@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.cjs

@@ -5,10 +5,26 @@ class UpdateConfigurationCommand {
   constructor(configuration) {
     this.configuration = configuration;
   }
-  async execute({ db }) {
+  async execute({ db, providers }) {
+    const captcha = this.configuration.captcha;
+    const rl = this.configuration.rateLimits;
+    let captchaSecretCol;
+    let captchaSecretVersionCol;
+    if (captcha?.secret !== void 0 && captcha.secret !== null) {
+      if (captcha.secret === "") {
+        captchaSecretCol = null;
+        captchaSecretVersionCol = null;
+      } else {
+        const encrypted = await providers.encrypt(Buffer.from(captcha.secret, "utf8"));
+        captchaSecretCol = encrypted.value;
+        captchaSecretVersionCol = encrypted.version;
+      }
+    }
     const result = await Database.UpdateBuilder.create().table("config").where({ id: "singleton" }).values(
       {
         passwordless_enabled: this.configuration.passwordless?.enabled ?? void 0,
+        signup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? void 0,
+        require_email_change_verification: this.configuration.emailChange?.requireVerification ?? void 0,
         passwordless_url: this.configuration.passwordless?.url,
         passwordless_expiration: this.configuration.passwordless?.expiration ?? void 0,
         password_min_length: this.configuration.password?.minLength ?? void 0,
@@ -18,12 +34,41 @@ class UpdateConfigurationCommand {
         password_require_special: this.configuration.password?.requireSpecial ?? void 0,
         password_pattern: this.configuration.password?.pattern,
         password_check_blacklist: this.configuration.password?.checkBlacklist ?? void 0,
+        password_check_hibp: this.configuration.password?.checkHibp ?? void 0,
         login_base_backoff: this.configuration.login?.baseBackoff ?? void 0,
         login_max_backoff: this.configuration.login?.maxBackoff ?? void 0,
         login_attempt_window: this.configuration.login?.attemptWindow ?? void 0,
         login_reveal_user_exits: this.configuration.login?.revealUserExists ?? void 0,
+        login_reveal_login_method: this.configuration.login?.revealLoginMethod ?? void 0,
         login_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? void 0,
-        login_max_token_expiration: this.configuration.login?.maxTokenExpiration
+        login_max_token_expiration: this.configuration.login?.maxTokenExpiration,
+        login_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? void 0,
+        login_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? void 0,
+        login_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? void 0,
+        login_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? void 0,
+        login_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? void 0,
+        captcha_provider: captcha?.provider !== void 0 ? captcha.provider : void 0,
+        captcha_secret: captchaSecretCol,
+        captcha_secret_version: captchaSecretVersionCol,
+        captcha_threshold: captcha?.threshold !== void 0 ? captcha.threshold : void 0,
+        captcha_protect_sign_up: captcha?.protect?.signUp ?? void 0,
+        captcha_protect_password_reset: captcha?.protect?.passwordReset ?? void 0,
+        captcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? void 0,
+        captcha_protect_email_verification: captcha?.protect?.emailVerification ?? void 0,
+        rate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? void 0,
+        rate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? void 0,
+        rate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? void 0,
+        rate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? void 0,
+        rate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? void 0,
+        rate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? void 0,
+        rate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? void 0,
+        rate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? void 0,
+        rate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? void 0,
+        rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? void 0,
+        rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? void 0,
+        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0,
+        panel_global_roles: this.configuration.panel?.globalRoles ?? void 0,
+        panel_project_roles: this.configuration.panel?.projectRoles ?? void 0
       }
     ).execute(db);
     if (!result) {

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateConfigurationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ConfigInput } from '../../../schema'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,MAAA;AAAA,IACvD,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;;"}
+{"version":3,"file":"UpdateConfigurationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// Null and omission preserve the stored secret; only an empty string clears it.\n\t\tlet captchaSecretCol: Buffer | null | undefined\n\t\tlet captchaSecretVersionCol: number | null | undefined\n\t\tif (captcha?.secret !== undefined && captcha.secret !== null) {\n\t\t\tif (captcha.secret === '') {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t\tpanel_global_roles: this.configuration.panel?.globalRoles ?? undefined,\n\t\t\t\t\tpanel_project_roles: this.configuration.panel?.projectRoles ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;AAG9B,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC7D,UAAI,QAAQ,WAAW,IAAI;AAC1B,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,QACnF,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,qBAAqB,KAAK,cAAc,OAAO,gBAAgB;AAAA,MAAA;AAAA,IAChE,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;;"}

