@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/development/src/model/service/CustomRoleManager.js

@@ -0,0 +1,170 @@
+import { UniqueViolationError, LockType } from "@contember/database";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import "../type/ApiKey.js";
+import { CustomRolesQuery } from "../queries/customRole/CustomRolesQuery.js";
+import { IdentitiesHoldingRoleCountQuery } from "../queries/identity/IdentitiesHoldingRoleCountQuery.js";
+import { ProjectsQuery } from "../queries/project/ProjectsQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import { ROLE_SLUG_PATTERN } from "../authorization/Roles.js";
+import { BUILTIN_TENANT_ROLES, parsePersistedCustomRoleReferences, parseCustomRoleGrants, CustomRoleGrantValidationError, parsePersistedCustomRoleGrants } from "../authorization/CustomRolePermissions.js";
+import "../authorization/PermissionContext.js";
+import "../authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
+import { CreateCustomRoleCommand } from "../commands/customRole/CreateCustomRoleCommand.js";
+import { DeleteCustomRoleCommand } from "../commands/customRole/DeleteCustomRoleCommand.js";
+import { RemoveCustomRoleAssignmentsCommand } from "../commands/customRole/RemoveCustomRoleAssignmentsCommand.js";
+import { UpdateCustomRoleCommand } from "../commands/customRole/UpdateCustomRoleCommand.js";
+import { GlobalRoleValidator } from "./GlobalRoleValidator.js";
+const SLUG_MAX_LENGTH = 64;
+class CustomRoleManager {
+  constructor(globalRoleValidator = new GlobalRoleValidator()) {
+    this.globalRoleValidator = globalRoleValidator;
+  }
+  async listRoles(db) {
+    const rows = await db.queryHandler.fetch(new CustomRolesQuery());
+    return rows.map((row) => this.toState(row));
+  }
+  async createRole(db, input) {
+    if (!ROLE_SLUG_PATTERN.test(input.slug) || input.slug.length > SLUG_MAX_LENGTH) {
+      return new ResponseError("INVALID_SLUG", `Slug must match ${ROLE_SLUG_PATTERN} and be at most ${SLUG_MAX_LENGTH} characters long`);
+    }
+    if (BUILTIN_TENANT_ROLES.has(input.slug)) {
+      return new ResponseError("INVALID_SLUG", `Slug ${input.slug} collides with a built-in role`);
+    }
+    const parsed = this.parseGrants(input.grants);
+    if (parsed instanceof ResponseError) {
+      return parsed;
+    }
+    const referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, /* @__PURE__ */ new Set([input.slug]));
+    if (referenceError !== null) {
+      return referenceError;
+    }
+    const existing = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [input.slug] }));
+    if (existing.length > 0) {
+      return new ResponseError("SLUG_ALREADY_EXISTS", `Custom role ${input.slug} already exists`);
+    }
+    const holders = await db.queryHandler.fetch(new IdentitiesHoldingRoleCountQuery(input.slug));
+    if (holders > 0) {
+      return new ResponseError(
+        "SLUG_ALREADY_ASSIGNED",
+        `Role string ${input.slug} is already held by ${holders} identities; remove it from them before defining the role`
+      );
+    }
+    const id = await db.commandBus.execute(
+      new CreateCustomRoleCommand({
+        slug: input.slug,
+        description: input.description,
+        grants: parsed.grants
+      })
+    );
+    return new ResponseOk({
+      id,
+      role: {
+        slug: input.slug,
+        description: input.description,
+        grants: parsed.grants
+      }
+    });
+  }
+  /** Maps the racing-insert failure the transaction could not report itself. */
+  static isSlugConflict(error) {
+    return error instanceof UniqueViolationError;
+  }
+  async updateRole(db, slug, input) {
+    const [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }));
+    if (current === void 0) {
+      return new ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    let canonicalGrants;
+    if (input.grants !== void 0) {
+      const parsed = this.parseGrants(input.grants);
+      if (parsed instanceof ResponseError) {
+        return parsed;
+      }
+      const referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, /* @__PURE__ */ new Set([slug]));
+      if (referenceError !== null) {
+        return referenceError;
+      }
+      canonicalGrants = parsed.grants;
+    }
+    const before = this.toState(current);
+    const updated = await db.commandBus.execute(
+      new UpdateCustomRoleCommand(slug, {
+        description: input.description,
+        grants: canonicalGrants
+      })
+    );
+    if (!updated) {
+      return new ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    return new ResponseOk({
+      before,
+      after: {
+        slug,
+        description: input.description === void 0 ? before.description : input.description,
+        grants: canonicalGrants ?? before.grants
+      }
+    });
+  }
+  async deleteRole(db, slug) {
+    const [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }));
+    if (current === void 0) {
+      return new ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    const referencedBy = (await db.queryHandler.fetch(new CustomRolesQuery())).filter((row) => row.slug !== slug && parsePersistedCustomRoleReferences(row.grants).includes(slug)).map((row) => row.slug);
+    if (referencedBy.length > 0) {
+      return new ResponseError(
+        "ROLE_IN_USE",
+        `Custom role ${slug} is referenced by the grant configuration of ${referencedBy.join(", ")}`
+      );
+    }
+    const deleted = await db.commandBus.execute(new DeleteCustomRoleCommand(slug));
+    if (!deleted) {
+      return new ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    const removedAssignmentIdentityIds = await db.commandBus.execute(new RemoveCustomRoleAssignmentsCommand(slug));
+    return new ResponseOk({
+      before: this.toState(current),
+      removedAssignments: removedAssignmentIdentityIds.length,
+      removedAssignmentIdentityIds
+    });
+  }
+  parseGrants(grants) {
+    try {
+      return parseCustomRoleGrants(grants);
+    } catch (error) {
+      if (error instanceof CustomRoleGrantValidationError) {
+        return new ResponseError(error.code, error.message);
+      }
+      throw error;
+    }
+  }
+  async validateReferences(db, roles, projects, additionallyActiveRoles) {
+    const invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles, additionallyActiveRoles);
+    if (invalidRole !== null) {
+      return new ResponseError("INVALID_PERMISSION_CONFIGURATION", `Referenced role ${invalidRole} does not exist or is not globally assignable`);
+    }
+    if (projects.length > 0) {
+      const existingProjects = new Set((await db.queryHandler.fetch(new ProjectsQuery())).map((project) => project.slug));
+      const missingProject = projects.find((project) => !existingProjects.has(project));
+      if (missingProject !== void 0) {
+        return new ResponseError("INVALID_PERMISSION_CONFIGURATION", `Referenced project ${missingProject} does not exist`);
+      }
+    }
+    return null;
+  }
+  toState(row) {
+    return {
+      slug: row.slug,
+      description: row.description,
+      grants: parsePersistedCustomRoleGrants(row.grants)
+    };
+  }
+}
+export {
+  CustomRoleManager
+};
+//# sourceMappingURL=CustomRoleManager.js.map

