@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/development/src/model/commands/personToken/ResetPasswordCommand.js

@@ -10,10 +10,9 @@ class ResetPasswordCommand {
     this.token = token;
     this.password = password;
   }
-  async execute({ db, providers, bus }) {
-    const now = providers.now();
+  async execute({ db, bus }) {
     const token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, "password_reset"));
-    const tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: "token" });
+    const tokenValidationResult = validateToken({ entry: token, token: this.token, validationType: "token" });
     if (!tokenValidationResult.ok) {
       return tokenValidationResult;
     }

package/dist/development/src/model/commands/personToken/ResetPasswordCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand'\nimport { Response, ResponseOk } from '../../utils/Response'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand'\nimport { validateToken } from '../../utils'\nimport { PersonToken } from '../../type'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst now = providers.now()\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode = PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":[],"mappings":";;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6B,OAAgC,UAAkB;AAAlD,SAAA,QAAA;AAAgC,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhF,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA4D;AAC1F,UAAM,MAAM,UAAU,IAAA;AACtB,UAAM,QAAQ,MAAM,GAAG,qBAAqB,MAAM,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AACxG,UAAM,wBAAwB,cAAc,EAAE,OAAO,OAAO,OAAO,KAAK,OAAO,KAAK,gBAAgB,QAAA,CAAS;AAC7G,QAAI,CAAC,sBAAsB,IAAI;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,IAAI,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AAC7E,UAAM,IAAI,QAAQ,IAAI,sBAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAElG,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}
+{"version":3,"file":"ResetPasswordCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand.js'\nimport { Response, ResponseOk } from '../../utils/Response.js'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery.js'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand.js'\nimport { validateToken } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode = PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":[],"mappings":";;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6B,OAAgC,UAAkB;AAAlD,SAAA,QAAA;AAAgC,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhF,MAAM,QAAQ,EAAE,IAAI,OAA4D;AAC/E,UAAM,QAAQ,MAAM,GAAG,qBAAqB,MAAM,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AACxG,UAAM,wBAAwB,cAAc,EAAE,OAAO,OAAO,OAAO,KAAK,OAAO,gBAAgB,SAAS;AACxG,QAAI,CAAC,sBAAsB,IAAI;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,IAAI,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AAC7E,UAAM,IAAI,QAAQ,IAAI,sBAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAElG,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}

package/dist/development/src/model/commands/personToken/SaveEmailOtpTokenCommand.cjs

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+const time = require("../../utils/time.cjs");
+require("../../type/ApiKey.cjs");
+const token = require("../../utils/token.cjs");
+class SaveEmailOtpTokenCommand {
+  constructor(personId, code, expirationMinutes) {
+    this.personId = personId;
+    this.code = code;
+    this.expirationMinutes = expirationMinutes;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const tokenHash = token.computeTokenHash(await token.generateToken(providers));
+    const otpHash = token.computeTokenHash(this.code);
+    await Database.InsertBuilder.create().into("person_token").values({
+      id,
+      token_hash: tokenHash,
+      person_id: this.personId,
+      // expires_at on the DATABASE clock — see SavePersonTokenCommand / CLAUDE.md.
+      expires_at: new Database.Literal("now() + make_interval(secs => ?)", [this.expirationMinutes * 60]),
+      created_at: providers.now(),
+      used_at: null,
+      type: "mfa_email_otp",
+      otp_hash: otpHash
+    }).execute(db);
+    return { id, expiresAt: time.plusMinutes(providers.now(), this.expirationMinutes) };
+  }
+}
+exports.SaveEmailOtpTokenCommand = SaveEmailOtpTokenCommand;
+//# sourceMappingURL=SaveEmailOtpTokenCommand.cjs.map

package/dist/development/src/model/commands/personToken/SaveEmailOtpTokenCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"SaveEmailOtpTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SaveEmailOtpTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\n\n/**\n * Creates an `mfa_email_otp` person_token carrying a 6-digit code in `otp_hash`.\n *\n * Unlike the passwordless flow there is no magic-link step, so the code itself is\n * the only secret — it is validated via {@link validateToken}'s `'otp'` path. The\n * `token_hash` column is NOT NULL and UNIQUE, so we still fill it with a random,\n * never-used token hash to satisfy the schema.\n */\nexport class SaveEmailOtpTokenCommand implements Command<SaveEmailOtpTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly code: string,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SaveEmailOtpTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst tokenHash: TokenHash = computeTokenHash(await generateToken(providers))\n\t\tconst otpHash = computeTokenHash(this.code)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\t// expires_at on the DATABASE clock — see SavePersonTokenCommand / CLAUDE.md.\n\t\t\t\texpires_at: new Literal('now() + make_interval(secs => ?)', [this.expirationMinutes * 60]),\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: 'mfa_email_otp',\n\t\t\t\totp_hash: otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\t// Display-only approximation; the DB-clock `expires_at` column is authoritative.\n\t\treturn { id, expiresAt: plusMinutes(providers.now(), this.expirationMinutes) }\n\t}\n}\n\nnamespace SaveEmailOtpTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n"],"names":["computeTokenHash","generateToken","InsertBuilder","Literal","plusMinutes"],"mappings":";;;;;;AAaO,MAAM,yBAA6E;AAAA,EACzF,YACkB,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAqE;AACxF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAuBA,MAAAA,iBAAiB,MAAMC,MAAAA,cAAc,SAAS,CAAC;AAC5E,UAAM,UAAUD,MAAAA,iBAAiB,KAAK,IAAI;AAC1C,UAAME,SAAAA,cAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY;AAAA,MACZ,WAAW,KAAK;AAAA;AAAA,MAEhB,YAAY,IAAIC,SAAAA,QAAQ,oCAAoC,CAAC,KAAK,oBAAoB,EAAE,CAAC;AAAA,MACzF,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV,EACA,QAAQ,EAAE;AAGZ,WAAO,EAAE,IAAI,WAAWC,KAAAA,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB,EAAA;AAAA,EAC5E;AACD;;"}

package/dist/development/src/model/commands/personToken/SaveEmailOtpTokenCommand.js

@@ -0,0 +1,32 @@
+import { InsertBuilder as InsertBuilder$1, Literal } from "@contember/database";
+import { plusMinutes } from "../../utils/time.js";
+import "../../type/ApiKey.js";
+import { computeTokenHash, generateToken } from "../../utils/token.js";
+class SaveEmailOtpTokenCommand {
+  constructor(personId, code, expirationMinutes) {
+    this.personId = personId;
+    this.code = code;
+    this.expirationMinutes = expirationMinutes;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const tokenHash = computeTokenHash(await generateToken(providers));
+    const otpHash = computeTokenHash(this.code);
+    await InsertBuilder$1.create().into("person_token").values({
+      id,
+      token_hash: tokenHash,
+      person_id: this.personId,
+      // expires_at on the DATABASE clock — see SavePersonTokenCommand / CLAUDE.md.
+      expires_at: new Literal("now() + make_interval(secs => ?)", [this.expirationMinutes * 60]),
+      created_at: providers.now(),
+      used_at: null,
+      type: "mfa_email_otp",
+      otp_hash: otpHash
+    }).execute(db);
+    return { id, expiresAt: plusMinutes(providers.now(), this.expirationMinutes) };
+  }
+}
+export {
+  SaveEmailOtpTokenCommand
+};
+//# sourceMappingURL=SaveEmailOtpTokenCommand.js.map

