@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/types/model/service/EmailVerificationManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailVerificationManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/EmailVerificationManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAOnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD,UAAU,WAAW;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,wBAAwB;IAEnC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAFhC,YACkB,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,EAC5C;IAEJ;;;;;;OAMG;IACU,qBAAqB,CACjC,SAAS,EAAE,eAAe,EAC1B,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,SAAS,EACjB,WAAW,GAAE,WAAgB,GAC3B,OAAO,CAAC,OAAO,CAAC,CAiClB;IAEY,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAqChG;CACD;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CACzC;IAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CAAE,EAC5C,WAAW,CAAC,oBAAoB,EAChC;IAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CAAE,CAC5C,CAAA"}

package/dist/types/model/service/GlobalRoleValidator.d.ts

@@ -0,0 +1,5 @@
+import { DatabaseContext } from '../utils/index.js';
+export declare class GlobalRoleValidator {
+    findInvalidRole(db: DatabaseContext, roles: readonly string[], additionallyActiveRoles?: ReadonlySet<string>): Promise<string | null>;
+}
+//# sourceMappingURL=GlobalRoleValidator.d.ts.map

package/dist/types/model/service/GlobalRoleValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GlobalRoleValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/GlobalRoleValidator.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,qBAAa,mBAAmB;IACzB,eAAe,CACpB,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,uBAAuB,GAAE,WAAW,CAAC,MAAM,CAAa,GACtD,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;CACD"}

package/dist/types/model/service/HibpChecker.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Looks up a password in the Have-I-Been-Pwned passwords corpus using its
+ * k-anonymity API: the client sends only the first 5 hex chars of the SHA-1
+ * hash, the server returns all matching suffixes plus counts.
+ *
+ * https://haveibeenpwned.com/API/v3#PwnedPasswords
+ *
+ * Implementations are expected to be fail-open: when the upstream is down or
+ * misbehaves, `isCompromised` should resolve to `false`, never throw.
+ */
+export interface HibpChecker {
+    isCompromised(password: string): Promise<boolean>;
+}
+export declare class HttpHibpChecker implements HibpChecker {
+    private readonly endpoint;
+    private readonly fetchImpl;
+    private readonly timeoutMs;
+    constructor(endpoint?: string, fetchImpl?: typeof fetch, timeoutMs?: number);
+    isCompromised(password: string): Promise<boolean>;
+}
+/** Disabled checker — used when HIBP integration is turned off in tenant config. */
+export declare class NoopHibpChecker implements HibpChecker {
+    isCompromised(_password: string): Promise<boolean>;
+}
+//# sourceMappingURL=HibpChecker.d.ts.map

package/dist/types/model/service/HibpChecker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HibpChecker.d.ts","sourceRoot":"","sources":["../../../../src/model/service/HibpChecker.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC3B,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACjD;AAED,qBAAa,eAAgB,YAAW,WAAW;IAEjD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAH3B,YACkB,QAAQ,GAAE,MAAgD,EAC1D,SAAS,GAAE,OAAO,KAAa,EAC/B,SAAS,GAAE,MAAa,EACtC;IAEE,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA2BtD;CACD;AAED,oFAAoF;AACpF,qBAAa,eAAgB,YAAW,WAAW;IAC5C,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEvD;CACD"}

package/dist/types/model/service/IDPSignInManager.d.ts

@@ -1,26 +1,44 @@
-import { ApiKeyManager } from './apiKey';
-import { PersonRow } from '../queries';
-import { IDPHandlerRegistry } from './idp';
-import { Response } from '../utils/Response';
-import { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema';
-import { DatabaseContext } from '../utils';
-import { AuthLogService } from './AuthLogService';
+import { ApiKeyManager } from './apiKey/index.js';
+import { PersonRow } from '../queries/index.js';
+import { IDPHandlerRegistry } from './idp/index.js';
+import { Response } from '../utils/Response.js';
+import { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { ApiKeyRequestInfo } from '../commands/index.js';
+import { AuthLogService } from './AuthLogService.js';
+import { ClaimMappingAudit, IDPClaimSyncService } from './idp/IDPClaimSyncService.js';
+import { Logger } from '@contember/logger';
 declare class IDPSignInManager {
     private readonly apiKeyManager;
     private readonly idpRegistry;
-    constructor(apiKeyManager: ApiKeyManager, idpRegistry: IDPHandlerRegistry);
-    signInIDP(dbContext: DatabaseContext, idpSlug: string, responseData: unknown, expiration?: number): Promise<IDPSignInManager.SignInIDPResponse>;
+    private readonly claimSyncService;
+    private readonly logger;
+    constructor(apiKeyManager: ApiKeyManager, idpRegistry: IDPHandlerRegistry, claimSyncService: IDPClaimSyncService, logger: Logger);
+    signInIDP(dbContext: DatabaseContext, idpSlug: string, responseData: unknown, expiration?: number, requestInfo?: ApiKeyRequestInfo, trustForwardedInfo?: boolean): Promise<IDPSignInManager.SignInIDPResponse>;
     initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse>;
     private resolvePerson;
     private signUp;
     private saveIdpIdentifier;
 }
 declare namespace IDPSignInManager {
+    export type ResolvePersonResult = {
+        readonly person: PersonRow | null;
+        readonly blockedReason?: 'idp_email_unverified';
+        readonly blockedPersonId?: string;
+        /** True when the person row was just created by auto-sign-up (drives the `sticky` claim-mapping policy). */
+        readonly isNewPerson?: boolean;
+    };
     export type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>;
     interface SignInIDPResult {
         readonly person: PersonRow;
         readonly token: string;
         readonly idpResponse?: Record<string, unknown>;
+        /** Identity provider the sign-in went through (for the resolver's audit). */
+        readonly identityProviderId?: string;
+        /** Claim-mapping (A09) before/after delta — present only when a mapping changed grants. */
+        readonly claimMappingAudit?: ClaimMappingAudit | null;
+        /** True when claim mapping failed and was skipped (fail-open) — drives the `idp_role_mapping_failed` audit. */
+        readonly claimMappingFailed?: boolean;
         [AuthLogService.Key]: AuthLogService.Bag;
     }
     export type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode, {