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.js

@@ -3,10 +3,26 @@ class UpdateConfigurationCommand {
   constructor(configuration) {
     this.configuration = configuration;
   }
-  async execute({ db }) {
+  async execute({ db, providers }) {
+    const captcha = this.configuration.captcha;
+    const rl = this.configuration.rateLimits;
+    let captchaSecretCol;
+    let captchaSecretVersionCol;
+    if (captcha?.secret !== void 0 && captcha.secret !== null) {
+      if (captcha.secret === "") {
+        captchaSecretCol = null;
+        captchaSecretVersionCol = null;
+      } else {
+        const encrypted = await providers.encrypt(Buffer.from(captcha.secret, "utf8"));
+        captchaSecretCol = encrypted.value;
+        captchaSecretVersionCol = encrypted.version;
+      }
+    }
     const result = await UpdateBuilder$1.create().table("config").where({ id: "singleton" }).values(
       {
         passwordless_enabled: this.configuration.passwordless?.enabled ?? void 0,
+        signup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? void 0,
+        require_email_change_verification: this.configuration.emailChange?.requireVerification ?? void 0,
         passwordless_url: this.configuration.passwordless?.url,
         passwordless_expiration: this.configuration.passwordless?.expiration ?? void 0,
         password_min_length: this.configuration.password?.minLength ?? void 0,
@@ -16,12 +32,41 @@ class UpdateConfigurationCommand {
         password_require_special: this.configuration.password?.requireSpecial ?? void 0,
         password_pattern: this.configuration.password?.pattern,
         password_check_blacklist: this.configuration.password?.checkBlacklist ?? void 0,
+        password_check_hibp: this.configuration.password?.checkHibp ?? void 0,
         login_base_backoff: this.configuration.login?.baseBackoff ?? void 0,
         login_max_backoff: this.configuration.login?.maxBackoff ?? void 0,
         login_attempt_window: this.configuration.login?.attemptWindow ?? void 0,
         login_reveal_user_exits: this.configuration.login?.revealUserExists ?? void 0,
+        login_reveal_login_method: this.configuration.login?.revealLoginMethod ?? void 0,
         login_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? void 0,
-        login_max_token_expiration: this.configuration.login?.maxTokenExpiration
+        login_max_token_expiration: this.configuration.login?.maxTokenExpiration,
+        login_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? void 0,
+        login_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? void 0,
+        login_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? void 0,
+        login_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? void 0,
+        login_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? void 0,
+        captcha_provider: captcha?.provider !== void 0 ? captcha.provider : void 0,
+        captcha_secret: captchaSecretCol,
+        captcha_secret_version: captchaSecretVersionCol,
+        captcha_threshold: captcha?.threshold !== void 0 ? captcha.threshold : void 0,
+        captcha_protect_sign_up: captcha?.protect?.signUp ?? void 0,
+        captcha_protect_password_reset: captcha?.protect?.passwordReset ?? void 0,
+        captcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? void 0,
+        captcha_protect_email_verification: captcha?.protect?.emailVerification ?? void 0,
+        rate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? void 0,
+        rate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? void 0,
+        rate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? void 0,
+        rate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? void 0,
+        rate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? void 0,
+        rate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? void 0,
+        rate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? void 0,
+        rate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? void 0,
+        rate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? void 0,
+        rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? void 0,
+        rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? void 0,
+        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0,
+        panel_global_roles: this.configuration.panel?.globalRoles ?? void 0,
+        panel_project_roles: this.configuration.panel?.projectRoles ?? void 0
       }
     ).execute(db);
     if (!result) {

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateConfigurationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ConfigInput } from '../../../schema'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,MAAA;AAAA,IACvD,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;"}
+{"version":3,"file":"UpdateConfigurationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// Null and omission preserve the stored secret; only an empty string clears it.\n\t\tlet captchaSecretCol: Buffer | null | undefined\n\t\tlet captchaSecretVersionCol: number | null | undefined\n\t\tif (captcha?.secret !== undefined && captcha.secret !== null) {\n\t\t\tif (captcha.secret === '') {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t\tpanel_global_roles: this.configuration.panel?.globalRoles ?? undefined,\n\t\t\t\t\tpanel_project_roles: this.configuration.panel?.projectRoles ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;AAG9B,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC7D,UAAI,QAAQ,WAAW,IAAI;AAC1B,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,QACnF,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,qBAAqB,KAAK,cAAc,OAAO,gBAAgB;AAAA,MAAA;AAAA,IAChE,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;"}

package/dist/development/src/model/commands/customRole/CreateCustomRoleCommand.cjs