package/dist/development/src/model/service/CustomRoleManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/CustomRoleManager.ts"],"sourcesContent":["import { LockType, UniqueViolationError } from '@contember/database'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { CustomRolesQuery, IdentitiesHoldingRoleCountQuery, ProjectsQuery } from '../queries/index.js'\nimport { CreateCustomRoleCommand, DeleteCustomRoleCommand, RemoveCustomRoleAssignmentsCommand, UpdateCustomRoleCommand } from '../commands/index.js'\nimport { CustomRoleRow } from '../type/index.js'\nimport {\n\tBUILTIN_TENANT_ROLES,\n\tCanonicalCustomRoleGrant,\n\tCustomRoleGrantValidationError,\n\tparseCustomRoleGrants,\n\tparsePersistedCustomRoleGrants,\n\tparsePersistedCustomRoleReferences,\n} from '../authorization/CustomRolePermissions.js'\nimport { ROLE_SLUG_PATTERN } from '../authorization/Roles.js'\nimport { CreateCustomRoleErrorCode, DeleteCustomRoleErrorCode, UpdateCustomRoleErrorCode } from '../../schema/index.js'\nimport { GlobalRoleValidator } from './GlobalRoleValidator.js'\n\nconst SLUG_MAX_LENGTH = 64\n\nexport type CustomRoleState = {\n\treadonly slug: string\n\treadonly description: string | null\n\treadonly grants: readonly CanonicalCustomRoleGrant[]\n}\n\ntype CreateResult = {\n\treadonly id: string\n\treadonly role: CustomRoleState\n}\n\ntype UpdateResult = {\n\treadonly before: CustomRoleState\n\treadonly after: CustomRoleState\n}\n\ntype DeleteResult = {\n\treadonly before: CustomRoleState\n\treadonly removedAssignments: number\n\t/** Which identities lost the role — a count alone cannot answer \"who lost what\" after the fact. */\n\treadonly removedAssignmentIdentityIds: readonly string[]\n}\n\nexport class CustomRoleManager {\n\tconstructor(\n\t\tprivate readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),\n\t) {\n\t}\n\n\tasync listRoles(db: DatabaseContext): Promise<CustomRoleState[]> {\n\t\tconst rows = await db.queryHandler.fetch(new CustomRolesQuery())\n\t\treturn rows.map(row => this.toState(row))\n\t}\n\n\tasync createRole(\n\t\tdb: DatabaseContext,\n\t\tinput: { slug: string; description: string | null; grants: unknown },\n\t): Promise<Response<CreateResult, CreateCustomRoleErrorCode>> {\n\t\tif (!ROLE_SLUG_PATTERN.test(input.slug) || input.slug.length > SLUG_MAX_LENGTH) {\n\t\t\treturn new ResponseError('INVALID_SLUG', `Slug must match ${ROLE_SLUG_PATTERN} and be at most ${SLUG_MAX_LENGTH} characters long`)\n\t\t}\n\t\tif (BUILTIN_TENANT_ROLES.has(input.slug)) {\n\t\t\treturn new ResponseError('INVALID_SLUG', `Slug ${input.slug} collides with a built-in role`)\n\t\t}\n\t\tconst parsed = this.parseGrants(input.grants)\n\t\tif (parsed instanceof ResponseError) {\n\t\t\treturn parsed\n\t\t}\n\t\tconst referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, new Set([input.slug]))\n\t\tif (referenceError !== null) {\n\t\t\treturn referenceError\n\t\t}\n\t\tconst existing = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [input.slug] }))\n\t\tif (existing.length > 0) {\n\t\t\treturn new ResponseError('SLUG_ALREADY_EXISTS', `Custom role ${input.slug} already exists`)\n\t\t}\n\t\t// Only legacy rows can match: every assignment path rejects a slug with no custom_role row,\n\t\t// so no concurrent writer can add one before this insert commits.\n\t\tconst holders = await db.queryHandler.fetch(new IdentitiesHoldingRoleCountQuery(input.slug))\n\t\tif (holders > 0) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'SLUG_ALREADY_ASSIGNED',\n\t\t\t\t`Role string ${input.slug} is already held by ${holders} identities; remove it from them before defining the role`,\n\t\t\t)\n\t\t}\n\t\t// A racing INSERT aborts the transaction, so UniqueViolationError cannot be mapped\n\t\t// here — the caller catches it outside, once the transaction has rolled back.\n\t\tconst id = await db.commandBus.execute(\n\t\t\tnew CreateCustomRoleCommand({\n\t\t\t\tslug: input.slug,\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: parsed.grants,\n\t\t\t}),\n\t\t)\n\t\treturn new ResponseOk({\n\t\t\tid,\n\t\t\trole: {\n\t\t\t\tslug: input.slug,\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: parsed.grants,\n\t\t\t},\n\t\t})\n\t}\n\n\t/** Maps the racing-insert failure the transaction could not report itself. */\n\tstatic isSlugConflict(error: unknown): boolean {\n\t\treturn error instanceof UniqueViolationError\n\t}\n\n\tasync updateRole(\n\t\tdb: DatabaseContext,\n\t\tslug: string,\n\t\tinput: { description?: string | null; grants?: unknown },\n\t): Promise<Response<UpdateResult, UpdateCustomRoleErrorCode>> {\n\t\tconst [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }))\n\t\tif (current === undefined) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\tlet canonicalGrants: readonly CanonicalCustomRoleGrant[] | undefined\n\t\tif (input.grants !== undefined) {\n\t\t\tconst parsed = this.parseGrants(input.grants)\n\t\t\tif (parsed instanceof ResponseError) {\n\t\t\t\treturn parsed\n\t\t\t}\n\t\t\tconst referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, new Set([slug]))\n\t\t\tif (referenceError !== null) {\n\t\t\t\treturn referenceError\n\t\t\t}\n\t\t\tcanonicalGrants = parsed.grants\n\t\t}\n\t\tconst before = this.toState(current)\n\t\tconst updated = await db.commandBus.execute(\n\t\t\tnew UpdateCustomRoleCommand(slug, {\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: canonicalGrants,\n\t\t\t}),\n\t\t)\n\t\tif (!updated) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\treturn new ResponseOk({\n\t\t\tbefore,\n\t\t\tafter: {\n\t\t\t\tslug,\n\t\t\t\tdescription: input.description === undefined ? before.description : input.description,\n\t\t\t\tgrants: canonicalGrants ?? before.grants,\n\t\t\t},\n\t\t})\n\t}\n\n\tasync deleteRole(db: DatabaseContext, slug: string): Promise<Response<DeleteResult, DeleteCustomRoleErrorCode>> {\n\t\tconst [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }))\n\t\tif (current === undefined) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\t// References live inside an opaque jsonb blob — no FK can catch this. Read the other rows\n\t\t// unlocked: a concurrent create/update naming this slug holds FOR SHARE on the row we\n\t\t// already hold FOR UPDATE, so the two serialize without a second lock (and without the\n\t\t// deadlock a reversed acquisition order would invite).\n\t\tconst referencedBy = (await db.queryHandler.fetch(new CustomRolesQuery()))\n\t\t\t.filter(row => row.slug !== slug && parsePersistedCustomRoleReferences(row.grants).includes(slug))\n\t\t\t.map(row => row.slug)\n\t\tif (referencedBy.length > 0) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'ROLE_IN_USE',\n\t\t\t\t`Custom role ${slug} is referenced by the grant configuration of ${referencedBy.join(', ')}`,\n\t\t\t)\n\t\t}\n\t\tconst deleted = await db.commandBus.execute(new DeleteCustomRoleCommand(slug))\n\t\tif (!deleted) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\tconst removedAssignmentIdentityIds = await db.commandBus.execute(new RemoveCustomRoleAssignmentsCommand(slug))\n\t\treturn new ResponseOk({\n\t\t\tbefore: this.toState(current),\n\t\t\tremovedAssignments: removedAssignmentIdentityIds.length,\n\t\t\tremovedAssignmentIdentityIds,\n\t\t})\n\t}\n\n\tprivate parseGrants(\n\t\tgrants: unknown,\n\t): ReturnType<typeof parseCustomRoleGrants> | ResponseError<'UNKNOWN_PERMISSION' | 'DUPLICATE_PERMISSION' | 'INVALID_PERMISSION_CONFIGURATION'> {\n\t\ttry {\n\t\t\treturn parseCustomRoleGrants(grants)\n\t\t} catch (error) {\n\t\t\tif (error instanceof CustomRoleGrantValidationError) {\n\t\t\t\treturn new ResponseError(error.code, error.message)\n\t\t\t}\n\t\t\tthrow error\n\t\t}\n\t}\n\n\tprivate async validateReferences(\n\t\tdb: DatabaseContext,\n\t\troles: readonly string[],\n\t\tprojects: readonly string[],\n\t\tadditionallyActiveRoles: ReadonlySet<string>,\n\t): Promise<ResponseError<'INVALID_PERMISSION_CONFIGURATION'> | null> {\n\t\tconst invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles, additionallyActiveRoles)\n\t\tif (invalidRole !