package/dist/types/model/service/IDPSignInManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IDPSignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/IDPSignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAA8D,SAAS,EAAE,MAAM,YAAY,CAAA;AAClG,OAAO,EAAE,kBAAkB,EAAqD,MAAM,OAAO,CAAA;AAC7F,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAK1C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,cAAM,gBAAgB;IAEpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;gBADX,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,kBAAkB;IAG3C,SAAS,CACd,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,OAAO,EACrB,UAAU,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,CAAC,iBAAiB,CAAC;IAqExC,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC;YA0BlH,aAAa;YAwBb,MAAM;YAmBN,iBAAiB;CAG/B;AAED,kBAAU,gBAAgB,CAAC;IAC1B,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAA;IAEzF,UAAU,eAAe;QACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC9C,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC;IAED,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,eAAe,EAAE,kBAAkB,EAAE;QAC7E,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CAAC,CAAA;;CACF;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA"}
+{"version":3,"file":"IDPSignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/IDPSignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAA8D,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC3G,OAAO,EAAE,kBAAkB,EAAqD,MAAM,gBAAgB,CAAA;AACtG,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAA6F,MAAM,sBAAsB,CAAA;AAMnJ,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AAErF,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,cAAM,gBAAgB;IAEpB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJxB,YACkB,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,kBAAkB,EAC/B,gBAAgB,EAAE,mBAAmB,EACrC,MAAM,EAAE,MAAM,EAC5B;IAEE,SAAS,CACd,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,OAAO,EACrB,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CA8J7C;IAEK,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,CAwB/H;YAEa,aAAa;YAoCb,MAAM;YAmBN,iBAAiB;CAG/B;AAED,kBAAU,gBAAgB,CAAC;IAC1B,MAAM,MAAM,mBAAmB,GAAG;QACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAA;QACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,sBAAsB,CAAA;QAC/C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;QACjC,4GAA4G;QAC5G,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAC9B,CAAA;IAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAA;IAEzF,UAAU,eAAe;QACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC9C,6EAA6E;QAC7E,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;QACpC,2FAA2F;QAC3F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAA;QACrD,+GAA+G;QAC/G,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;QACrC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC;IAED,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,eAAe,EAAE,kBAAkB,EAAE;QAC7E,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CAAC,CAAA;;CACF;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA"}

package/dist/types/model/service/InviteManager.d.ts

@@ -1,10 +1,10 @@
-import { Providers } from '../providers';
-import { PersonRow } from '../queries';
-import { Project, ProjectSchemaResolver } from '../type';
-import { InviteErrorCode, InviteMethod } from '../../schema';
-import { UserMailer } from '../mailing';
-import { Response } from '../utils/Response';
-import { DatabaseContext, TokenHash } from '../utils';
+import { Providers } from '../providers.js';
+import { PersonRow } from '../queries/index.js';
+import { Project, ProjectSchemaResolver } from '../type/index.js';
+import { InviteErrorCode, InviteMethod } from '../../schema/index.js';
+import { UserMailer } from '../mailing/index.js';
+import { Response } from '../utils/Response.js';
+import { DatabaseContext, TokenHash } from '../utils/index.js';
 import { Acl } from '@contember/schema';
 export interface InviteData {
     email: string;

package/dist/types/model/service/InviteManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"InviteManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/InviteManager.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAe,SAAS,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAE5D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAErD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAIvC,MAAM,WAAW,UAAU;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,sBAAsB,CAAC,EAAE,SAAS,CAAA;CAClC;AAED,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBAFrB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,UAAU,EAClB,qBAAqB,EAAE,qBAAqB;IAGxD,MAAM,CACX,SAAS,EAAE,eAAe,EAC1B,EACC,KAAK,EACL,OAAO,EACP,IAAI,EACJ,WAAW,EACX,MAAM,EACN,YAAY,EACZ,OAAe,EACf,QAAQ,EACR,sBAAsB,GACtB,EAAE,UAAU,GACX,OAAO,CAAC,cAAc,CAAC;YA2DZ,mBAAmB;CAKjC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;AAEpE,qBAAa,YAAY;aACI,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;aAAkB,KAAK,EAAE,OAAO;gBAAhE,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAkB,KAAK,EAAE,OAAO;CAC5F"}
+{"version":3,"file":"InviteManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/InviteManager.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAErE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE9D,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAIvC,MAAM,WAAW,UAAU;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;IACtC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,sBAAsB,CAAC,EAAE,SAAS,CAAA;CAClC;AAED,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAHvC,YACkB,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,UAAU,EAClB,qBAAqB,EAAE,qBAAqB,EAC1D;IAEE,MAAM,CACX,SAAS,EAAE,eAAe,EAC1B,EACC,KAAK,EACL,OAAO,EACP,IAAI,EACJ,WAAW,EACX,MAAM,EACN,YAAY,EACZ,OAAe,EACf,QAAQ,EACR,sBAAsB,GACtB,EAAE,UAAU,GACX,OAAO,CAAC,cAAc,CAAC,CAyDzB;YAEa,mBAAmB;CAKjC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;AAEpE,qBAAa,YAAY;aACI,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;aAAkB,KAAK,EAAE,OAAO;IAA5F,YAA4B,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAAkB,KAAK,EAAE,OAAO,EAAI;CAChG"}

