.isPasswordlessEnabled = isPasswordlessEnabled;
+//# sourceMappingURL=isPasswordlessEnabled.cjs.map

package/dist/production/src/model/service/helpers/isPasswordlessEnabled.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"isPasswordlessEnabled.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/isPasswordlessEnabled.ts"],"sourcesContent":["import { ConfigPolicy } from '../../../schema/index.js'\n\n/**\n * Resolves whether passwordless sign-in is effectively available for a person,\n * combining the tenant-wide policy with the person's own flag. This is the same\n * gate the passwordless sign-in flow applies, so any caller that reasons about a\n * person's usable sign-in methods (e.g. the IdP disconnect lock-out check) stays\n * consistent with what sign-in actually permits.\n */\nexport const isPasswordlessEnabled = (globalValue: ConfigPolicy, personValue: boolean | null): boolean => {\n\tswitch (globalValue) {\n\t\tcase 'always':\n\t\t\treturn true\n\t\tcase 'never':\n\t\t\treturn false\n\t\tcase 'optIn':\n\t\t\treturn personValue === true\n\t\tcase 'optOut':\n\t\t\treturn personValue !== false\n\t}\n}\n"],"names":[],"mappings":";;AASO,MAAM,wBAAwB,CAAC,aAA2B,gBAAyC;AACzG,UAAQ,aAAA;AAAA,IACP,KAAK;AACJ,aAAO;AAAA,IACR,KAAK;AACJ,aAAO;AAAA,IACR,KAAK;AACJ,aAAO,gBAAgB;AAAA,IACxB,KAAK;AACJ,aAAO,gBAAgB;AAAA,EAAA;AAE1B;;"}

package/dist/production/src/model/service/helpers/isPasswordlessEnabled.js

@@ -0,0 +1,16 @@
+const isPasswordlessEnabled = (globalValue, personValue) => {
+  switch (globalValue) {
+    case "always":
+      return true;
+    case "never":
+      return false;
+    case "optIn":
+      return personValue === true;
+    case "optOut":
+      return personValue !== false;
+  }
+};
+export {
+  isPasswordlessEnabled
+};
+//# sourceMappingURL=isPasswordlessEnabled.js.map

package/dist/production/src/model/service/helpers/isPasswordlessEnabled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"isPasswordlessEnabled.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/helpers/isPasswordlessEnabled.ts"],"sourcesContent":["import { ConfigPolicy } from '../../../schema/index.js'\n\n/**\n * Resolves whether passwordless sign-in is effectively available for a person,\n * combining the tenant-wide policy with the person's own flag. This is the same\n * gate the passwordless sign-in flow applies, so any caller that reasons about a\n * person's usable sign-in methods (e.g. the IdP disconnect lock-out check) stays\n * consistent with what sign-in actually permits.\n */\nexport const isPasswordlessEnabled = (globalValue: ConfigPolicy, personValue: boolean | null): boolean => {\n\tswitch (globalValue) {\n\t\tcase 'always':\n\t\t\treturn true\n\t\tcase 'never':\n\t\t\treturn false\n\t\tcase 'optIn':\n\t\t\treturn personValue === true\n\t\tcase 'optOut':\n\t\t\treturn personValue !== false\n\t}\n}\n"],"names":[],"mappings":"AASO,MAAM,wBAAwB,CAAC,aAA2B,gBAAyC;AACzG,UAAQ,aAAA;AAAA,IACP,KAAK;AACJ,aAAO;AAAA,IACR,KAAK;AACJ,aAAO;AAAA,IACR,KAAK;AACJ,aAAO,gBAAgB;AAAA,IACxB,KAAK;AACJ,aAAO,gBAAgB;AAAA,EAAA;AAE1B;"}