== null) {\n\t\t\treturn new ResponseError('INVALID_PERMISSION_CONFIGURATION', `Referenced role ${invalidRole} does not exist or is not globally assignable`)\n\t\t}\n\t\tif (projects.length > 0) {\n\t\t\tconst existingProjects = new Set((await db.queryHandler.fetch(new ProjectsQuery())).map(project => project.slug))\n\t\t\tconst missingProject = projects.find(project => !existingProjects.has(project))\n\t\t\tif (missingProject !== undefined) {\n\t\t\t\treturn new ResponseError('INVALID_PERMISSION_CONFIGURATION', `Referenced project ${missingProject} does not exist`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n\n\tprivate toState(row: CustomRoleRow): CustomRoleState {\n\t\treturn {\n\t\t\tslug: row.slug,\n\t\t\tdescription: row.description,\n\t\t\tgrants: parsePersistedCustomRoleGrants(row.grants),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAkBA,MAAM,kBAAkB;AAyBjB,MAAM,kBAAkB;AAAA,EAC9B,YACkB,sBAA2C,IAAI,uBAC/D;AADgB,SAAA,sBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,IAAiD;AAChE,UAAM,OAAO,MAAM,GAAG,aAAa,MAAM,IAAI,kBAAkB;AAC/D,WAAO,KAAK,IAAI,CAAA,QAAO,KAAK,QAAQ,GAAG,CAAC;AAAA,EACzC;AAAA,EAEA,MAAM,WACL,IACA,OAC6D;AAC7D,QAAI,CAAC,kBAAkB,KAAK,MAAM,IAAI,KAAK,MAAM,KAAK,SAAS,iBAAiB;AAC/E,aAAO,IAAI,cAAc,gBAAgB,mBAAmB,iBAAiB,mBAAmB,eAAe,kBAAkB;AAAA,IAClI;AACA,QAAI,qBAAqB,IAAI,MAAM,IAAI,GAAG;AACzC,aAAO,IAAI,cAAc,gBAAgB,QAAQ,MAAM,IAAI,gCAAgC;AAAA,IAC5F;AACA,UAAM,SAAS,KAAK,YAAY,MAAM,MAAM;AAC5C,QAAI,kBAAkB,eAAe;AACpC,aAAO;AAAA,IACR;AACA,UAAM,iBAAiB,MAAM,KAAK,mBAAmB,IAAI,OAAO,iBAAiB,OAAO,wCAAwB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;AACjI,QAAI,mBAAmB,MAAM;AAC5B,aAAO;AAAA,IACR;AACA,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAI,iBAAiB,EAAE,OAAO,CAAC,MAAM,IAAI,EAAA,CAAG,CAAC;AAC1F,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO,IAAI,cAAc,uBAAuB,eAAe,MAAM,IAAI,iBAAiB;AAAA,IAC3F;AAGA,UAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,gCAAgC,MAAM,IAAI,CAAC;AAC3F,QAAI,UAAU,GAAG;AAChB,aAAO,IAAI;AAAA,QACV;AAAA,QACA,eAAe,MAAM,IAAI,uBAAuB,OAAO;AAAA,MAAA;AAAA,IAEzD;AAGA,UAAM,KAAK,MAAM,GAAG,WAAW;AAAA,MAC9B,IAAI,wBAAwB;AAAA,QAC3B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,QAAQ,OAAO;AAAA,MAAA,CACf;AAAA,IAAA;AAEF,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,MAAM;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,QAAQ,OAAO;AAAA,MAAA;AAAA,IAChB,CACA;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,eAAe,OAAyB;AAC9C,WAAO,iBAAiB;AAAA,EACzB;AAAA,EAEA,MAAM,WACL,IACA,MACA,OAC6D;AAC7D,UAAM,CAAC,OAAO,IAAI,MAAM,GAAG,aAAa,MAAM,IAAI,iBAAiB,EAAE,OAAO,CAAC,IAAI,GAAG,MAAM,SAAS,UAAA,CAAW,CAAC;AAC/G,QAAI,YAAY,QAAW;AAC1B,aAAO,IAAI,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,QAAI;AACJ,QAAI,MAAM,WAAW,QAAW;AAC/B,YAAM,SAAS,KAAK,YAAY,MAAM,MAAM;AAC5C,UAAI,kBAAkB,eAAe;AACpC,eAAO;AAAA,MACR;AACA,YAAM,iBAAiB,MAAM,KAAK,mBAAmB,IAAI,OAAO,iBAAiB,OAAO,oBAAoB,oBAAI,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3H,UAAI,mBAAmB,MAAM;AAC5B,eAAO;AAAA,MACR;AACA,wBAAkB,OAAO;AAAA,IAC1B;AACA,UAAM,SAAS,KAAK,QAAQ,OAAO;AACnC,UAAM,UAAU,MAAM,GAAG,WAAW;AAAA,MACnC,IAAI,wBAAwB,MAAM;AAAA,QACjC,aAAa,MAAM;AAAA,QACnB,QAAQ;AAAA,MAAA,CACR;AAAA,IAAA;AAEF,QAAI,CAAC,SAAS;AACb,aAAO,IAAI,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,QACN;AAAA,QACA,aAAa,MAAM,gBAAgB,SAAY,OAAO,cAAc,MAAM;AAAA,QAC1E,QAAQ,mBAAmB,OAAO;AAAA,MAAA;AAAA,IACnC,CACA;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,IAAqB,MAA0E;AAC/G,UAAM,CAAC,OAAO,IAAI,MAAM,GAAG,aAAa,MAAM,IAAI,iBAAiB,EAAE,OAAO,CAAC,IAAI,GAAG,MAAM,SAAS,UAAA,CAAW,CAAC;AAC/G,QAAI,YAAY,QAAW;AAC1B,aAAO,IAAI,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AAKA,UAAM,gBAAgB,MAAM,GAAG,aAAa,MAAM,IAAI,iBAAA,CAAkB,GACtE,OAAO,CAAA,QAAO,IAAI,SAAS,QAAQ,mCAAmC,IAAI,MAAM,EAAE,SAAS,IAAI,CAAC,EAChG,IAAI,CAAA,QAAO,IAAI,IAAI;AACrB,QAAI,aAAa,SAAS,GAAG;AAC5B,aAAO,IAAI;AAAA,QACV;AAAA,QACA,eAAe,IAAI,gDAAgD,aAAa,KAAK,IAAI,CAAC;AAAA,MAAA;AAAA,IAE5F;AACA,UAAM,UAAU,MAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,IAAI,CAAC;AAC7E,QAAI,CAAC,SAAS;AACb,aAAO,IAAI,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,UAAM,+BAA+B,MAAM,GAAG,WAAW,QAAQ,IAAI,mCAAmC,IAAI,CAAC;AAC7G,WAAO,IAAI,WAAW;AAAA,MACrB,QAAQ,KAAK,QAAQ,OAAO;AAAA,MAC5B,oBAAoB,6BAA6B;AAAA,MACjD;AAAA,IAAA,CACA;AAAA,EACF;AAAA,EAEQ,YACP,QAC+I;AAC/I,QAAI;AACH,aAAO,sBAAsB,MAAM;AAAA,IACpC,SAAS,OAAO;AACf,UAAI,iBAAiB,gCAAgC;AACpD,eAAO,IAAI,cAAc,MAAM,MAAM,MAAM,OAAO;AAAA,MACnD;AACA,YAAM;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAc,mBACb,IACA,OACA,UACA,yBACoE;AACpE,UAAM,cAAc,MAAM,KAAK,oBAAoB,gBAAgB,IAAI,OAAO,uBAAuB;AACrG,QAAI,gBAAgB,MAAM;AACzB,aAAO,IAAI,cAAc,oCAAoC,mBAAmB,WAAW,+CAA+C;AAAA,IAC3I;AACA,QAAI,SAAS,SAAS,GAAG;AACxB,YAAM,mBAAmB,IAAI,KAAK,MAAM,GAAG,aAAa,MAAM,IAAI,cAAA,CAAe,GAAG,IAAI,CAAA,YAAW,QAAQ,IAAI,CAAC;AAChH,YAAM,iBAAiB,SAAS,KAAK,CAAA,YAAW,CAAC,iBAAiB,IAAI,OAAO,CAAC;AAC9E,UAAI,mBAAmB,QAAW;AACjC,eAAO,IAAI,cAAc,oCAAoC,sBAAsB,cAAc,iBAAiB;AAAA,MACnH;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEQ,QAAQ,KAAqC;AACpD,WAAO;AAAA,MACN,MAAM,IAAI;AAAA,MACV,aAAa,IAAI;AAAA,MACjB,QAAQ,+BAA+B,IAAI,MAAM;AAAA,IAAA;AAAA,EAEnD;AACD;"}

package/dist/development/src/model/service/EmailChangeManager.cjs

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Response = require("../utils/Response.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const Database = require("@contember/database");
+require("../type/ApiKey.cjs");
+const exceptions = require("../../exceptions.cjs");
+const PersonQuery = require("../queries/person/PersonQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+const getPreferredProject = require("./helpers/getPreferredProject.cjs");
+const token = require("../utils/token.cjs");
+const email = require("../utils/email.cjs");
+const MarkEmailVerifiedCommand = require("../commands/person/MarkEmailVerifiedCommand.cjs");
+const CreatePersonTokenCommand = require("../commands/personToken/CreatePersonTokenCommand.cjs");
+const InvalidateTokenCommand = require("../commands/personToken/InvalidateTokenCommand.cjs");
+const PersonTokenQuery = require("../queries/personToken/PersonTokenQuery.cjs");
+const NextMailAttemptQuery = require("../queries/authLog/NextMailAttemptQuery.cjs");
+const AuthLogService = require("./AuthLogService.cjs");
+class EmailChangeManager {
+  constructor(mailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory) {
+    this.mailer = mailer;
+    this.projectManager = projectManager;
+    this.emailValidator = emailValidator;
+    this.apiKeyManager = apiKeyManager;
+    this.permissionContextFactory = permissionContextFactory;
+  }
+  /**
+   * Request an e-mail change. Validation and rate-limiting run BEFORE any
+   * write, so a rejected request never leaves a half-applied profile (e.g. a
+   * persisted name change without the e-mail change going through). Any
+   * immediate side-changes the caller wants applied atomically with the token
+   * (the name change) are passed via `applyWithinTransaction`.
