@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.cjs

@@ -4,28 +4,59 @@ const ApiKeyHelper = require("./ApiKeyHelper.cjs");
 const Database = require("@contember/database");
 const PROLONG_THROTTLE_MS = 6e4;
 class ProlongApiKeyCommand {
-  constructor(id, type, expiration, currentExpiration) {
+  constructor(id, type, expiration, currentExpiration, requestInfo, tracking, maxExpiresAt) {
     this.id = id;
     this.type = type;
     this.expiration = expiration;
     this.currentExpiration = currentExpiration;
+    this.requestInfo = requestInfo;
+    this.tracking = tracking;
+    this.maxExpiresAt = maxExpiresAt;
   }
   async execute({ db, providers }) {
-    const newExpiration = ApiKeyHelper.ApiKeyHelper.getExpiration(providers, this.type, this.expiration);
-    if (newExpiration === null) {
-      return;
+    let newExpiration = ApiKeyHelper.ApiKeyHelper.getExpiration(providers, this.type, this.expiration);
+    if (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {
+      newExpiration = this.maxExpiresAt;
     }
-    if (this.currentExpiration) {
+    const now = providers.now();
+    let updateExpiration = newExpiration !== null;
+    if (updateExpiration && this.currentExpiration && newExpiration !== null) {
       const prolongMs = newExpiration.getTime() - this.currentExpiration.getTime();
       if (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {
-        return;
+        updateExpiration = false;
       }
     }
-    const qb = Database.UpdateBuilder.create().table("api_key").where({ id: this.id }).values({
-      expires_at: newExpiration
-    });
+    const requestIp = this.requestInfo?.ip || null;
+    const requestUserAgent = this.requestInfo?.userAgent || null;
+    const updateTracking = this.shouldUpdateTracking(now);
+    if (!updateExpiration && !updateTracking) {
+      return;
+    }
+    const values = {};
+    if (updateExpiration && newExpiration !== null) {
+      values.expires_at = new Database.Literal('LEAST(now() + make_interval(secs => ?), "max_expires_at")', [
+        ApiKeyHelper.ApiKeyHelper.getSessionExpirationSeconds(this.expiration)
+      ]);
+    }
+    if (updateTracking) {
+      values.last_ip = requestIp;
+      values.last_user_agent = requestUserAgent;
+      values.last_used_at = new Database.Literal("now()");
+    }
+    const qb = Database.UpdateBuilder.create().table("api_key").where({ id: this.id }).values(values);
     await qb.execute(db);
   }
+  shouldUpdateTracking(now) {
+    if (!this.requestInfo) {
+      return false;
+    }
+    const lastUsedAt = this.tracking?.lastUsedAt;
+    if (!lastUsedAt) {
+      return true;
+    }
+    return now.getTime() - lastUsedAt.getTime() >= PROLONG_THROTTLE_MS;
+  }
 }
+exports.PROLONG_THROTTLE_MS = PROLONG_THROTTLE_MS;
 exports.ProlongApiKeyCommand = ProlongApiKeyCommand;
 //# sourceMappingURL=ProlongApiKeyCommand.cjs.map