package/dist/types/model/service/LoginRiskAnalyzer.d.ts

@@ -0,0 +1,97 @@
+import { BinaryLike } from 'node:crypto';
+import { DatabaseContext } from '../utils/index.js';
+import { Config } from '../type/Config.js';
+/**
+ * Risk weights per signal (A03 v1). Cumulative: a login from a new country on a
+ * new device scores HIGH + MEDIUM. Chosen so that the shipped default thresholds
+ * (email >= 1, step-up >= 3) map intuitively to "any single low signal emails,
+ * a high signal steps up".
+ */
+export declare const RiskWeight: {
+    /** New country (from the trusted reverse-proxy geo header). */
+    readonly newCountry: 3;
+    /** New user-agent fingerprint. */
+    readonly newDevice: 2;
+    /** New IP / IP-prefix. */
+    readonly newIpPrefix: 1;
+};
+export type RiskAction = 'allow' | 'email' | 'stepUp';
+/**
+ * Auth-log `type` values that represent a successful *interactive* sign-in which
+ * issued a session for the person from their own client — i.e. the rows whose
+ * geo/device/IP form the baseline for the next sign-in's anomaly check. Password
+ * (`login`), federated (`idp_login`), and magic-link (`passwordless_login`) all
+ * qualify. Deliberately excluded: `passwordless_login_exchange` (the OTP
+ * activation step issues no session) and `create_session_token` (an admin minting
+ * a token carries the admin's client info, not the person's).
+ */
+export declare const BASELINE_SIGN_IN_TYPES: readonly ['login', 'idp_login', 'passwordless_login'];
+export interface LoginSignals {
+    /** Country code from the trusted geo header, or null when unavailable. */
+    readonly geoCountry: string | null;
+    /** Hash of the client user-agent, or null when no UA was provided. */
+    readonly deviceFingerprint: string | null;
+    /** Client IP, or null when unavailable. */
+    readonly ip: string | null;
+}
+export interface PriorLogin {
+    readonly geoCountry: string | null;
+    readonly deviceFingerprint: string | null;
+    readonly ip: string | null;
+}
+export interface RiskAssessment {
+    readonly score: number;
+    readonly action: RiskAction;
+    /** Greppable list of which signals fired, e.g. ['new_country', 'new_device']. */
+    readonly reasons: readonly string[];
+}
+/**
+ * A03 — sign-in anomaly detection (v1). Runs after password verification (and any
+ * standing MFA), before a session is issued. Pure scoring lives in {@link score};
+ * {@link analyze} loads the comparison history and applies the configured policy.
+ *
+ * v1 scope (locked): no GeoIP DB — country comes from a trusted reverse-proxy
+ * header read through the same trust gate as the forwarded IP/UA. No
+ * impossible-travel detection. Opt-in, disabled by default.
+ */
+export declare class LoginRiskAnalyzer {
+    private readonly hash;
+    constructor(hash: (value: BinaryLike, algo: string) => Buffer);
+    /**
+     * Deterministic user-agent fingerprint: a hex sha256 of the raw UA. We never
+     * store the raw UA in a second column nor any cross-site fingerprint — just a
+     * stable hash so "same browser" comparisons work without retaining the string.
+     * Returns null for an absent/empty UA.
+     */
+    fingerprint(userAgent: string | undefined | null): string | null;
+    /**
+     * Pure scoring. Compares the current sign-in's signals against the set of prior
+     * successful logins. A signal fires only when (a) the current value is known,
+     * (b) a baseline for *that* signal exists in history — at least one prior login
+     * recorded a non-null value for it — and (c) the current value is absent from
+     * that baseline. With no history at all, or no baseline yet for a given signal
+     * (e.g. the geo header or device fingerprint only started being collected when
+     * the feature was enabled, so every prior row is null for it), that signal is
+     * treated as known. This keeps the documented "no baseline to deviate from →
+     * trusted" rule true per signal, so turning the feature on does not score every
+     * returning user's first login as anomalous.
+     */
+    score(current: LoginSignals, history: readonly PriorLogin[], config: Config['login']['anomalyDetection']): RiskAssessment;
+    private decide;
+    /**
+     * Loads the last N successful logins for the person and scores the current
+     * sign-in against them. Returns `allow` with no DB work when the feature is
+     * disabled (the default), so an opted-out deployment runs exactly as before.
+     */
+    analyze(dbContext: DatabaseContext, personId: string, current: LoginSignals, config: Config['login']['anomalyDetection']): Promise<RiskAssessment>;
+}
+/**
+ * Coarsens an IP to a prefix so a roaming client on the same network is treated
+ * as "known": /24 for IPv4, /48 for IPv6 (the typical site-allocation boundary).
+ * Returns null for an absent or unparseable address. Intentionally string-based
+ * to avoid pulling a parser onto the sign-in hot path, but the IPv6 form is fully
+ * canonicalized (lower-cased, leading zeros stripped, `::` expanded) so the same
+ * /48 written two different ways compares equal against stored values.
+ */
+export declare const ipPrefix: (ip: string | null) => string | null;
+//# sourceMappingURL=LoginRiskAnalyzer.d.ts.map