+   */
+  async requestEmailChange(dbContext, permissionContext, person, newEmail, mailOptions = {}, applyWithinTransaction) {
+    const normalizedNewEmail = email.normalizeEmail(newEmail);
+    const validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail);
+    if (validationError !== null) {
+      return new Response.ResponseError(validationError.error, validationError.errorMessage);
+    }
+    const retryAfter = await dbContext.queryHandler.fetch(
+      new NextMailAttemptQuery.NextMailAttemptQuery(normalizedNewEmail, "email_change_init", "email_change_complete")
+    );
+    if (retryAfter > 0) {
+      return new Response.ResponseError("RATE_LIMIT_EXCEEDED", "Too many e-mail change requests for this address.");
+    }
+    const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+    const project = getPreferredProject.getPreferredProject(projects, mailOptions.project ?? null);
+    await dbContext.transaction(async (db) => {
+      if (applyWithinTransaction) {
+        await applyWithinTransaction(db);
+      }
+      const result = await db.commandBus.execute(
+        CreatePersonTokenCommand.CreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail)
+      );
+      await this.mailer.sendEmailChangeVerifyEmail(
+        db,
+        {
+          email: normalizedNewEmail,
+          token: result.token,
+          project: project?.name,
+          projectSlug: project?.slug
+        },
+        {
+          variant: mailOptions.mailVariant || "",
+          projectId: project?.id ?? null
+        }
+      );
+    });
+    return new Response.ResponseOk(null);
+  }
+  async confirmEmailChange(dbContext, token$1) {
+    const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byToken(token$1, "email_change"));
+    const validation = token.validateToken({ entry: tokenRow, token: token$1, validationType: "token" });
+    if (!validation.ok) {
+      return new Response.ResponseError(validation.error, validation.errorMessage, {
+        [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag(
+          tokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {}
+        )
+      });
+    }
+    const authLogData = new AuthLogService.AuthLogService.Bag({
+      personId: validation.result.person_id,
+      tokenId: validation.result.id
+    });
+    const newEmail = validation.result.meta?.email;
+    if (!newEmail) {
+      throw new exceptions.ImplementationException("email_change token is missing its email payload");
+    }
+    const person = await dbContext.queryHandler.fetch(PersonQuery.PersonQuery.byId(validation.result.person_id));
+    if (!person) {
+      throw new exceptions.ImplementationException();
+    }
+    const validationError = await this.emailValidator.validateEmail(dbContext, newEmail);
+    if (validationError !== null) {
+      return new Response.ResponseError(validationError.error, validationError.errorMessage, {
+        [AuthLogService.AuthLogService.Key]: authLogData
+      });
+    }
+    const oldEmail = person.email;
+    try {
+      await dbContext.transaction(async (db) => {
+        await db.commandBus.execute(new InvalidateTokenCommand.InvalidateTokenCommand(validation.result.id));
+        await db.commandBus.execute(new MarkEmailVerifiedCommand.MarkEmailVerifiedCommand(person.id, newEmail));
+        await this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id);
+      });
+    } catch (e) {
+      if (e instanceof Database.UniqueViolationError) {
+        return new Response.ResponseError("EMAIL_ALREADY_EXISTS", `User with email ${newEmail} already exists`, {
+          [AuthLogService.AuthLogService.Key]: authLogData
+        });
+      }
+      throw e;
+    }
+    if (oldEmail) {
+      const permissionContext = this.permissionContextFactory.create(dbContext, {
+        id: person.identity_id,
+        roles: person.roles
+      });
+      const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+      const project = getPreferredProject.getPreferredProject(projects, null);
+      await this.mailer.sendEmailChangeNotifyEmail(
+        dbContext,
+        { email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },
+        { projectId: project?.id ?? null, variant: "" }
+      );
+    }
+    return new Response.ResponseOk({ personId: person.id, newEmail, [AuthLogService.AuthLogService.Key]: authLogData });
+  }
+}
+exports.EmailChangeManager = EmailChangeManager;
+//# sourceMappingURL=EmailChangeManager.cjs.map

package/dist/development/src/model/service/EmailChangeManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailChangeManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext, PermissionContextFactory } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { ApiKeyManager } from './apiKey/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { normalizeEmail } from '../utils/email.js'\nimport { PersonToken } from '../type/index.js'\nimport { UniqueViolationError } from '@contember/database'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailChangeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\t/**\n\t * Request an e-mail change. Validation and rate-limiting run BEFORE any\n\t * write, so a rejected request never leaves a half-applied profile (e.g. a\n\t * persisted name change without the e-mail change going through). Any\n\t * immediate side-changes the caller wants applied atomically with the token\n\t * (the name change) are passed via `applyWithinTransaction`.\n\t */\n\tpublic async requestEmailChange(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tnewEmail: string,\n\t\tmailOptions: MailOptions = {},\n\t\tapplyWithinTransaction?: (db: DatabaseContext) => Promise<void>,\n\t): Promise<RequestEmailChangeResponse> {\n\t\tconst normalizedNewEmail = normalizeEmail(newEmail)\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t}\n\n\t\t// Per-recipient exponential backoff: an authenticated user (or a hijacked\n\t\t// session) must not be able to flood an arbitrary address with\n\t\t// \"confirm your new e-mail\" mails. Keyed on the normalized NEW address so\n\t\t// the `email_change_init` auth-log entries (written with the same\n\t\t// normalized address) actually drive the backoff. Reuses login_* config.\n\t\tconst retryAfter = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(normalizedNewEmail, 'email_change_init', 'email_change_complete'),\n\t\t)\n\t\tif (retryAfter > 0) {\n\t\t\treturn new ResponseError('RATE_LIMIT_EXCEEDED', 'Too many e-mail change requests for this address.')\n\t\t}\n\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait dbContext.transaction(async db => {\n\t\t\tif (applyWithinTransaction) {\n\t\t\t\tawait applyWithinTransaction(db)\n\t\t\t}\n\t\t\tconst result = await db.commandBus.execute(\n\t\t\t\tCreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail),\n\t\t\t)\n\t\t\t// The verification link goes to the NEW address — clicking it proves\n\t\t\t// ownership of the address being switched to, which is the whole point.\n\t\t\tawait this.mailer.sendEmailChangeVerifyEmail(\n\t\t\t\tdb,\n\t\t\t\t{\n\t\t\t\t\temail: normalizedNewEmail,\n\t\t\t\t\ttoken: result.token,\n\t\t\t\t\tproject: project?.name,\n\t\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t\t},\n\t\t\t)\n\t\t})\n\t\treturn new ResponseOk(null)\n\t}\n\n\tpublic async confirmEmailChange(dbContext: DatabaseContext, token: string): Promise<ConfirmEmailChangeResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_change'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Tie the failure to a person/token in the audit log when we can, even\n\t\t\t// for an invalid/expired token (matches verifyEmail / password reset).