@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/types/model/service/ProjectManager.d.ts

@@ -1,10 +1,10 @@
-import { PermissionContext } from '../authorization';
-import { Project, ProjectInitializer, ProjectWithSecrets } from '../type';
-import { SecretsManager } from './SecretsManager';
-import { DatabaseContext, TokenHash } from '../utils';
-import { ApiKeyService, CreateApiKeyResult } from './apiKey';
-import { Response } from '../utils/Response';
-import { CreateProjectResponseErrorCode } from '../../schema';
+import { PermissionContext } from '../authorization/index.js';
+import { Project, ProjectInitializer, ProjectWithSecrets } from '../type/index.js';
+import { SecretsManager } from './SecretsManager.js';
+import { DatabaseContext, TokenHash } from '../utils/index.js';
+import { ApiKeyService, CreateApiKeyResult } from './apiKey/index.js';
+import { Response } from '../utils/Response.js';
+import { CreateProjectResponseErrorCode } from '../../schema/index.js';
 import { Logger } from '@contember/logger';
 export declare class ProjectManager {
     private readonly secretManager;

package/dist/types/model/service/ProjectManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ProjectManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAEzE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAIrD,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAC5D,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AACvE,OAAO,EAAE,8BAA8B,EAAE,MAAM,cAAc,CAAA;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,qBAAa,cAAc;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAFb,aAAa,EAAE,cAAc,EAC7B,iBAAiB,EAAE,kBAAkB,EACrC,aAAa,EAAE,aAAa;IAGjC,aAAa,CACzB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,EACzE,OAAO,EAAE;QACR,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,eAAe,CAAC,EAAE,SAAS,CAAA;QAC3B,aAAa,CAAC,EAAE,OAAO,CAAA;KACvB,GACC,OAAO,CAAC,qBAAqB,CAAC;IA8CpB,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrH,gBAAgB,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAInF,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC;IAQtH,2BAA2B,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IASzH,WAAW,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAI3D,qBAAqB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAG5I;AAED,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAA;AAEjG,qBAAa,mBAAmB;aACH,cAAc,CAAC,EAAE,kBAAkB;gBAAnC,cAAc,CAAC,EAAE,kBAAkB,YAAA;CAE/D"}
+{"version":3,"file":"ProjectManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ProjectManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAElF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAI9D,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AACrE,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAE1C,qBAAa,cAAc;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAH/B,YACkB,aAAa,EAAE,cAAc,EAC7B,iBAAiB,EAAE,kBAAkB,EACrC,aAAa,EAAE,aAAa,EAC1C;IAES,aAAa,CACzB,SAAS,EAAE,eAAe,EAC1B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,CAAC,EACzE,OAAO,EAAE;QACR,eAAe,CAAC,EAAE,MAAM,CAAA;QACxB,eAAe,CAAC,EAAE,SAAS,CAAA;QAC3B,aAAa,CAAC,EAAE,OAAO,CAAA;KACvB,GACC,OAAO,CAAC,qBAAqB,CAAC,CA4ChC;IAEY,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjI;IAEY,gBAAgB,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAE/F;IAEY,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,GAAG,SAAS,GAAG,WAAW,CAAC,CAMlI;IAEY,2BAA2B,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAOrI;IAEY,WAAW,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAEvE;IAEY,qBAAqB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAE3I;CACD;AAED,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,CAAC,CAAA;AAEjG,qBAAa,mBAAmB;aACH,cAAc,CAAC,EAAE,kBAAkB;IAA/D,YAA4B,cAAc,CAAC,EAAE,kBAAkB,YAAA,EAC9D;CACD"}

package/dist/types/model/service/ProjectMemberManager.d.ts

@@ -1,9 +1,9 @@
-import { MembershipUpdateInput, RemoveProjectMemberResponse, UpdateProjectMemberResponse } from '../commands';
-import { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema';
-import { AccessVerifier } from '../authorization';
+import { MembershipUpdateInput, RemoveProjectMemberResponse, UpdateProjectMemberResponse } from '../commands/index.js';
+import { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema/index.js';
+import { AccessVerifier } from '../authorization/index.js';
 import { Acl } from '@contember/schema';
-import { Response } from '../utils/Response';
-import { DatabaseContext } from '../utils';
+import { Response } from '../utils/Response.js';
+import { DatabaseContext } from '../utils/index.js';
 export declare class ProjectMemberManager {
     addProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string, memberships: readonly Acl.Membership[]): Promise<AddProjectMemberResponse>;
     updateProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string, memberships: readonly MembershipUpdateInput[]): Promise<UpdateProjectMemberResponse>;