package/dist/types/model/service/LoginRiskAnalyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LoginRiskAnalyzer.d.ts","sourceRoot":"","sources":["../../../../src/model/service/LoginRiskAnalyzer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,UAAU;IACtB,+DAA+D;aAC/D,UAAU,EAAE,CAAC;IACb,kCAAkC;aAClC,SAAS,EAAE,CAAC;IACZ,0BAA0B;aAC1B,WAAW,EAAE,CAAC;CACL,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;AAErD;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,YAAI,OAAO,EAAE,WAAW,EAAE,oBAAoB,CAAU,CAAA;AAE3F,MAAM,WAAW,YAAY;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,sEAAsE;IACtE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED;;;;;;;;GAQG;AACH,qBAAa,iBAAiB;IAE5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IADtB,YACkB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,EAC/D;IAEJ;;;;;OAKG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAK/D;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,cAAc,CAmCxH;IAED,OAAO,CAAC,MAAM;IAYd;;;;OAIG;IACG,OAAO,CACZ,SAAS,EAAE,eAAe,EAC1B,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC,GACzC,OAAO,CAAC,cAAc,CAAC,CAgCzB;CACD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,QAAQ,OAAQ,MAAM,GAAG,IAAI,KAAG,MAAM,GAAG,IAoCrD,CAAA"}

package/dist/types/model/service/MailTemplateManager.d.ts

@@ -1,5 +1,5 @@
-import { MailTemplate, MailTemplateIdentifier } from '../mailing';
-import { DatabaseContext } from '../utils';
+import { MailTemplate, MailTemplateIdentifier } from '../mailing/index.js';
+import { DatabaseContext } from '../utils/index.js';
 export declare class MailTemplateManager {
     addMailTemplate(dbContext: DatabaseContext, mailTemplate: MailTemplate): Promise<void>;
     removeMailTemplate(dbContext: DatabaseContext, mailTemplateId: MailTemplateIdentifier): Promise<boolean>;

package/dist/types/model/service/MailTemplateManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/MailTemplateManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,qBAAa,mBAAmB;IAClB,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAItF,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC;CAGrH"}
+{"version":3,"file":"MailTemplateManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/MailTemplateManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,qBAAa,mBAAmB;IAClB,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAElG;IAEY,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,cAAc,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,CAAC,CAEpH;CACD"}

package/dist/types/model/service/MembershipValidator.d.ts

@@ -1,4 +1,4 @@
-import { ProjectSchemaResolver } from '../type';
+import { ProjectSchemaResolver } from '../type/index.js';
 import { MembershipResolver, MembershipValidationError, MembershipValidationErrorType } from '@contember/schema-utils';
 import { Acl } from '@contember/schema';
 export declare class MembershipValidator {

package/dist/types/model/service/MembershipValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MembershipValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/MembershipValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA;AAC/C,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAA;AACtH,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,mBAAmB;IAE9B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,cAAc,EAAE,qBAAqB,EACrC,QAAQ,GAAE,kBAA6C;IAGnE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;CAO7G;AAED,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,CAAA"}
+{"version":3,"file":"MembershipValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/MembershipValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,MAAM,yBAAyB,CAAA;AACtH,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,mBAAmB;IAE9B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAF1B,YACkB,cAAc,EAAE,qBAAqB,EACrC,QAAQ,GAAE,kBAA6C,EACrE;IAEE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAM5G;CACD;AAED,OAAO,EAAE,yBAAyB,EAAE,6BAA6B,EAAE,CAAA"}

package/dist/types/model/service/OtpAuthenticator.d.ts

@@ -1,4 +1,4 @@
-import { Providers } from '../providers';
+import { Providers } from '../providers.js';
 export interface OtpData {
     secret: string;
     uri: string;

package/dist/types/model/service/OtpAuthenticator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OtpAuthenticator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/OtpAuthenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAGxC,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACX;AAID,qBAAa,gBAAgB;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,aAAa,CAAC;IAI5D,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAUpD,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM;IAQ9B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAYlE;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA"}
+{"version":3,"file":"OtpAuthenticator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/OtpAuthenticator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAG3C,MAAM,WAAW,OAAO;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACX;AAID,qBAAa,gBAAgB;IAE3B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAD3B,YACkB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,aAAa,CAAC,EAElE;IAEM,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ1D;IAEM,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAM1C;IAEY,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAWjE;CACD;AAED,KAAK,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA"}

package/dist/types/model/service/OtpManager.d.ts

@@ -1,13 +1,28 @@
-import { PersonRow } from '../queries';
-import { DatabaseContext } from '../utils';
-import { OtpAuthenticator, OtpData } from './OtpAuthenticator';
+import { PersonRow } from '../queries/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { OtpAuthenticator, OtpData } from './OtpAuthenticator.js';
+import { Providers } from '../providers.js';
 export declare class OtpManager {
     private readonly otpAuthenticator;
-    constructor(otpAuthenticator: OtpAuthenticator);
+    private readonly providers;
+    constructor(otpAuthenticator: OtpAuthenticator, providers: Pick<Providers, 'decrypt' | 'encrypt' | 'encryptionEnabled'>);
     prepareOtp(dbContext: DatabaseContext, person: PersonRow, label: string): Promise<OtpData>;
-    confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void>;
+    /** Promotes the pending TOTP secret to active. Returns false if there was no pending secret to promote (e.g. a lost concurrent confirm). */
+    confirmOtp(dbContext: DatabaseContext, person: PersonRow): Promise<boolean>;
     disableOtp(dbContext: DatabaseContext, person: PersonRow): Promise<void>;
-    verifyOtp(person: PersonRow, token: string): boolean;
+    /** Verifies a token against the person's *active* TOTP secret. */
+    verifyOtp(dbContext: DatabaseContext, person: PersonRow, token: string): Promise<boolean>;
+    /** Verifies a token against the person's *pending* TOTP secret (used during enrollment). */
+    verifyPendingOtp(person: PersonRow, token: string): Promise<boolean>;
+    /**
+     * Resolves the stored secret bytes into something the authenticator understands.
+     * Version 0 = legacy plaintext otpauth URI. Version >= 1 = encrypted base32 secret.
+     *
+     * Also surfaces whether the active secret warrants opportunistic re-encryption:
+     * version-0 (legacy plaintext) always does; version>=1 does when the encryption
+     * layer signals the key has rotated (`needsReEncrypt`).
+     */
+    private resolveSecret;
 }
 export declare class OtpError extends Error {
 }