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst newEmail = validation.result.meta?.email\n\t\tif (!newEmail) {\n\t\t\tthrow new ImplementationException('email_change token is missing its email payload')\n\t\t}\n\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Re-check uniqueness at confirmation time: another account may have\n\t\t// claimed the address between request and confirmation.\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, newEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\n\t\tconst oldEmail = person.email\n\t\ttry {\n\t\t\tawait dbContext.transaction(async db => {\n\t\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(person.id, newEmail))\n\t\t\t\t// An email change is a takeover-grade event: drop every existing\n\t\t\t\t// session so a stale attacker session cannot ride the new address.\n\t\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id)\n\t\t\t})\n\t\t} catch (e) {\n\t\t\t// The uniqueness re-check above narrows but cannot fully close the\n\t\t\t// window: another account may claim the address between the check and\n\t\t\t// this UPDATE. The unique index is the real guard — translate its\n\t\t\t// violation into a clean error instead of leaking a 500.\n\t\t\tif (e instanceof UniqueViolationError) {\n\t\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${newEmail} already exists`, {\n\t\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\n\t\tif (oldEmail) {\n\t\t\t// Resolve the person's preferred project so a per-project\n\t\t\t// EMAIL_CHANGE_NOTIFY template (and branding) is honoured, mirroring\n\t\t\t// requestEmailChange. The token carries no project, so derive it from the\n\t\t\t// person's own identity.\n\t\t\tconst permissionContext = this.permissionContextFactory.create(dbContext, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, null)\n\t\t\tawait this.mailer.sendEmailChangeNotifyEmail(\n\t\t\t\tdbContext,\n\t\t\t\t{ email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },\n\t\t\t\t{ projectId: project?.id ?? null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn new ResponseOk({ personId: person.id, newEmail, [AuthLogService.Key]: authLogData })\n\t}\n}\n\nexport type RequestEmailChangeResponse = Response<null, EmailValidatorError | 'RATE_LIMIT_EXCEEDED'>\n\nexport type ConfirmEmailChangeResponse = Response<\n\t{ personId: string; newEmail: string; [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError | EmailValidatorError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":["normalizeEmail","ResponseError","NextMailAttemptQuery","getPreferredProject","CreatePersonTokenCommand","ResponseOk","token","PersonTokenQuery","validateToken","AuthLogService","ImplementationException","PersonQuery","InvalidateTokenCommand","MarkEmailVerifiedCommand","UniqueViolationError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAwBO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,QACA,gBACA,gBACA,eACA,0BAChB;AALgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,iBAAA;AACA,SAAA,gBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,mBACZ,WACA,mBACA,QACA,UACA,cAA2B,CAAA,GAC3B,wBACsC;AACtC,UAAM,qBAAqBA,MAAAA,eAAe,QAAQ;AAClD,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,kBAAkB;AAC7F,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAIC,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,IAC7E;AAOA,UAAM,aAAa,MAAM,UAAU,aAAa;AAAA,MAC/C,IAAIC,qBAAAA,qBAAqB,oBAAoB,qBAAqB,uBAAuB;AAAA,IAAA;AAE1F,QAAI,aAAa,GAAG;AACnB,aAAO,IAAID,SAAAA,cAAc,uBAAuB,mDAAmD;AAAA,IACpG;AAEA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUE,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,UAAI,wBAAwB;AAC3B,cAAM,uBAAuB,EAAE;AAAA,MAChC;AACA,YAAM,SAAS,MAAM,GAAG,WAAW;AAAA,QAClCC,yBAAAA,yBAAyB,yBAAyB,OAAO,IAAI,kBAAkB;AAAA,MAAA;AAIhF,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA;AAAA,UACC,OAAO;AAAA,UACP,OAAO,OAAO;AAAA,UACd,SAAS,SAAS;AAAA,UAClB,aAAa,SAAS;AAAA,QAAA;AAAA,QAEvB;AAAA,UACC,SAAS,YAAY,eAAe;AAAA,UACpC,WAAW,SAAS,MAAM;AAAA,QAAA;AAAA,MAC3B;AAAA,IAEF,CAAC;AACD,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAa,mBAAmB,WAA4BC,SAAoD;AAC/G,UAAM,WAAW,MAAM,UAAU,aAAa,MAAMC,iBAAAA,iBAAiB,QAAQD,SAAO,cAAc,CAAC;AACnG,UAAM,aAAaE,MAAAA,cAAc,EAAE,OAAO,iBAAUF,SAAO,gBAAgB,SAAS;AACpF,QAAI,CAAC,WAAW,IAAI;AAGnB,aAAO,IAAIL,SAAAA,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAACQ,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAIA,eAAAA,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,WAAW,OAAO,MAAM;AACzC,QAAI,CAAC,UAAU;AACd,YAAM,IAAIC,WAAAA,wBAAwB,iDAAiD;AAAA,IACpF;AAEA,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMC,wBAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAID,WAAAA,wBAAA;AAAA,IACX;AAIA,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,QAAQ;AACnF,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAIT,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,cAAc;AAAA,QAC7E,CAACQ,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AAEA,UAAM,WAAW,OAAO;AACxB,QAAI;AACH,YAAM,UAAU,YAAY,OAAM,OAAM;AACvC,cAAM,GAAG,WAAW,QAAQ,IAAIG,uBAAAA,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,cAAM,GAAG,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,OAAO,IAAI,QAAQ,CAAC;AAG7E,cAAM,KAAK,cAAc,uBAAuB,IAAI,OAAO,WAAW;AAAA,MACvE,CAAC;AAAA,IACF,SAAS,GAAG;AAKX,UAAI,aAAaC,SAAAA,sBAAsB;AACtC,eAAO,IAAIb,SAAAA,cAAc,wBAAwB,mBAAmB,QAAQ,mBAAmB;AAAA,UAC9F,CAACQ,eAAAA,eAAe,GAAG,GAAG;AAAA,QAAA,CACtB;AAAA,MACF;AACA,YAAM;AAAA,IACP;AAEA,QAAI,UAAU;AAKb,YAAM,oBAAoB,KAAK,yBAAyB,OAAO,WAAW;AAAA,QACzE,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,YAAM,UAAUN,oBAAAA,oBAAoB,UAAU,IAAI;AAClD,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA,EAAE,OAAO,UAAU,UAAU,SAAS,SAAS,MAAM,aAAa,SAAS,KAAA;AAAA,QAC3E,EAAE,WAAW,SAAS,MAAM,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEhD;AAEA,WAAO,IAAIE,SAAAA,WAAW,EAAE,UAAU,OAAO,IAAI,UAAU,CAACI,eAAAA,eAAe,GAAG,GAAG,aAAa;AAAA,EAC3F;AACD;;"}

package/dist/development/src/model/service/EmailChangeManager.js

@@ -0,0 +1,136 @@
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import { UniqueViolationError } from "@contember/database";
+import "../type/ApiKey.js";
+import { ImplementationException } from "../../exceptions.js";
+import { PersonQuery } from "../queries/person/PersonQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
+import "../authorization/PermissionContext.js";
+import "../authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import { getPreferredProject } from "./helpers/getPreferredProject.js";
+import { validateToken } from "../utils/token.js";
+import { normalizeEmail } from "../utils/email.js";
+import { MarkEmailVerifiedCommand } from "../commands/person/MarkEmailVerifiedCommand.js";
+import { CreatePersonTokenCommand } from "../commands/personToken/CreatePersonTokenCommand.js";
+import { InvalidateTokenCommand } from "../commands/personToken/InvalidateTokenCommand.js";
+import { PersonTokenQuery } from "../queries/personToken/PersonTokenQuery.js";
+import { NextMailAttemptQuery } from "../queries/authLog/NextMailAttemptQuery.js";
+import { AuthLogService } from "./AuthLogService.js";
+class EmailChangeManager {
+  constructor(mailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory) {
+    this.mailer = mailer;
+    this.projectManager = projectManager;
+    this.emailValidator = emailValidator;
+    this.apiKeyManager = apiKeyManager;
+    this.permissionContextFactory = permissionContextFactory;
+  }
+  /**
+   * Request an e-mail change. Validation and rate-limiting run BEFORE any
+   * write, so a rejected request never leaves a half-applied profile (e.g. a
+   * persisted name change without the e-mail change going through). Any
+   * immediate side-changes the caller wants applied atomically with the token
+   * (the name change) are passed via `applyWithinTransaction`.
