@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/src/model/service/IDPSignInManager.ts

@@ -1,19 +1,26 @@
-import { ApiKeyManager } from './apiKey'
-import { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries'
-import { IDPHandlerRegistry, IDPResponse, IDPResponseError, IDPValidationError } from './idp'
-import { Response, ResponseError, ResponseOk } from '../utils/Response'
-import { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema'
-import { DatabaseContext } from '../utils'
-import { CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProviderIdentifierCommand } from '../commands'
-import { TenantRole } from '../authorization'
-import { NoPassword } from '../dtos'
-import { IdentityProviderRow } from '../queries/idp/types'
-import { AuthLogService } from './AuthLogService'
+import { ApiKeyManager } from './apiKey/index.js'
+import { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries/index.js'
+import { IDPHandlerRegistry, IDPResponse, IDPResponseError, IDPValidationError } from './idp/index.js'
+import { Response, ResponseError, ResponseOk } from '../utils/Response.js'
+import { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema/index.js'
+import { DatabaseContext } from '../utils/index.js'
+import { ApiKeyRequestInfo, CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProviderIdentifierCommand } from '../commands/index.js'
+import { CreateIdpSessionCommand } from '../commands/idp/CreateIdpSessionCommand.js'
+import { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'
+import { TenantRole } from '../authorization/index.js'
+import { NoPassword } from '../dtos/index.js'
+import { IdentityProviderRow } from '../queries/idp/types.js'
+import { AuthLogService } from './AuthLogService.js'
+import { ClaimMappingAudit, IDPClaimSyncService } from './idp/IDPClaimSyncService.js'
+import { ClaimMapping, parseClaimMapping } from './idp/ClaimMapping.js'
+import { Logger } from '@contember/logger'
 
 class IDPSignInManager {
 	constructor(
 		private readonly apiKeyManager: ApiKeyManager,
 		private readonly idpRegistry: IDPHandlerRegistry,
+		private readonly claimSyncService: IDPClaimSyncService,
+		private readonly logger: Logger,
 	) {}
 
 	async signInIDP(
@@ -21,6 +28,8 @@ class IDPSignInManager {
 		idpSlug: string,
 		responseData: unknown,
 		expiration?: number,
+		requestInfo?: ApiKeyRequestInfo,
+		trustForwardedInfo?: boolean,
 	): Promise<IDPSignInManager.SignInIDPResponse> {
 		return dbContext.transaction(async (db): Promise<IDPSignInManager.SignInIDPResponse> => {
 			const provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))
@@ -54,14 +63,19 @@ class IDPSignInManager {
 				}
 				throw e
 			}
-			const personRow = await this.resolvePerson(db, claim, provider)
+			const resolved = await this.resolvePerson(db, claim, provider)
+			const personRow = resolved.person
 
 			if (!personRow) {
+				// Keep the external error generic (no account-existence leak), but
+				// record the email-verification gate block distinctly in the audit
+				// log — it is a takeover-grade event, not an ordinary "not found".
 				return new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`, {
 					[AuthLogService.Key]: new AuthLogService.Bag({
 						identityProviderId: provider.id,
 						personInput: claim.email,
-						personId: undefined,
+						personId: resolved.blockedPersonId,
+						eventData: resolved.blockedReason ? { reason: resolved.blockedReason } : undefined,
 					}),
 				})
 			}
@@ -76,11 +90,97 @@ class IDPSignInManager {
 				})
 			}
 