package/dist/types/model/service/ProjectMemberManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMemberManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ProjectMemberManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,qBAAqB,EAErB,2BAA2B,EAE3B,2BAA2B,EAC3B,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAiC,MAAM,kBAAkB,CAAA;AAGhF,OAAO,EAAE,GAAG,EAAe,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,qBAAa,oBAAoB;IAC1B,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GACpC,OAAO,CAAC,wBAAwB,CAAC;IAQ9B,mBAAmB,CACxB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,SAAS,qBAAqB,EAAE,GAC3C,OAAO,CAAC,2BAA2B,CAAC;IAMjC,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC;IAM5H,wBAAwB,CAC7B,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EACnD,QAAQ,EAAE,cAAc,GAAG,SAAS,GAClC,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;IAO/B,8BAA8B,CACnC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GACjD,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;IAQ/B,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EACxB,QAAQ,EAAE,cAAc,GAAG,SAAS,GAClC,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC;IAUrC,OAAO,CAAC,6BAA6B;IAO/B,iBAAiB,CACtB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,cAAc,EAC9B,KAAK,EAAE,mBAAmB,GACxB,OAAO,CAAC,yBAAyB,CAAC;YAiBvB,iBAAiB;YAuBjB,qCAAqC;CAyBnD;AAED,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAA;AAEhF,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;CACtC,EAAE,CAAA"}
+{"version":3,"file":"ProjectMemberManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ProjectMemberManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAEN,qBAAqB,EAErB,2BAA2B,EAE3B,2BAA2B,EAC3B,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AACtF,OAAO,EAAE,cAAc,EAAiC,MAAM,2BAA2B,CAAA;AAGzF,OAAO,EAAE,GAAG,EAAe,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,qBAAa,oBAAoB;IAC1B,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,GACpC,OAAO,CAAC,wBAAwB,CAAC,CAMnC;IAEK,mBAAmB,CACxB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,SAAS,qBAAqB,EAAE,GAC3C,OAAO,CAAC,2BAA2B,CAAC,CAItC;IAEK,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAIjI;IAEK,wBAAwB,CAC7B,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,EACnD,QAAQ,EAAE,cAAc,GAAG,SAAS,GAClC,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC,CAKpC;IAEK,8BAA8B,CACnC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GACjD,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC,CAMpC;IAEK,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAC1C,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EACxB,QAAQ,EAAE,cAAc,GAAG,SAAS,GAClC,OAAO,CAAC,SAAS,GAAG,CAAC,UAAU,EAAE,CAAC,CAQpC;IAED,OAAO,CAAC,6BAA6B;IAO/B,iBAAiB,CACtB,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,cAAc,EAC9B,KAAK,EAAE,mBAAmB,GACxB,OAAO,CAAC,yBAAyB,CAAC,CAepC;YAEa,iBAAiB;YAuBjB,qCAAqC;CAyBnD;AAED,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAA;AAEhF,MAAM,MAAM,yBAAyB,GAAG;IACvC,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACxB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;CACtC,EAAE,CAAA"}

package/dist/types/model/service/RateLimiter.d.ts

@@ -0,0 +1,46 @@
+import { DatabaseContext } from '../utils/index.js';
+import { Providers } from '../providers.js';
+import { Config } from '../type/Config.js';
+import { RateLimitScope } from '../type/RateLimit.js';
+export interface RateLimitWindow {
+    readonly limit: number;
+    readonly window: {};
+}
+export interface RateLimitDecision {
+    readonly ok: boolean;
+    readonly retryAfterSeconds?: number;
+}
+/**
+ * Sliding-window rate limiter backed by the `rate_limit_event` table.
+ *
+ * Cost: one COUNT(*) and (on success) one INSERT per check. The event row is
+ * recorded only when the call passes — denied calls do not extend the window,
+ * matching the spec's "max N successful attempts per window".
+ *
+ * The raw key (IP, email, ...) is hashed with the configured provider so the
+ * raw value is not stored at rest. Note this is pseudonymization, not strong
+ * anonymization: an unsalted SHA-256 of a low-entropy input (e.g. an IPv4
+ * address) is recoverable by brute force, so treat key_hash as sensitive.
+ */
+export declare class RateLimiter {
+    private readonly providers;
+    constructor(providers: Pick<Providers, 'hash'>);
+    private hashKey;
+    private resolveWindow;
+    /**
+     * Check whether the next attempt fits within the configured window without
+     * recording it. Use {@link record} after a successful gating decision.
+     */
+    check(db: DatabaseContext, scope: RateLimitScope, key: string, config: Config): Promise<RateLimitDecision>;
+    record(db: DatabaseContext, scope: RateLimitScope, key: string): Promise<void>;
+    /**
+     * Combined check + record. Returns the decision; only records on success.
+     *
+     * Not atomic: the COUNT and the INSERT are separate statements, so under
+     * concurrent requests for the same key a few attempts beyond the limit can
+     * slip through (the window is a soft ceiling). That is acceptable for abuse
+     * mitigation — do not rely on it as a hard quota.
+     */
+    consume(db: DatabaseContext, scope: RateLimitScope, key: string | null | undefined, config: Config): Promise<RateLimitDecision>;
+}
+//# sourceMappingURL=RateLimiter.d.ts.map

package/dist/types/model/service/RateLimiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../../../../src/model/service/RateLimiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAG1C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGrD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,EAA+B,CAAA;CAChD;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;CACnC;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,WAAW;IAEtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAD3B,YACkB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAChD;IAEJ,OAAO,CAAC,OAAO;IAIf,OAAO,CAAC,aAAa;IAkBrB;;;OAGG;IACG,KAAK,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAU/G;IAEK,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEnF;IAED;;;;;;;OAOG;IACG,OAAO,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CASpI;CACD"}

package/dist/types/model/service/RolesManager.d.ts

@@ -1,10 +1,15 @@
-import { DatabaseContext } from '../utils';
-import { Response } from '../utils/Response';
+import { DatabaseContext } from '../utils/index.js';
+import { Response } from '../utils/Response.js';
+import { GlobalRoleValidator } from './GlobalRoleValidator.js';
+import { Connection } from '@contember/database';
 export declare class RolesManager {
+    private readonly globalRoleValidator;
+    constructor(globalRoleValidator?: GlobalRoleValidator);
     addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>>;
+    addValidatedGlobalRoles(dbContext: DatabaseContext<Connection.TransactionLike>, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>>;
+    validateAddedGlobalRoles(dbContext: DatabaseContext, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>>;
     removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>>;
     private patchGlobalRoles;
-    private validateRoles;
 }
 type GlobalRolesErrorCode = 'IDENTITY_NOT_FOUND' | 'INVALID_ROLE';
 export {};