+   */
+  async requestEmailChange(dbContext, permissionContext, person, newEmail, mailOptions = {}, applyWithinTransaction) {
+    const normalizedNewEmail = normalizeEmail(newEmail);
+    const validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail);
+    if (validationError !== null) {
+      return new ResponseError(validationError.error, validationError.errorMessage);
+    }
+    const retryAfter = await dbContext.queryHandler.fetch(
+      new NextMailAttemptQuery(normalizedNewEmail, "email_change_init", "email_change_complete")
+    );
+    if (retryAfter > 0) {
+      return new ResponseError("RATE_LIMIT_EXCEEDED", "Too many e-mail change requests for this address.");
+    }
+    const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+    const project = getPreferredProject(projects, mailOptions.project ?? null);
+    await dbContext.transaction(async (db) => {
+      if (applyWithinTransaction) {
+        await applyWithinTransaction(db);
+      }
+      const result = await db.commandBus.execute(
+        CreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail)
+      );
+      await this.mailer.sendEmailChangeVerifyEmail(
+        db,
+        {
+          email: normalizedNewEmail,
+          token: result.token,
+          project: project?.name,
+          projectSlug: project?.slug
+        },
+        {
+          variant: mailOptions.mailVariant || "",
+          projectId: project?.id ?? null
+        }
+      );
+    });
+    return new ResponseOk(null);
+  }
+  async confirmEmailChange(dbContext, token) {
+    const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, "email_change"));
+    const validation = validateToken({ entry: tokenRow, token, validationType: "token" });
+    if (!validation.ok) {
+      return new ResponseError(validation.error, validation.errorMessage, {
+        [AuthLogService.Key]: new AuthLogService.Bag(
+          tokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {}
+        )
+      });
+    }
+    const authLogData = new AuthLogService.Bag({
+      personId: validation.result.person_id,
+      tokenId: validation.result.id
+    });
+    const newEmail = validation.result.meta?.email;
+    if (!newEmail) {
+      throw new ImplementationException("email_change token is missing its email payload");
+    }
+    const person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id));
+    if (!person) {
+      throw new ImplementationException();
+    }
+    const validationError = await this.emailValidator.validateEmail(dbContext, newEmail);
+    if (validationError !== null) {
+      return new ResponseError(validationError.error, validationError.errorMessage, {
+        [AuthLogService.Key]: authLogData
+      });
+    }
+    const oldEmail = person.email;
+    try {
+      await dbContext.transaction(async (db) => {
+        await db.commandBus.execute(new InvalidateTokenCommand(validation.result.id));
+        await db.commandBus.execute(new MarkEmailVerifiedCommand(person.id, newEmail));
+        await this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id);
+      });
+    } catch (e) {
+      if (e instanceof UniqueViolationError) {
+        return new ResponseError("EMAIL_ALREADY_EXISTS", `User with email ${newEmail} already exists`, {
+          [AuthLogService.Key]: authLogData
+        });
+      }
+      throw e;
+    }
+    if (oldEmail) {
+      const permissionContext = this.permissionContextFactory.create(dbContext, {
+        id: person.identity_id,
+        roles: person.roles
+      });
+      const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
+      const project = getPreferredProject(projects, null);
+      await this.mailer.sendEmailChangeNotifyEmail(
+        dbContext,
+        { email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },
+        { projectId: project?.id ?? null, variant: "" }
+      );
+    }
+    return new ResponseOk({ personId: person.id, newEmail, [AuthLogService.Key]: authLogData });
+  }
+}
+export {
+  EmailChangeManager
+};
+//# sourceMappingURL=EmailChangeManager.js.map

package/dist/development/src/model/service/EmailChangeManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailChangeManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext, PermissionContextFactory } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { ApiKeyManager } from './apiKey/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { normalizeEmail } from '../utils/email.js'\nimport { PersonToken } from '../type/index.js'\nimport { UniqueViolationError } from '@contember/database'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailChangeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\t/**\n\t * Request an e-mail change. Validation and rate-limiting run BEFORE any\n\t * write, so a rejected request never leaves a half-applied profile (e.g. a\n\t * persisted name change without the e-mail change going through). Any\n\t * immediate side-changes the caller wants applied atomically with the token\n\t * (the name change) are passed via `applyWithinTransaction`.\n\t */\n\tpublic async requestEmailChange(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tnewEmail: string,\n\t\tmailOptions: MailOptions = {},\n\t\tapplyWithinTransaction?: (db: DatabaseContext) => Promise<void>,\n\t): Promise<RequestEmailChangeResponse> {\n\t\tconst normalizedNewEmail = normalizeEmail(newEmail)\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t}\n\n\t\t// Per-recipient exponential backoff: an authenticated user (or a hijacked\n\t\t// session) must not be able to flood an arbitrary address with\n\t\t// \"confirm your new e-mail\" mails. Keyed on the normalized NEW address so\n\t\t// the `email_change_init` auth-log entries (written with the same\n\t\t// normalized address) actually drive the backoff. Reuses login_* config.\n\t\tconst retryAfter = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(normalizedNewEmail, 'email_change_init', 'email_change_complete'),\n\t\t)\n\t\tif (retryAfter > 0) {\n\t\t\treturn new ResponseError('RATE_LIMIT_EXCEEDED', 'Too many e-mail change requests for this address.')\n\t\t}\n\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait dbContext.transaction(async db => {\n\t\t\tif (applyWithinTransaction) {\n\t\t\t\tawait applyWithinTransaction(db)\n\t\t\t}\n\t\t\tconst result = await db.commandBus.execute(\n\t\t\t\tCreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail),\n\t\t\t)\n\t\t\t// The verification link goes to the NEW address — clicking it proves\n\t\t\t// ownership of the address being switched to, which is the whole point.\n\t\t\tawait this.mailer.sendEmailChangeVerifyEmail(\n\t\t\t\tdb,\n\t\t\t\t{\n\t\t\t\t\temail: normalizedNewEmail,\n\t\t\t\t\ttoken: result.token,\n\t\t\t\t\tproject: project?.name,\n\t\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t\t},\n\t\t\t)\n\t\t})\n\t\treturn new ResponseOk(null)\n\t}\n\n\tpublic async confirmEmailChange(dbContext: DatabaseContext, token: string): Promise<ConfirmEmailChangeResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_change'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Tie the failure to a person/token in the audit log when we can, even\n\t\t\t// for an invalid/expired token (matches verifyEmail / password reset).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst newEmail = validation.result.meta?.email\n\t\tif (!newEmail) {\n\t\t\tthrow new ImplementationException('email_change token is missing its email payload')\n\t\t}\n\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Re-check uniqueness at confirmation time: another account may have\n\t\t// claimed the address between request and confirmation.