package/dist/production/src/model/service/idp/BackchannelLogoutManager.cjs

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const IdentityProviderBySlugQuery = require("../../queries/idp/IdentityProviderBySlugQuery.cjs");
+const IdpSessionsBySidQuery = require("../../queries/idp/IdpSessionsBySidQuery.cjs");
+const IdpSessionsBySubQuery = require("../../queries/idp/IdpSessionsBySubQuery.cjs");
+const ApiKeyQuery = require("../../queries/apiKey/ApiKeyQuery.cjs");
+require("../../type/ApiKey.cjs");
+require("@contember/database");
+require("node:crypto");
+const DisableApiKeyCommand = require("../../commands/apiKey/DisableApiKeyCommand.cjs");
+const CreateAuthLogEntryCommand = require("../../commands/authLog/CreateAuthLogEntryCommand.cjs");
+const IDPValidationError = require("./IDPValidationError.cjs");
+class BackchannelLogoutManager {
+  constructor(idpRegistry) {
+    this.idpRegistry = idpRegistry;
+  }
+  async logout(db, providerSlug, logoutToken) {
+    const provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery.IdentityProviderBySlugQuery(providerSlug));
+    if (!provider) {
+      return { status: "provider_not_found" };
+    }
+    const handler = this.idpRegistry.getHandlerOrNull(provider.type);
+    if (!handler?.validateLogoutToken) {
+      return { status: "not_supported" };
+    }
+    let config;
+    try {
+      config = handler.validateConfiguration(provider.configuration);
+    } catch (e) {
+      return { status: "invalid_token", message: "IdP configuration is invalid" };
+    }
+    let claims;
+    try {
+      claims = await handler.validateLogoutToken(config, logoutToken);
+    } catch (e) {
+      return { status: "invalid_token", message: e instanceof IDPValidationError.IDPValidationError ? e.message : "Invalid logout token" };
+    }
+    const sessions = await this.resolveTargetSessions(db, provider.id, claims);
+    let revokedCount = 0;
+    for (const session of sessions) {
+      const disabled = await db.commandBus.execute(new DisableApiKeyCommand.DisableApiKeyCommand(session.apiKeyId));
+      if (disabled) {
+        revokedCount++;
+      }
+    }
+    await this.audit(db, provider.id, claims, revokedCount, sessions[0]?.apiKeyId);
+    return { status: "ok", revokedCount };
+  }
+  async resolveTargetSessions(db, identityProviderId, claims) {
+    if (claims.sid) {
+      return db.queryHandler.fetch(new IdpSessionsBySidQuery.IdpSessionsBySidQuery(identityProviderId, claims.sid));
+    }
+    if (claims.sub) {
+      return db.queryHandler.fetch(new IdpSessionsBySubQuery.IdpSessionsBySubQuery(identityProviderId, claims.sub));
+    }
+    return [];
+  }
+  async audit(db, identityProviderId, claims, revokedCount, targetApiKeyId) {
+    let invokedById;
+    let personId;
+    if (targetApiKeyId) {
+      const apiKeyRow = await db.queryHandler.fetch(new ApiKeyQuery.ApiKeyByIdQuery(targetApiKeyId));
+      if (apiKeyRow) {
+        invokedById = apiKeyRow.identity_id;
+        personId = apiKeyRow.person_id ?? void 0;
+      }
+    }
+    try {
+      await db.commandBus.execute(
+        new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
+          type: "idp_backchannel_logout",
+          invokedById,
+          personId,
+          identityProviderId,
+          success: true,
+          eventData: { sid: claims.sid ?? null, sub: claims.sub ?? null, revokedCount }
+        })
+      );
+    } catch {
+    }
+  }
+}
+exports.BackchannelLogoutManager = BackchannelLogoutManager;
+//# sourceMappingURL=BackchannelLogoutManager.cjs.map