package/dist/types/model/service/RolesManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RolesManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/RolesManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AAGvE,qBAAa,YAAY;IAClB,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;IAIvI,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC;YAIlI,gBAAgB;IAiB9B,OAAO,CAAC,aAAa;CAQrB;AAED,KAAK,oBAAoB,GACtB,oBAAoB,GACpB,cAAc,CAAA"}
+{"version":3,"file":"RolesManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/RolesManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAEhD,qBAAa,YAAY;IAEvB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IADrC,YACkB,mBAAmB,GAAE,mBAA+C,EAErF;IAEK,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAQ5I;IAEK,uBAAuB,CAC5B,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,EACtD,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAE/C;IAEK,wBAAwB,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAKlI;IAEK,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAE/I;YAEa,gBAAgB;CAY9B;AAED,KAAK,oBAAoB,GACtB,oBAAoB,GACpB,cAAc,CAAA"}

package/dist/types/model/service/SecretsManager.d.ts

@@ -1,9 +1,12 @@
-import { Providers } from '../providers';
-import { DatabaseContext } from '../utils';
+import { Providers } from '../providers.js';
+import { ProjectSecretInfoRow } from '../queries/index.js';
+import { DatabaseContext } from '../utils/index.js';
 export declare class SecretsManager {
     private providers;
     constructor(providers: Providers);
     setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void>;
+    /** Lists secret keys (with timestamps) without decrypting any values. */
+    listSecretKeys(dbContext: DatabaseContext, projectId: string): Promise<ProjectSecretInfoRow[]>;
     readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>>;
     private setSecrets;
 }

package/dist/types/model/service/SecretsManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecretsManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SecretsManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AAExC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,qBAAa,cAAc;IACd,OAAO,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAE3B,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInG,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAO1F,UAAU;CAWxB"}
+{"version":3,"file":"SecretsManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SecretsManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,oBAAoB,EAA+C,MAAM,qBAAqB,CAAA;AACvG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,qBAAa,cAAc;IACd,OAAO,CAAC,SAAS;IAA7B,YAAoB,SAAS,EAAE,SAAS,EAAI;IAE/B,SAAS,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/G;IAED,yEAAyE;IAC5D,cAAc,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAE1G;IAEY,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAKvG;YAEa,UAAU;CAWxB"}

package/dist/types/model/service/SignInManager.d.ts

@@ -1,24 +1,85 @@
-import { CreateSessionTokenErrorCode, SignInErrorCode } from '../../schema';
-import { ApiKeyManager, OtpAuthenticator } from '../service';
-import { PersonRow, PersonUniqueIdentifier } from '../queries';
-import { Providers } from '../providers';
-import { DatabaseContext } from '../utils';
-import { Response } from '../utils/Response';
-import { AuthLogService } from './AuthLogService';
+import { CreateSessionTokenErrorCode, MfaEnrollment, SignInErrorCode } from '../../schema/index.js';
+import { ApiKeyManager, AuthPolicyResolver, BackupCodeManager, EmailOtpManager, LoginRiskAnalyzer, OtpManager } from '../service/index.js';
+import { PersonRow, PersonUniqueIdentifier } from '../queries/index.js';
+import { Config } from '../type/Config.js';
+import { Providers } from '../providers.js';
+import { DatabaseContext } from '../utils/index.js';
+import { Response } from '../utils/Response.js';
+import { AuthLogService } from './AuthLogService.js';
+import { UserMailer } from '../mailing/index.js';
+import { ApiKeyRequestInfo } from '../commands/index.js';
 declare class SignInManager {
     private readonly apiKeyManager;
     private readonly providers;
-    private readonly otpAuthenticator;
-    constructor(apiKeyManager: ApiKeyManager, providers: Providers, otpAuthenticator: OtpAuthenticator);
-    signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string): Promise<SignInResponse>;
-    createSessionToken(dbContext: DatabaseContext, personIdentifier: PersonUniqueIdentifier, expiration?: number, verifier?: (person: PersonRow) => Promise<void>): Promise<CreateSessionTokenResponse>;
+    private readonly otpManager;
+    private readonly backupCodeManager;
+    private readonly emailOtpManager;
+    private readonly authPolicyResolver;
+    private readonly loginRiskAnalyzer;
+    private readonly userMailer;
+    constructor(apiKeyManager: ApiKeyManager, providers: Providers, otpManager: OtpManager, backupCodeManager: BackupCodeManager, emailOtpManager: EmailOtpManager, authPolicyResolver: AuthPolicyResolver, loginRiskAnalyzer: LoginRiskAnalyzer, userMailer: UserMailer);
+    signIn(dbContext: DatabaseContext, email: string, password: string, expiration?: number, otpCode?: string, requestInfo?: ApiKeyRequestInfo, trustForwardedInfo?: boolean, backupCode?: string, config?: Config, geoCountry?: string): Promise<SignInResponse>;
+    /**
+     * A03 — evaluate the sign-in risk score and act per policy. Returns:
+     * - `null` when anomaly detection is off or no `config` was supplied (the
+     *   default): no DB work, sign-in proceeds unchanged.
+     * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email
+     *   was sent (best-effort) but the session may still be issued.
+     * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was
+     *   supplied — reuses the email-OTP step-up channel (dispatches a code).
+     * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but
+     *   did not verify. A valid code consumes the token and the session is issued.
+     * - `{ unusualLoginDetected: false }` when the score was below every threshold.
+     *
+     * The audit entries (`unusual_login_detected`, `step_up_required`) are emitted
+     * by the resolver from the response metadata, matching the project convention.
+     */
+    private applyRiskPolicy;
+    private sendUnusualLoginEmail;
+    /**
+     * A06 enforcement for the no-active-factor case. Returns:
+     * - `null` when MFA is not required, or grace currently allows sign-in
+     *   (caller proceeds to issue a session as normal). With zero auth_policy
+     *   rows this is always the outcome — no behavior change.
+     * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to
+     *   enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.
+     * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP
+     *   promoted to active); caller issues the session.
+     */
+    private enforceMfaEnrollment;
+    createSessionToken(dbContext: DatabaseContext, personIdentifier: PersonUniqueIdentifier, expiration?: number, verifier?: (person: PersonRow) => Promise<void>, requestInfo?: ApiKeyRequestInfo, trustForwardedInfo?: boolean): Promise<CreateSessionTokenResponse>;
+}
+/** A03: greppable payload describing why a sign-in scored as unusual. */
+export interface RiskMeta {
+    readonly score: number;
+    readonly reasons: readonly string[];
 }
 export interface SignInResult {
     readonly person: PersonRow;
     readonly token: string;
+    /** True when MFA was satisfied by consuming a backup code (instead of a TOTP token). */
+    readonly usedBackupCode?: boolean;
+    /** Set when sign-in completed an MFA enrollment (A06): the freshly issued backup codes, shown once. */
+    readonly backupCodes?: string[];
+    /** A03: true when this sign-in scored as unusual and an UNUSUAL_LOGIN email was sent. */
+    readonly unusualLoginDetected?: boolean;
+    /** A03: the risk score + reasons, recorded in the `unusual_login_detected` audit `event_data`. */
+    readonly risk?: RiskMeta;
     [AuthLogService.Key]: AuthLogService.Bag;
 }
 export type SignInResponse = Response<SignInResult, SignInErrorCode, {
+    /** Set on an OTP_REQUIRED error when an email-OTP code was just dispatched (A05). */
+    emailOtpSent?: boolean;
+    /** Set on a MFA_ENROLLMENT_REQUIRED error (A06): triggers the `mfa_enrollment_required` audit. */
+    mfaEnrollmentRequired?: boolean;
+    /** Set on a MFA_ENROLLMENT_REQUIRED error (A06): the pending secret the client must enroll. */
+    mfaEnrollment?: MfaEnrollment;
+    /** Set on an OTP_REQUIRED error raised by A03 anomaly step-up: triggers the `step_up_required` audit. */
+    stepUpRequired?: boolean;
+    /** A03: true when the sign-in scored as unusual (triggers the `unusual_login_detected` audit). */
+    unusualLoginDetected?: boolean;
+    /** A03: the risk score + reasons, recorded in the audit `event_data`. */
+    risk?: RiskMeta;
     [AuthLogService.Key]: AuthLogService.Bag;
 }>;
 export type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {

package/dist/types/model/service/SignInManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC3E,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAe,SAAS,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAA6B,MAAM,mBAAmB,CAAA;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEjD,cAAM,aAAa;IAEjB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBAFhB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,gBAAgB;IAG9C,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA8CnI,kBAAkB,CACvB,SAAS,EAAE,eAAe,EAC1B,gBAAgB,EAAE,sBAAsB,EACxC,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,GAC7C,OAAO,CAAC,0BAA0B,CAAC;CA2CtC;AAED,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE;IACpE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CAAC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,YAAY,EAAE,2BAA2B,EAAE;IAC5F,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CAAC,CAAA;AAEF,OAAO,EAAE,aAAa,EAAE,CAAA"}
+{"version":3,"file":"SignInManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SignInManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AACnG,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAC1I,OAAO,EAAgE,SAAS,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA;AACrI,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAE1E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,iBAAiB,EAA2B,MAAM,sBAAsB,CAAA;AAGjF,cAAM,aAAa;IAEjB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAR5B,YACkB,aAAa,EAAE,aAAa,EAC5B,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,UAAU,EACtB,iBAAiB,EAAE,iBAAiB,EACpC,eAAe,EAAE,eAAe,EAChC,kBAAkB,EAAE,kBAAkB,EACtC,iBAAiB,EAAE,iBAAiB,EACpC,UAAU,EAAE,UAAU,EACpC;IAEE,MAAM,CACX,SAAS,EAAE,eAAe,EAC1B,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,EAC5B,UAAU,CAAC,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,cAAc,CAAC,CA8JzB;IAED;;;;;;;;;;;;;;OAcG;YACW,eAAe;YA4Ef,qBAAqB;IAgBnC;;;;;;;;;OASG;YACW,oBAAoB;IA4E5B,kBAAkB,CACvB,SAAS,EAAE,eAAe,EAC1B,gBAAgB,EAAE,sBAAsB,EACxC,UAAU,CAAC,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,EAC/C,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,0BAA0B,CAAC,CA0CrC;CACD;AAED,yEAAyE;AACzE,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAkBD,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,wFAAwF;IACxF,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,uGAAuG;IACvG,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,yFAAyF;IACzF,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAA;IACvC,kGAAkG;IAClG,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAA;IACxB,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE;IACpE,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,kGAAkG;IAClG,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,+FAA+F;IAC/F,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,yGAAyG;IACzG,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,kGAAkG;IAClG,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,yEAAyE;IACzE,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CAAC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,YAAY,EAAE,2BAA2B,EAAE;IAC5F,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CACxC,CAAC,CAAA;AAEF,OAAO,EAAE,aAAa,EAAE,CAAA"}