package/dist/development/src/model/commands/personToken/SaveEmailOtpTokenCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SaveEmailOtpTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SaveEmailOtpTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\n\n/**\n * Creates an `mfa_email_otp` person_token carrying a 6-digit code in `otp_hash`.\n *\n * Unlike the passwordless flow there is no magic-link step, so the code itself is\n * the only secret — it is validated via {@link validateToken}'s `'otp'` path. The\n * `token_hash` column is NOT NULL and UNIQUE, so we still fill it with a random,\n * never-used token hash to satisfy the schema.\n */\nexport class SaveEmailOtpTokenCommand implements Command<SaveEmailOtpTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly code: string,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SaveEmailOtpTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst tokenHash: TokenHash = computeTokenHash(await generateToken(providers))\n\t\tconst otpHash = computeTokenHash(this.code)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\t// expires_at on the DATABASE clock — see SavePersonTokenCommand / CLAUDE.md.\n\t\t\t\texpires_at: new Literal('now() + make_interval(secs => ?)', [this.expirationMinutes * 60]),\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: 'mfa_email_otp',\n\t\t\t\totp_hash: otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\t// Display-only approximation; the DB-clock `expires_at` column is authoritative.\n\t\treturn { id, expiresAt: plusMinutes(providers.now(), this.expirationMinutes) }\n\t}\n}\n\nnamespace SaveEmailOtpTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;;AAaO,MAAM,yBAA6E;AAAA,EACzF,YACkB,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAqE;AACxF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAuB,iBAAiB,MAAM,cAAc,SAAS,CAAC;AAC5E,UAAM,UAAU,iBAAiB,KAAK,IAAI;AAC1C,UAAMA,gBAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY;AAAA,MACZ,WAAW,KAAK;AAAA;AAAA,MAEhB,YAAY,IAAI,QAAQ,oCAAoC,CAAC,KAAK,oBAAoB,EAAE,CAAC;AAAA,MACzF,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV,EACA,QAAQ,EAAE;AAGZ,WAAO,EAAE,IAAI,WAAW,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB,EAAA;AAAA,EAC5E;AACD;"}

package/dist/development/src/model/commands/personToken/SavePersonTokenCommand.cjs

@@ -1,27 +1,35 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
-const time = require("../../utils/time.cjs");
+const exceptions = require("../../../exceptions.cjs");
 class SavePersonTokenCommand {
-  constructor(personId, tokenHash, type, expirationMinutes) {
+  constructor(personId, tokenHash, type, expirationMinutes, meta = null) {
     this.personId = personId;
     this.tokenHash = tokenHash;
     this.type = type;
     this.expirationMinutes = expirationMinutes;
+    this.meta = meta;
   }
   async execute({ db, providers }) {
     const id = providers.uuid();
-    const expiresAt = time.plusMinutes(providers.now(), this.expirationMinutes);
-    await Database.InsertBuilder.create().into("person_token").values({
+    const result = await Database.InsertBuilder.create().into("person_token").values({
       id,
       token_hash: this.tokenHash,
+      // expires_at is computed on the DATABASE clock so the expiry gate
+      // (PersonTokenQuery's `is_expired`, evaluated against NOW()) can never be
+      // weakened by app/DB clock skew. created_at stays on the app clock — it is
+      // display/ordering only, never compared. See engine-tenant-api/CLAUDE.md.
       person_id: this.personId,
-      expires_at: expiresAt,
+      expires_at: new Database.Literal("now() + make_interval(secs => ?)", [this.expirationMinutes * 60]),
       created_at: providers.now(),
       used_at: null,
-      type: this.type
-    }).execute(db);
-    return { id, expiresAt };
+      type: this.type,
+      meta: this.meta
+    }).returning("expires_at").execute(db);
+    if (result.length !== 1) {
+      throw new exceptions.ImplementationException();
+    }
+    return { id, expiresAt: result[0].expires_at };
   }
 }
 exports.SavePersonTokenCommand = SavePersonTokenCommand;

package/dist/development/src/model/commands/personToken/SavePersonTokenCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SavePersonTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time'\nimport { TokenHash } from '../../utils'\nimport { PersonToken } from '../../type'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["plusMinutes","InsertBuilder"],"mappings":";;;;AAMA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBAChB;AAJgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAYA,KAAAA,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAMC,SAAAA,cAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,IAAA,CACX,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"SavePersonTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { TokenHash } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\nimport { JSONValue } from '@contember/schema'\nimport { ImplementationException } from '../../../exceptions.js'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t\tprivate readonly meta: JSONValue | null = null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst result = await InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\t// expires_at is computed on the DATABASE clock so the expiry gate\n\t\t\t\t// (PersonTokenQuery's `is_expired`, evaluated against NOW()) can never be\n\t\t\t\t// weakened by app/DB clock skew. created_at stays on the app clock — it is\n\t\t\t\t// display/ordering only, never compared. See engine-tenant-api/CLAUDE.md.\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: new Literal('now() + make_interval(secs => ?)', [this.expirationMinutes * 60]),\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t\tmeta: this.meta,\n\t\t\t})\n\t\t\t.returning<{ expires_at: Date }>('expires_at')\n\t\t\t.execute(db)\n\t\tif (result.length !== 1) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\treturn { id, expiresAt: result[0].expires_at }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["InsertBuilder","Literal","ImplementationException"],"mappings":";;;;AAOA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBACA,OAAyB,MACzC;AALgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AACA,SAAA,OAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjB,WAAW,KAAK;AAAA,MAChB,YAAY,IAAIC,SAAAA,QAAQ,oCAAoC,CAAC,KAAK,oBAAoB,EAAE,CAAC;AAAA,MACzF,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,IAAA,CACX,EACA,UAAgC,YAAY,EAC5C,QAAQ,EAAE;AACZ,QAAI,OAAO,WAAW,GAAG;AACxB,YAAM,IAAIC,WAAAA,wBAAA;AAAA,IACX;AACA,WAAO,EAAE,IAAI,WAAW,OAAO,CAAC,EAAE,WAAA;AAAA,EACnC;AACD;;"}

package/dist/development/src/model/commands/personToken/SavePersonTokenCommand.js

@@ -1,25 +1,33 @@
-import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
-import { plusMinutes } from "../../utils/time.js";
+import { InsertBuilder as InsertBuilder$1, Literal } from "@contember/database";
+import { ImplementationException } from "../../../exceptions.js";
 class SavePersonTokenCommand {
-  constructor(personId, tokenHash, type, expirationMinutes) {
+  constructor(personId, tokenHash, type, expirationMinutes, meta = null) {
     this.personId = personId;
     this.tokenHash = tokenHash;
     this.type = type;
     this.expirationMinutes = expirationMinutes;
+    this.meta = meta;
   }
   async execute({ db, providers }) {
     const id = providers.uuid();
-    const expiresAt = plusMinutes(providers.now(), this.expirationMinutes);
-    await InsertBuilder$1.create().into("person_token").values({
+    const result = await InsertBuilder$1.create().into("person_token").values({
       id,
       token_hash: this.tokenHash,
+      // expires_at is computed on the DATABASE clock so the expiry gate
+      // (PersonTokenQuery's `is_expired`, evaluated against NOW()) can never be
+      // weakened by app/DB clock skew. created_at stays on the app clock — it is
+      // display/ordering only, never compared. See engine-tenant-api/CLAUDE.md.
       person_id: this.personId,
-      expires_at: expiresAt,
+      expires_at: new Literal("now() + make_interval(secs => ?)", [this.expirationMinutes * 60]),
       created_at: providers.now(),
       used_at: null,
-      type: this.type
-    }).execute(db);
-    return { id, expiresAt };
+      type: this.type,
+      meta: this.meta
+    }).returning("expires_at").execute(db);
+    if (result.length !== 1) {
+      throw new ImplementationException();
+    }
+    return { id, expiresAt: result[0].expires_at };
   }
 }
 export {