package/dist/types/model/service/OtpManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OtpManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/OtpManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAA;AAE9D,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAAhB,gBAAgB,EAAE,gBAAgB;IAG9C,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM1F,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9E,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;CAMpD;AAED,qBAAa,QAAS,SAAQ,KAAK;CAClC"}
+{"version":3,"file":"OtpManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/OtpManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAgB3C,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF3B,YACkB,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,GAAG,mBAAmB,CAAC,EACrF;IAEE,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa/F;IAED,4IAA4I;IACtI,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhF;IAEK,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7E;IAED,kEAAkE;IAC5D,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiB9F;IAED,4FAA4F;IACtF,gBAAgB,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGzE;IAED;;;;;;;OAOG;YACW,aAAa;CAkB3B;AAED,qBAAa,QAAS,SAAQ,KAAK;CAClC"}

package/dist/types/model/service/PanelAccessResolver.d.ts

@@ -0,0 +1,19 @@
+import { DatabaseContext } from '../utils/index.js';
+import { Providers } from '../providers.js';
+/**
+ * Decides whether an identity may enter the management panel served by the engine.
+ *
+ * This is an **entry gate for the console, not an authorization system**: everything the panel shows
+ * still goes through the tenant ACL, and whoever gets in could equally call `/tenant` directly. Its
+ * job is to keep the console door shut for accounts that have no business there, so an admin surface
+ * on a public API port does not look like a leak.
+ *
+ * An identity is allowed when it holds one of `globalRoles`, or a membership with one of
+ * `projectRoles` in **any** project. Empty lists mean nobody.
+ */
+export declare class PanelAccessResolver {
+    private readonly providers;
+    constructor(providers: Providers);
+    isAllowed(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<boolean>;
+}
+//# sourceMappingURL=PanelAccessResolver.d.ts.map

package/dist/types/model/service/PanelAccessResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PanelAccessResolver.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PanelAccessResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C;;;;;;;;;;GAUG;AACH,qBAAa,mBAAmB;IACnB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAtC,YAA6B,SAAS,EAAE,SAAS,EAAI;IAE/C,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAYzG;CACD"}

package/dist/types/model/service/PasswordChangeManager.d.ts

@@ -1,9 +1,9 @@
-import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema';
-import { Response } from '../utils/Response';
-import { PersonRow } from '../queries';
-import { Providers } from '../providers';
-import { DatabaseContext } from '../utils';
-import { PasswordStrengthValidator } from './PasswordStrengthValidator';
+import { ChangeMyPasswordErrorCode, ChangePasswordErrorCode, WeakPasswordReason } from '../../schema/index.js';
+import { Response } from '../utils/Response.js';
+import { PersonRow } from '../queries/index.js';
+import { Providers } from '../providers.js';
+import { DatabaseContext } from '../utils/index.js';
+import { PasswordStrengthValidator } from './PasswordStrengthValidator.js';
 declare class PasswordChangeManager {
     private readonly providers;
     private readonly passwordStrengthVerifier;

package/dist/types/model/service/PasswordChangeManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordChangeManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordChangeManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAErG,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAsB,SAAS,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAEvE,cAAM,qBAAqB;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;gBADxB,SAAS,EAAE,SAAS,EACpB,wBAAwB,EAAE,yBAAyB;IAG/D,cAAc,CACnB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,CAAC;IAU3E,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,SAAS,EACjB,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,CAAC;CAgBnF;AAED,kBAAU,qBAAqB,CAAC;IAC/B,KAAY,sBAAsB,CAAC,CAAC,SAAS,uBAAuB,GAAG,yBAAyB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE;QACrH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;KAC1C,CAAC,CAAA;CACF;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAA"}
+{"version":3,"file":"PasswordChangeManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordChangeManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE9G,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAsB,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAE1E,cAAM,qBAAqB;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IAF1C,YACkB,SAAS,EAAE,SAAS,EACpB,wBAAwB,EAAE,yBAAyB,EACjE;IAEE,cAAc,CACnB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,uBAAuB,CAAC,CAAC,CAQhF;IAEK,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,SAAS,EACjB,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,yBAAyB,CAAC,CAAC,CAelF;CACD;AAED,kBAAU,qBAAqB,CAAC;IAC/B,KAAY,sBAAsB,CAAC,CAAC,SAAS,uBAAuB,GAAG,yBAAyB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE;QACrH,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;KAC1C,CAAC,CAAA;CACF;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAA"}