-			const sessionToken = await this.apiKeyManager.createSessionApiKey(db, personRow.identity_id, expiration)
+			// A09 — map IdP claims to project memberships. Returns a `{ before, after }` delta only
+			// when something actually changed; the resolver emits the `idp_role_mapped` audit from it
+			// (audit stays at the resolver layer).
+			//
+			// Fail-open on a MALFORMED/out-of-band `claimMapping`: parsing is caught so a bad config can
+			// never lock the user out — sign-in proceeds without claim mapping and the resolver emits an
+			// `idp_role_mapping_failed` marker. A DB error during the apply itself is NOT caught: it
+			// propagates and rolls back the whole sign-in transaction, so a half-applied set of grants is
+			// never committed (failing sign-in on an infra error is the safe outcome).
+			let mapping: ClaimMapping | null = null
+			let claimMappingFailed = false
+			try {
+				mapping = parseClaimMapping(provider.configuration)
+			} catch (e) {
+				this.logger.warn(e, { message: 'IdP sign-in: claim mapping configuration is invalid', identityProviderId: provider.id })
+				claimMappingFailed = true
+			}
+			let claimMappingAudit: ClaimMappingAudit | null = null
+			if (mapping) {
+				const syncResult = await this.claimSyncService.sync(
+					db,
+					mapping,
+					claim,
+					{ id: personRow.identity_id },
+					resolved.isNewPerson === true,
+				)
+				claimMappingAudit = syncResult.audit
+				// The apply-time safety backstop dropped a configured rule (config-time validation was skipped, or
+				// the project's ACL drifted since): surface the same fail-open marker as a malformed config, so a
+				// silently-unapplied grant is visible to the operator. The resolver emits `idp_role_mapping_failed`.
+				if (syncResult.droppedUnsafeRules) {
+					claimMappingFailed = true
+				}
+			}
+
+			const { id: apiKeyId, token: sessionToken } = await this.apiKeyManager.createSessionApiKeyWithId(
+				db,
+				personRow.identity_id,
+				expiration,
+				requestInfo,
+				trustForwardedInfo,
+			)
+
+			// Bind the federated-session state to this session so it can be re-validated
+			// against the IdP later. Present only when the provider supports it and
+			// revalidation is enabled on the IdP configuration (A24). Refresh tokens must be
+			// encrypted at rest, so when no encryption key is configured we skip persisting a
+			// token-bearing session (it would otherwise crash or store secrets in plaintext) —
+			// the session then behaves like a plain session with no re-validation.
+			if (claim.idpSession) {
+				const hasTokens = !!claim.idpSession.tokens && Object.keys(claim.idpSession.tokens).length > 0
+				if (!hasTokens || db.providers.encryptionEnabled) {
+					await db.commandBus.execute(new CreateIdpSessionCommand(apiKeyId, provider.id, claim.idpSession))
+				} else {
+					// Re-validation is enabled on this IdP but no encryption key is configured, so we
+					// won't store the token-bearing session — it silently degrades to a plain,
+					// non-revalidated session. Audit the downgrade (errorCode `encryption_disabled`)
+					// so the operator can see that a session they expected to be continuously
+					// re-validated is in fact not protected, instead of failing closed at sign-in.
+					// Best-effort, in a savepoint: a failed insert would otherwise abort the whole
+					// sign-in transaction, and a lost audit row must not block the sign-in.
+					try {
+						await db.commandBus.transaction(bus =>
+							bus.execute(
+								new CreateAuthLogEntryCommand({
+									type: 'idp_session_revalidation_failed',
+									invokedById: personRow.identity_id,
+									personId: personRow.id,
+									identityProviderId: provider.id,
+									success: true,
+									errorCode: 'encryption_disabled',
+									ipAddress: requestInfo?.ip,
+									userAgent: requestInfo?.userAgent,
+									eventData: { apiKeyId },
+								}),
+							)
+						)
+					} catch (e) {
+						this.logger.error(e, { message: 'IdP sign-in: writing the encryption_disabled audit entry failed', identityProviderId: provider.id })
+						// the savepoint is rolled back, the sign-in transaction stays usable
+					}
+				}
+			}
+
 			return new ResponseOk({
 				person: personRow,
 				token: sessionToken,
 				idpResponse: claim,
+				claimMappingAudit,
+				claimMappingFailed,
+				identityProviderId: provider.id,
 				[AuthLogService.Key]: new AuthLogService.Bag({
 					personId: personRow.id,
 					identityProviderId: provider.id,
@@ -116,28 +216,40 @@ class IDPSignInManager {
 		}
 	}
 
-	private async resolvePerson(db: DatabaseContext, claim: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow | null> {
+	private async resolvePerson(db: DatabaseContext, claim: IDPResponse, provider: IdentityProviderRow): Promise<IDPSignInManager.ResolvePersonResult> {
 		const personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)
 		const personByIdp = await db.queryHandler.fetch(personByIdPQuery)
 		if (personByIdp) {
-			return personByIdp
+			return { person: personByIdp }
 		}
 