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class CreateCustomRoleCommand {
+  constructor(values) {
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const now = providers.now();
+    await Database.InsertBuilder.create().into("custom_role").values({
+      id,
+      slug: this.values.slug,
+      description: this.values.description,
+      grants: JSON.stringify(this.values.grants),
+      created_at: now,
+      updated_at: now
+    }).execute(db);
+    return id;
+  }
+}
+exports.CreateCustomRoleCommand = CreateCustomRoleCommand;
+//# sourceMappingURL=CreateCustomRoleCommand.cjs.map

package/dist/development/src/model/commands/customRole/CreateCustomRoleCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateCustomRoleCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/CreateCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\n/** Inserts a new `custom_role` row. Returns the generated id. */\nexport class CreateCustomRoleCommand implements Command<string> {\n\tconstructor(\n\t\tprivate readonly values: {\n\t\t\tslug: string\n\t\t\tdescription: string | null\n\t\t\tgrants: unknown\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst id = providers.uuid()\n\t\tconst now = providers.now()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('custom_role')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tslug: this.values.slug,\n\t\t\t\tdescription: this.values.description,\n\t\t\t\tgrants: JSON.stringify(this.values.grants),\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn id\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,wBAAmD;AAAA,EAC/D,YACkB,QAKhB;AALgB,SAAA,SAAA;AAAA,EAKf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA4C;AAC/D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,MAAM,UAAU,IAAA;AACtB,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,MAAM,KAAK,OAAO;AAAA,MAClB,aAAa,KAAK,OAAO;AAAA,MACzB,QAAQ,KAAK,UAAU,KAAK,OAAO,MAAM;AAAA,MACzC,YAAY;AAAA,MACZ,YAAY;AAAA,IAAA,CACZ,EACA,QAAQ,EAAE;AACZ,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/commands/customRole/CreateCustomRoleCommand.js

@@ -0,0 +1,23 @@
+import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+class CreateCustomRoleCommand {
+  constructor(values) {
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const now = providers.now();
+    await InsertBuilder$1.create().into("custom_role").values({
+      id,
+      slug: this.values.slug,
+      description: this.values.description,
+      grants: JSON.stringify(this.values.grants),
+      created_at: now,
+      updated_at: now
+    }).execute(db);
+    return id;
+  }
+}
+export {
+  CreateCustomRoleCommand
+};
+//# sourceMappingURL=CreateCustomRoleCommand.js.map

package/dist/development/src/model/commands/customRole/CreateCustomRoleCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateCustomRoleCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/CreateCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\n/** Inserts a new `custom_role` row. Returns the generated id. */\nexport class CreateCustomRoleCommand implements Command<string> {\n\tconstructor(\n\t\tprivate readonly values: {\n\t\t\tslug: string\n\t\t\tdescription: string | null\n\t\t\tgrants: unknown\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst id = providers.uuid()\n\t\tconst now = providers.now()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('custom_role')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tslug: this.values.slug,\n\t\t\t\tdescription: this.values.description,\n\t\t\t\tgrants: JSON.stringify(this.values.grants),\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn id\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,wBAAmD;AAAA,EAC/D,YACkB,QAKhB;AALgB,SAAA,SAAA;AAAA,EAKf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA4C;AAC/D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,MAAM,UAAU,IAAA;AACtB,UAAMA,gBAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,MAAM,KAAK,OAAO;AAAA,MAClB,aAAa,KAAK,OAAO;AAAA,MACzB,QAAQ,KAAK,UAAU,KAAK,OAAO,MAAM;AAAA,MACzC,YAAY;AAAA,MACZ,YAAY;AAAA,IAAA,CACZ,EACA,QAAQ,EAAE;AACZ,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/commands/customRole/DeleteCustomRoleCommand.cjs