package/dist/development/src/model/commands/personToken/SavePersonTokenCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"SavePersonTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time'\nimport { TokenHash } from '../../utils'\nimport { PersonToken } from '../../type'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["InsertBuilder"],"mappings":";;AAMA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBAChB;AAJgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAY,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAMA,gBAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,IAAA,CACX,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"SavePersonTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { TokenHash } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\nimport { JSONValue } from '@contember/schema'\nimport { ImplementationException } from '../../../exceptions.js'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t\tprivate readonly meta: JSONValue | null = null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst result = await InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\t// expires_at is computed on the DATABASE clock so the expiry gate\n\t\t\t\t// (PersonTokenQuery's `is_expired`, evaluated against NOW()) can never be\n\t\t\t\t// weakened by app/DB clock skew. created_at stays on the app clock — it is\n\t\t\t\t// display/ordering only, never compared. See engine-tenant-api/CLAUDE.md.\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: new Literal('now() + make_interval(secs => ?)', [this.expirationMinutes * 60]),\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t\tmeta: this.meta,\n\t\t\t})\n\t\t\t.returning<{ expires_at: Date }>('expires_at')\n\t\t\t.execute(db)\n\t\tif (result.length !== 1) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\treturn { id, expiresAt: result[0].expires_at }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["InsertBuilder"],"mappings":";;AAOA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBACA,OAAyB,MACzC;AALgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AACA,SAAA,OAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjB,WAAW,KAAK;AAAA,MAChB,YAAY,IAAI,QAAQ,oCAAoC,CAAC,KAAK,oBAAoB,EAAE,CAAC;AAAA,MACzF,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,IAAA,CACX,EACA,UAAgC,YAAY,EAC5C,QAAQ,EAAE;AACZ,QAAI,OAAO,WAAW,GAAG;AACxB,YAAM,IAAI,wBAAA;AAAA,IACX;AACA,WAAO,EAAE,IAAI,WAAW,OAAO,CAAC,EAAE,WAAA;AAAA,EACnC;AACD;"}

package/dist/development/src/model/commands/project/CreateProjectCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateProjectCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/CreateProjectCommand.ts"],"sourcesContent":["import { InsertBuilder } from '@contember/database'\nimport { Command } from '../Command'\nimport { Project } from '../../type'\nimport { ConflictActionType } from '@contember/database'\n\nexport class CreateProjectCommand implements Command<string | null> {\n\tconstructor(private readonly project: Pick<Project, 'name' | 'slug' | 'config'>, private readonly timestamp: Date) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string | null> {\n\t\tconst id = providers.uuid()\n\t\tconst result = await InsertBuilder.create()\n\t\t\t.into('project')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\tname: this.project.name,\n\t\t\t\tslug: this.project.slug,\n\t\t\t\tconfig: this.project.config as any,\n\t\t\t\tupdated_at: this.timestamp,\n\t\t\t})\n\t\t\t.onConflict(ConflictActionType.doNothing)\n\t\t\t.execute(db)\n\t\treturn result > 0 ? id : null\n\t}\n}\n"],"names":["InsertBuilder","ConflictActionType"],"mappings":";;;AAKO,MAAM,qBAAuD;AAAA,EACnE,YAA6B,SAAqE,WAAiB;AAAtF,SAAA,UAAA;AAAqE,SAAA,YAAA;AAAA,EAAkB;AAAA,EAEpH,MAAa,QAAQ,EAAE,IAAI,aAAmD;AAC7E,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,KAAK,SAAS,EACd,OAAO;AAAA,MACP;AAAA,MACA,MAAM,KAAK,QAAQ;AAAA,MACnB,MAAM,KAAK,QAAQ;AAAA,MACnB,QAAQ,KAAK,QAAQ;AAAA,MACrB,YAAY,KAAK;AAAA,IAAA,CACjB,EACA,WAAWC,SAAAA,mBAAmB,SAAS,EACvC,QAAQ,EAAE;AACZ,WAAO,SAAS,IAAI,KAAK;AAAA,EAC1B;AACD;;"}
+{"version":3,"file":"CreateProjectCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/CreateProjectCommand.ts"],"sourcesContent":["import { InsertBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\nimport { Project } from '../../type/index.js'\nimport { ConflictActionType } from '@contember/database'\n\nexport class CreateProjectCommand implements Command<string | null> {\n\tconstructor(private readonly project: Pick<Project, 'name' | 'slug' | 'config'>, private readonly timestamp: Date) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string | null> {\n\t\tconst id = providers.uuid()\n\t\tconst result = await InsertBuilder.create()\n\t\t\t.into('project')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\tname: this.project.name,\n\t\t\t\tslug: this.project.slug,\n\t\t\t\tconfig: this.project.config as any,\n\t\t\t\tupdated_at: this.timestamp,\n\t\t\t})\n\t\t\t.onConflict(ConflictActionType.doNothing)\n\t\t\t.execute(db)\n\t\treturn result > 0 ? id : null\n\t}\n}\n"],"names":["InsertBuilder","ConflictActionType"],"mappings":";;;AAKO,MAAM,qBAAuD;AAAA,EACnE,YAA6B,SAAqE,WAAiB;AAAtF,SAAA,UAAA;AAAqE,SAAA,YAAA;AAAA,EAAkB;AAAA,EAEpH,MAAa,QAAQ,EAAE,IAAI,aAAmD;AAC7E,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,KAAK,SAAS,EACd,OAAO;AAAA,MACP;AAAA,MACA,MAAM,KAAK,QAAQ;AAAA,MACnB,MAAM,KAAK,QAAQ;AAAA,MACnB,QAAQ,KAAK,QAAQ;AAAA,MACrB,YAAY,KAAK;AAAA,IAAA,CACjB,EACA,WAAWC,SAAAA,mBAAmB,SAAS,EACvC,QAAQ,EAAE;AACZ,WAAO,SAAS,IAAI,KAAK;AAAA,EAC1B;AACD;;"}

package/dist/development/src/model/commands/project/CreateProjectCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateProjectCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/CreateProjectCommand.ts"],"sourcesContent":["import { InsertBuilder } from '@contember/database'\nimport { Command } from '../Command'\nimport { Project } from '../../type'\nimport { ConflictActionType } from '@contember/database'\n\nexport class CreateProjectCommand implements Command<string | null> {\n\tconstructor(private readonly project: Pick<Project, 'name' | 'slug' | 'config'>, private readonly timestamp: Date) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string | null> {\n\t\tconst id = providers.uuid()\n\t\tconst result = await InsertBuilder.create()\n\t\t\t.into('project')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\tname: this.project.name,\n\t\t\t\tslug: this.project.slug,\n\t\t\t\tconfig: this.project.config as any,\n\t\t\t\tupdated_at: this.timestamp,\n\t\t\t})\n\t\t\t.onConflict(ConflictActionType.doNothing)\n\t\t\t.execute(db)\n\t\treturn result > 0 ? id : null\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAKO,MAAM,qBAAuD;AAAA,EACnE,YAA6B,SAAqE,WAAiB;AAAtF,SAAA,UAAA;AAAqE,SAAA,YAAA;AAAA,EAAkB;AAAA,EAEpH,MAAa,QAAQ,EAAE,IAAI,aAAmD;AAC7E,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,KAAK,SAAS,EACd,OAAO;AAAA,MACP;AAAA,MACA,MAAM,KAAK,QAAQ;AAAA,MACnB,MAAM,KAAK,QAAQ;AAAA,MACnB,QAAQ,KAAK,QAAQ;AAAA,MACrB,YAAY,KAAK;AAAA,IAAA,CACjB,EACA,WAAW,mBAAmB,SAAS,EACvC,QAAQ,EAAE;AACZ,WAAO,SAAS,IAAI,KAAK;AAAA,EAC1B;AACD;"}
+{"version":3,"file":"CreateProjectCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/CreateProjectCommand.ts"],"sourcesContent":["import { InsertBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\nimport { Project } from '../../type/index.js'\nimport { ConflictActionType } from '@contember/database'\n\nexport class CreateProjectCommand implements Command<string | null> {\n\tconstructor(private readonly project: Pick<Project, 'name' | 'slug' | 'config'>, private readonly timestamp: Date) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<string | null> {\n\t\tconst id = providers.uuid()\n\t\tconst result = await InsertBuilder.create()\n\t\t\t.into('project')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\tname: this.project.name,\n\t\t\t\tslug: this.project.slug,\n\t\t\t\tconfig: this.project.config as any,\n\t\t\t\tupdated_at: this.timestamp,\n\t\t\t})\n\t\t\t.onConflict(ConflictActionType.doNothing)\n\t\t\t.execute(db)\n\t\treturn result > 0 ? id : null\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAKO,MAAM,qBAAuD;AAAA,EACnE,YAA6B,SAAqE,WAAiB;AAAtF,SAAA,UAAA;AAAqE,SAAA,YAAA;AAAA,EAAkB;AAAA,EAEpH,MAAa,QAAQ,EAAE,IAAI,aAAmD;AAC7E,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,KAAK,SAAS,EACd,OAAO;AAAA,MACP;AAAA,MACA,MAAM,KAAK,QAAQ;AAAA,MACnB,MAAM,KAAK,QAAQ;AAAA,MACnB,QAAQ,KAAK,QAAQ;AAAA,MACrB,YAAY,KAAK;AAAA,IAAA,CACjB,EACA,WAAW,mBAAmB,SAAS,EACvC,QAAQ,EAAE;AACZ,WAAO,SAAS,IAAI,KAAK;AAAA,EAC1B;AACD;"}