package/dist/types/model/service/PasswordResetManager.d.ts

@@ -1,12 +1,12 @@
-import { Response } from '../utils/Response';
-import { UserMailer } from '../mailing';
-import { PersonRow } from '../queries';
-import { PermissionContext } from '../authorization';
-import { ProjectManager } from './ProjectManager';
-import { DatabaseContext } from '../utils';
-import { PasswordStrengthValidator } from './PasswordStrengthValidator';
-import { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema';
-import { AuthLogService } from './AuthLogService';
+import { Response } from '../utils/Response.js';
+import { UserMailer } from '../mailing/index.js';
+import { PersonRow } from '../queries/index.js';
+import { PermissionContext } from '../authorization/index.js';
+import { ProjectManager } from './ProjectManager.js';
+import { DatabaseContext } from '../utils/index.js';
+import { PasswordStrengthValidator } from './PasswordStrengthValidator.js';
+import { ResetPasswordErrorCode, WeakPasswordReason } from '../../schema/index.js';
+import { AuthLogService } from './AuthLogService.js';
 interface MailOptions {
     project?: string;
     mailVariant?: string;

package/dist/types/model/service/PasswordResetManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordResetManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordResetManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,EAAsB,SAAS,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAI1C,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,UAAU,WAAW;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,oBAAoB;IAE/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;gBAFzB,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,EAC9B,yBAAyB,EAAE,yBAAyB;IAGzD,0BAA0B,CACtC,SAAS,EAAE,eAAe,EAC1B,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,SAAS,EACjB,WAAW,GAAE,WAAgB,GAC3B,OAAO,CAAC,IAAI,CAAC;IAuBH,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA+BvH;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAC3C;IACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,EACD,sBAAsB,EACtB;IACC,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAC1C,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CACD,CAAA"}
+{"version":3,"file":"PasswordResetManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordResetManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAmD,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAChG,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAInD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAElF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAGpD,UAAU,WAAW;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,oBAAoB;IAE/B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAH3C,YACkB,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,EAC9B,yBAAyB,EAAE,yBAAyB,EAClE;IAES,0BAA0B,CACtC,SAAS,EAAE,eAAe,EAC1B,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,SAAS,EACjB,WAAW,GAAE,WAAgB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwCf;IAEY,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA8BtH;CACD;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAC3C;IACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,EACD,sBAAsB,EACtB;IACC,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAC1C,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CACD,CAAA"}

package/dist/types/model/service/PasswordStrengthValidator.d.ts

@@ -1,7 +1,10 @@
-import { Config } from '../type/Config';
-import { WeakPasswordReason } from '../../schema';
-import { ResponseError, ResponseOk } from '../utils/Response';
+import { Config } from '../type/Config.js';
+import { WeakPasswordReason } from '../../schema/index.js';
+import { ResponseError, ResponseOk } from '../utils/Response.js';
+import { HibpChecker } from './HibpChecker.js';
 export declare class PasswordStrengthValidator {
+    private readonly hibpChecker;
+    constructor(hibpChecker?: HibpChecker);
     verify<const Code extends string>(password: string, passwordConfig: Config['password'], errorCode: Code): Promise<ResponseOk<null> | ResponseError<Code, {
         weakPasswordReasons: WeakPasswordReason[];
     }>>;

package/dist/types/model/service/PasswordStrengthValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordStrengthValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordStrengthValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAEvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAY,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAEvE,qBAAa,yBAAyB;IACxB,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC5C,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,EAClC,SAAS,EAAE,IAAI,GACb,OAAO,CACP,UAAU,CAAC,IAAI,CAAC,GAChB,aAAa,CAAC,IAAI,EAAE;QACrB,mBAAmB,EAAE,kBAAkB,EAAE,CAAA;KACzC,CAAC,CACF;IAqDD,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,eAAe;CAiBvB"}
+{"version":3,"file":"PasswordStrengthValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordStrengthValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAY,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,WAAW,EAAmB,MAAM,kBAAkB,CAAA;AAE/D,qBAAa,yBAAyB;IAEpC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAD7B,YACkB,WAAW,GAAE,WAAmC,EAC9D;IAES,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,EAC5C,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,EAClC,SAAS,EAAE,IAAI,GACb,OAAO,CACP,UAAU,CAAC,IAAI,CAAC,GAChB,aAAa,CAAC,IAAI,EAAE;QACrB,mBAAmB,EAAE,kBAAkB,EAAE,CAAA;KACzC,CAAC,CACF,CAwDA;IAED,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,eAAe;CAiBvB"}