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class DeleteCustomRoleCommand {
+  constructor(slug) {
+    this.slug = slug;
+  }
+  async execute({ db }) {
+    const result = await Database.DeleteBuilder.create().from("custom_role").where({ slug: this.slug }).execute(db);
+    return result > 0;
+  }
+}
+exports.DeleteCustomRoleCommand = DeleteCustomRoleCommand;
+//# sourceMappingURL=DeleteCustomRoleCommand.cjs.map

package/dist/development/src/model/commands/customRole/DeleteCustomRoleCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteCustomRoleCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/DeleteCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/**\n * Removes a role definition outright. The slug becomes reusable; the audit log\n * (`custom_role_change`) is what preserves the trace of what it used to grant.\n * Callers must strip the slug from every identity in the same transaction —\n * see `RemoveCustomRoleAssignmentsCommand`.\n */\nexport class DeleteCustomRoleCommand implements Command<boolean> {\n\tconstructor(private readonly slug: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await DeleteBuilder.create()\n\t\t\t.from('custom_role')\n\t\t\t.where({ slug: this.slug })\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AASO,MAAM,wBAAoD;AAAA,EAChE,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAAe;AAAA,EAE5C,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAMA,SAAAA,cAAc,OAAA,EACjC,KAAK,aAAa,EAClB,MAAM,EAAE,MAAM,KAAK,KAAA,CAAM,EACzB,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}

package/dist/development/src/model/commands/customRole/DeleteCustomRoleCommand.js

@@ -0,0 +1,14 @@
+import { DeleteBuilder } from "@contember/database";
+class DeleteCustomRoleCommand {
+  constructor(slug) {
+    this.slug = slug;
+  }
+  async execute({ db }) {
+    const result = await DeleteBuilder.create().from("custom_role").where({ slug: this.slug }).execute(db);
+    return result > 0;
+  }
+}
+export {
+  DeleteCustomRoleCommand
+};
+//# sourceMappingURL=DeleteCustomRoleCommand.js.map

package/dist/development/src/model/commands/customRole/DeleteCustomRoleCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteCustomRoleCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/DeleteCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/**\n * Removes a role definition outright. The slug becomes reusable; the audit log\n * (`custom_role_change`) is what preserves the trace of what it used to grant.\n * Callers must strip the slug from every identity in the same transaction —\n * see `RemoveCustomRoleAssignmentsCommand`.\n */\nexport class DeleteCustomRoleCommand implements Command<boolean> {\n\tconstructor(private readonly slug: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await DeleteBuilder.create()\n\t\t\t.from('custom_role')\n\t\t\t.where({ slug: this.slug })\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":[],"mappings":";AASO,MAAM,wBAAoD;AAAA,EAChE,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAAe;AAAA,EAE5C,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAM,cAAc,OAAA,EACjC,KAAK,aAAa,EAClB,MAAM,EAAE,MAAM,KAAK,KAAA,CAAM,EACzB,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}

package/dist/development/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.cjs

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class RemoveCustomRoleAssignmentsCommand {
+  constructor(slug) {
+    this.slug = slug;
+  }
+  async execute({ db }) {
+    const result = await Database.UpdateBuilder.create().table("identity").where((expr) => expr.raw("roles \\? ?", this.slug)).values({
+      roles: (expr) => expr.raw("roles - ?", this.slug)
+    }).returning("id").execute(db);
+    return result.map((row) => row.id);
+  }
+}
+exports.RemoveCustomRoleAssignmentsCommand = RemoveCustomRoleAssignmentsCommand;
+//# sourceMappingURL=RemoveCustomRoleAssignmentsCommand.cjs.map

package/dist/development/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemoveCustomRoleAssignmentsCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/** Returns the identities the slug was stripped from, so the delete can audit who actually lost it. */\nexport class RemoveCustomRoleAssignmentsCommand implements Command<string[]> {\n\tconstructor(private readonly slug: string) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<string[]> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where(expr => expr.raw('roles \\\\? ?', this.slug))\n\t\t\t.values({\n\t\t\t\troles: expr => expr.raw('roles - ?', this.slug),\n\t\t\t})\n\t\t\t.returning('id')\n\t\t\t.execute(db)\n\t\treturn result.map(row => row.id as string)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAIO,MAAM,mCAAgE;AAAA,EAC5E,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAuC;AACtD,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM,CAAA,SAAQ,KAAK,IAAI,eAAe,KAAK,IAAI,CAAC,EAChD,OAAO;AAAA,MACP,OAAO,CAAA,SAAQ,KAAK,IAAI,aAAa,KAAK,IAAI;AAAA,IAAA,CAC9C,EACA,UAAU,IAAI,EACd,QAAQ,EAAE;AACZ,WAAO,OAAO,IAAI,CAAA,QAAO,IAAI,EAAY;AAAA,EAC1C;AACD;;"}

package/dist/development/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.js