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProlongApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { UpdateBuilder } from '@contember/database'\n\nconst PROLONG_THROTTLE_MS = 60_000\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\tif (newExpiration === null) {\n\t\t\treturn\n\t\t}\n\n\t\tif (this.currentExpiration) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\texpires_at: newExpiration,\n\t\t\t})\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["ApiKeyHelper","UpdateBuilder"],"mappings":";;;;AAKA,MAAM,sBAAsB;AAErB,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBAChB;AAJgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,gBAAgBA,aAAAA,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AACtF,QAAI,kBAAkB,MAAM;AAC3B;AAAA,IACD;AAEA,QAAI,KAAK,mBAAmB;AAC3B,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD;AAAA,MACD;AAAA,IACD;AAEA,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,YAAY;AAAA,IAAA,CACZ;AACF,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}
+{"version":3,"file":"ProlongApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { Literal, QueryBuilder, UpdateBuilder } from '@contember/database'\n\n/**\n * Tracking writes (`last_ip`, `last_user_agent`, `last_used_at`) are throttled to at most once per\n * this window, even when the IP or User-Agent changes: a key shared by several service replicas\n * alternates between their addresses, and writing every change makes its row a lock hotspot.\n * An idle check must add this slack to avoid prematurely expiring an active session whose\n * `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).\n */\nexport const PROLONG_THROTTLE_MS = 60_000\n\nexport interface ApiKeyRequestInfo {\n\tip?: string\n\tuserAgent?: string\n}\n\nexport interface ApiKeyTrackingState {\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tlastUsedAt: Date | null\n}\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t\tprivate readonly requestInfo?: ApiKeyRequestInfo,\n\t\tprivate readonly tracking?: ApiKeyTrackingState,\n\t\tprivate readonly maxExpiresAt?: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tlet newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\t// A19: clamp the sliding window at the absolute cap snapshotted at sign-in.\n\t\t// NULL maxExpiresAt = today's uncapped sliding window.\n\t\tif (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {\n\t\t\tnewExpiration = this.maxExpiresAt\n\t\t}\n\t\tconst now = providers.now()\n\n\t\tlet updateExpiration = newExpiration !== null\n\t\tif (updateExpiration && this.currentExpiration && newExpiration !== null) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\tupdateExpiration = false\n\t\t\t}\n\t\t}\n\n\t\tconst requestIp = this.requestInfo?.ip || null\n\t\tconst requestUserAgent = this.requestInfo?.userAgent || null\n\t\tconst updateTracking = this.shouldUpdateTracking(now)\n\n\t\tif (!updateExpiration && !updateTracking) {\n\t\t\treturn\n\t\t}\n\n\t\tconst values: QueryBuilder.Values = {}\n\t\tif (updateExpiration && newExpiration !== null) {\n\t\t\t// Write the sliding expiry on the DB clock and clamp to the stored\n\t\t\t// max_expires_at in SQL (LEAST ignores a NULL cap → uncapped window). The JS\n\t\t\t// throttle above only decides *whether* to write; the expiry gate itself is\n\t\t\t// computed on the DB clock. See engine-tenant-api/CLAUDE.md.\n\t\t\tvalues.expires_at = new Literal('LEAST(now() + make_interval(secs => ?), \"max_expires_at\")', [\n\t\t\t\tApiKeyHelper.getSessionExpirationSeconds(this.expiration),\n\t\t\t])\n\t\t}\n\t\tif (updateTracking) {\n\t\t\tvalues.last_ip = requestIp\n\t\t\tvalues.last_user_agent = requestUserAgent\n\t\t\t// last_used_at on the DB clock: it's compared against now() in the idle gate\n\t\t\t// (ApiKeyByTokenQuery's is_idle_expired), so it must be written on the same\n\t\t\t// clock. The app-clock `now` above only drives the write-rate throttle. See CLAUDE.md.\n\t\t\tvalues.last_used_at = new Literal('now()')\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values(values)\n\t\tawait qb.execute(db)\n\t}\n\n\tprivate shouldUpdateTracking(now: Date): boolean {\n\t\tif (!this.requestInfo) {\n\t\t\treturn false\n\t\t}\n\t\tconst lastUsedAt = this.tracking?.lastUsedAt\n\t\tif (!lastUsedAt) {\n\t\t\treturn true\n\t\t}\n\t\treturn now.getTime() - lastUsedAt.getTime() >= PROLONG_THROTTLE_MS\n\t}\n}\n"],"names":["ApiKeyHelper","Literal","UpdateBuilder"],"mappings":";;;;AAYO,MAAM,sBAAsB;AAa5B,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBACA,aACA,UACA,cAChB;AAPgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,cAAA;AACA,SAAA,WAAA;AACA,SAAA,eAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,QAAI,gBAAgBA,aAAAA,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AAGpF,QAAI,kBAAkB,QAAQ,KAAK,gBAAgB,cAAc,YAAY,KAAK,aAAa,WAAW;AACzG,sBAAgB,KAAK;AAAA,IACtB;AACA,UAAM,MAAM,UAAU,IAAA;AAEtB,QAAI,mBAAmB,kBAAkB;AACzC,QAAI,oBAAoB,KAAK,qBAAqB,kBAAkB,MAAM;AACzE,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD,2BAAmB;AAAA,MACpB;AAAA,IACD;AAEA,UAAM,YAAY,KAAK,aAAa,MAAM;AAC1C,UAAM,mBAAmB,KAAK,aAAa,aAAa;AACxD,UAAM,iBAAiB,KAAK,qBAAqB,GAAG;AAEpD,QAAI,CAAC,oBAAoB,CAAC,gBAAgB;AACzC;AAAA,IACD;AAEA,UAAM,SAA8B,CAAA;AACpC,QAAI,oBAAoB,kBAAkB,MAAM;AAK/C,aAAO,aAAa,IAAIC,SAAAA,QAAQ,6DAA6D;AAAA,QAC5FD,0BAAa,4BAA4B,KAAK,UAAU;AAAA,MAAA,CACxD;AAAA,IACF;AACA,QAAI,gBAAgB;AACnB,aAAO,UAAU;AACjB,aAAO,kBAAkB;AAIzB,aAAO,eAAe,IAAIC,SAAAA,QAAQ,OAAO;AAAA,IAC1C;AAEA,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO,MAAM;AACf,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AAAA,EAEQ,qBAAqB,KAAoB;AAChD,QAAI,CAAC,KAAK,aAAa;AACtB,aAAO;AAAA,IACR;AACA,UAAM,aAAa,KAAK,UAAU;AAClC,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,IAAI,QAAA,IAAY,WAAW,aAAa;AAAA,EAChD;AACD;;;"}

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.js

@@ -1,31 +1,62 @@
 import { ApiKeyHelper } from "./ApiKeyHelper.js";
-import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+import { Literal, UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
 const PROLONG_THROTTLE_MS = 6e4;
 class ProlongApiKeyCommand {
-  constructor(id, type, expiration, currentExpiration) {
+  constructor(id, type, expiration, currentExpiration, requestInfo, tracking, maxExpiresAt) {
     this.id = id;
     this.type = type;
     this.expiration = expiration;
     this.currentExpiration = currentExpiration;
+    this.requestInfo = requestInfo;
+    this.tracking = tracking;
+    this.maxExpiresAt = maxExpiresAt;
   }
   async execute({ db, providers }) {
-    const newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration);
-    if (newExpiration === null) {
-      return;
+    let newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration);
+    if (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {
+      newExpiration = this.maxExpiresAt;
     }
-    if (this.currentExpiration) {
+    const now = providers.now();
+    let updateExpiration = newExpiration !== null;
+    if (updateExpiration && this.currentExpiration && newExpiration !== null) {
       const prolongMs = newExpiration.getTime() - this.currentExpiration.getTime();
       if (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {
-        return;
+        updateExpiration = false;
       }
     }
-    const qb = UpdateBuilder$1.create().table("api_key").where({ id: this.id }).values({
-      expires_at: newExpiration
-    });
+    const requestIp = this.requestInfo?.ip || null;
+    const requestUserAgent = this.requestInfo?.userAgent || null;
+    const updateTracking = this.shouldUpdateTracking(now);
+    if (!updateExpiration && !updateTracking) {
+      return;
+    }
+    const values = {};
+    if (updateExpiration && newExpiration !== null) {
+      values.expires_at = new Literal('LEAST(now() + make_interval(secs => ?), "max_expires_at")', [
+        ApiKeyHelper.getSessionExpirationSeconds(this.expiration)
+      ]);
+    }
+    if (updateTracking) {
+      values.last_ip = requestIp;
+      values.last_user_agent = requestUserAgent;
+      values.last_used_at = new Literal("now()");
+    }
+    const qb = UpdateBuilder$1.create().table("api_key").where({ id: this.id }).values(values);
     await qb.execute(db);
   }
+  shouldUpdateTracking(now) {
+    if (!this.requestInfo) {
+      return false;
+    }
+    const lastUsedAt = this.tracking?.lastUsedAt;
+    if (!lastUsedAt) {
+      return true;
+    }
+    return now.getTime() - lastUsedAt.getTime() >= PROLONG_THROTTLE_MS;
+  }
 }
 export {
+  PROLONG_THROTTLE_MS,
   ProlongApiKeyCommand
 };
 //# sourceMappingURL=ProlongApiKeyCommand.js.map