package/dist/types/model/service/SignOutManager.d.ts

@@ -0,0 +1,31 @@
+import { ApiKeyManager } from './apiKey/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { IDPHandlerRegistry } from './idp/IDPHandlerRegistry.js';
+import { Response } from '../utils/Response.js';
+export type SignOutErrorCode = 'NOT_A_PERSON' | 'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY';
+export type SignOutResult = {
+    /** Set when the session was federated via an OIDC IdP that exposes RP-initiated logout. */
+    readonly logoutUrl: string | null;
+    /** The IdP this session belonged to, for auditing. Null for plain (password) sessions. */
+    readonly identityProviderId: string | null;
+};
+export type SignOutResponse = Response<SignOutResult, SignOutErrorCode>;
+/**
+ * Owns the sign-out flow (extracted from `SignOutMutationResolver`, A10):
+ *   - the existing local logout (disable this session, or all of the identity's sessions);
+ *   - OIDC Single Logout — when the session was federated and the IdP advertises an
+ *     `end_session_endpoint`, build the RP-initiated (front-channel) logout redirect URL the admin
+ *     should send the browser to. Legacy IdPs without `end_session_endpoint` (and password
+ *     sessions) gracefully fall back to a local-only logout with no `logoutUrl`.
+ *
+ * Auditing lives at the resolver layer (the manager only returns what happened), matching the
+ * existing convention.
+ */
+export declare class SignOutManager {
+    private readonly apiKeyManager;
+    private readonly idpRegistry;
+    constructor(apiKeyManager: ApiKeyManager, idpRegistry: IDPHandlerRegistry);
+    signOut(db: DatabaseContext, identityId: string, apiKeyId: string, all: boolean): Promise<SignOutResponse>;
+    private resolveOidcLogout;
+}
+//# sourceMappingURL=SignOutManager.d.ts.map

package/dist/types/model/service/SignOutManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SignOutManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SignOutManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAInD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAChE,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAE1E,MAAM,MAAM,gBAAgB,GAAG,cAAc,GAAG,8CAA8C,CAAA;AAE9F,MAAM,MAAM,aAAa,GAAG;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,0FAA0F;IAC1F,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1C,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAA;AAEvE;;;;;;;;;;GAUG;AACH,qBAAa,cAAc;IAEzB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAF7B,YACkB,aAAa,EAAE,aAAa,EAC5B,WAAW,EAAE,kBAAkB,EAC7C;IAEE,OAAO,CACZ,EAAE,EAAE,eAAe,EACnB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,OAAO,GACV,OAAO,CAAC,eAAe,CAAC,CA4B1B;YAEa,iBAAiB;CAsC/B"}

package/dist/types/model/service/SignUpManager.d.ts

@@ -1,28 +1,34 @@
-import { PersonRow } from '../queries';
-import { SignUpErrorCode, WeakPasswordReason } from '../../schema';
-import { Response } from '../utils/Response';
-import { DatabaseContext } from '../utils';
-import { MaybePassword } from '../dtos';
-import { EmailValidator } from './EmailValidator';
-import { PasswordStrengthValidator } from './PasswordStrengthValidator';
+import { PersonRow } from '../queries/index.js';
+import { SignUpErrorCode, SignUpRecommendedAction, WeakPasswordReason } from '../../schema/index.js';
+import { Response } from '../utils/Response.js';
+import { DatabaseContext } from '../utils/index.js';
+import { MaybePassword } from '../dtos/index.js';
+import { EmailValidator } from './EmailValidator.js';
+import { PasswordStrengthValidator } from './PasswordStrengthValidator.js';
+import { Config } from '../type/Config.js';
+import { GlobalRoleValidator } from './GlobalRoleValidator.js';
 type SignUpUser = {
     email: string;
     name?: string;
     password: MaybePassword;
     roles?: readonly string[];
+    config: Config;
 };
 export declare class SignUpManager {
     private readonly emailValidator;
     private readonly passwordStrengthValidator;
-    constructor(emailValidator: EmailValidator, passwordStrengthValidator: PasswordStrengthValidator);
-    signUp(dbContext: DatabaseContext, { email, password, roles }: SignUpUser): Promise<SignUpResponse>;
+    private readonly globalRoleValidator;
+    constructor(emailValidator: EmailValidator, passwordStrengthValidator: PasswordStrengthValidator, globalRoleValidator?: GlobalRoleValidator);
+    signUp(dbContext: DatabaseContext, args: SignUpUser): Promise<SignUpResponse>;
 }
 export declare class SignUpResult {
     readonly person: Omit<PersonRow, 'roles'>;
-    constructor(person: Omit<PersonRow, 'roles'>);
+    readonly emailVerificationRequired: boolean;
+    constructor(person: Omit<PersonRow, 'roles'>, emailVerificationRequired?: boolean);
 }
 export type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {
     weakPasswordReasons?: WeakPasswordReason[];
+    recommendedAction?: SignUpRecommendedAction;
 }>;
 export {};
 //# sourceMappingURL=SignUpManager.d.ts.map

package/dist/types/model/service/SignUpManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SignUpManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,SAAS,EAAE,MAAM,YAAY,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAElE,OAAO,EAAE,QAAQ,EAAc,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AAEvE,KAAK,UAAU,GAAG;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,aAAa,CAAA;IACvB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACzB,CAAA;AAED,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;gBADzB,cAAc,EAAE,cAAc,EAC9B,yBAAyB,EAAE,yBAAyB;IAIhE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAU,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC;CAqB9G;AAED,qBAAa,YAAY;aACI,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;gBAAhC,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;CAC5D;AACD,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE;IACpE,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;CAC1C,CAAC,CAAA"}
+{"version":3,"file":"SignUpManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/SignUpManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAEpG,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAE1E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,KAAK,UAAU,GAAG;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,aAAa,CAAA;IACvB,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAED,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,yBAAyB;IAC1C,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IAHrC,YACkB,cAAc,EAAE,cAAc,EAC9B,yBAAyB,EAAE,yBAAyB,EACpD,mBAAmB,GAAE,mBAA+C,EAErF;IAEK,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CA6ClF;CACD;AAED,qBAAa,YAAY;aAEP,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,yBAAyB,EAAE,OAAO;IAFnD,YACiB,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,EAChC,yBAAyB,GAAE,OAAe,EACvD;CACJ;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE;IACpE,mBAAmB,CAAC,EAAE,kBAAkB,EAAE,CAAA;IAC1C,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;CAC3C,CAAC,CAAA"}