\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, newEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\n\t\tconst oldEmail = person.email\n\t\ttry {\n\t\t\tawait dbContext.transaction(async db => {\n\t\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(person.id, newEmail))\n\t\t\t\t// An email change is a takeover-grade event: drop every existing\n\t\t\t\t// session so a stale attacker session cannot ride the new address.\n\t\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id)\n\t\t\t})\n\t\t} catch (e) {\n\t\t\t// The uniqueness re-check above narrows but cannot fully close the\n\t\t\t// window: another account may claim the address between the check and\n\t\t\t// this UPDATE. The unique index is the real guard — translate its\n\t\t\t// violation into a clean error instead of leaking a 500.\n\t\t\tif (e instanceof UniqueViolationError) {\n\t\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${newEmail} already exists`, {\n\t\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\n\t\tif (oldEmail) {\n\t\t\t// Resolve the person's preferred project so a per-project\n\t\t\t// EMAIL_CHANGE_NOTIFY template (and branding) is honoured, mirroring\n\t\t\t// requestEmailChange. The token carries no project, so derive it from the\n\t\t\t// person's own identity.\n\t\t\tconst permissionContext = this.permissionContextFactory.create(dbContext, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, null)\n\t\t\tawait this.mailer.sendEmailChangeNotifyEmail(\n\t\t\t\tdbContext,\n\t\t\t\t{ email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },\n\t\t\t\t{ projectId: project?.id ?? null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn new ResponseOk({ personId: person.id, newEmail, [AuthLogService.Key]: authLogData })\n\t}\n}\n\nexport type RequestEmailChangeResponse = Response<null, EmailValidatorError | 'RATE_LIMIT_EXCEEDED'>\n\nexport type ConfirmEmailChangeResponse = Response<\n\t{ personId: string; newEmail: string; [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError | EmailValidatorError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,QACA,gBACA,gBACA,eACA,0BAChB;AALgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,iBAAA;AACA,SAAA,gBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,mBACZ,WACA,mBACA,QACA,UACA,cAA2B,CAAA,GAC3B,wBACsC;AACtC,UAAM,qBAAqB,eAAe,QAAQ;AAClD,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,kBAAkB;AAC7F,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,IAC7E;AAOA,UAAM,aAAa,MAAM,UAAU,aAAa;AAAA,MAC/C,IAAI,qBAAqB,oBAAoB,qBAAqB,uBAAuB;AAAA,IAAA;AAE1F,QAAI,aAAa,GAAG;AACnB,aAAO,IAAI,cAAc,uBAAuB,mDAAmD;AAAA,IACpG;AAEA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,UAAI,wBAAwB;AAC3B,cAAM,uBAAuB,EAAE;AAAA,MAChC;AACA,YAAM,SAAS,MAAM,GAAG,WAAW;AAAA,QAClC,yBAAyB,yBAAyB,OAAO,IAAI,kBAAkB;AAAA,MAAA;AAIhF,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA;AAAA,UACC,OAAO;AAAA,UACP,OAAO,OAAO;AAAA,UACd,SAAS,SAAS;AAAA,UAClB,aAAa,SAAS;AAAA,QAAA;AAAA,QAEvB;AAAA,UACC,SAAS,YAAY,eAAe;AAAA,UACpC,WAAW,SAAS,MAAM;AAAA,QAAA;AAAA,MAC3B;AAAA,IAEF,CAAC;AACD,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAa,mBAAmB,WAA4B,OAAoD;AAC/G,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,iBAAiB,QAAQ,OAAO,cAAc,CAAC;AACnG,UAAM,aAAa,cAAc,EAAE,OAAO,UAAU,OAAO,gBAAgB,SAAS;AACpF,QAAI,CAAC,WAAW,IAAI;AAGnB,aAAO,IAAI,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAI,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,WAAW,OAAO,MAAM;AACzC,QAAI,CAAC,UAAU;AACd,YAAM,IAAI,wBAAwB,iDAAiD;AAAA,IACpF;AAEA,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAA;AAAA,IACX;AAIA,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,QAAQ;AACnF,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,cAAc;AAAA,QAC7E,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AAEA,UAAM,WAAW,OAAO;AACxB,QAAI;AACH,YAAM,UAAU,YAAY,OAAM,OAAM;AACvC,cAAM,GAAG,WAAW,QAAQ,IAAI,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,cAAM,GAAG,WAAW,QAAQ,IAAI,yBAAyB,OAAO,IAAI,QAAQ,CAAC;AAG7E,cAAM,KAAK,cAAc,uBAAuB,IAAI,OAAO,WAAW;AAAA,MACvE,CAAC;AAAA,IACF,SAAS,GAAG;AAKX,UAAI,aAAa,sBAAsB;AACtC,eAAO,IAAI,cAAc,wBAAwB,mBAAmB,QAAQ,mBAAmB;AAAA,UAC9F,CAAC,eAAe,GAAG,GAAG;AAAA,QAAA,CACtB;AAAA,MACF;AACA,YAAM;AAAA,IACP;AAEA,QAAI,UAAU;AAKb,YAAM,oBAAoB,KAAK,yBAAyB,OAAO,WAAW;AAAA,QACzE,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,YAAM,UAAU,oBAAoB,UAAU,IAAI;AAClD,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA,EAAE,OAAO,UAAU,UAAU,SAAS,SAAS,MAAM,aAAa,SAAS,KAAA;AAAA,QAC3E,EAAE,WAAW,SAAS,MAAM,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEhD;AAEA,WAAO,IAAI,WAAW,EAAE,UAAU,OAAO,IAAI,UAAU,CAAC,eAAe,GAAG,GAAG,aAAa;AAAA,EAC3F;AACD;"}

package/dist/development/src/model/service/EmailOtpManager.cjs

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("@contember/database");
+require("../type/ApiKey.cjs");
+const InvalidateTokenCommand = require("../commands/personToken/InvalidateTokenCommand.cjs");
+const InvalidateEmailOtpTokensCommand = require("../commands/personToken/InvalidateEmailOtpTokensCommand.cjs");
+const ClaimOtpAttemptCommand = require("../commands/personToken/ClaimOtpAttemptCommand.cjs");
+const PersonTokenQuery = require("../queries/personToken/PersonTokenQuery.cjs");
+const SaveEmailOtpTokenCommand = require("../commands/personToken/SaveEmailOtpTokenCommand.cjs");
+const token = require("../utils/token.cjs");
+const RateLimit = require("../type/RateLimit.cjs");
+const EMAIL_OTP_EXPIRATION_MINUTES = 10;
+const EMAIL_OTP_DIGITS = 6;
+class EmailOtpManager {
+  constructor(mailer, providers, rateLimiter) {
+    this.mailer = mailer;
+    this.providers = providers;
+    this.rateLimiter = rateLimiter;
+  }
+  /**
+   * Generates a fresh code, invalidates any prior unused email-OTP tokens for the
+   * person, persists the new one and emails the code. Must run inside the request's
+   * db context (it issues commands + sends mail).
+   *
+   * Gated by the per-person `email_otp_per_person` rate limit so an attacker who
+   * knows the password cannot re-issue codes to reset the per-code 3-attempt
+   * counter, nor email-bomb a person. When the limit is hit nothing is sent and
+   * the returned decision is `ok: false` (the caller decides how to surface it);
+   * a previously emailed, still-valid code remains usable.
+   */
+  async sendCode(dbContext, person, config) {
+    const decision = await this.rateLimiter.consume(dbContext, RateLimit.RateLimitScopes.emailOtpPerPerson, person.id, config);
+    if (!decision.ok) {
+      return decision;
+    }
+    const code = await this.generateCode();
+    await dbContext.commandBus.execute(new InvalidateEmailOtpTokensCommand.InvalidateEmailOtpTokensCommand(person.id));
+    await dbContext.commandBus.execute(new SaveEmailOtpTokenCommand.SaveEmailOtpTokenCommand(person.id, code, EMAIL_OTP_EXPIRATION_MINUTES));
+    await this.mailer.sendEmailOtpEmail(dbContext, {
+      email: person.email ?? "",
+      code
+    }, {
+      variant: "",
+      projectId: null
+    });
+    return decision;
+  }
+  /**
+   * Fetches the latest unused email-OTP token for the person and validates the
+   * supplied code via the shared `'otp'` path; on success, consumes (invalidates)
+   * the token. Returns whether the code was accepted.
+   *
+   * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}
+   * — a single conditional UPDATE that increments `otp_attempts` only while it is
+   * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent
+   * writers on the row, N parallel guesses can never collectively exceed the cap;
+   * a plain read-then-increment let them all pass with a stale counter.