package/dist/development/src/model/commands/project/SetProjectSecretCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SetProjectSecretCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/SetProjectSecretCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ConflictActionType, InsertBuilder } from '@contember/database'\n\nexport class SetProjectSecretCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private key: string, private value: Buffer) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst id = providers.uuid()\n\t\tconst { value, version } = await providers.encrypt(this.value)\n\t\tconst qb = InsertBuilder.create()\n\t\t\t.into('project_secret')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tkey: this.key,\n\t\t\t\tvalue,\n\t\t\t\tversion,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.onConflict(ConflictActionType.update, ['project_id', 'key'], {\n\t\t\t\tvalue,\n\t\t\t\tversion,\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["InsertBuilder","ConflictActionType"],"mappings":";;;AAGO,MAAM,wBAAiD;AAAA,EAC7D,YAA6B,WAA2B,KAAqB,OAAe;AAA/D,SAAA,YAAA;AAA2B,SAAA,MAAA;AAAqB,SAAA,QAAA;AAAA,EAAgB;AAAA,EAE7F,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,EAAE,OAAO,QAAA,IAAY,MAAM,UAAU,QAAQ,KAAK,KAAK;AAC7D,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,KAAK,gBAAgB,EACrB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,KAAK,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,WAAWC,SAAAA,mBAAmB,QAAQ,CAAC,cAAc,KAAK,GAAG;AAAA,MAC7D;AAAA,MACA;AAAA,MACA,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B;AACF,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}
+{"version":3,"file":"SetProjectSecretCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/SetProjectSecretCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConflictActionType, InsertBuilder } from '@contember/database'\n\nexport class SetProjectSecretCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private key: string, private value: Buffer) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst id = providers.uuid()\n\t\tconst { value, version } = await providers.encrypt(this.value)\n\t\tconst qb = InsertBuilder.create()\n\t\t\t.into('project_secret')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tkey: this.key,\n\t\t\t\tvalue,\n\t\t\t\tversion,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.onConflict(ConflictActionType.update, ['project_id', 'key'], {\n\t\t\t\tvalue,\n\t\t\t\tversion,\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["InsertBuilder","ConflictActionType"],"mappings":";;;AAGO,MAAM,wBAAiD;AAAA,EAC7D,YAA6B,WAA2B,KAAqB,OAAe;AAA/D,SAAA,YAAA;AAA2B,SAAA,MAAA;AAAqB,SAAA,QAAA;AAAA,EAAgB;AAAA,EAE7F,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,EAAE,OAAO,QAAA,IAAY,MAAM,UAAU,QAAQ,KAAK,KAAK;AAC7D,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,KAAK,gBAAgB,EACrB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,KAAK,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,WAAWC,SAAAA,mBAAmB,QAAQ,CAAC,cAAc,KAAK,GAAG;AAAA,MAC7D;AAAA,MACA;AAAA,MACA,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B;AACF,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}

package/dist/development/src/model/commands/project/SetProjectSecretCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"SetProjectSecretCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/SetProjectSecretCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ConflictActionType, InsertBuilder } from '@contember/database'\n\nexport class SetProjectSecretCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private key: string, private value: Buffer) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst id = providers.uuid()\n\t\tconst { value, version } = await providers.encrypt(this.value)\n\t\tconst qb = InsertBuilder.create()\n\t\t\t.into('project_secret')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tkey: this.key,\n\t\t\t\tvalue,\n\t\t\t\tversion,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.onConflict(ConflictActionType.update, ['project_id', 'key'], {\n\t\t\t\tvalue,\n\t\t\t\tversion,\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAGO,MAAM,wBAAiD;AAAA,EAC7D,YAA6B,WAA2B,KAAqB,OAAe;AAA/D,SAAA,YAAA;AAA2B,SAAA,MAAA;AAAqB,SAAA,QAAA;AAAA,EAAgB;AAAA,EAE7F,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,EAAE,OAAO,QAAA,IAAY,MAAM,UAAU,QAAQ,KAAK,KAAK;AAC7D,UAAM,KAAKA,gBAAc,OAAA,EACvB,KAAK,gBAAgB,EACrB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,KAAK,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,WAAW,mBAAmB,QAAQ,CAAC,cAAc,KAAK,GAAG;AAAA,MAC7D;AAAA,MACA;AAAA,MACA,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B;AACF,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}
+{"version":3,"file":"SetProjectSecretCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/SetProjectSecretCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConflictActionType, InsertBuilder } from '@contember/database'\n\nexport class SetProjectSecretCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private key: string, private value: Buffer) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst id = providers.uuid()\n\t\tconst { value, version } = await providers.encrypt(this.value)\n\t\tconst qb = InsertBuilder.create()\n\t\t\t.into('project_secret')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tkey: this.key,\n\t\t\t\tvalue,\n\t\t\t\tversion,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.onConflict(ConflictActionType.update, ['project_id', 'key'], {\n\t\t\t\tvalue,\n\t\t\t\tversion,\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAGO,MAAM,wBAAiD;AAAA,EAC7D,YAA6B,WAA2B,KAAqB,OAAe;AAA/D,SAAA,YAAA;AAA2B,SAAA,MAAA;AAAqB,SAAA,QAAA;AAAA,EAAgB;AAAA,EAE7F,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,EAAE,OAAO,QAAA,IAAY,MAAM,UAAU,QAAQ,KAAK,KAAK;AAC7D,UAAM,KAAKA,gBAAc,OAAA,EACvB,KAAK,gBAAgB,EACrB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,KAAK,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,WAAW,mBAAmB,QAAQ,CAAC,cAAc,KAAK,GAAG;AAAA,MAC7D;AAAA,MACA;AAAA,MACA,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B;AACF,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}