package/dist/types/model/service/apiKey/ApiKeyManager.d.ts

@@ -1,19 +1,40 @@
-import { Response } from '../../utils/Response';
-import { DatabaseContext, TokenHash } from '../../utils';
-import { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService';
+import { ApiKeyRequestInfo } from '../../commands/index.js';
+import { Response } from '../../utils/Response.js';
+import { DatabaseContext, TokenHash } from '../../utils/index.js';
+import { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService.js';
 import { Acl } from '@contember/schema';
-import { ApiKeyRow } from '../../queries';
+import { ApiKeyRow } from '../../queries/index.js';
+import { AuthPolicyResolver } from '../AuthPolicyResolver.js';
+import { AuthLogService } from '../AuthLogService.js';
+import { IdpSessionRevalidator } from '../idp/IdpSessionRevalidator.js';
+import { UnpersistedApiKeyManager } from './UnpersistedApiKeyManager.js';
+import { GlobalRoleValidator } from '../GlobalRoleValidator.js';
 export declare class ApiKeyManager {
     private readonly apiKeyService;
-    constructor(apiKeyService: ApiKeyService);
-    verifyAndProlong(dbContext: DatabaseContext, readDbContext: DatabaseContext, token: string): Promise<VerifyResponse>;
-    createSessionApiKey(dbContext: DatabaseContext, identityId: string, expiration?: number): Promise<string>;
+    private readonly authPolicyResolver;
+    private readonly authLogService;
+    private readonly unpersistedApiKeyManager;
+    private readonly idpSessionRevalidator?;
+    private readonly globalRoleValidator;
+    constructor(apiKeyService: ApiKeyService, authPolicyResolver: AuthPolicyResolver, authLogService: AuthLogService, unpersistedApiKeyManager?: UnpersistedApiKeyManager, idpSessionRevalidator?: IdpSessionRevalidator | undefined, globalRoleValidator?: GlobalRoleValidator);
+    verifyAndProlong(dbContext: DatabaseContext, readDbContext: DatabaseContext, token: string, requestInfo?: ApiKeyRequestInfo, forwardedInfo?: ApiKeyRequestInfo): Promise<VerifyResponse>;
+    private fetchApiKeyByToken;
+    createSessionApiKey(dbContext: DatabaseContext, identityId: string, expiration?: number, requestInfo?: ApiKeyRequestInfo, trustForwardedInfo?: boolean): Promise<string>;
+    /**
+     * Like {@link createSessionApiKey} but also returns the api_key id — needed when the
+     * caller has to bind another row to the session (e.g. an `idp_session` for IdP
+     * re-validation).
+     */
+    createSessionApiKeyWithId(dbContext: DatabaseContext, identityId: string, expiration?: number, requestInfo?: ApiKeyRequestInfo, trustForwardedInfo?: boolean): Promise<{
+        id: string;
+        token: string;
+    }>;
     findApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<ApiKeyRow | null>;
     disableOneOffApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<void>;
     disableApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<boolean>;
     disableIdentityApiKeys(dbContext: DatabaseContext, identityId: string): Promise<void>;
-    createGlobalPermanentApiKey(dbContext: DatabaseContext, description: string, roles: readonly string[], tokenHash?: TokenHash): Promise<CreateApiKeyResponse>;
-    createProjectPermanentApiKey(dbContext: DatabaseContext, projectId: string, memberships: readonly Acl.Membership[], description: string, tokenHash?: TokenHash): Promise<CreateApiKeyResponse>;
+    createGlobalPermanentApiKey(dbContext: DatabaseContext, description: string, roles: readonly string[], tokenHash?: TokenHash, trustForwardedInfo?: boolean): Promise<CreateApiKeyResponse>;
+    createProjectPermanentApiKey(dbContext: DatabaseContext, projectId: string, memberships: readonly Acl.Membership[], description: string, tokenHash?: TokenHash, trustForwardedInfo?: boolean): Promise<CreateApiKeyResponse>;
 }
 export type VerifyResponse = Response<VerifyResult, VerifyErrorCode>;
 export declare class VerifyResult {
@@ -21,8 +42,9 @@ export declare class VerifyResult {
     readonly apiKeyId: string;
     readonly roles: string[];
     readonly personId: string | null;
+    readonly trustForwardedInfo: boolean;
     readonly valid = true;
-    constructor(identityId: string, apiKeyId: string, roles: string[], personId: string | null);
+    constructor(identityId: string, apiKeyId: string, roles: string[], personId: string | null, trustForwardedInfo?: boolean);
 }
 export declare enum VerifyErrorCode {
     NOT_FOUND = "not_found",