@@ -0,0 +1,16 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class RemoveCustomRoleAssignmentsCommand {
+  constructor(slug) {
+    this.slug = slug;
+  }
+  async execute({ db }) {
+    const result = await UpdateBuilder$1.create().table("identity").where((expr) => expr.raw("roles \\? ?", this.slug)).values({
+      roles: (expr) => expr.raw("roles - ?", this.slug)
+    }).returning("id").execute(db);
+    return result.map((row) => row.id);
+  }
+}
+export {
+  RemoveCustomRoleAssignmentsCommand
+};
+//# sourceMappingURL=RemoveCustomRoleAssignmentsCommand.js.map

package/dist/development/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemoveCustomRoleAssignmentsCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/** Returns the identities the slug was stripped from, so the delete can audit who actually lost it. */\nexport class RemoveCustomRoleAssignmentsCommand implements Command<string[]> {\n\tconstructor(private readonly slug: string) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<string[]> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where(expr => expr.raw('roles \\\\? ?', this.slug))\n\t\t\t.values({\n\t\t\t\troles: expr => expr.raw('roles - ?', this.slug),\n\t\t\t})\n\t\t\t.returning('id')\n\t\t\t.execute(db)\n\t\treturn result.map(row => row.id as string)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAIO,MAAM,mCAAgE;AAAA,EAC5E,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAuC;AACtD,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM,CAAA,SAAQ,KAAK,IAAI,eAAe,KAAK,IAAI,CAAC,EAChD,OAAO;AAAA,MACP,OAAO,CAAA,SAAQ,KAAK,IAAI,aAAa,KAAK,IAAI;AAAA,IAAA,CAC9C,EACA,UAAU,IAAI,EACd,QAAQ,EAAE;AACZ,WAAO,OAAO,IAAI,CAAA,QAAO,IAAI,EAAY;AAAA,EAC1C;AACD;"}

package/dist/development/src/model/commands/customRole/UpdateCustomRoleCommand.cjs

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class UpdateCustomRoleCommand {
+  constructor(slug, values) {
+    this.slug = slug;
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const result = await Database.UpdateBuilder.create().table("custom_role").where({ slug: this.slug }).values({
+      description: this.values.description,
+      grants: this.values.grants === void 0 ? void 0 : JSON.stringify(this.values.grants),
+      updated_at: providers.now()
+    }).execute(db);
+    return result > 0;
+  }
+}
+exports.UpdateCustomRoleCommand = UpdateCustomRoleCommand;
+//# sourceMappingURL=UpdateCustomRoleCommand.cjs.map

package/dist/development/src/model/commands/customRole/UpdateCustomRoleCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateCustomRoleCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/UpdateCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Updates an existing `custom_role` row. Only the supplied fields are written\n * (an `undefined` field is left untouched; an explicit `null` description clears it).\n * `updated_at` is always bumped. Returns whether a row was affected.\n */\nexport class UpdateCustomRoleCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly slug: string,\n\t\tprivate readonly values: {\n\t\t\tdescription?: string | null\n\t\t\tgrants?: unknown\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('custom_role')\n\t\t\t.where({ slug: this.slug })\n\t\t\t.values({\n\t\t\t\tdescription: this.values.description,\n\t\t\t\tgrants: this.values.grants === undefined ? undefined : JSON.stringify(this.values.grants),\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAQO,MAAM,wBAAoD;AAAA,EAChE,YACkB,MACA,QAIhB;AALgB,SAAA,OAAA;AACA,SAAA,SAAA;AAAA,EAIf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,SAAS,MAAMA,SAAAA,cAAc,OAAA,EACjC,MAAM,aAAa,EACnB,MAAM,EAAE,MAAM,KAAK,KAAA,CAAM,EACzB,OAAO;AAAA,MACP,aAAa,KAAK,OAAO;AAAA,MACzB,QAAQ,KAAK,OAAO,WAAW,SAAY,SAAY,KAAK,UAAU,KAAK,OAAO,MAAM;AAAA,MACxF,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}

package/dist/development/src/model/commands/customRole/UpdateCustomRoleCommand.js