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProlongApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { UpdateBuilder } from '@contember/database'\n\nconst PROLONG_THROTTLE_MS = 60_000\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\tif (newExpiration === null) {\n\t\t\treturn\n\t\t}\n\n\t\tif (this.currentExpiration) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\treturn\n\t\t\t}\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\texpires_at: newExpiration,\n\t\t\t})\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAKA,MAAM,sBAAsB;AAErB,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBAChB;AAJgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,gBAAgB,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AACtF,QAAI,kBAAkB,MAAM;AAC3B;AAAA,IACD;AAEA,QAAI,KAAK,mBAAmB;AAC3B,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD;AAAA,MACD;AAAA,IACD;AAEA,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,YAAY;AAAA,IAAA,CACZ;AACF,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}
+{"version":3,"file":"ProlongApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { Literal, QueryBuilder, UpdateBuilder } from '@contember/database'\n\n/**\n * Tracking writes (`last_ip`, `last_user_agent`, `last_used_at`) are throttled to at most once per\n * this window, even when the IP or User-Agent changes: a key shared by several service replicas\n * alternates between their addresses, and writing every change makes its row a lock hotspot.\n * An idle check must add this slack to avoid prematurely expiring an active session whose\n * `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).\n */\nexport const PROLONG_THROTTLE_MS = 60_000\n\nexport interface ApiKeyRequestInfo {\n\tip?: string\n\tuserAgent?: string\n}\n\nexport interface ApiKeyTrackingState {\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tlastUsedAt: Date | null\n}\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t\tprivate readonly requestInfo?: ApiKeyRequestInfo,\n\t\tprivate readonly tracking?: ApiKeyTrackingState,\n\t\tprivate readonly maxExpiresAt?: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tlet newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\t// A19: clamp the sliding window at the absolute cap snapshotted at sign-in.\n\t\t// NULL maxExpiresAt = today's uncapped sliding window.\n\t\tif (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {\n\t\t\tnewExpiration = this.maxExpiresAt\n\t\t}\n\t\tconst now = providers.now()\n\n\t\tlet updateExpiration = newExpiration !== null\n\t\tif (updateExpiration && this.currentExpiration && newExpiration !== null) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\tupdateExpiration = false\n\t\t\t}\n\t\t}\n\n\t\tconst requestIp = this.requestInfo?.ip || null\n\t\tconst requestUserAgent = this.requestInfo?.userAgent || null\n\t\tconst updateTracking = this.shouldUpdateTracking(now)\n\n\t\tif (!updateExpiration && !updateTracking) {\n\t\t\treturn\n\t\t}\n\n\t\tconst values: QueryBuilder.Values = {}\n\t\tif (updateExpiration && newExpiration !== null) {\n\t\t\t// Write the sliding expiry on the DB clock and clamp to the stored\n\t\t\t// max_expires_at in SQL (LEAST ignores a NULL cap → uncapped window). The JS\n\t\t\t// throttle above only decides *whether* to write; the expiry gate itself is\n\t\t\t// computed on the DB clock. See engine-tenant-api/CLAUDE.md.\n\t\t\tvalues.expires_at = new Literal('LEAST(now() + make_interval(secs => ?), \"max_expires_at\")', [\n\t\t\t\tApiKeyHelper.getSessionExpirationSeconds(this.expiration),\n\t\t\t])\n\t\t}\n\t\tif (updateTracking) {\n\t\t\tvalues.last_ip = requestIp\n\t\t\tvalues.last_user_agent = requestUserAgent\n\t\t\t// last_used_at on the DB clock: it's compared against now() in the idle gate\n\t\t\t// (ApiKeyByTokenQuery's is_idle_expired), so it must be written on the same\n\t\t\t// clock. The app-clock `now` above only drives the write-rate throttle. See CLAUDE.md.\n\t\t\tvalues.last_used_at = new Literal('now()')\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values(values)\n\t\tawait qb.execute(db)\n\t}\n\n\tprivate shouldUpdateTracking(now: Date): boolean {\n\t\tif (!this.requestInfo) {\n\t\t\treturn false\n\t\t}\n\t\tconst lastUsedAt = this.tracking?.lastUsedAt\n\t\tif (!lastUsedAt) {\n\t\t\treturn true\n\t\t}\n\t\treturn now.getTime() - lastUsedAt.getTime() >= PROLONG_THROTTLE_MS\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAYO,MAAM,sBAAsB;AAa5B,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBACA,aACA,UACA,cAChB;AAPgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,cAAA;AACA,SAAA,WAAA;AACA,SAAA,eAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,QAAI,gBAAgB,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AAGpF,QAAI,kBAAkB,QAAQ,KAAK,gBAAgB,cAAc,YAAY,KAAK,aAAa,WAAW;AACzG,sBAAgB,KAAK;AAAA,IACtB;AACA,UAAM,MAAM,UAAU,IAAA;AAEtB,QAAI,mBAAmB,kBAAkB;AACzC,QAAI,oBAAoB,KAAK,qBAAqB,kBAAkB,MAAM;AACzE,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD,2BAAmB;AAAA,MACpB;AAAA,IACD;AAEA,UAAM,YAAY,KAAK,aAAa,MAAM;AAC1C,UAAM,mBAAmB,KAAK,aAAa,aAAa;AACxD,UAAM,iBAAiB,KAAK,qBAAqB,GAAG;AAEpD,QAAI,CAAC,oBAAoB,CAAC,gBAAgB;AACzC;AAAA,IACD;AAEA,UAAM,SAA8B,CAAA;AACpC,QAAI,oBAAoB,kBAAkB,MAAM;AAK/C,aAAO,aAAa,IAAI,QAAQ,6DAA6D;AAAA,QAC5F,aAAa,4BAA4B,KAAK,UAAU;AAAA,MAAA,CACxD;AAAA,IACF;AACA,QAAI,gBAAgB;AACnB,aAAO,UAAU;AACjB,aAAO,kBAAkB;AAIzB,aAAO,eAAe,IAAI,QAAQ,OAAO;AAAA,IAC1C;AAEA,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO,MAAM;AACf,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AAAA,EAEQ,qBAAqB,KAAoB;AAChD,QAAI,CAAC,KAAK,aAAa;AACtB,aAAO;AAAA,IACR;AACA,UAAM,aAAa,KAAK,UAAU;AAClC,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,IAAI,QAAA,IAAY,WAAW,aAAa;AAAA,EAChD;AACD;"}