package/dist/types/model/service/apiKey/ApiKeyManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyManager.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAErE,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAuC,SAAS,EAAsB,MAAM,eAAe,CAAA;AAKlG,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa;gBAAb,aAAa,EAAE,aAAa;IAGxC,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,eAAe,EAC9B,KAAK,EAAE,MAAM,GACX,OAAO,CAAC,cAAc,CAAC;IAkCpB,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAYzG,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAMnF,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhF,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7E,sBAAsB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrF,2BAA2B,CAChC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,CAAC,EAAE,SAAS,GACnB,OAAO,CAAC,oBAAoB,CAAC;IAM1B,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS,GACnB,OAAO,CAAC,oBAAoB,CAAC;CAKhC;AAED,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;AAEpE,qBAAa,YAAY;aAIP,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,KAAK,EAAE,MAAM,EAAE;aACf,QAAQ,EAAE,MAAM,GAAG,IAAI;IANxC,QAAQ,CAAC,KAAK,QAAO;gBAGJ,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,GAAG,IAAI;CAExC;AAED,oBAAY,eAAe;IAC1B,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;CAC3C"}
+{"version":3,"file":"ApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,iBAAiB,EAMjB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAExE,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAuC,SAAS,EAAqC,MAAM,wBAAwB,CAAA;AAI1H,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAG/D,qBAAa,aAAa;IAExB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;IACvC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IANrC,YACkB,aAAa,EAAE,aAAa,EAC5B,kBAAkB,EAAE,kBAAkB,EACtC,cAAc,EAAE,cAAc,EAC9B,wBAAwB,GAAE,wBAAyD,EACnF,qBAAqB,CAAC,EAAE,qBAAqB,YAAA,EAC7C,mBAAmB,GAAE,mBAA+C,EAClF;IAEE,gBAAgB,CACrB,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,eAAe,EAC9B,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,iBAAiB,EAC/B,aAAa,CAAC,EAAE,iBAAiB,GAC/B,OAAO,CAAC,cAAc,CAAC,CAkHzB;YAEa,kBAAkB;IAc1B,mBAAmB,CACxB,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,MAAM,CAAC,CAGjB;IAED;;;;OAIG;IACG,yBAAyB,CAC9B,SAAS,EAAE,eAAe,EAC1B,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,iBAAiB,EAC/B,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAuExC;IAEK,UAAU,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAIxF;IAEK,mBAAmB,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErF;IAEK,aAAa,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElF;IAEK,sBAAsB,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1F;IAEK,2BAA2B,CAChC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAQ/B;IAEK,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAI/B;CACD;AAOD,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;AAEpE,qBAAa,YAAY;aAIP,UAAU,EAAE,MAAM;aAClB,QAAQ,EAAE,MAAM;aAChB,KAAK,EAAE,MAAM,EAAE;aACf,QAAQ,EAAE,MAAM,GAAG,IAAI;aACvB,kBAAkB,EAAE,OAAO;IAP5C,QAAQ,CAAC,KAAK,QAAO;IAErB,YACiB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,kBAAkB,GAAE,OAAe,EAChD;CACJ;AAED,oBAAY,eAAe;IAC1B,SAAS,cAAc;IACvB,QAAQ,aAAa;IACrB,OAAO,YAAY;IACnB,cAAc,mBAAmB;IACjC,mBAAmB,wBAAwB;CAC3C"}

package/dist/types/model/service/apiKey/ApiKeyService.d.ts

@@ -1,12 +1,12 @@
-import { DatabaseContext, TokenHash } from '../../utils';
-import { Response, ResponseOk } from '../../utils/Response';
-import { ApiKeyWithToken } from '../../../schema';
+import { DatabaseContext, TokenHash } from '../../utils/index.js';
+import { Response, ResponseOk } from '../../utils/Response.js';
+import { ApiKeyWithToken, CreateApiKeyErrorCode } from '../../../schema/index.js';
 import { Acl } from '@contember/schema';
 export declare class ApiKeyService {
-    createPermanentApiKey(db: DatabaseContext, description: string, roles?: readonly string[], tokenHash?: TokenHash): Promise<ResponseOk<CreateApiKeyResult>>;
-    createProjectPermanentApiKey(db: DatabaseContext, projectId: string, memberships: readonly Acl.Membership[], description: string, tokenHash?: TokenHash): Promise<ResponseOk<CreateApiKeyResult>>;
+    createPermanentApiKey(db: DatabaseContext, description: string, roles?: readonly string[], tokenHash?: TokenHash, trustForwardedInfo?: boolean): Promise<ResponseOk<CreateApiKeyResult>>;
+    createProjectPermanentApiKey(db: DatabaseContext, projectId: string, memberships: readonly Acl.Membership[], description: string, tokenHash?: TokenHash, trustForwardedInfo?: boolean): Promise<ResponseOk<CreateApiKeyResult>>;
 }
-export type CreateApiKeyResponse = Response<CreateApiKeyResult, never>;
+export type CreateApiKeyResponse = Response<CreateApiKeyResult, CreateApiKeyErrorCode>;
 export declare class CreateApiKeyResult {
     readonly identity: {
         id: string;

package/dist/types/model/service/apiKey/ApiKeyService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyService.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAKxD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,aAAa;IACnB,qBAAqB,CAC1B,EAAE,EAAE,eAAe,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,SAAS,MAAM,EAAO,EAC7B,SAAS,CAAC,EAAE,SAAS;IAQhB,4BAA4B,CACjC,EAAE,EAAE,eAAe,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS;CAYtB;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAA;AAEtE,qBAAa,kBAAkB;aACF,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;aAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;gBAAtG,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAGlI,iBAAiB,IAAI,eAAe;CAUpC"}
+{"version":3,"file":"ApiKeyService.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/ApiKeyService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAKjE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AACjF,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,aAAa;IACnB,qBAAqB,CAC1B,EAAE,EAAE,eAAe,EACnB,WAAW,EAAE,MAAM,EACnB,KAAK,GAAE,SAAS,MAAM,EAAO,EAC7B,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,2CAa5B;IAEK,4BAA4B,CACjC,EAAE,EAAE,eAAe,EACnB,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,EACtC,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,SAAS,EACrB,kBAAkB,CAAC,EAAE,OAAO,2CAW5B;CACD;AAED,MAAM,MAAM,oBAAoB,GAAG,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,CAAA;AAEtF,qBAAa,kBAAkB;aACF,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE;aAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAAlI,YAA4B,QAAQ,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAkB,MAAM,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,EACjI;IAED,iBAAiB,IAAI,eAAe,CAUnC;CACD"}