package/dist/production/src/model/service/idp/BackchannelLogoutManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackchannelLogoutManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/BackchannelLogoutManager.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { IdentityProviderBySlugQuery } from '../../queries/idp/IdentityProviderBySlugQuery.js'\nimport { IdpSessionBySidRow, IdpSessionsBySidQuery } from '../../queries/idp/IdpSessionsBySidQuery.js'\nimport { IdpSessionsBySubQuery } from '../../queries/idp/IdpSessionsBySubQuery.js'\nimport { ApiKeyByIdQuery } from '../../queries/apiKey/ApiKeyQuery.js'\nimport { DisableApiKeyCommand } from '../../commands/index.js'\nimport { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { IDPValidationError } from './IDPValidationError.js'\n\nexport type BackchannelLogoutResult =\n\t| { status: 'ok'; revokedCount: number }\n\t| { status: 'provider_not_found' }\n\t| { status: 'not_supported' }\n\t| { status: 'invalid_token'; message: string }\n\n/**\n * Handles an incoming OIDC Back-Channel Logout request (A10). Runs entirely on the HTTP auth path\n * (no GraphQL resolver), so — like {@link IdpSessionRevalidator} — it owns its own audit write\n * rather than deferring to a resolver. Flow:\n *   1. resolve the IdP by slug (the back-channel endpoint carries a `?provider=` query param, since\n *      the IdP only knows which client it is calling, not the Contember tenant/provider record);\n *   2. validate the IdP-signed logout token and extract `sid` / `sub`;\n *   3. look up the local federated session(s) the token targets and revoke their api_key(s).\n *\n * A logout token with a `sid` targets that single IdP session; a `sub`-only token (rare — most IdPs\n * send a `sid`) targets *all* of that subject's federated sessions under the provider. Either way, a\n * token that matches no live session is reported as `revokedCount: 0` and audited, not failed.\n */\nexport class BackchannelLogoutManager {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync logout(db: DatabaseContext, providerSlug: string, logoutToken: string): Promise<BackchannelLogoutResult> {\n\t\tconst provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(providerSlug))\n\t\tif (!provider) {\n\t\t\treturn { status: 'provider_not_found' }\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(provider.type)\n\t\tif (!handler?.validateLogoutToken) {\n\t\t\treturn { status: 'not_supported' }\n\t\t}\n\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(provider.configuration)\n\t\t} catch (e) {\n\t\t\treturn { status: 'invalid_token', message: 'IdP configuration is invalid' }\n\t\t}\n\n\t\tlet claims: { sid?: string; sub?: string }\n\t\ttry {\n\t\t\tclaims = await handler.validateLogoutToken(config, logoutToken)\n\t\t} catch (e) {\n\t\t\treturn { status: 'invalid_token', message: e instanceof IDPValidationError ? e.message : 'Invalid logout token' }\n\t\t}\n\n\t\tconst sessions = await this.resolveTargetSessions(db, provider.id, claims)\n\t\tlet revokedCount = 0\n\t\tfor (const session of sessions) {\n\t\t\tconst disabled = await db.commandBus.execute(new DisableApiKeyCommand(session.apiKeyId))\n\t\t\tif (disabled) {\n\t\t\t\trevokedCount++\n\t\t\t}\n\t\t}\n\n\t\tawait this.audit(db, provider.id, claims, revokedCount, sessions[0]?.apiKeyId)\n\n\t\treturn { status: 'ok', revokedCount }\n\t}\n\n\tprivate async resolveTargetSessions(\n\t\tdb: DatabaseContext,\n\t\tidentityProviderId: string,\n\t\tclaims: { sid?: string; sub?: string },\n\t): Promise<IdpSessionBySidRow[]> {\n\t\t// Prefer `sid` (targets one session); fall back to `sub` (targets all the subject's sessions).