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.cjs

@@ -19,7 +19,11 @@ class CreateAuthLogEntryCommand {
       ip_address: this.data.ipAddress,
       user_agent: this.data.userAgent,
       identity_provider_id: this.data.identityProviderId,
-      metadata: this.data.metadata ?? {}
+      metadata: this.data.metadata ?? {},
+      target_person_id: this.data.targetPersonId,
+      event_data: this.data.eventData,
+      geo_country: this.data.geoCountry,
+      device_fingerprint: this.data.deviceFingerprint
     }).execute(db);
   }
 }

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateAuthLogEntryCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { AuthActionType } from '../../type/AuthLog'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\tinvokedById: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,IAAC,CACjC,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"CreateAuthLogEntryCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { AuthActionType } from '../../type/AuthLog.js'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t\ttarget_person_id: this.data.targetPersonId,\n\t\t\t\tevent_data: this.data.eventData,\n\t\t\t\tgeo_country: this.data.geoCountry,\n\t\t\t\tdevice_fingerprint: this.data.deviceFingerprint,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\t/** The identity that initiated the action. Omit (→ NULL) when there is no acting identity, e.g. an IdP-initiated back-channel logout. */\n\t\tinvokedById?: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\t/** A `person_token` id (password reset, e-mail verification, passwordless). FK-checked, so never an `api_key` id: put that in `eventData`. */\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t\ttargetPersonId?: string\n\t\teventData?: JSONValue\n\t\t/** A03: country derived from the trusted reverse-proxy geo header, when present. */\n\t\tgeoCountry?: string\n\t\t/** A03: hash of the client user-agent (never the raw UA). */\n\t\tdeviceFingerprint?: string\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,MAChC,kBAAkB,KAAK,KAAK;AAAA,MAC5B,YAAY,KAAK,KAAK;AAAA,MACtB,aAAa,KAAK,KAAK;AAAA,MACvB,oBAAoB,KAAK,KAAK;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.js

@@ -17,7 +17,11 @@ class CreateAuthLogEntryCommand {
       ip_address: this.data.ipAddress,
       user_agent: this.data.userAgent,
       identity_provider_id: this.data.identityProviderId,
-      metadata: this.data.metadata ?? {}
+      metadata: this.data.metadata ?? {},
+      target_person_id: this.data.targetPersonId,
+      event_data: this.data.eventData,
+      geo_country: this.data.geoCountry,
+      device_fingerprint: this.data.deviceFingerprint
     }).execute(db);
   }
 }

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateAuthLogEntryCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { AuthActionType } from '../../type/AuthLog'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\tinvokedById: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,IAAC,CACjC,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"CreateAuthLogEntryCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { AuthActionType } from '../../type/AuthLog.js'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t\ttarget_person_id: this.data.targetPersonId,\n\t\t\t\tevent_data: this.data.eventData,\n\t\t\t\tgeo_country: this.data.geoCountry,\n\t\t\t\tdevice_fingerprint: this.data.deviceFingerprint,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\t/** The identity that initiated the action. Omit (→ NULL) when there is no acting identity, e.g. an IdP-initiated back-channel logout. */\n\t\tinvokedById?: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\t/** A `person_token` id (password reset, e-mail verification, passwordless). FK-checked, so never an `api_key` id: put that in `eventData`. */\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t\ttargetPersonId?: string\n\t\teventData?: JSONValue\n\t\t/** A03: country derived from the trusted reverse-proxy geo header, when present. */\n\t\tgeoCountry?: string\n\t\t/** A03: hash of the client user-agent (never the raw UA). */\n\t\tdeviceFingerprint?: string\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,MAChC,kBAAkB,KAAK,KAAK;AAAA,MAC5B,YAAY,KAAK,KAAK;AAAA,MACtB,aAAa,KAAK,KAAK;AAAA,MACvB,oBAAoB,KAAK,KAAK;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/authPolicy/CreateAuthPolicyCommand.cjs