package/dist/development/src/model/commands/project/UpdateProjectCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/UpdateProjectCommand.ts"],"sourcesContent":["import { QueryBuilder, UpdateBuilder } from '@contember/database'\nimport { Command } from '../Command'\nimport { Project } from '../../type'\n\nexport class UpdateProjectCommand implements Command<void> {\n\tconstructor(private projectId: string, private readonly data: Partial<Pick<Project, 'name' | 'config'>>) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst values: QueryBuilder.Values = {\n\t\t\tupdated_at: 'now',\n\t\t}\n\t\tif (this.data.config !== undefined) {\n\t\t\tvalues.config = this.data.config as any\n\t\t}\n\t\tif (this.data.name !== undefined) {\n\t\t\tvalues.name = this.data.name\n\t\t}\n\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('project')\n\t\t\t.values(values)\n\t\t\t.where({\n\t\t\t\tid: this.projectId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAIO,MAAM,qBAA8C;AAAA,EAC1D,YAAoB,WAAoC,MAAiD;AAArF,SAAA,YAAA;AAAoC,SAAA,OAAA;AAAA,EAAkD;AAAA,EAE1G,MAAa,QAAQ,EAAE,IAAI,aAA0C;AACpE,UAAM,SAA8B;AAAA,MACnC,YAAY;AAAA,IAAA;AAEb,QAAI,KAAK,KAAK,WAAW,QAAW;AACnC,aAAO,SAAS,KAAK,KAAK;AAAA,IAC3B;AACA,QAAI,KAAK,KAAK,SAAS,QAAW;AACjC,aAAO,OAAO,KAAK,KAAK;AAAA,IACzB;AAEA,UAAMA,SAAAA,cAAc,SAClB,MAAM,SAAS,EACf,OAAO,MAAM,EACb,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"UpdateProjectCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/UpdateProjectCommand.ts"],"sourcesContent":["import { QueryBuilder, UpdateBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\nimport { Project } from '../../type/index.js'\n\nexport class UpdateProjectCommand implements Command<void> {\n\tconstructor(private projectId: string, private readonly data: Partial<Pick<Project, 'name' | 'config'>>) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst values: QueryBuilder.Values = {\n\t\t\tupdated_at: 'now',\n\t\t}\n\t\tif (this.data.config !== undefined) {\n\t\t\tvalues.config = this.data.config as any\n\t\t}\n\t\tif (this.data.name !== undefined) {\n\t\t\tvalues.name = this.data.name\n\t\t}\n\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('project')\n\t\t\t.values(values)\n\t\t\t.where({\n\t\t\t\tid: this.projectId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAIO,MAAM,qBAA8C;AAAA,EAC1D,YAAoB,WAAoC,MAAiD;AAArF,SAAA,YAAA;AAAoC,SAAA,OAAA;AAAA,EAAkD;AAAA,EAE1G,MAAa,QAAQ,EAAE,IAAI,aAA0C;AACpE,UAAM,SAA8B;AAAA,MACnC,YAAY;AAAA,IAAA;AAEb,QAAI,KAAK,KAAK,WAAW,QAAW;AACnC,aAAO,SAAS,KAAK,KAAK;AAAA,IAC3B;AACA,QAAI,KAAK,KAAK,SAAS,QAAW;AACjC,aAAO,OAAO,KAAK,KAAK;AAAA,IACzB;AAEA,UAAMA,SAAAA,cAAc,SAClB,MAAM,SAAS,EACf,OAAO,MAAM,EACb,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/project/UpdateProjectCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/UpdateProjectCommand.ts"],"sourcesContent":["import { QueryBuilder, UpdateBuilder } from '@contember/database'\nimport { Command } from '../Command'\nimport { Project } from '../../type'\n\nexport class UpdateProjectCommand implements Command<void> {\n\tconstructor(private projectId: string, private readonly data: Partial<Pick<Project, 'name' | 'config'>>) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst values: QueryBuilder.Values = {\n\t\t\tupdated_at: 'now',\n\t\t}\n\t\tif (this.data.config !== undefined) {\n\t\t\tvalues.config = this.data.config as any\n\t\t}\n\t\tif (this.data.name !== undefined) {\n\t\t\tvalues.name = this.data.name\n\t\t}\n\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('project')\n\t\t\t.values(values)\n\t\t\t.where({\n\t\t\t\tid: this.projectId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAIO,MAAM,qBAA8C;AAAA,EAC1D,YAAoB,WAAoC,MAAiD;AAArF,SAAA,YAAA;AAAoC,SAAA,OAAA;AAAA,EAAkD;AAAA,EAE1G,MAAa,QAAQ,EAAE,IAAI,aAA0C;AACpE,UAAM,SAA8B;AAAA,MACnC,YAAY;AAAA,IAAA;AAEb,QAAI,KAAK,KAAK,WAAW,QAAW;AACnC,aAAO,SAAS,KAAK,KAAK;AAAA,IAC3B;AACA,QAAI,KAAK,KAAK,SAAS,QAAW;AACjC,aAAO,OAAO,KAAK,KAAK;AAAA,IACzB;AAEA,UAAMA,gBAAc,SAClB,MAAM,SAAS,EACf,OAAO,MAAM,EACb,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"UpdateProjectCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/project/UpdateProjectCommand.ts"],"sourcesContent":["import { QueryBuilder, UpdateBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\nimport { Project } from '../../type/index.js'\n\nexport class UpdateProjectCommand implements Command<void> {\n\tconstructor(private projectId: string, private readonly data: Partial<Pick<Project, 'name' | 'config'>>) {}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst values: QueryBuilder.Values = {\n\t\t\tupdated_at: 'now',\n\t\t}\n\t\tif (this.data.config !== undefined) {\n\t\t\tvalues.config = this.data.config as any\n\t\t}\n\t\tif (this.data.name !== undefined) {\n\t\t\tvalues.name = this.data.name\n\t\t}\n\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('project')\n\t\t\t.values(values)\n\t\t\t.where({\n\t\t\t\tid: this.projectId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAIO,MAAM,qBAA8C;AAAA,EAC1D,YAAoB,WAAoC,MAAiD;AAArF,SAAA,YAAA;AAAoC,SAAA,OAAA;AAAA,EAAkD;AAAA,EAE1G,MAAa,QAAQ,EAAE,IAAI,aAA0C;AACpE,UAAM,SAA8B;AAAA,MACnC,YAAY;AAAA,IAAA;AAEb,QAAI,KAAK,KAAK,WAAW,QAAW;AACnC,aAAO,SAAS,KAAK,KAAK;AAAA,IAC3B;AACA,QAAI,KAAK,KAAK,SAAS,QAAW;AACjC,aAAO,OAAO,KAAK,KAAK;AAAA,IACzB;AAEA,UAAMA,gBAAc,SAClB,MAAM,SAAS,EACf,OAAO,MAAM,EACb,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/rateLimit/RecordRateLimitEventCommand.cjs

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class RecordRateLimitEventCommand {
+  constructor(scope, keyHash) {
+    this.scope = scope;
+    this.keyHash = keyHash;
+  }
+  async execute({ db, providers }) {
+    await Database.InsertBuilder.create().into("rate_limit_event").values({
+      id: providers.uuid(),
+      scope: this.scope,
+      key_hash: this.keyHash
+    }).execute(db);
+  }
+}
+exports.RecordRateLimitEventCommand = RecordRateLimitEventCommand;
+//# sourceMappingURL=RecordRateLimitEventCommand.cjs.map

package/dist/development/src/model/commands/rateLimit/RecordRateLimitEventCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecordRateLimitEventCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/rateLimit/RecordRateLimitEventCommand.ts"],"sourcesContent":["import { InsertBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RecordRateLimitEventCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\t// occurred_at is left to its DB default (NOW()) so every rate-limit\n\t\t// timestamp is on the database clock — the same clock the window is counted\n\t\t// against (see RateLimitCountQuery). Never stamp it from the app clock.\n\t\tawait InsertBuilder.create()\n\t\t\t.into('rate_limit_event')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tscope: this.scope,\n\t\t\t\tkey_hash: this.keyHash,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,4BAAqD;AAAA,EACjE,YACkB,OACA,SAChB;AAFgB,SAAA,QAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAI7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,kBAAkB,EACvB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,IAAA,CACf,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/rateLimit/RecordRateLimitEventCommand.js

@@ -0,0 +1,18 @@
+import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+class RecordRateLimitEventCommand {
+  constructor(scope, keyHash) {
+    this.scope = scope;
+    this.keyHash = keyHash;
+  }
+  async execute({ db, providers }) {
+    await InsertBuilder$1.create().into("rate_limit_event").values({
+      id: providers.uuid(),
+      scope: this.scope,
+      key_hash: this.keyHash
+    }).execute(db);
+  }
+}
+export {
+  RecordRateLimitEventCommand
+};
+//# sourceMappingURL=RecordRateLimitEventCommand.js.map

package/dist/development/src/model/commands/rateLimit/RecordRateLimitEventCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RecordRateLimitEventCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/rateLimit/RecordRateLimitEventCommand.ts"],"sourcesContent":["import { InsertBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RecordRateLimitEventCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\t// occurred_at is left to its DB default (NOW()) so every rate-limit\n\t\t// timestamp is on the database clock — the same clock the window is counted\n\t\t// against (see RateLimitCountQuery). Never stamp it from the app clock.\n\t\tawait InsertBuilder.create()\n\t\t\t.into('rate_limit_event')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tscope: this.scope,\n\t\t\t\tkey_hash: this.keyHash,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,4BAAqD;AAAA,EACjE,YACkB,OACA,SAChB;AAFgB,SAAA,QAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAI7D,UAAMA,gBAAc,OAAA,EAClB,KAAK,kBAAkB,EACvB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,IAAA,CACf,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/consts/expirations.cjs