+   */
+  async verifyAndConsume(dbContext, person, code) {
+    const tokenResult = await dbContext.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.latestUnusedByPerson(person.id, "mfa_email_otp"));
+    if (!tokenResult) {
+      return false;
+    }
+    const reserved = await dbContext.commandBus.execute(new ClaimOtpAttemptCommand.ClaimOtpAttemptCommand(tokenResult.id, token.MAX_OTP_ATTEMPTS));
+    if (!reserved) {
+      return false;
+    }
+    const validation = token.validateToken({
+      entry: tokenResult,
+      token: code,
+      validationType: "otp"
+    });
+    if (!validation.ok) {
+      return false;
+    }
+    await dbContext.commandBus.execute(new InvalidateTokenCommand.InvalidateTokenCommand(validation.result.id));
+    return true;
+  }
+  async generateCode() {
+    const bytes = await this.providers.randomBytes(EMAIL_OTP_DIGITS);
+    let code = "";
+    for (let i = 0; i < EMAIL_OTP_DIGITS; i++) {
+      code += (bytes[i] % 10).toString();
+    }
+    return code;
+  }
+}
+exports.EmailOtpManager = EmailOtpManager;
+//# sourceMappingURL=EmailOtpManager.cjs.map

package/dist/development/src/model/service/EmailOtpManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailOtpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailOtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries/index.js'\nimport { DatabaseContext, MAX_OTP_ATTEMPTS, validateToken } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ClaimOtpAttemptCommand, InvalidateEmailOtpTokensCommand, InvalidateTokenCommand, SaveEmailOtpTokenCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { RateLimitDecision, RateLimiter } from './RateLimiter.js'\nimport { RateLimitScopes } from '../type/RateLimit.js'\nimport { Config } from '../type/Config.js'\n\n/** Email-OTP codes are short-lived numeric codes delivered by email. */\nconst EMAIL_OTP_EXPIRATION_MINUTES = 10\nconst EMAIL_OTP_DIGITS = 6\n\n/**\n * Email OTP as a second factor (A05). Opt-in per person via\n * `person_mfa.email_otp_enabled`. The emitted code is a 6-digit numeric code,\n * transported through a short-lived `mfa_email_otp` person_token (the code's hash\n * lives in `otp_hash`), validated through the shared `'otp'` token path (max 3\n * attempts). Behavior for anyone who hasn't enabled it is unchanged.\n */\nexport class EmailOtpManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly providers: Pick<Providers, 'randomBytes' | 'now' | 'uuid'>,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\t/**\n\t * Generates a fresh code, invalidates any prior unused email-OTP tokens for the\n\t * person, persists the new one and emails the code. Must run inside the request's\n\t * db context (it issues commands + sends mail).\n\t *\n\t * Gated by the per-person `email_otp_per_person` rate limit so an attacker who\n\t * knows the password cannot re-issue codes to reset the per-code 3-attempt\n\t * counter, nor email-bomb a person. When the limit is hit nothing is sent and\n\t * the returned decision is `ok: false` (the caller decides how to surface it);\n\t * a previously emailed, still-valid code remains usable.\n\t */\n\tasync sendCode(dbContext: DatabaseContext, person: PersonRow, config: Config): Promise<RateLimitDecision> {\n\t\tconst decision = await this.rateLimiter.consume(dbContext, RateLimitScopes.emailOtpPerPerson, person.id, config)\n\t\tif (!decision.ok) {\n\t\t\treturn decision\n\t\t}\n\t\tconst code = await this.generateCode()\n\t\t// Only the latest emailed code may ever verify.\n\t\tawait dbContext.commandBus.execute(new InvalidateEmailOtpTokensCommand(person.id))\n\t\tawait dbContext.commandBus.execute(new SaveEmailOtpTokenCommand(person.id, code, EMAIL_OTP_EXPIRATION_MINUTES))\n\t\tawait this.mailer.sendEmailOtpEmail(dbContext, {\n\t\t\temail: person.email ?? '',\n\t\t\tcode,\n\t\t}, {\n\t\t\tvariant: '',\n\t\t\tprojectId: null,\n\t\t})\n\t\treturn decision\n\t}\n\n\t/**\n\t * Fetches the latest unused email-OTP token for the person and validates the\n\t * supplied code via the shared `'otp'` path; on success, consumes (invalidates)\n\t * the token. Returns whether the code was accepted.\n\t *\n\t * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}\n\t * — a single conditional UPDATE that increments `otp_attempts` only while it is\n\t * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent\n\t * writers on the row, N parallel guesses can never collectively exceed the cap;\n\t * a plain read-then-increment let them all pass with a stale counter.\n\t */\n\tasync verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean> {\n\t\tconst tokenResult = await dbContext.queryHandler.fetch(PersonTokenQuery.latestUnusedByPerson(person.id, 'mfa_email_otp'))\n\t\tif (!tokenResult) {\n\t\t\treturn false\n\t\t}\n\t\t// Atomically reserve a guess slot before comparing the code. A false result\n\t\t// means the token was already used/replaced or the attempt cap is exhausted.\n\t\tconst reserved = await dbContext.commandBus.execute(new ClaimOtpAttemptCommand(tokenResult.id, MAX_OTP_ATTEMPTS))\n\t\tif (!reserved) {\n\t\t\treturn false\n\t\t}\n\t\t// otp_hash and expires_at are immutable for a token, so validating against the\n\t\t// pre-claim snapshot is correct; the attempt has already been counted.\n\t\tconst validation = validateToken({\n\t\t\tentry: tokenResult,\n\t\t\ttoken: code,\n\t\t\tvalidationType: 'otp',\n\t\t})\n\t\tif (!validation.ok) {\n\t\t\treturn false\n\t\t}\n\t\tawait dbContext.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\treturn true\n\t}\n\n\tprivate async generateCode(): Promise<string> {\n\t\t// Rejection-free uniform-ish digits is acceptable here: this is a second factor\n\t\t// behind a valid password, short-lived, and capped at 3 attempts.\n\t\tconst bytes = await this.providers.randomBytes(EMAIL_OTP_DIGITS)\n\t\tlet code = ''\n\t\tfor (let i = 0; i < EMAIL_OTP_DIGITS; i++) {\n\t\t\tcode += (bytes[i] % 10).toString()\n\t\t}\n\t\treturn code\n\t}\n}\n"],"names":["RateLimitScopes","InvalidateEmailOtpTokensCommand","SaveEmailOtpTokenCommand","PersonTokenQuery","ClaimOtpAttemptCommand","MAX_OTP_ATTEMPTS","validateToken","InvalidateTokenCommand"],"mappings":";;;;;;;;;;;AAWA,MAAM,+BAA+B;AACrC,MAAM,mBAAmB;AASlB,MAAM,gBAAgB;AAAA,EAC5B,YACkB,QACA,WACA,aAChB;AAHgB,SAAA,SAAA;AACA,SAAA,YAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaH,MAAM,SAAS,WAA4B,QAAmB,QAA4C;AACzG,UAAM,WAAW,MAAM,KAAK,YAAY,QAAQ,WAAWA,UAAAA,gBAAgB,mBAAmB,OAAO,IAAI,MAAM;AAC/G,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,aAAA;AAExB,UAAM,UAAU,WAAW,QAAQ,IAAIC,gCAAAA,gCAAgC,OAAO,EAAE,CAAC;AACjF,UAAM,UAAU,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,OAAO,IAAI,MAAM,4BAA4B,CAAC;AAC9G,UAAM,KAAK,OAAO,kBAAkB,WAAW;AAAA,MAC9C,OAAO,OAAO,SAAS;AAAA,MACvB;AAAA,IAAA,GACE;AAAA,MACF,SAAS;AAAA,MACT,WAAW;AAAA,IAAA,CACX;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,iBAAiB,WAA4B,QAAmB,MAAgC;AACrG,UAAM,cAAc,MAAM,UAAU,aAAa,MAAMC,kCAAiB,qBAAqB,OAAO,IAAI,eAAe,CAAC;AACxH,QAAI,CAAC,aAAa;AACjB,aAAO;AAAA,IACR;AAGA,UAAM,WAAW,MAAM,UAAU,WAAW,QAAQ,IAAIC,uBAAAA,uBAAuB,YAAY,IAAIC,MAAAA,gBAAgB,CAAC;AAChH,QAAI,CAAC,UAAU;AACd,aAAO;AAAA,IACR;AAGA,UAAM,aAAaC,MAAAA,cAAc;AAAA,MAChC,OAAO;AAAA,MACP,OAAO;AAAA,MACP,gBAAgB;AAAA,IAAA,CAChB;AACD,QAAI,CAAC,WAAW,IAAI;AACnB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,uBAAAA,uBAAuB,WAAW,OAAO,EAAE,CAAC;AACnF,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,eAAgC;AAG7C,UAAM,QAAQ,MAAM,KAAK,UAAU,YAAY,gBAAgB;AAC/D,QAAI,OAAO;AACX,aAAS,IAAI,GAAG,IAAI,kBAAkB,KAAK;AAC1C,eAAS,MAAM,CAAC,IAAI,IAAI,SAAA;AAAA,IACzB;AACA,WAAO;AAAA,EACR;AACD;;"}