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class CreateAuthPolicyCommand {
+  constructor(values) {
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const now = providers.now();
+    await Database.InsertBuilder.create().into("auth_policy").values({
+      id,
+      scope: this.values.scope,
+      project_id: this.values.projectId,
+      roles: this.values.roles,
+      mfa_required: this.values.mfaRequired,
+      token_expiration: this.values.tokenExpiration,
+      idle_timeout: this.values.idleTimeout,
+      grace_duration: this.values.graceDuration,
+      remember_me_allowed: this.values.rememberMeAllowed,
+      created_at: now,
+      updated_at: now
+    }).execute(db);
+    return id;
+  }
+}
+exports.CreateAuthPolicyCommand = CreateAuthPolicyCommand;
+//# sourceMappingURL=CreateAuthPolicyCommand.cjs.map

package/dist/development/src/model/commands/authPolicy/CreateAuthPolicyCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateAuthPolicyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/CreateAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { AuthPolicyScope } from '../../type/index.js'\n\nexport type AuthPolicyWriteValues = {\n\tscope: AuthPolicyScope\n\tprojectId: string | null\n\troles: string[]\n\tmfaRequired: boolean | null\n\ttokenExpiration: string | null\n\tidleTimeout: string | null\n\tgraceDuration: string | null\n\trememberMeAllowed: boolean | null\n}\n\n/** Inserts a new `auth_policy` row. Returns the generated id. */\nexport class CreateAuthPolicyCommand implements Command<string> {\n\tconstructor(private readonly values: AuthPolicyWriteValues) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst id = providers.uuid()\n\t\tconst now = providers.now()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('auth_policy')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tscope: this.values.scope,\n\t\t\t\tproject_id: this.values.projectId,\n\t\t\t\troles: this.values.roles,\n\t\t\t\tmfa_required: this.values.mfaRequired,\n\t\t\t\ttoken_expiration: this.values.tokenExpiration,\n\t\t\t\tidle_timeout: this.values.idleTimeout,\n\t\t\t\tgrace_duration: this.values.graceDuration,\n\t\t\t\tremember_me_allowed: this.values.rememberMeAllowed,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn id\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAgBO,MAAM,wBAAmD;AAAA,EAC/D,YAA6B,QAA+B;AAA/B,SAAA,SAAA;AAAA,EAAgC;AAAA,EAE7D,MAAM,QAAQ,EAAE,IAAI,aAA4C;AAC/D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,MAAM,UAAU,IAAA;AACtB,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,OAAO,KAAK,OAAO;AAAA,MACnB,YAAY,KAAK,OAAO;AAAA,MACxB,OAAO,KAAK,OAAO;AAAA,MACnB,cAAc,KAAK,OAAO;AAAA,MAC1B,kBAAkB,KAAK,OAAO;AAAA,MAC9B,cAAc,KAAK,OAAO;AAAA,MAC1B,gBAAgB,KAAK,OAAO;AAAA,MAC5B,qBAAqB,KAAK,OAAO;AAAA,MACjC,YAAY;AAAA,MACZ,YAAY;AAAA,IAAA,CACZ,EACA,QAAQ,EAAE;AACZ,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/commands/authPolicy/CreateAuthPolicyCommand.js

@@ -0,0 +1,28 @@
+import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+class CreateAuthPolicyCommand {
+  constructor(values) {
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const now = providers.now();
+    await InsertBuilder$1.create().into("auth_policy").values({
+      id,
+      scope: this.values.scope,
+      project_id: this.values.projectId,
+      roles: this.values.roles,
+      mfa_required: this.values.mfaRequired,
+      token_expiration: this.values.tokenExpiration,
+      idle_timeout: this.values.idleTimeout,
+      grace_duration: this.values.graceDuration,
+      remember_me_allowed: this.values.rememberMeAllowed,
+      created_at: now,
+      updated_at: now
+    }).execute(db);
+    return id;
+  }
+}
+export {
+  CreateAuthPolicyCommand
+};
+//# sourceMappingURL=CreateAuthPolicyCommand.js.map

package/dist/development/src/model/commands/authPolicy/CreateAuthPolicyCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateAuthPolicyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/CreateAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { AuthPolicyScope } from '../../type/index.js'\n\nexport type AuthPolicyWriteValues = {\n\tscope: AuthPolicyScope\n\tprojectId: string | null\n\troles: string[]\n\tmfaRequired: boolean | null\n\ttokenExpiration: string | null\n\tidleTimeout: string | null\n\tgraceDuration: string | null\n\trememberMeAllowed: boolean | null\n}\n\n/** Inserts a new `auth_policy` row. Returns the generated id. */\nexport class CreateAuthPolicyCommand implements Command<string> {\n\tconstructor(private readonly values: AuthPolicyWriteValues) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst id = providers.uuid()\n\t\tconst now = providers.now()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('auth_policy')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tscope: this.values.scope,\n\t\t\t\tproject_id: this.values.projectId,\n\t\t\t\troles: this.values.roles,\n\t\t\t\tmfa_required: this.values.mfaRequired,\n\t\t\t\ttoken_expiration: this.values.tokenExpiration,\n\t\t\t\tidle_timeout: this.values.idleTimeout,\n\t\t\t\tgrace_duration: this.values.graceDuration,\n\t\t\t\tremember_me_allowed: this.values.rememberMeAllowed,\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn id\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAgBO,MAAM,wBAAmD;AAAA,EAC/D,YAA6B,QAA+B;AAA/B,SAAA,SAAA;AAAA,EAAgC;AAAA,EAE7D,MAAM,QAAQ,EAAE,IAAI,aAA4C;AAC/D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,MAAM,UAAU,IAAA;AACtB,UAAMA,gBAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,OAAO,KAAK,OAAO;AAAA,MACnB,YAAY,KAAK,OAAO;AAAA,MACxB,OAAO,KAAK,OAAO;AAAA,MACnB,cAAc,KAAK,OAAO;AAAA,MAC1B,kBAAkB,KAAK,OAAO;AAAA,MAC9B,cAAc,KAAK,OAAO;AAAA,MAC1B,gBAAgB,KAAK,OAAO;AAAA,MAC5B,qBAAqB,KAAK,OAAO;AAAA,MACjC,YAAY;AAAA,MACZ,YAAY;AAAA,IAAA,CACZ,EACA,QAAQ,EAAE;AACZ,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/commands/authPolicy/DeleteAuthPolicyCommand.cjs