@@ -0,0 +1,19 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class UpdateCustomRoleCommand {
+  constructor(slug, values) {
+    this.slug = slug;
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const result = await UpdateBuilder$1.create().table("custom_role").where({ slug: this.slug }).values({
+      description: this.values.description,
+      grants: this.values.grants === void 0 ? void 0 : JSON.stringify(this.values.grants),
+      updated_at: providers.now()
+    }).execute(db);
+    return result > 0;
+  }
+}
+export {
+  UpdateCustomRoleCommand
+};
+//# sourceMappingURL=UpdateCustomRoleCommand.js.map

package/dist/development/src/model/commands/customRole/UpdateCustomRoleCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateCustomRoleCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/UpdateCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Updates an existing `custom_role` row. Only the supplied fields are written\n * (an `undefined` field is left untouched; an explicit `null` description clears it).\n * `updated_at` is always bumped. Returns whether a row was affected.\n */\nexport class UpdateCustomRoleCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly slug: string,\n\t\tprivate readonly values: {\n\t\t\tdescription?: string | null\n\t\t\tgrants?: unknown\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('custom_role')\n\t\t\t.where({ slug: this.slug })\n\t\t\t.values({\n\t\t\t\tdescription: this.values.description,\n\t\t\t\tgrants: this.values.grants === undefined ? undefined : JSON.stringify(this.values.grants),\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAQO,MAAM,wBAAoD;AAAA,EAChE,YACkB,MACA,QAIhB;AALgB,SAAA,OAAA;AACA,SAAA,SAAA;AAAA,EAIf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,aAAa,EACnB,MAAM,EAAE,MAAM,KAAK,KAAA,CAAM,EACzB,OAAO;AAAA,MACP,aAAa,KAAK,OAAO;AAAA,MACzB,QAAQ,KAAK,OAAO,WAAW,SAAY,SAAY,KAAK,UAAU,KAAK,OAAO,MAAM;AAAA,MACxF,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}

package/dist/development/src/model/commands/identity/CreateIdentityCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdentityCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/CreateIdentityCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\n\nexport class CreateIdentityCommand implements Command<string> {\n\tconstructor(private readonly roles: readonly string[], private readonly description?: string) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst identityId = providers.uuid()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity')\n\t\t\t.values({\n\t\t\t\tid: identityId,\n\t\t\t\tparent_id: null,\n\t\t\t\troles: JSON.stringify(this.roles),\n\t\t\t\tdescription: this.description || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn identityId\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAGO,MAAM,sBAAiD;AAAA,EAC7D,YAA6B,OAA2C,aAAsB;AAAjE,SAAA,QAAA;AAA2C,SAAA,cAAA;AAAA,EAAuB;AAAA,EAE/F,MAAa,QAAQ,EAAE,IAAI,aAA4C;AACtE,UAAM,aAAa,UAAU,KAAA;AAC7B,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,UAAU,EACf,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,WAAW;AAAA,MACX,OAAO,KAAK,UAAU,KAAK,KAAK;AAAA,MAChC,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"CreateIdentityCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/CreateIdentityCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\nexport class CreateIdentityCommand implements Command<string> {\n\tconstructor(private readonly roles: readonly string[], private readonly description?: string) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst identityId = providers.uuid()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity')\n\t\t\t.values({\n\t\t\t\tid: identityId,\n\t\t\t\tparent_id: null,\n\t\t\t\troles: JSON.stringify(this.roles),\n\t\t\t\tdescription: this.description || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn identityId\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAGO,MAAM,sBAAiD;AAAA,EAC7D,YAA6B,OAA2C,aAAsB;AAAjE,SAAA,QAAA;AAA2C,SAAA,cAAA;AAAA,EAAuB;AAAA,EAE/F,MAAa,QAAQ,EAAE,IAAI,aAA4C;AACtE,UAAM,aAAa,UAAU,KAAA;AAC7B,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,UAAU,EACf,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,WAAW;AAAA,MACX,OAAO,KAAK,UAAU,KAAK,KAAK;AAAA,MAChC,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/commands/identity/CreateIdentityCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdentityCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/CreateIdentityCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\n\nexport class CreateIdentityCommand implements Command<string> {\n\tconstructor(private readonly roles: readonly string[], private readonly description?: string) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst identityId = providers.uuid()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity')\n\t\t\t.values({\n\t\t\t\tid: identityId,\n\t\t\t\tparent_id: null,\n\t\t\t\troles: JSON.stringify(this.roles),\n\t\t\t\tdescription: this.description || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn identityId\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAGO,MAAM,sBAAiD;AAAA,EAC7D,YAA6B,OAA2C,aAAsB;AAAjE,SAAA,QAAA;AAA2C,SAAA,cAAA;AAAA,EAAuB;AAAA,EAE/F,MAAa,QAAQ,EAAE,IAAI,aAA4C;AACtE,UAAM,aAAa,UAAU,KAAA;AAC7B,UAAMA,gBAAc,OAAA,EAClB,KAAK,UAAU,EACf,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,WAAW;AAAA,MACX,OAAO,KAAK,UAAU,KAAK,KAAK;AAAA,MAChC,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"CreateIdentityCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/CreateIdentityCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\nexport class CreateIdentityCommand implements Command<string> {\n\tconstructor(private readonly roles: readonly string[], private readonly description?: string) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst identityId = providers.uuid()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity')\n\t\t\t.values({\n\t\t\t\tid: identityId,\n\t\t\t\tparent_id: null,\n\t\t\t\troles: JSON.stringify(this.roles),\n\t\t\t\tdescription: this.description || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn identityId\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAGO,MAAM,sBAAiD;AAAA,EAC7D,YAA6B,OAA2C,aAAsB;AAAjE,SAAA,QAAA;AAA2C,SAAA,cAAA;AAAA,EAAuB;AAAA,EAE/F,MAAa,QAAQ,EAAE,IAAI,aAA4C;AACtE,UAAM,aAAa,UAAU,KAAA;AAC7B,UAAMA,gBAAc,OAAA,EAClB,KAAK,UAAU,EACf,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,WAAW;AAAA,MACX,OAAO,KAAK,UAAU,KAAK,KAAK;AAAA,MAChC,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/commands/identity/PatchIdentityGlobalRoles.cjs