@@ -2,6 +2,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const PASSWORD_RESET_EXPIRATION_MINUTES = 60;
 const INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = 60 * 24;
+const EMAIL_VERIFICATION_EXPIRATION_MINUTES = 60 * 24;
+const EMAIL_CHANGE_EXPIRATION_MINUTES = 60 * 24;
+exports.EMAIL_CHANGE_EXPIRATION_MINUTES = EMAIL_CHANGE_EXPIRATION_MINUTES;
+exports.EMAIL_VERIFICATION_EXPIRATION_MINUTES = EMAIL_VERIFICATION_EXPIRATION_MINUTES;
 exports.INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = INVITATION_RESET_TOKEN_EXPIRATION_MINUTES;
 exports.PASSWORD_RESET_EXPIRATION_MINUTES = PASSWORD_RESET_EXPIRATION_MINUTES;
 //# sourceMappingURL=expirations.cjs.map

package/dist/development/src/model/consts/expirations.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"expirations.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/consts/expirations.ts"],"sourcesContent":["export const PASSWORD_RESET_EXPIRATION_MINUTES = 60\nexport const INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = 60 * 24\n"],"names":[],"mappings":";;AAAO,MAAM,oCAAoC;AAC1C,MAAM,4CAA4C,KAAK;;;"}
+{"version":3,"file":"expirations.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/consts/expirations.ts"],"sourcesContent":["export const PASSWORD_RESET_EXPIRATION_MINUTES = 60\nexport const INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = 60 * 24\nexport const EMAIL_VERIFICATION_EXPIRATION_MINUTES = 60 * 24\nexport const EMAIL_CHANGE_EXPIRATION_MINUTES = 60 * 24\n"],"names":[],"mappings":";;AAAO,MAAM,oCAAoC;AAC1C,MAAM,4CAA4C,KAAK;AACvD,MAAM,wCAAwC,KAAK;AACnD,MAAM,kCAAkC,KAAK;;;;;"}

package/dist/development/src/model/consts/expirations.js

@@ -1,6 +1,10 @@
 const PASSWORD_RESET_EXPIRATION_MINUTES = 60;
 const INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = 60 * 24;
+const EMAIL_VERIFICATION_EXPIRATION_MINUTES = 60 * 24;
+const EMAIL_CHANGE_EXPIRATION_MINUTES = 60 * 24;
 export {
+  EMAIL_CHANGE_EXPIRATION_MINUTES,
+  EMAIL_VERIFICATION_EXPIRATION_MINUTES,
   INVITATION_RESET_TOKEN_EXPIRATION_MINUTES,
   PASSWORD_RESET_EXPIRATION_MINUTES
 };

package/dist/development/src/model/consts/expirations.js.map

@@ -1 +1 @@
-{"version":3,"file":"expirations.js","sources":["../../../../../../packages/engine-tenant-api/src/model/consts/expirations.ts"],"sourcesContent":["export const PASSWORD_RESET_EXPIRATION_MINUTES = 60\nexport const INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = 60 * 24\n"],"names":[],"mappings":"AAAO,MAAM,oCAAoC;AAC1C,MAAM,4CAA4C,KAAK;"}
+{"version":3,"file":"expirations.js","sources":["../../../../../../packages/engine-tenant-api/src/model/consts/expirations.ts"],"sourcesContent":["export const PASSWORD_RESET_EXPIRATION_MINUTES = 60\nexport const INVITATION_RESET_TOKEN_EXPIRATION_MINUTES = 60 * 24\nexport const EMAIL_VERIFICATION_EXPIRATION_MINUTES = 60 * 24\nexport const EMAIL_CHANGE_EXPIRATION_MINUTES = 60 * 24\n"],"names":[],"mappings":"AAAO,MAAM,oCAAoC;AAC1C,MAAM,4CAA4C,KAAK;AACvD,MAAM,wCAAwC,KAAK;AACnD,MAAM,kCAAkC,KAAK;"}

package/dist/development/src/model/dtos/Password.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"Password.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/dtos/Password.ts"],"sourcesContent":["import { Providers } from '../providers'\n\nexport type MaybePassword = Password | typeof NoPassword\n\nexport const NoPassword = {\n\tgetPlain: () => null,\n\tgetHash: () => null,\n}\n\nexport interface Password {\n\tgetPlain(): string | null\n\n\tgetHash(providers: Providers): Promise<string>\n}\n\nexport class PasswordHash implements Password {\n\tconstructor(private readonly hash: string) {\n\t}\n\n\tgetHash(providers: Providers): Promise<string> {\n\t\treturn Promise.resolve(this.hash)\n\t}\n\n\tgetPlain(): string | null {\n\t\treturn null\n\t}\n}\n\nexport class PasswordPlain implements Password {\n\tconstructor(private readonly plain: string) {\n\t}\n\n\tgetHash(providers: Providers) {\n\t\treturn providers.bcrypt(this.plain)\n\t}\n\n\tgetPlain() {\n\t\treturn this.plain\n\t}\n}\n"],"names":[],"mappings":";;AAIO,MAAM,aAAa;AAAA,EACzB,UAAU,MAAM;AAAA,EAChB,SAAS,MAAM;AAChB;AAQO,MAAM,aAAiC;AAAA,EAC7C,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,WAAuC;AAC9C,WAAO,QAAQ,QAAQ,KAAK,IAAI;AAAA,EACjC;AAAA,EAEA,WAA0B;AACzB,WAAO;AAAA,EACR;AACD;AAEO,MAAM,cAAkC;AAAA,EAC9C,YAA6B,OAAe;AAAf,SAAA,QAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,WAAsB;AAC7B,WAAO,UAAU,OAAO,KAAK,KAAK;AAAA,EACnC;AAAA,EAEA,WAAW;AACV,WAAO,KAAK;AAAA,EACb;AACD;;;;"}
+{"version":3,"file":"Password.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/dtos/Password.ts"],"sourcesContent":["import { Providers } from '../providers.js'\n\nexport type MaybePassword = Password | typeof NoPassword\n\nexport const NoPassword = {\n\tgetPlain: () => null,\n\tgetHash: () => null,\n}\n\nexport interface Password {\n\tgetPlain(): string | null\n\n\tgetHash(providers: Providers): Promise<string>\n}\n\nexport class PasswordHash implements Password {\n\tconstructor(private readonly hash: string) {\n\t}\n\n\tgetHash(providers: Providers): Promise<string> {\n\t\treturn Promise.resolve(this.hash)\n\t}\n\n\tgetPlain(): string | null {\n\t\treturn null\n\t}\n}\n\nexport class PasswordPlain implements Password {\n\tconstructor(private readonly plain: string) {\n\t}\n\n\tgetHash(providers: Providers) {\n\t\treturn providers.bcrypt(this.plain)\n\t}\n\n\tgetPlain() {\n\t\treturn this.plain\n\t}\n}\n"],"names":[],"mappings":";;AAIO,MAAM,aAAa;AAAA,EACzB,UAAU,MAAM;AAAA,EAChB,SAAS,MAAM;AAChB;AAQO,MAAM,aAAiC;AAAA,EAC7C,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,WAAuC;AAC9C,WAAO,QAAQ,QAAQ,KAAK,IAAI;AAAA,EACjC;AAAA,EAEA,WAA0B;AACzB,WAAO;AAAA,EACR;AACD;AAEO,MAAM,cAAkC;AAAA,EAC9C,YAA6B,OAAe;AAAf,SAAA,QAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,WAAsB;AAC7B,WAAO,UAAU,OAAO,KAAK,KAAK;AAAA,EACnC;AAAA,EAEA,WAAW;AACV,WAAO,KAAK;AAAA,EACb;AACD;;;;"}