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class DeleteAuthPolicyCommand {
+  constructor(id) {
+    this.id = id;
+  }
+  async execute({ db }) {
+    const result = await Database.DeleteBuilder.create().from("auth_policy").where({ id: this.id }).execute(db);
+    return result > 0;
+  }
+}
+exports.DeleteAuthPolicyCommand = DeleteAuthPolicyCommand;
+//# sourceMappingURL=DeleteAuthPolicyCommand.cjs.map

package/dist/development/src/model/commands/authPolicy/DeleteAuthPolicyCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteAuthPolicyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/DeleteAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/** Deletes an `auth_policy` row by id. Returns whether a row was removed. */\nexport class DeleteAuthPolicyCommand implements Command<boolean> {\n\tconstructor(private readonly id: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await DeleteBuilder.create()\n\t\t\t.from('auth_policy')\n\t\t\t.where({ id: this.id })\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAIO,MAAM,wBAAoD;AAAA,EAChE,YAA6B,IAAY;AAAZ,SAAA,KAAA;AAAA,EAAa;AAAA,EAE1C,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAMA,SAAAA,cAAc,OAAA,EACjC,KAAK,aAAa,EAClB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}

package/dist/development/src/model/commands/authPolicy/DeleteAuthPolicyCommand.js

@@ -0,0 +1,14 @@
+import { DeleteBuilder } from "@contember/database";
+class DeleteAuthPolicyCommand {
+  constructor(id) {
+    this.id = id;
+  }
+  async execute({ db }) {
+    const result = await DeleteBuilder.create().from("auth_policy").where({ id: this.id }).execute(db);
+    return result > 0;
+  }
+}
+export {
+  DeleteAuthPolicyCommand
+};
+//# sourceMappingURL=DeleteAuthPolicyCommand.js.map

package/dist/development/src/model/commands/authPolicy/DeleteAuthPolicyCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteAuthPolicyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/DeleteAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/** Deletes an `auth_policy` row by id. Returns whether a row was removed. */\nexport class DeleteAuthPolicyCommand implements Command<boolean> {\n\tconstructor(private readonly id: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await DeleteBuilder.create()\n\t\t\t.from('auth_policy')\n\t\t\t.where({ id: this.id })\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,wBAAoD;AAAA,EAChE,YAA6B,IAAY;AAAZ,SAAA,KAAA;AAAA,EAAa;AAAA,EAE1C,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAM,cAAc,OAAA,EACjC,KAAK,aAAa,EAClB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}

package/dist/development/src/model/commands/authPolicy/UpdateAuthPolicyCommand.cjs

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class UpdateAuthPolicyCommand {
+  constructor(id, values) {
+    this.id = id;
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const result = await Database.UpdateBuilder.create().table("auth_policy").where({ id: this.id }).values({
+      scope: this.values.scope,
+      project_id: this.values.projectId,
+      roles: this.values.roles,
+      mfa_required: this.values.mfaRequired,
+      token_expiration: this.values.tokenExpiration,
+      idle_timeout: this.values.idleTimeout,
+      grace_duration: this.values.graceDuration,
+      remember_me_allowed: this.values.rememberMeAllowed,
+      updated_at: providers.now()
+    }).execute(db);
+    return result > 0;
+  }
+}
+exports.UpdateAuthPolicyCommand = UpdateAuthPolicyCommand;
+//# sourceMappingURL=UpdateAuthPolicyCommand.cjs.map

package/dist/development/src/model/commands/authPolicy/UpdateAuthPolicyCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateAuthPolicyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/UpdateAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { AuthPolicyScope } from '../../type/index.js'\n\n/**\n * Updates an existing `auth_policy` row. Only the supplied fields are written\n * (an `undefined` field is left untouched; an explicit `null` clears it).\n * `updated_at` is always bumped. Returns whether a row was affected.\n */\nexport class UpdateAuthPolicyCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly values: {\n\t\t\tscope?: AuthPolicyScope\n\t\t\tprojectId?: string | null\n\t\t\troles?: string[]\n\t\t\tmfaRequired?: boolean | null\n\t\t\ttokenExpiration?: string | null\n\t\t\tidleTimeout?: string | null\n\t\t\tgraceDuration?: string | null\n\t\t\trememberMeAllowed?: boolean | null\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('auth_policy')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\tscope: this.values.scope,\n\t\t\t\tproject_id: this.values.projectId,\n\t\t\t\troles: this.values.roles,\n\t\t\t\tmfa_required: this.values.mfaRequired,\n\t\t\t\ttoken_expiration: this.values.tokenExpiration,\n\t\t\t\tidle_timeout: this.values.idleTimeout,\n\t\t\t\tgrace_duration: this.values.graceDuration,\n\t\t\t\tremember_me_allowed: this.values.rememberMeAllowed,\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AASO,MAAM,wBAAoD;AAAA,EAChE,YACkB,IACA,QAUhB;AAXgB,SAAA,KAAA;AACA,SAAA,SAAA;AAAA,EAUf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,SAAS,MAAMA,SAAAA,cAAc,OAAA,EACjC,MAAM,aAAa,EACnB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,OAAO,KAAK,OAAO;AAAA,MACnB,YAAY,KAAK,OAAO;AAAA,MACxB,OAAO,KAAK,OAAO;AAAA,MACnB,cAAc,KAAK,OAAO;AAAA,MAC1B,kBAAkB,KAAK,OAAO;AAAA,MAC9B,cAAc,KAAK,OAAO;AAAA,MAC1B,gBAAgB,KAAK,OAAO;AAAA,MAC5B,qBAAqB,KAAK,OAAO;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}

package/dist/development/src/model/commands/authPolicy/UpdateAuthPolicyCommand.js