@@ -13,7 +13,7 @@ class PatchIdentityGlobalRoles {
     }).values({
       roles: (it) => it.raw(
         `(
-						SELECT JSONB_AGG(DISTINCT out_role)
+						SELECT COALESCE(JSONB_AGG(DISTINCT out_role), '[]'::jsonb)
 						FROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)
 						WHERE NOT(out_role = ANY (?::text[]))
 					)`,

package/dist/development/src/model/commands/identity/PatchIdentityGlobalRoles.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PatchIdentityGlobalRoles.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT JSONB_AGG(DISTINCT out_role)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}
+{"version":3,"file":"PatchIdentityGlobalRoles.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT COALESCE(JSONB_AGG(DISTINCT out_role), '[]'::jsonb)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}

package/dist/development/src/model/commands/identity/PatchIdentityGlobalRoles.js

@@ -11,7 +11,7 @@ class PatchIdentityGlobalRoles {
     }).values({
       roles: (it) => it.raw(
         `(
-						SELECT JSONB_AGG(DISTINCT out_role)
+						SELECT COALESCE(JSONB_AGG(DISTINCT out_role), '[]'::jsonb)
 						FROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)
 						WHERE NOT(out_role = ANY (?::text[]))
 					)`,

package/dist/development/src/model/commands/identity/PatchIdentityGlobalRoles.js.map

@@ -1 +1 @@
-{"version":3,"file":"PatchIdentityGlobalRoles.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT JSONB_AGG(DISTINCT out_role)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}
+{"version":3,"file":"PatchIdentityGlobalRoles.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT COALESCE(JSONB_AGG(DISTINCT out_role), '[]'::jsonb)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}

package/dist/development/src/model/commands/idp/ClaimIdpRevalidationCommand.cjs

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class ClaimIdpRevalidationCommand {
+  constructor(id, interval) {
+    this.id = id;
+    this.interval = interval;
+  }
+  async execute({ db }) {
+    const qb = Database.UpdateBuilder.create().table("idp_session").where({ id: this.id }).where((expr) => expr.raw('"last_validated_at" <= now() - ?::interval', this.interval)).values({ last_validated_at: (expr) => expr.raw("now()") });
+    return await qb.execute(db) > 0;
+  }
+}
+exports.ClaimIdpRevalidationCommand = ClaimIdpRevalidationCommand;
+//# sourceMappingURL=ClaimIdpRevalidationCommand.cjs.map

package/dist/development/src/model/commands/idp/ClaimIdpRevalidationCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimIdpRevalidationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { UpdateBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\n\n/**\n * Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n *\n * This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('idp_session')\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.raw('\"last_validated_at\" <= now() - ?::interval', this.interval))\n\t\t\t.values({ last_validated_at: expr => expr.raw('now()') })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAYO,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,aAAa,EACnB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,IAAI,8CAA8C,KAAK,QAAQ,CAAC,EACnF,OAAO,EAAE,mBAAmB,CAAA,SAAQ,KAAK,IAAI,OAAO,GAAG;AAEzD,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;;"}