package/dist/types/model/service/apiKey/UnpersistedApiKeyManager.d.ts

@@ -0,0 +1,56 @@
+import { TokenHash } from '../../utils/index.js';
+import { VerifyResult } from './ApiKeyManager.js';
+/**
+ * Well-known identity id used for super-admin identities authenticated via an
+ * unpersisted (configured) root token. The id is stable so that audit logs and
+ * created entities consistently reference the same virtual identity, even
+ * though no row exists in the `identity` table.
+ */
+export declare const UNPERSISTED_ROOT_IDENTITY_ID = "f3b2c4d6-0000-4000-8000-000000000001";
+/**
+ * Well-known identity id for the pre-sign-in caller of a first-party UI served by the engine (the
+ * management panel's login screen). It holds exactly {@link TenantRole.LOGIN} and exists only in
+ * memory, so the surface it opens is fixed by this file rather than by whatever token an operator
+ * happened to configure.
+ */
+export declare const UNPERSISTED_LOGIN_IDENTITY_ID = "f3b2c4d6-0000-4000-8000-000000000002";
+/**
+ * Whether an identity id is one of the virtual identities above, i.e. has no row in `identity`.
+ * Anything writing a foreign key to `identity` must ask first — see `AuthLogService`.
+ */
+export declare const isUnpersistedIdentityId: (identityId: string | undefined) => boolean;
+/**
+ * The pre-sign-in caller of an engine-served UI, as an already-verified result. There is no token to
+ * present: the surface is reached by being routed there, so nothing is compared and nothing is read
+ * from the database.
+ */
+export declare const createUnpersistedLoginVerifyResult: () => VerifyResult;
+export interface UnpersistedApiKey {
+    readonly tokenHash: TokenHash;
+    readonly identityId: string;
+    readonly roles: readonly string[];
+}
+/**
+ * Verifies incoming tokens against a fixed set of root tokens configured out of
+ * band (env/config) instead of being stored in the database. This enables token
+ * rotation without database writes and avoids persisting the token hash.
+ *
+ * Token hashes are compared in constant time to avoid leaking information about
+ * the configured secret.
+ */
+export declare class UnpersistedApiKeyManager {
+    private readonly apiKeys;
+    constructor(apiKeys?: readonly UnpersistedApiKey[]);
+    get isEmpty(): boolean;
+    verify(token: string): VerifyResult | null;
+    static createRootApiKey(tokenHash: TokenHash): UnpersistedApiKey;
+    /**
+     * Builds a manager for unpersisted super-admin root tokens from configured
+     * plain tokens and/or pre-computed token hashes.
+     */
+    static createForRootTokens(input: {
+        tokens?: readonly string[];
+        tokenHashes?: readonly string[];
+    }): UnpersistedApiKeyManager;
+}
+//# sourceMappingURL=UnpersistedApiKeyManager.d.ts.map

package/dist/types/model/service/apiKey/UnpersistedApiKeyManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnpersistedApiKeyManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/UnpersistedApiKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwD,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAEtG,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,yCAAyC,CAAA;AAElF;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,yCAAyC,CAAA;AAInF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,eAAgB,MAAM,GAAG,SAAS,KAAG,OAA6E,CAAA;AAEtJ;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,QAAO,YAC0D,CAAA;AAEhH,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CACjC;AAED;;;;;;;GAOG;AACH,qBAAa,wBAAwB;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IAEtD,YAAY,OAAO,GAAE,SAAS,iBAAiB,EAAO,EAErD;IAED,IAAI,OAAO,IAAI,OAAO,CAErB;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAwBzC;IAED,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,iBAAiB,CAM/D;IAED;;;OAGG;IACH,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QACjC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;KAC/B,GAAG,wBAAwB,CAmB3B;CACD"}

package/dist/types/model/service/apiKey/index.d.ts

@@ -1,3 +1,4 @@
-export * from './ApiKeyManager';
-export * from './ApiKeyService';
+export * from './ApiKeyManager.js';
+export * from './ApiKeyService.js';
+export * from './UnpersistedApiKeyManager.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/service/apiKey/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/apiKey/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,+BAA+B,CAAA"}

package/dist/types/model/service/captcha/CaptchaProvider.d.ts

@@ -0,0 +1,24 @@
+export interface CaptchaProviderHandler {
+    /**
+     * Verify a client-submitted captcha token with the provider. Implementations
+     * should never throw on remote failure — return `verifyError` so the caller
+     * can decide whether to fail-open or fail-closed.
+     */
+    verify(args: CaptchaVerifyArgs): Promise<CaptchaVerifyResult>;
+}
+export interface CaptchaVerifyArgs {
+    readonly token: string;
+    readonly secret: string;
+    readonly remoteIp?: string;
+    /** Score gate for v3-style providers; ignored by binary providers. */
+    readonly threshold: number | null;
+}
+export type CaptchaVerifyResult = {
+    ok: true;
+    score?: number;
+} | {
+    ok: false;
+    reason: 'invalid' | 'low_score' | 'expired' | 'verify_error';
+    detail?: string;
+};
+//# sourceMappingURL=CaptchaProvider.d.ts.map

package/dist/types/model/service/captcha/CaptchaProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CaptchaProvider.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/captcha/CaptchaProvider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,sBAAsB;IACtC;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,MAAM,mBAAmB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,cAAc,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA"}