@@ -0,0 +1,25 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class UpdateAuthPolicyCommand {
+  constructor(id, values) {
+    this.id = id;
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const result = await UpdateBuilder$1.create().table("auth_policy").where({ id: this.id }).values({
+      scope: this.values.scope,
+      project_id: this.values.projectId,
+      roles: this.values.roles,
+      mfa_required: this.values.mfaRequired,
+      token_expiration: this.values.tokenExpiration,
+      idle_timeout: this.values.idleTimeout,
+      grace_duration: this.values.graceDuration,
+      remember_me_allowed: this.values.rememberMeAllowed,
+      updated_at: providers.now()
+    }).execute(db);
+    return result > 0;
+  }
+}
+export {
+  UpdateAuthPolicyCommand
+};
+//# sourceMappingURL=UpdateAuthPolicyCommand.js.map

package/dist/development/src/model/commands/authPolicy/UpdateAuthPolicyCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateAuthPolicyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authPolicy/UpdateAuthPolicyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { AuthPolicyScope } from '../../type/index.js'\n\n/**\n * Updates an existing `auth_policy` row. Only the supplied fields are written\n * (an `undefined` field is left untouched; an explicit `null` clears it).\n * `updated_at` is always bumped. Returns whether a row was affected.\n */\nexport class UpdateAuthPolicyCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly values: {\n\t\t\tscope?: AuthPolicyScope\n\t\t\tprojectId?: string | null\n\t\t\troles?: string[]\n\t\t\tmfaRequired?: boolean | null\n\t\t\ttokenExpiration?: string | null\n\t\t\tidleTimeout?: string | null\n\t\t\tgraceDuration?: string | null\n\t\t\trememberMeAllowed?: boolean | null\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('auth_policy')\n\t\t\t.where({ id: this.id })\n\t\t\t.values({\n\t\t\t\tscope: this.values.scope,\n\t\t\t\tproject_id: this.values.projectId,\n\t\t\t\troles: this.values.roles,\n\t\t\t\tmfa_required: this.values.mfaRequired,\n\t\t\t\ttoken_expiration: this.values.tokenExpiration,\n\t\t\t\tidle_timeout: this.values.idleTimeout,\n\t\t\t\tgrace_duration: this.values.graceDuration,\n\t\t\t\tremember_me_allowed: this.values.rememberMeAllowed,\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AASO,MAAM,wBAAoD;AAAA,EAChE,YACkB,IACA,QAUhB;AAXgB,SAAA,KAAA;AACA,SAAA,SAAA;AAAA,EAUf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,aAAa,EACnB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO;AAAA,MACP,OAAO,KAAK,OAAO;AAAA,MACnB,YAAY,KAAK,OAAO;AAAA,MACxB,OAAO,KAAK,OAAO;AAAA,MACnB,cAAc,KAAK,OAAO;AAAA,MAC1B,kBAAkB,KAAK,OAAO;AAAA,MAC9B,cAAc,KAAK,OAAO;AAAA,MAC1B,gBAAgB,KAAK,OAAO;AAAA,MAC5B,qBAAqB,KAAK,OAAO;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}

package/dist/development/src/model/commands/backupCode/ConsumeBackupCodeCommand.cjs

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class ConsumeBackupCodeCommand {
+  constructor(personId, codeHash) {
+    this.personId = personId;
+    this.codeHash = codeHash;
+  }
+  async execute({ db, providers }) {
+    const affected = await Database.UpdateBuilder.create().table("person_backup_code").values({
+      used_at: providers.now()
+    }).where({
+      person_id: this.personId,
+      code_hash: this.codeHash
+    }).where((expr) => expr.isNull("used_at")).execute(db);
+    return affected > 0;
+  }
+}
+exports.ConsumeBackupCodeCommand = ConsumeBackupCodeCommand;
+//# sourceMappingURL=ConsumeBackupCodeCommand.cjs.map

package/dist/development/src/model/commands/backupCode/ConsumeBackupCodeCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConsumeBackupCodeCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/ConsumeBackupCodeCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Atomically consumes an unused backup code matching the given hash.\n * Returns true if a code was consumed. Safe against double-spend: the\n * UPDATE only touches a row that is still unused, and we rely on the\n * affected-row count, so two concurrent attempts with the same code can\n * succeed at most once.\n */\nexport class ConsumeBackupCodeCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly codeHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst affected = await UpdateBuilder.create()\n\t\t\t.table('person_backup_code')\n\t\t\t.values({\n\t\t\t\tused_at: providers.now(),\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tperson_id: this.personId,\n\t\t\t\tcode_hash: this.codeHash,\n\t\t\t})\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.execute(db)\n\n\t\treturn affected > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAUO,MAAM,yBAAqD;AAAA,EACjE,YACkB,UACA,UAChB;AAFgB,SAAA,WAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,WAAW,MAAMA,uBAAc,OAAA,EACnC,MAAM,oBAAoB,EAC1B,OAAO;AAAA,MACP,SAAS,UAAU,IAAA;AAAA,IAAI,CACvB,EACA,MAAM;AAAA,MACN,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,IAAA,CAChB,EACA,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,QAAQ,EAAE;AAEZ,WAAO,WAAW;AAAA,EACnB;AACD;;"}

package/dist/development/src/model/commands/backupCode/ConsumeBackupCodeCommand.js