 		if (!provider.exclusive) {
-			const personByEmail = claim.email ? await db.queryHandler.fetch(PersonQuery.byEmail(claim.email)) : null
+			const personByEmail = typeof claim.email === 'string' && claim.email
+				? await db.queryHandler.fetch(PersonQuery.byEmail(claim.email))
+				: null
 			if (personByEmail) {
+				// Auto-linking an IdP identity to a pre-existing local account by
+				// e-mail is takeover-grade: if the provider returns an unverified
+				// (or attacker-controlled) e-mail, it could hijack the account. When
+				// the provider requires a verified e-mail, refuse to link — and to
+				// sign in — unless the address is asserted verified. `assumeEmailVerified`
+				// lets a trusted IdP that never emits the claim still satisfy the gate.
+				const emailVerified = provider.assumeEmailVerified || claim.emailVerified === true
+				if (provider.requireVerifiedEmail && !emailVerified) {
+					return { person: null, blockedReason: 'idp_email_unverified', blockedPersonId: personByEmail.id }
+				}
 				await this.saveIdpIdentifier(db, provider, claim, personByEmail)
-				return personByEmail
+				return { person: personByEmail }
 			}
 		}
 
 		if (provider.autoSignUp) {
 			const signedUpPerson = await this.signUp(db, claim, provider)
 			await this.saveIdpIdentifier(db, provider, claim, signedUpPerson)
-			return signedUpPerson
+			return { person: signedUpPerson, isNewPerson: true }
 		}
 
-		return null
+		return { person: null }
 	}
 
 	private async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow> {
@@ -165,12 +277,26 @@ class IDPSignInManager {
 }
 
 namespace IDPSignInManager {
+	export type ResolvePersonResult = {
+		readonly person: PersonRow | null
+		readonly blockedReason?: 'idp_email_unverified'
+		readonly blockedPersonId?: string
+		/** True when the person row was just created by auto-sign-up (drives the `sticky` claim-mapping policy). */
+		readonly isNewPerson?: boolean
+	}
+
 	export type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>
 
 	interface SignInIDPResult {
 		readonly person: PersonRow
 		readonly token: string
 		readonly idpResponse?: Record<string, unknown>
+		/** Identity provider the sign-in went through (for the resolver's audit). */
+		readonly identityProviderId?: string
+		/** Claim-mapping (A09) before/after delta — present only when a mapping changed grants. */
+		readonly claimMappingAudit?: ClaimMappingAudit | null
+		/** True when claim mapping failed and was skipped (fail-open) — drives the `idp_role_mapping_failed` audit. */
+		readonly claimMappingFailed?: boolean
 		[AuthLogService.Key]: AuthLogService.Bag
 	}
 

package/src/model/service/InviteManager.ts

@@ -4,20 +4,20 @@ import {
 	CreatePersonCommand,
 	CreatePersonTokenCommand,
 	SavePersonTokenCommand,
-} from '../commands'
-import { Providers } from '../providers'
-import { PersonQuery, PersonRow } from '../queries'
-import { Project, ProjectSchemaResolver } from '../type'
-import { InviteErrorCode, InviteMethod } from '../../schema'
-import { TenantRole } from '../authorization'
-import { UserMailer } from '../mailing'
-import { createAppendMembershipVariables } from './membershipUtils'
-import { Response, ResponseError, ResponseOk } from '../utils/Response'
-import { DatabaseContext, TokenHash } from '../utils'
-import { NoPassword, PasswordPlain } from '../dtos'
+} from '../commands/index.js'
+import { Providers } from '../providers.js'
+import { PersonQuery, PersonRow } from '../queries/index.js'
+import { Project, ProjectSchemaResolver } from '../type/index.js'
+import { InviteErrorCode, InviteMethod } from '../../schema/index.js'
+import { TenantRole } from '../authorization/index.js'
+import { UserMailer } from '../mailing/index.js'
+import { createAppendMembershipVariables } from './membershipUtils.js'
+import { Response, ResponseError, ResponseOk } from '../utils/Response.js'
+import { DatabaseContext, TokenHash } from '../utils/index.js'
+import { NoPassword, PasswordPlain } from '../dtos/index.js'
 import { Acl } from '@contember/schema'
-import { validateEmail } from '../utils/email'
-import { INVITATION_RESET_TOKEN_EXPIRATION_MINUTES } from '../consts/expirations'
+import { validateEmail } from '../utils/email.js'
+import { INVITATION_RESET_TOKEN_EXPIRATION_MINUTES } from '../consts/expirations.js'
 