\n\t\tif (claims.sid) {\n\t\t\treturn db.queryHandler.fetch(new IdpSessionsBySidQuery(identityProviderId, claims.sid))\n\t\t}\n\t\tif (claims.sub) {\n\t\t\treturn db.queryHandler.fetch(new IdpSessionsBySubQuery(identityProviderId, claims.sub))\n\t\t}\n\t\treturn []\n\t}\n\n\tprivate async audit(\n\t\tdb: DatabaseContext,\n\t\tidentityProviderId: string,\n\t\tclaims: { sid?: string; sub?: string },\n\t\trevokedCount: number,\n\t\ttargetApiKeyId: string | undefined,\n\t): Promise<void> {\n\t\t// Resolve the affected identity for the audit `invoked_by_id` from a targeted session, when\n\t\t// one resolves. Otherwise leave it unset (→ NULL) — the provider id is NOT a valid identity id\n\t\t// and inserting it would violate the `invoked_by_id` FK (the provider is recorded separately\n\t\t// in `identity_provider_id`).\n\t\tlet invokedById: string | undefined\n\t\tlet personId: string | undefined\n\t\tif (targetApiKeyId) {\n\t\t\tconst apiKeyRow = await db.queryHandler.fetch(new ApiKeyByIdQuery(targetApiKeyId))\n\t\t\tif (apiKeyRow) {\n\t\t\t\tinvokedById = apiKeyRow.identity_id\n\t\t\t\tpersonId = apiKeyRow.person_id ?? undefined\n\t\t\t}\n\t\t}\n\n\t\ttry {\n\t\t\tawait db.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_backchannel_logout',\n\t\t\t\t\tinvokedById,\n\t\t\t\t\tpersonId,\n\t\t\t\t\tidentityProviderId,\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\teventData: { sid: claims.sid ?? null, sub: claims.sub ?? null, revokedCount },\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort observability — never fail the logout because the audit write failed\n\t\t}\n\t}\n}\n"],"names":["IdentityProviderBySlugQuery","IDPValidationError","DisableApiKeyCommand","IdpSessionsBySidQuery","IdpSessionsBySubQuery","ApiKeyByIdQuery","CreateAuthLogEntryCommand"],"mappings":";;;;;;;;;;;;AA6BO,MAAM,yBAAyB;AAAA,EACrC,YACkB,aAChB;AADgB,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,IAAqB,cAAsB,aAAuD;AAC9G,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIA,4BAAAA,4BAA4B,YAAY,CAAC;AAC1F,QAAI,CAAC,UAAU;AACd,aAAO,EAAE,QAAQ,qBAAA;AAAA,IAClB;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,SAAS,IAAI;AAC/D,QAAI,CAAC,SAAS,qBAAqB;AAClC,aAAO,EAAE,QAAQ,gBAAA;AAAA,IAClB;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,SAAS,aAAa;AAAA,IAC9D,SAAS,GAAG;AACX,aAAO,EAAE,QAAQ,iBAAiB,SAAS,+BAAA;AAAA,IAC5C;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,oBAAoB,QAAQ,WAAW;AAAA,IAC/D,SAAS,GAAG;AACX,aAAO,EAAE,QAAQ,iBAAiB,SAAS,aAAaC,wCAAqB,EAAE,UAAU,uBAAA;AAAA,IAC1F;AAEA,UAAM,WAAW,MAAM,KAAK,sBAAsB,IAAI,SAAS,IAAI,MAAM;AACzE,QAAI,eAAe;AACnB,eAAW,WAAW,UAAU;AAC/B,YAAM,WAAW,MAAM,GAAG,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,QAAQ,QAAQ,CAAC;AACvF,UAAI,UAAU;AACb;AAAA,MACD;AAAA,IACD;AAEA,UAAM,KAAK,MAAM,IAAI,SAAS,IAAI,QAAQ,cAAc,SAAS,CAAC,GAAG,QAAQ;AAE7E,WAAO,EAAE,QAAQ,MAAM,aAAA;AAAA,EACxB;AAAA,EAEA,MAAc,sBACb,IACA,oBACA,QACgC;AAEhC,QAAI,OAAO,KAAK;AACf,aAAO,GAAG,aAAa,MAAM,IAAIC,sBAAAA,sBAAsB,oBAAoB,OAAO,GAAG,CAAC;AAAA,IACvF;AACA,QAAI,OAAO,KAAK;AACf,aAAO,GAAG,aAAa,MAAM,IAAIC,sBAAAA,sBAAsB,oBAAoB,OAAO,GAAG,CAAC;AAAA,IACvF;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAc,MACb,IACA,oBACA,QACA,cACA,gBACgB;AAKhB,QAAI;AACJ,QAAI;AACJ,QAAI,gBAAgB;AACnB,YAAM,YAAY,MAAM,GAAG,aAAa,MAAM,IAAIC,YAAAA,gBAAgB,cAAc,CAAC;AACjF,UAAI,WAAW;AACd,sBAAc,UAAU;AACxB,mBAAW,UAAU,aAAa;AAAA,MACnC;AAAA,IACD;AAEA,QAAI;AACH,YAAM,GAAG,WAAW;AAAA,QACnB,IAAIC,oDAA0B;AAAA,UAC7B,MAAM;AAAA,UACN;AAAA,UACA;AAAA,UACA;AAAA,UACA,SAAS;AAAA,UACT,WAAW,EAAE,KAAK,OAAO,OAAO,MAAM,KAAK,OAAO,OAAO,MAAM,aAAA;AAAA,QAAa,CAC5E;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AACD;;"}