@@ -0,0 +1,20 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class ConsumeBackupCodeCommand {
+  constructor(personId, codeHash) {
+    this.personId = personId;
+    this.codeHash = codeHash;
+  }
+  async execute({ db, providers }) {
+    const affected = await UpdateBuilder$1.create().table("person_backup_code").values({
+      used_at: providers.now()
+    }).where({
+      person_id: this.personId,
+      code_hash: this.codeHash
+    }).where((expr) => expr.isNull("used_at")).execute(db);
+    return affected > 0;
+  }
+}
+export {
+  ConsumeBackupCodeCommand
+};
+//# sourceMappingURL=ConsumeBackupCodeCommand.js.map

package/dist/development/src/model/commands/backupCode/ConsumeBackupCodeCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConsumeBackupCodeCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/ConsumeBackupCodeCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Atomically consumes an unused backup code matching the given hash.\n * Returns true if a code was consumed. Safe against double-spend: the\n * UPDATE only touches a row that is still unused, and we rely on the\n * affected-row count, so two concurrent attempts with the same code can\n * succeed at most once.\n */\nexport class ConsumeBackupCodeCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly codeHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst affected = await UpdateBuilder.create()\n\t\t\t.table('person_backup_code')\n\t\t\t.values({\n\t\t\t\tused_at: providers.now(),\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tperson_id: this.personId,\n\t\t\t\tcode_hash: this.codeHash,\n\t\t\t})\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.execute(db)\n\n\t\treturn affected > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAUO,MAAM,yBAAqD;AAAA,EACjE,YACkB,UACA,UAChB;AAFgB,SAAA,WAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,WAAW,MAAMA,gBAAc,OAAA,EACnC,MAAM,oBAAoB,EAC1B,OAAO;AAAA,MACP,SAAS,UAAU,IAAA;AAAA,IAAI,CACvB,EACA,MAAM;AAAA,MACN,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,IAAA,CAChB,EACA,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,QAAQ,EAAE;AAEZ,WAAO,WAAW;AAAA,EACnB;AACD;"}

package/dist/development/src/model/commands/backupCode/CreateBackupCodeCommand.cjs

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class CreateBackupCodeCommand {
+  constructor(personId, codeHash) {
+    this.personId = personId;
+    this.codeHash = codeHash;
+  }
+  async execute({ db, providers }) {
+    await Database.InsertBuilder.create().into("person_backup_code").values({
+      id: providers.uuid(),
+      person_id: this.personId,
+      code_hash: this.codeHash,
+      created_at: providers.now()
+    }).execute(db);
+  }
+}
+exports.CreateBackupCodeCommand = CreateBackupCodeCommand;
+//# sourceMappingURL=CreateBackupCodeCommand.cjs.map

package/dist/development/src/model/commands/backupCode/CreateBackupCodeCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateBackupCodeCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/CreateBackupCodeCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\n/**\n * Inserts a single backup code (stored as a hash) for a person.\n */\nexport class CreateBackupCodeCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly codeHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_backup_code')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tperson_id: this.personId,\n\t\t\t\tcode_hash: this.codeHash,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAMO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,UACA,UAChB;AAFgB,SAAA,WAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,oBAAoB,EACzB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/backupCode/CreateBackupCodeCommand.js

@@ -0,0 +1,19 @@
+import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+class CreateBackupCodeCommand {
+  constructor(personId, codeHash) {
+    this.personId = personId;
+    this.codeHash = codeHash;
+  }
+  async execute({ db, providers }) {
+    await InsertBuilder$1.create().into("person_backup_code").values({
+      id: providers.uuid(),
+      person_id: this.personId,
+      code_hash: this.codeHash,
+      created_at: providers.now()
+    }).execute(db);
+  }
+}
+export {
+  CreateBackupCodeCommand
+};
+//# sourceMappingURL=CreateBackupCodeCommand.js.map

package/dist/development/src/model/commands/backupCode/CreateBackupCodeCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateBackupCodeCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/CreateBackupCodeCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\n/**\n * Inserts a single backup code (stored as a hash) for a person.\n */\nexport class CreateBackupCodeCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly codeHash: string,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_backup_code')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tperson_id: this.personId,\n\t\t\t\tcode_hash: this.codeHash,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAMO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,UACA,UAChB;AAFgB,SAAA,WAAA;AACA,SAAA,WAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,KAAK,oBAAoB,EACzB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/backupCode/DeleteBackupCodesCommand.cjs

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class DeleteBackupCodesCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db }) {
+    await Database.DeleteBuilder.create().from("person_backup_code").where({ person_id: this.personId }).execute(db);
+  }
+}
+exports.DeleteBackupCodesCommand = DeleteBackupCodesCommand;
+//# sourceMappingURL=DeleteBackupCodesCommand.cjs.map

package/dist/development/src/model/commands/backupCode/DeleteBackupCodesCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteBackupCodesCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/DeleteBackupCodesCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/**\n * Deletes all backup codes (used and unused) for a person.\n */\nexport class DeleteBackupCodesCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.from('person_backup_code')\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAMO,MAAM,yBAAkD;AAAA,EAC9D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,oBAAoB,EACzB,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/backupCode/DeleteBackupCodesCommand.js

@@ -0,0 +1,13 @@
+import { DeleteBuilder } from "@contember/database";
+class DeleteBackupCodesCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db }) {
+    await DeleteBuilder.create().from("person_backup_code").where({ person_id: this.personId }).execute(db);
+  }
+}
+export {
+  DeleteBackupCodesCommand
+};
+//# sourceMappingURL=DeleteBackupCodesCommand.js.map

package/dist/development/src/model/commands/backupCode/DeleteBackupCodesCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteBackupCodesCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/backupCode/DeleteBackupCodesCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/**\n * Deletes all backup codes (used and unused) for a person.\n */\nexport class DeleteBackupCodesCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.from('person_backup_code')\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.execute(db)\n\t}\n}\n"],"names":[],"mappings":";AAMO,MAAM,yBAAkD;AAAA,EAC9D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,cAAc,OAAA,EAClB,KAAK,oBAAoB,EACzB,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,EAAE;AAAA,EACb;AACD;"}