 export interface InviteData {
 	email: string

package/src/model/service/LoginRiskAnalyzer.ts

@@ -0,0 +1,274 @@
+import { BinaryLike } from 'node:crypto'
+import { DatabaseContext } from '../utils/index.js'
+import { Operator, SelectBuilder } from '@contember/database'
+import { Config } from '../type/Config.js'
+
+/**
+ * Risk weights per signal (A03 v1). Cumulative: a login from a new country on a
+ * new device scores HIGH + MEDIUM. Chosen so that the shipped default thresholds
+ * (email >= 1, step-up >= 3) map intuitively to "any single low signal emails,
+ * a high signal steps up".
+ */
+export const RiskWeight = {
+	/** New country (from the trusted reverse-proxy geo header). */
+	newCountry: 3,
+	/** New user-agent fingerprint. */
+	newDevice: 2,
+	/** New IP / IP-prefix. */
+	newIpPrefix: 1,
+} as const
+
+export type RiskAction = 'allow' | 'email' | 'stepUp'
+
+/**
+ * Auth-log `type` values that represent a successful *interactive* sign-in which
+ * issued a session for the person from their own client — i.e. the rows whose
+ * geo/device/IP form the baseline for the next sign-in's anomaly check. Password
+ * (`login`), federated (`idp_login`), and magic-link (`passwordless_login`) all
+ * qualify. Deliberately excluded: `passwordless_login_exchange` (the OTP
+ * activation step issues no session) and `create_session_token` (an admin minting
+ * a token carries the admin's client info, not the person's).
+ */
+export const BASELINE_SIGN_IN_TYPES = ['login', 'idp_login', 'passwordless_login'] as const
+
+export interface LoginSignals {
+	/** Country code from the trusted geo header, or null when unavailable. */
+	readonly geoCountry: string | null
+	/** Hash of the client user-agent, or null when no UA was provided. */
+	readonly deviceFingerprint: string | null
+	/** Client IP, or null when unavailable. */
+	readonly ip: string | null
+}
+
+export interface PriorLogin {
+	readonly geoCountry: string | null
+	readonly deviceFingerprint: string | null
+	readonly ip: string | null
+}
+
+export interface RiskAssessment {
+	readonly score: number
+	readonly action: RiskAction
+	/** Greppable list of which signals fired, e.g. ['new_country', 'new_device']. */
+	readonly reasons: readonly string[]
+}
+
+/**
+ * A03 — sign-in anomaly detection (v1). Runs after password verification (and any
+ * standing MFA), before a session is issued. Pure scoring lives in {@link score};
+ * {@link analyze} loads the comparison history and applies the configured policy.
+ *
+ * v1 scope (locked): no GeoIP DB — country comes from a trusted reverse-proxy
+ * header read through the same trust gate as the forwarded IP/UA. No
+ * impossible-travel detection. Opt-in, disabled by default.
+ */
+export class LoginRiskAnalyzer {
+	constructor(
+		private readonly hash: (value: BinaryLike, algo: string) => Buffer,
+	) {}
+
+	/**
+	 * Deterministic user-agent fingerprint: a hex sha256 of the raw UA. We never
+	 * store the raw UA in a second column nor any cross-site fingerprint — just a
+	 * stable hash so "same browser" comparisons work without retaining the string.
+	 * Returns null for an absent/empty UA.
+	 */
+	fingerprint(userAgent: string | undefined | null): string | null {
+		if (!userAgent) {
+			return null
+		}
+		return this.hash(userAgent, 'sha256').toString('hex')
+	}
+
+	/**
+	 * Pure scoring. Compares the current sign-in's signals against the set of prior
+	 * successful logins. A signal fires only when (a) the current value is known,
+	 * (b) a baseline for *that* signal exists in history — at least one prior login
+	 * recorded a non-null value for it — and (c) the current value is absent from
+	 * that baseline. With no history at all, or no baseline yet for a given signal
+	 * (e.g. the geo header or device fingerprint only started being collected when
+	 * the feature was enabled, so every prior row is null for it), that signal is
+	 * treated as known. This keeps the documented "no baseline to deviate from →
+	 * trusted" rule true per signal, so turning the feature on does not score every
+	 * returning user's first login as anomalous.
+	 */
+	score(current: LoginSignals, history: readonly PriorLogin[], config: Config['login']['anomalyDetection']): RiskAssessment {
+		const reasons: string[] = []
+		let total = 0
+
+		if (history.length === 0) {
+			return { score: 0, action: 'allow', reasons }
+		}
+
+		if (current.geoCountry !== null) {
+			const baseline = history.filter(h => h.geoCountry !== null)
+			if (baseline.length > 0 && !baseline.some(h => h.geoCountry === current.geoCountry)) {
+				total += RiskWeight.newCountry
+				reasons.push('new_country')
+			}
+		}
+
+		const currentFingerprint = current.deviceFingerprint
+		if (currentFingerprint !== null) {
+			const baseline = history.filter(h => h.deviceFingerprint !== null)
+			if (baseline.length > 0 && !baseline.some(h => h.deviceFingerprint === currentFingerprint)) {
+				total += RiskWeight.newDevice
+				reasons.push('new_device')
+			}
+		}
+
+		const currentPrefix = ipPrefix(current.ip)
+		if (currentPrefix !== null) {
+			const baselinePrefixes = history.map(h => ipPrefix(h.ip)).filter((p): p is string => p !== null)
+			if (baselinePrefixes.length > 0 && !baselinePrefixes.includes(currentPrefix)) {
+				total += RiskWeight.newIpPrefix
+				reasons.push('new_ip_prefix')
+			}
+		}
+
+		return { score: total, action: this.decide(total, config), reasons }
+	}
+
+	private decide(total: number, config: Config['login']['anomalyDetection']): RiskAction {
+		// step-up wins over email when both thresholds are crossed. A threshold of 0
+		// would always fire, so it is only meaningful when the feature is enabled.