package/dist/development/src/model/dtos/Password.js.map

@@ -1 +1 @@
-{"version":3,"file":"Password.js","sources":["../../../../../../packages/engine-tenant-api/src/model/dtos/Password.ts"],"sourcesContent":["import { Providers } from '../providers'\n\nexport type MaybePassword = Password | typeof NoPassword\n\nexport const NoPassword = {\n\tgetPlain: () => null,\n\tgetHash: () => null,\n}\n\nexport interface Password {\n\tgetPlain(): string | null\n\n\tgetHash(providers: Providers): Promise<string>\n}\n\nexport class PasswordHash implements Password {\n\tconstructor(private readonly hash: string) {\n\t}\n\n\tgetHash(providers: Providers): Promise<string> {\n\t\treturn Promise.resolve(this.hash)\n\t}\n\n\tgetPlain(): string | null {\n\t\treturn null\n\t}\n}\n\nexport class PasswordPlain implements Password {\n\tconstructor(private readonly plain: string) {\n\t}\n\n\tgetHash(providers: Providers) {\n\t\treturn providers.bcrypt(this.plain)\n\t}\n\n\tgetPlain() {\n\t\treturn this.plain\n\t}\n}\n"],"names":[],"mappings":"AAIO,MAAM,aAAa;AAAA,EACzB,UAAU,MAAM;AAAA,EAChB,SAAS,MAAM;AAChB;AAQO,MAAM,aAAiC;AAAA,EAC7C,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,WAAuC;AAC9C,WAAO,QAAQ,QAAQ,KAAK,IAAI;AAAA,EACjC;AAAA,EAEA,WAA0B;AACzB,WAAO;AAAA,EACR;AACD;AAEO,MAAM,cAAkC;AAAA,EAC9C,YAA6B,OAAe;AAAf,SAAA,QAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,WAAsB;AAC7B,WAAO,UAAU,OAAO,KAAK,KAAK;AAAA,EACnC;AAAA,EAEA,WAAW;AACV,WAAO,KAAK;AAAA,EACb;AACD;"}
+{"version":3,"file":"Password.js","sources":["../../../../../../packages/engine-tenant-api/src/model/dtos/Password.ts"],"sourcesContent":["import { Providers } from '../providers.js'\n\nexport type MaybePassword = Password | typeof NoPassword\n\nexport const NoPassword = {\n\tgetPlain: () => null,\n\tgetHash: () => null,\n}\n\nexport interface Password {\n\tgetPlain(): string | null\n\n\tgetHash(providers: Providers): Promise<string>\n}\n\nexport class PasswordHash implements Password {\n\tconstructor(private readonly hash: string) {\n\t}\n\n\tgetHash(providers: Providers): Promise<string> {\n\t\treturn Promise.resolve(this.hash)\n\t}\n\n\tgetPlain(): string | null {\n\t\treturn null\n\t}\n}\n\nexport class PasswordPlain implements Password {\n\tconstructor(private readonly plain: string) {\n\t}\n\n\tgetHash(providers: Providers) {\n\t\treturn providers.bcrypt(this.plain)\n\t}\n\n\tgetPlain() {\n\t\treturn this.plain\n\t}\n}\n"],"names":[],"mappings":"AAIO,MAAM,aAAa;AAAA,EACzB,UAAU,MAAM;AAAA,EAChB,SAAS,MAAM;AAChB;AAQO,MAAM,aAAiC;AAAA,EAC7C,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,WAAuC;AAC9C,WAAO,QAAQ,QAAQ,KAAK,IAAI;AAAA,EACjC;AAAA,EAEA,WAA0B;AACzB,WAAO;AAAA,EACR;AACD;AAEO,MAAM,cAAkC;AAAA,EAC9C,YAA6B,OAAe;AAAf,SAAA,QAAA;AAAA,EAC7B;AAAA,EAEA,QAAQ,WAAsB;AAC7B,WAAO,UAAU,OAAO,KAAK,KAAK;AAAA,EACnC;AAAA,EAEA,WAAW;AACV,WAAO,KAAK;AAAA,EACb;AACD;"}

package/dist/development/src/model/mailing/UserMailer.cjs

@@ -4,14 +4,23 @@ const NewUserInvited_mustache = require("./templates/NewUserInvited.mustache.cjs
 const ExistingUserInvited_mustache = require("./templates/ExistingUserInvited.mustache.cjs");
 const PasswordReset_mustache = require("./templates/PasswordReset.mustache.cjs");
 const PasswordlessSignIn_mustache = require("./templates/PasswordlessSignIn.mustache.cjs");
+const EmailOtp_mustache = require("./templates/EmailOtp.mustache.cjs");
+const ForcedSignOut_mustache = require("./templates/ForcedSignOut.mustache.cjs");
+const BackupCodesExhausted_mustache = require("./templates/BackupCodesExhausted.mustache.cjs");
+const EmailVerification_mustache = require("./templates/EmailVerification.mustache.cjs");
+const EmailChangeVerify_mustache = require("./templates/EmailChangeVerify.mustache.cjs");
+const EmailChangeNotify_mustache = require("./templates/EmailChangeNotify.mustache.cjs");
+const UnusualLogin_mustache = require("./templates/UnusualLogin.mustache.cjs");
 const type = require("./type.cjs");
 require("../queries/apiKey/ApiKeyQuery.cjs");
 require("@contember/database");
+require("../type/ApiKey.cjs");
 const MailTemplateQuery = require("../queries/mailTemplate/MailTemplateQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 const Layout_mustache = require("./templates/Layout.mustache.cjs");
 class UserMailer {
@@ -46,6 +55,42 @@ class UserMailer {
     };
     await this.sendMail(templateId, template, mailArguments);
   }
+  async sendForcedSignOutEmail(dbContext, mailArguments, customMailOptions) {
+    const templateId = { type: type.MailType.forcedSignOut, ...customMailOptions };
+    const template = await this.getCustomTemplate(dbContext, templateId) || {
+      subject: "Your sessions have been signed out",
+      content: ForcedSignOut_mustache,
+      replyTo: null
+    };
+    await this.sendMail(templateId, template, mailArguments);
+  }
+  async sendEmailVerificationEmail(dbContext, mailArguments, customMailOptions) {
+    const templateId = { type: type.MailType.emailVerification, ...customMailOptions };
+    const template = await this.getCustomTemplate(dbContext, templateId) || {
+      subject: "Verify your e-mail address",
+      content: EmailVerification_mustache,
+      replyTo: null
+    };
+    await this.sendMail(templateId, template, mailArguments);
+  }
+  async sendEmailChangeVerifyEmail(dbContext, mailArguments, customMailOptions) {
+    const templateId = { type: type.MailType.emailChangeVerify, ...customMailOptions };
+    const template = await this.getCustomTemplate(dbContext, templateId) || {
+      subject: "Confirm your new e-mail address",
+      content: EmailChangeVerify_mustache,
+      replyTo: null
+    };
+    await this.sendMail(templateId, template, mailArguments);
+  }
+  async sendEmailChangeNotifyEmail(dbContext, mailArguments, customMailOptions) {
+    const templateId = { type: type.MailType.emailChangeNotify, ...customMailOptions };
+    const template = await this.getCustomTemplate(dbContext, templateId) || {
+      subject: "Your e-mail address was changed",
+      content: EmailChangeNotify_mustache,
+      replyTo: null
+    };
+    await this.sendMail(templateId, template, mailArguments);
+  }
   async sendPasswordlessEmail(dbContext, mailArguments, customMailOptions) {
     const templateId = { type: type.MailType.passwordlessSignIn, ...customMailOptions };
     const template = await this.getCustomTemplate(dbContext, templateId) || {
@@ -55,6 +100,33 @@ class UserMailer {
     };
     await this.sendMail(templateId, template, mailArguments);
   }
+  async sendEmailOtpEmail(dbContext, mailArguments, customMailOptions) {
+    const templateId = { type: type.MailType.emailOtp, ...customMailOptions };
+    const template = await this.getCustomTemplate(dbContext, templateId) || {
+      subject: "Your verification code",
+      content: EmailOtp_mustache,
+      replyTo: null
+    };
+    await this.sendMail(templateId, template, mailArguments);
+  }
+  async sendBackupCodesExhaustedEmail(dbContext, mailArguments, customMailOptions) {
+    const templateId = { type: type.MailType.backupCodesExhausted, ...customMailOptions };
+    const template = await this.getCustomTemplate(dbContext, templateId) || {
+      subject: "You have no MFA backup codes left",
+      content: BackupCodesExhausted_mustache,
+      replyTo: null
+    };
+    await this.sendMail(templateId, template, mailArguments);
+  }
+  async sendUnusualLoginEmail(dbContext, mailArguments, customMailOptions) {
+    const templateId = { type: type.MailType.unusualLogin, ...customMailOptions };
+    const template = await this.getCustomTemplate(dbContext, templateId) || {
+      subject: "Unusual sign-in to your account",
+      content: UnusualLogin_mustache,
+      replyTo: null
+    };
+    await this.sendMail(templateId, template, mailArguments);
+  }
   async sendMail(templateId, template, variables) {
     const html = await this.templateRenderer.render(template.content, variables);
     await this.mailer.send({