package/dist/types/model/service/PasswordlessSignInManager.d.ts

@@ -1,20 +1,23 @@
-import { ApiKeyManager } from './apiKey';
-import { PersonRow } from '../queries';
-import { Response } from '../utils/Response';
-import { ActivatePasswordlessOtpErrorCode, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema';
-import { DatabaseContext } from '../utils';
-import { UserMailer } from '../mailing';
-import { ProjectManager } from './ProjectManager';
-import { PermissionContext } from '../authorization';
-import { OtpAuthenticator } from './OtpAuthenticator';
-import { PersonToken } from '../type';
-import { AuthLogService } from './AuthLogService';
+import { ApiKeyManager } from './apiKey/index.js';
+import { PersonRow } from '../queries/index.js';
+import { Response } from '../utils/Response.js';
+import { ActivatePasswordlessOtpErrorCode, InitSignInPasswordlessErrorCode, InitSignInPasswordlessResult, SignInPasswordlessErrorCode } from '../../schema/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { UserMailer } from '../mailing/index.js';
+import { ApiKeyRequestInfo } from '../commands/index.js';
+import { ProjectManager } from './ProjectManager.js';
+import { PermissionContext } from '../authorization/index.js';
+import { OtpManager } from './OtpManager.js';
+import { BackupCodeManager } from './BackupCodeManager.js';
+import { PersonToken } from '../type/index.js';
+import { AuthLogService } from './AuthLogService.js';
 declare class PasswordlessSignInManager {
     private readonly apiKeyManager;
     private readonly mailer;
     private readonly projectManager;
-    private readonly otpAuthenticator;
-    constructor(apiKeyManager: ApiKeyManager, mailer: UserMailer, projectManager: ProjectManager, otpAuthenticator: OtpAuthenticator);
+    private readonly otpManager;
+    private readonly backupCodeManager;
+    constructor(apiKeyManager: ApiKeyManager, mailer: UserMailer, projectManager: ProjectManager, otpManager: OtpManager, backupCodeManager: BackupCodeManager);
     initSignInPasswordless({ db, permissionContext, mailVariant, mailProject, email }: {
         db: DatabaseContext;
         permissionContext: PermissionContext;
@@ -23,13 +26,16 @@ declare class PasswordlessSignInManager {
         mailProject?: string;
     }): Promise<PasswordlessSignInManager.InitSignInPasswordlessResponse>;
     private formatUrl;
-    signInPasswordless({ db, expiration, token, requestId, mfaOtp, validationType }: {
+    signInPasswordless({ db, expiration, token, requestId, mfaOtp, backupCode, validationType, requestInfo, trustForwardedInfo }: {
         db: DatabaseContext;
         validationType: PersonToken.ValidationType;
         requestId: string;
         token: string;
         mfaOtp?: string;
+        backupCode?: string;
         expiration?: number;
+        requestInfo?: ApiKeyRequestInfo;
+        trustForwardedInfo?: boolean;
     }): Promise<PasswordlessSignInManager.SignInPasswordlessResponse>;
     activatePasswordlessOtp({ db, token, requestId, otpHash }: {
         db: DatabaseContext;
@@ -37,7 +43,6 @@ declare class PasswordlessSignInManager {
         token: string;
         otpHash: string;
     }): Promise<PasswordlessSignInManager.ActivatePasswordlessOtpResponse>;
-    private isEnabled;
 }
 declare namespace PasswordlessSignInManager {
     export type InitSignInPasswordlessResponse = Response<InitSignInPasswordlessResult & {
@@ -48,6 +53,8 @@ declare namespace PasswordlessSignInManager {
     interface SignInPasswordlessResult {
         readonly person: PersonRow;
         readonly token: string;
+        /** True when MFA was satisfied by consuming a backup code (instead of a TOTP token). */
+        readonly usedBackupCode?: boolean;
         [AuthLogService.Key]: AuthLogService.Bag;
     }
     export type SignInPasswordlessResponse = Response<SignInPasswordlessResult, SignInPasswordlessErrorCode, {

package/dist/types/model/service/PasswordlessSignInManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PasswordlessSignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordlessSignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAmC,SAAS,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EACN,gCAAgC,EAEhC,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,eAAe,EAAiB,MAAM,UAAU,CAAA;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAGvC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAGpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAGjD,cAAM,yBAAyB;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAHhB,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,EAC9B,gBAAgB,EAAE,gBAAgB;IAG9C,sBAAsB,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;QACxF,EAAE,EAAE,eAAe,CAAA;QACnB,iBAAiB,EAAE,iBAAiB,CAAA;QACpC,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,WAAW,CAAC,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC;IA8DrE,OAAO,CAAC,SAAS;IAWX,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE;QACtF,EAAE,EAAE,eAAe,CAAA;QACnB,cAAc,EAAE,WAAW,CAAC,cAAc,CAAA;QAC1C,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;KACnB,GAAG,OAAO,CAAC,yBAAyB,CAAC,0BAA0B,CAAC;IAuE3D,uBAAuB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QAChE,EAAE,EAAE,eAAe,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,OAAO,EAAE,MAAM,CAAA;KACf,GAAG,OAAO,CAAC,yBAAyB,CAAC,+BAA+B,CAAC;IA+BtE,OAAO,CAAC,SAAS;CAYjB;AAED,kBAAU,yBAAyB,CAAC;IACnC,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CACpD,4BAA4B,GAAG;QAC9B,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,EACD,+BAA+B,EAC/B;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CACD,CAAA;IAED,UAAU,wBAAwB;QACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC;IACD,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,wBAAwB,EAAE,2BAA2B,EAAE;QACxG,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CAAC,CAAA;IAEF,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CACrD;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,EACD,gCAAgC,EAChC;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CACD,CAAA;;CACD;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAA"}
+{"version":3,"file":"PasswordlessSignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PasswordlessSignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAgE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC7G,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EACN,gCAAgC,EAChC,+BAA+B,EAC/B,4BAA4B,EAC5B,2BAA2B,EAC3B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,eAAe,EAAiB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAEN,iBAAiB,EAKjB,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAG7D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAIpD,cAAM,yBAAyB;IAE7B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IALnC,YACkB,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,EAC9B,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,iBAAiB,EAClD;IAEE,sBAAsB,CAAC,EAAE,EAAE,EAAE,iBAAiB,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;QACxF,EAAE,EAAE,eAAe,CAAA;QACnB,iBAAiB,EAAE,iBAAiB,CAAA;QACpC,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,WAAW,CAAC,EAAE,MAAM,CAAA;KACpB,GAAG,OAAO,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,CA0FpE;IAED,OAAO,CAAC,SAAS;IAWX,kBAAkB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE;QACnI,EAAE,EAAE,eAAe,CAAA;QACnB,cAAc,EAAE,WAAW,CAAC,cAAc,CAAA;QAC1C,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,iBAAiB,CAAA;QAC/B,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAC5B,GAAG,OAAO,CAAC,yBAAyB,CAAC,0BAA0B,CAAC,CA6GhE;IAEK,uBAAuB,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;QAChE,EAAE,EAAE,eAAe,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,KAAK,EAAE,MAAM,CAAA;QACb,OAAO,EAAE,MAAM,CAAA;KACf,GAAG,OAAO,CAAC,yBAAyB,CAAC,+BAA+B,CAAC,CA4BrE;CACD;AAED,kBAAU,yBAAyB,CAAC;IACnC,MAAM,MAAM,8BAA8B,GAAG,QAAQ,CACpD,4BAA4B,GAAG;QAC9B,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,EACD,+BAA+B,EAC/B;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CACD,CAAA;IAED,UAAU,wBAAwB;QACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;QACtB,wFAAwF;QACxF,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;QACjC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC;IACD,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,wBAAwB,EAAE,2BAA2B,EAAE;QACxG,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CAAC,CAAA;IAEF,MAAM,MAAM,+BAA+B,GAAG,QAAQ,CACrD;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,EACD,gCAAgC,EAChC;QACC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;KACxC,CACD,CAAA;;CACD;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAA"}