+		if (total >= config.stepUpThreshold) {
+			return 'stepUp'
+		}
+		if (total >= config.emailThreshold) {
+			return 'email'
+		}
+		return 'allow'
+	}
+
+	/**
+	 * Loads the last N successful logins for the person and scores the current
+	 * sign-in against them. Returns `allow` with no DB work when the feature is
+	 * disabled (the default), so an opted-out deployment runs exactly as before.
+	 */
+	async analyze(
+		dbContext: DatabaseContext,
+		personId: string,
+		current: LoginSignals,
+		config: Config['login']['anomalyDetection'],
+	): Promise<RiskAssessment> {
+		if (!config.enabled) {
+			return { score: 0, action: 'allow', reasons: [] }
+		}
+
+		const limit = Math.max(1, config.historySize)
+		const rows = await SelectBuilder.create<{ geo_country: string | null; device_fingerprint: string | null; ip_address: string | null }>()
+			.select(['person_auth_log', 'geo_country'])
+			.select(['person_auth_log', 'device_fingerprint'])
+			.select(['person_auth_log', 'ip_address'])
+			.from('person_auth_log')
+			.where(it =>
+				it
+					.compare(['person_auth_log', 'person_id'], Operator.eq, personId)
+					// Baseline = any successful interactive sign-in that issued a session
+					// (password / IdP / passwordless), not just password logins — otherwise
+					// a person who normally signs in via IdP/passwordless has no baseline and
+					// their rare password sign-in is wrongly treated as a trusted first login.
+					.in(['person_auth_log', 'type'], [...BASELINE_SIGN_IN_TYPES])
+					.compare(['person_auth_log', 'success'], Operator.eq, true)
+			)
+			.orderBy(['person_auth_log', 'created_at'], 'desc')
+			.limit(limit)
+			.getResult(dbContext.client)
+
+		const history: PriorLogin[] = rows.map(row => ({
+			geoCountry: row.geo_country,
+			deviceFingerprint: row.device_fingerprint,
+			ip: row.ip_address,
+		}))
+
+		return this.score(current, history, config)
+	}
+}
+
+/**
+ * Coarsens an IP to a prefix so a roaming client on the same network is treated
+ * as "known": /24 for IPv4, /48 for IPv6 (the typical site-allocation boundary).
+ * Returns null for an absent or unparseable address. Intentionally string-based
+ * to avoid pulling a parser onto the sign-in hot path, but the IPv6 form is fully
+ * canonicalized (lower-cased, leading zeros stripped, `::` expanded) so the same
+ * /48 written two different ways compares equal against stored values.
+ */
+export const ipPrefix = (ip: string | null): string | null => {
+	if (!ip) {
+		return null
+	}
+	const trimmed = ip.trim().toLowerCase()
+	if (trimmed.length === 0) {
+		return null
+	}
+	// Pure IPv4 (dotted quad, no colon) → /24.
+	if (!trimmed.includes(':')) {
+		const octets = trimmed.split('.')
+		if (octets.length === 4) {
+			return `${octets[0]}.${octets[1]}.${octets[2]}.0/24`
+		}
+		return trimmed
+	}
+	// IPv6. expandIpv6 also folds a trailing IPv4 dotted-quad (the ::ffff:a.b.c.d
+	// form, in any compressed/expanded spelling) into two hextets, so the whole
+	// address is canonicalized here in one place.
+	const hextets = expandIpv6(trimmed)
+	if (hextets === null) {
+		return trimmed
+	}
+	// IPv4-mapped IPv6 (::ffff:a.b.c.d) carries the real client IPv4 in its low 32
+	// bits → coarsen THAT to a /24. Guarded on the leading 80 bits being zero AND
+	// the 6th hextet being ffff, so a *non-mapped* address that merely ends in
+	// `:ffff:<dotted-quad>` (e.g. 2001:db8::ffff:1.2.3.4, or NAT64 64:ff9b::1.2.3.4)
+	// stays a normal IPv6 /48 instead of collapsing to a bogus, colliding /24.
+	if (hextets.slice(0, 5).every(h => parseInt(h, 16) === 0) && parseInt(hextets[5], 16) === 0xffff) {
+		const hi = parseInt(hextets[6], 16)
+		const lo = parseInt(hextets[7], 16)
+		return `${hi >> 8}.${hi & 0xff}.${lo >> 8}.0/24`
+	}
+	// Canonical /48 = the first three hextets, each with leading zeros stripped.
+	const network = hextets.slice(0, 3).map(h => parseInt(h, 16).toString(16))
+	return `${network.join(':')}::/48`
+}
+
+/**
+ * Expands an IPv6 address to its 8 hextets (as lower-case hex strings, leading
+ * zeros kept — the caller strips them). Handles a single `::` run and a trailing
+ * IPv4 dotted-quad in the low 32 bits (`x:x:x:x:x:x:d.d.d.d`, e.g. the
+ * `::ffff:a.b.c.d` mapped form), which it folds into two hextets first. Returns
+ * null for anything that does not look like a valid IPv6 address so the caller can
+ * fall back to a raw compare rather than mint a bogus prefix.
+ */
+const expandIpv6 = (value: string): string[] | null => {
+	// Fold a trailing IPv4 dotted-quad into two hextets so the rest works purely in
+	// hex groups (and a non-zero prefix before `:ffff:` is preserved as hextets,
+	// not mistaken for an IPv4-mapped address).
+	let normalized = value
+	const dotted = /^(.*:)(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(value)
+	if (dotted) {
+		const octets = [dotted[2], dotted[3], dotted[4], dotted[5]].map(Number)
+		if (octets.some(o => o > 255)) {
+			return null
+		}
+		const hi = ((octets[0] << 8) | octets[1]).toString(16)
+		const lo = ((octets[2] << 8) | octets[3]).toString(16)
+		normalized = `${dotted[1]}${hi}:${lo}`
+	}
+	const parts = normalized.split('::')
+	if (parts.length > 2) {
+		return null
+	}
+	const head = parts[0] === '' ? [] : parts[0].split(':')
+	const tail = parts.length === 2 ? (parts[1] === '' ? [] : parts[1].split(':')) : []
+	const groups = parts.length === 2
+		? [...head, ...Array(Math.max(0, 8 - head.length - tail.length)).fill('0'), ...tail]
+		: head
+	if (parts.length === 2 ? groups.length > 8 : groups.length !== 8) {
+		return null
+	}
+	if (groups.some(g => !/^[0-9a-f]{1,4}$/.test(g))) {
+		return null
+	}
+	return groups
+}