package/dist/development/src/model/mailing/UserMailer.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UserMailer.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils'\nimport NewUserInvited from './templates/NewUserInvited.mustache'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache'\nimport PasswordReset from './templates/PasswordReset.mustache'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type'\nimport { MailTemplateQuery } from '../queries'\nimport Layout from './templates/Layout.mustache'\nimport { DatabaseContext } from '../utils'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) {}\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: {\n\t\t\temail: string\n\t\t\tpassword: string | null\n\t\t\ttoken: string | null\n\t\t\tproject: string\n\t\t\tprojectSlug: string\n\t\t\tmemberships: readonly Acl.Membership[]\n\t\t},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string; requestId: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo\n\t\t\t\t? {\n\t\t\t\t\treplyTo: template.replyTo,\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'> | null> {\n\t\tconst customTemplate = (await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":["MailType","NewUserInvited","ExistingUserInvited","PasswordReset","PasswordlessSignIn","MailTemplateQuery","Layout"],"mappings":";;;;;;;;;;;;;;;;AAWO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,WACA,eAQA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMA,KAAAA,SAAS,gBAAgB,GAAG,kBAAA;AACvD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASC;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMD,KAAAA,SAAS,qBAAqB,GAAG,kBAAA;AAC5D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASE;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMF,KAAAA,SAAS,eAAe,GAAG,kBAAA;AACtD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASG;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMH,KAAAA,SAAS,oBAAoB,GAAG,kBAAA;AAC3D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASI;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAC3E,UAAM,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UACV;AAAA,QACD,SAAS,SAAS;AAAA,MAAA,IAEjB,CAAA;AAAA,IAAC,CACJ;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,WACA,YAC4E;AAC5E,UAAM,iBAAkB,MAAM,UAAU,aAAa,MAAM,IAAIC,kBAAAA,kBAAkB,UAAU,CAAC,KACvF,MAAM,UAAU,aAAa,MAAM,IAAIA,oCAAkB,EAAE,GAAG,YAAY,WAAW,KAAA,CAAM,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACpB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,eAAe,YAAYC,gBAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAA;AAAA,EAC5E;AACD;;"}
+{"version":3,"file":"UserMailer.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils/index.js'\nimport NewUserInvited from './templates/NewUserInvited.mustache.js'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache.js'\nimport PasswordReset from './templates/PasswordReset.mustache.js'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache.js'\nimport EmailOtp from './templates/EmailOtp.mustache.js'\nimport ForcedSignOut from './templates/ForcedSignOut.mustache.js'\nimport BackupCodesExhausted from './templates/BackupCodesExhausted.mustache.js'\nimport EmailVerification from './templates/EmailVerification.mustache.js'\nimport EmailChangeVerify from './templates/EmailChangeVerify.mustache.js'\nimport EmailChangeNotify from './templates/EmailChangeNotify.mustache.js'\nimport UnusualLogin from './templates/UnusualLogin.mustache.js'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type.js'\nimport { MailTemplateQuery } from '../queries/index.js'\nimport Layout from './templates/Layout.mustache.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) {}\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: {\n\t\t\temail: string\n\t\t\tpassword: string | null\n\t\t\ttoken: string | null\n\t\t\tproject: string\n\t\t\tprojectSlug: string\n\t\t\tmemberships: readonly Acl.Membership[]\n\t\t},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendForcedSignOutEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; reason: string | null },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.forcedSignOut, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your sessions have been signed out',\n\t\t\tcontent: ForcedSignOut,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailVerificationEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailVerification, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Verify your e-mail address',\n\t\t\tcontent: EmailVerification,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailChangeVerifyEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailChangeVerify, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Confirm your new e-mail address',\n\t\t\tcontent: EmailChangeVerify,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailChangeNotifyEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; newEmail: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailChangeNotify, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your e-mail address was changed',\n\t\t\tcontent: EmailChangeNotify,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string; requestId: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailOtpEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; code: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailOtp, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your verification code',\n\t\t\tcontent: EmailOtp,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendBackupCodesExhaustedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.backupCodesExhausted, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have no MFA backup codes left',\n\t\t\tcontent: BackupCodesExhausted,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendUnusualLoginEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; geoCountry: string | null; ipAddress: string | null },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.unusualLogin, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Unusual sign-in to your account',\n\t\t\tcontent: UnusualLogin,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo\n\t\t\t\t? {\n\t\t\t\t\treplyTo: template.replyTo,\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'> | null> {\n\t\tconst customTemplate = (await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":["MailType","NewUserInvited","ExistingUserInvited","PasswordReset","ForcedSignOut","EmailVerification","EmailChangeVerify","EmailChangeNotify","PasswordlessSignIn","EmailOtp","BackupCodesExhausted","UnusualLogin","MailTemplateQuery","Layout"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAkBO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,WACA,eAQA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMA,KAAAA,SAAS,gBAAgB,GAAG,kBAAA;AACvD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASC;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMD,KAAAA,SAAS,qBAAqB,GAAG,kBAAA;AAC5D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASE;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMF,KAAAA,SAAS,eAAe,GAAG,kBAAA;AACtD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASG;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMH,KAAAA,SAAS,eAAe,GAAG,kBAAA;AACtD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASI;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMJ,KAAAA,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASK;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAML,KAAAA,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASM;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMN,KAAAA,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASO;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMP,KAAAA,SAAS,oBAAoB,GAAG,kBAAA;AAC3D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASQ;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,kBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMR,KAAAA,SAAS,UAAU,GAAG,kBAAA;AACjD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASS;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,8BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMT,KAAAA,SAAS,sBAAsB,GAAG,kBAAA;AAC7D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASU;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMV,KAAAA,SAAS,cAAc,GAAG,kBAAA;AACrD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASW;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAC3E,UAAM,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UACV;AAAA,QACD,SAAS,SAAS;AAAA,MAAA,IAEjB,CAAA;AAAA,IAAC,CACJ;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,WACA,YAC4E;AAC5E,UAAM,iBAAkB,MAAM,UAAU,aAAa,MAAM,IAAIC,kBAAAA,kBAAkB,UAAU,CAAC,KACvF,MAAM,UAAU,aAAa,MAAM,IAAIA,oCAAkB,EAAE,GAAG,YAAY,WAAW,KAAA,CAAM,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACpB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,eAAe,YAAYC,gBAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAA;AAAA,EAC5E;AACD;;"}