package/dist/types/model/service/PersonAccessManager.d.ts

@@ -1,16 +1,18 @@
 import { Logger } from '@contember/logger';
-import { PersonRow } from '../queries';
-import { DatabaseContext } from '../utils';
-import { ApiKeyManager } from './apiKey';
-import { Response } from '../utils/Response';
-import { DisablePersonErrorCode } from '../../schema';
+import { PersonRow } from '../queries/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { ApiKeyManager } from './apiKey/index.js';
+import { Response } from '../utils/Response.js';
+import { DisablePersonErrorCode, EnablePersonErrorCode } from '../../schema/index.js';
 declare class PersonAccessManager {
     private readonly apiKeyManager;
     constructor(apiKeyManager: ApiKeyManager);
     disablePerson(dbContext: DatabaseContext, person: PersonRow, logger: Logger): Promise<PersonDisableAccessResponse>;
+    enablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonEnableAccessResponse>;
     private disablePersonAccount;
     private disableIdentityApiKeys;
 }
 export type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>;
+export type PersonEnableAccessResponse = Response<null, EnablePersonErrorCode>;
 export { PersonAccessManager };
 //# sourceMappingURL=PersonAccessManager.d.ts.map

package/dist/types/model/service/PersonAccessManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonAccessManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PersonAccessManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAe,SAAS,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAErD,cAAM,mBAAmB;IACZ,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa;IAEnD,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;YAgB1G,oBAAoB;YAIpB,sBAAsB;CAGpC;AAED,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAA;AAEhF,OAAO,EAAE,mBAAmB,EAAE,CAAA"}
+{"version":3,"file":"PersonAccessManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PersonAccessManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAErF,cAAM,mBAAmB;IACZ,OAAO,CAAC,QAAQ,CAAC,aAAa;IAA1C,YAA6B,aAAa,EAAE,aAAa,EAAI;IAEvD,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAcvH;IAEK,YAAY,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,0BAA0B,CAAC,CASrG;YAEa,oBAAoB;YAIpB,sBAAsB;CAGpC;AAED,MAAM,MAAM,2BAA2B,GAAG,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAA;AAChF,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAA;AAE9E,OAAO,EAAE,mBAAmB,EAAE,CAAA"}

package/dist/types/model/service/PersonManager.d.ts

@@ -1,12 +1,13 @@
-import { ChangeProfileData } from '../commands/person/ChangeProfileCommand';
-import { Response } from '../utils/Response';
-import { PersonRow } from '../queries';
-import { DatabaseContext } from '../utils';
-import { EmailValidator, EmailValidatorError } from './EmailValidator';
+import { ChangeProfileData } from '../commands/person/ChangeProfileCommand.js';
+import { Response } from '../utils/Response.js';
+import { PersonListRow, PersonRow, PersonsQueryFilter } from '../queries/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { EmailValidator, EmailValidatorError } from './EmailValidator.js';
 declare class PersonManager {
     private readonly emailValidator;
     constructor(emailValidator: EmailValidator);
     findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null>;
+    listPersons(dbContext: DatabaseContext, filter?: PersonsQueryFilter, limit?: number | null, offset?: number | null): Promise<PersonListRow[]>;
     changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse>;
     togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>>;
 }

package/dist/types/model/service/PersonManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PersonManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,iBAAiB,EAAE,MAAM,yCAAyC,CAAA;AACjG,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAe,SAAS,EAAE,MAAM,YAAY,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAGtE,cAAM,aAAa;IAEjB,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAAd,cAAc,EAAE,cAAc;IAI1C,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAMvF,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,qBAAqB,CAAC;IAWnI,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;CAIvH;AAED,kBAAU,aAAa,CAAC;IACvB,KAAY,qBAAqB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;CACvE;AAED,OAAO,EAAE,aAAa,EAAE,CAAA"}
+{"version":3,"file":"PersonManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/PersonManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,iBAAiB,EAAE,MAAM,4CAA4C,CAAA;AACpG,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,aAAa,EAAe,SAAS,EAAgB,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC7G,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAIzE,cAAM,aAAa;IAEjB,OAAO,CAAC,QAAQ,CAAC,cAAc;IADhC,YACkB,cAAc,EAAE,cAAc,EAE/C;IAEK,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAI5F;IAEK,WAAW,CAChB,SAAS,EAAE,eAAe,EAC1B,MAAM,GAAE,kBAAuB,EAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,EACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,aAAa,EAAE,CAAC,CAE1B;IAEK,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAiBxI;IAEK,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAGtH;CACD;AAED,kBAAU,aAAa,CAAC;IACvB,KAAY,qBAAqB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;CACvE;AAED,OAAO,EAAE,aAAa,EAAE,CAAA"}