package/src/model/service/MailTemplateManager.ts

@@ -1,6 +1,6 @@
-import { AddMailTemplateCommand, RemoveMailTemplateCommand } from '../commands'
-import { MailTemplate, MailTemplateIdentifier } from '../mailing'
-import { DatabaseContext } from '../utils'
+import { AddMailTemplateCommand, RemoveMailTemplateCommand } from '../commands/index.js'
+import { MailTemplate, MailTemplateIdentifier } from '../mailing/index.js'
+import { DatabaseContext } from '../utils/index.js'
 
 export class MailTemplateManager {
 	public async addMailTemplate(dbContext: DatabaseContext, mailTemplate: MailTemplate): Promise<void> {

package/src/model/service/MembershipValidator.ts

@@ -1,4 +1,4 @@
-import { ProjectSchemaResolver } from '../type'
+import { ProjectSchemaResolver } from '../type/index.js'
 import { MembershipResolver, MembershipValidationError, MembershipValidationErrorType } from '@contember/schema-utils'
 import { Acl } from '@contember/schema'
 

package/src/model/service/OtpAuthenticator.ts

@@ -1,4 +1,4 @@
-import { Providers } from '../providers'
+import { Providers } from '../providers.js'
 import { Secret, TOTP, URI } from 'otpauth'
 
 export interface OtpData {