package/dist/development/src/model/commands/idp/ClaimIdpRevalidationCommand.js

@@ -0,0 +1,15 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class ClaimIdpRevalidationCommand {
+  constructor(id, interval) {
+    this.id = id;
+    this.interval = interval;
+  }
+  async execute({ db }) {
+    const qb = UpdateBuilder$1.create().table("idp_session").where({ id: this.id }).where((expr) => expr.raw('"last_validated_at" <= now() - ?::interval', this.interval)).values({ last_validated_at: (expr) => expr.raw("now()") });
+    return await qb.execute(db) > 0;
+  }
+}
+export {
+  ClaimIdpRevalidationCommand
+};
+//# sourceMappingURL=ClaimIdpRevalidationCommand.js.map

package/dist/development/src/model/commands/idp/ClaimIdpRevalidationCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimIdpRevalidationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { UpdateBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\n\n/**\n * Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n *\n * This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('idp_session')\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.raw('\"last_validated_at\" <= now() - ?::interval', this.interval))\n\t\t\t.values({ last_validated_at: expr => expr.raw('now()') })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAYO,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,aAAa,EACnB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,IAAI,8CAA8C,KAAK,QAAQ,CAAC,EACnF,OAAO,EAAE,mBAAmB,CAAA,SAAQ,KAAK,IAAI,OAAO,GAAG;AAEzD,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;"}

package/dist/development/src/model/commands/idp/CreateIdpCommand.cjs

@@ -6,7 +6,12 @@ class CreateIdpCommand {
     this.data = data;
   }
   async execute({ db, providers }) {
-    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig }, slug, type } = this.data;
+    const {
+      configuration,
+      options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
+      slug,
+      type
+    } = this.data;
     await Database.InsertBuilder.create().into("identity_provider").values({
       id: providers.uuid(),
       configuration,
@@ -14,7 +19,10 @@ class CreateIdpCommand {
       type,
       auto_sign_up: autoSignUp,
       exclusive,
-      init_returns_config: initReturnsConfig
+      init_returns_config: initReturnsConfig,
+      require_verified_email: requireVerifiedEmail,
+      assume_email_verified: assumeEmailVerified,
+      disable_local_authentication: disableLocalAuthentication
     }).execute(db);
   }
 }

package/dist/development/src/model/commands/idp/CreateIdpCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst { configuration, options: { autoSignUp, exclusive, initReturnsConfig }, slug, type } = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,EAAE,eAAe,SAAS,EAAE,YAAY,WAAW,kBAAA,GAAqB,MAAM,KAAA,IAAS,KAAK;AAClG,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,IAAA,CACrB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"CreateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst {\n\t\t\tconfiguration,\n\t\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },\n\t\t\tslug,\n\t\t\ttype,\n\t\t} = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t\tdisable_local_authentication: disableLocalAuthentication,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM;AAAA,MACL;AAAA,MACA,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,2BAAA;AAAA,MAChG;AAAA,MACA;AAAA,IAAA,IACG,KAAK;AACT,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,MACvB,8BAA8B;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/idp/CreateIdpCommand.js

@@ -4,7 +4,12 @@ class CreateIdpCommand {
     this.data = data;
   }
   async execute({ db, providers }) {
-    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig }, slug, type } = this.data;
+    const {
+      configuration,
+      options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
+      slug,
+      type
+    } = this.data;
     await InsertBuilder$1.create().into("identity_provider").values({
       id: providers.uuid(),
       configuration,
@@ -12,7 +17,10 @@ class CreateIdpCommand {
       type,
       auto_sign_up: autoSignUp,
       exclusive,
-      init_returns_config: initReturnsConfig
+      init_returns_config: initReturnsConfig,
+      require_verified_email: requireVerifiedEmail,
+      assume_email_verified: assumeEmailVerified,
+      disable_local_authentication: disableLocalAuthentication
     }).execute(db);
   }
 }

package/dist/development/src/model/commands/idp/CreateIdpCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst { configuration, options: { autoSignUp, exclusive, initReturnsConfig }, slug, type } = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,EAAE,eAAe,SAAS,EAAE,YAAY,WAAW,kBAAA,GAAqB,MAAM,KAAA,IAAS,KAAK;AAClG,UAAMA,gBAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,IAAA,CACrB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"CreateIdpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst {\n\t\t\tconfiguration,\n\t\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },\n\t\t\tslug,\n\t\t\ttype,\n\t\t} = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t\tdisable_local_authentication: disableLocalAuthentication,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM;AAAA,MACL;AAAA,MACA,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,2BAAA;AAAA,MAChG;AAAA,MACA;AAAA,IAAA,IACG,KAAK;AACT,UAAMA,gBAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,MACvB,8BAA8B;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}