@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/development/src/model/service/PersonAccessManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonAccessManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { Logger } from '@contember/logger'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand'\nimport { ApiKeyManager } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { DisablePersonErrorCode } from '../../schema'\n\nclass PersonAccessManager {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, person: PersonRow, logger: Logger): Promise<PersonDisableAccessResponse> {\n\t\t// Retried: the api_key update races the target's own background session tracking and loses with a 40001,\n\t\t// which would otherwise leave the person enabled behind an internal error. Nothing here escapes the transaction.\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tif (person.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, person.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, person.identity_id)\n\n\t\t\treturn new ResponseOk(null)\n\t\t}, { retry: { logger } })\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":[],"mappings":";;AAQA,MAAM,oBAAoB;AAAA,EACzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,WAA4B,QAAmB,QAAsD;AAGxH,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC/C,UAAI,OAAO,gBAAgB,MAAM;AAChC,eAAO,IAAI,cAAc,2BAA2B,4BAA4B;AAAA,MACjF;AAGA,YAAM,KAAK,qBAAqB,KAAK,OAAO,EAAE;AAC9C,YAAM,KAAK,uBAAuB,KAAK,OAAO,WAAW;AAEzD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,GAAG,EAAE,OAAO,EAAE,OAAA,GAAU;AAAA,EACzB;AAAA,EAEA,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,CAAC;AAAA,EACtE;AAAA,EAEA,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAC5E;AACD;"}
+{"version":3,"file":"PersonAccessManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonAccessManager.ts"],"sourcesContent":["import { Logger } from '@contember/logger'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { DisablePersonCommand } from '../commands/person/DisablePersonCommand.js'\nimport { EnablePersonCommand } from '../commands/person/EnablePersonCommand.js'\nimport { ApiKeyManager } from './apiKey/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { DisablePersonErrorCode, EnablePersonErrorCode } from '../../schema/index.js'\n\nclass PersonAccessManager {\n\tconstructor(private readonly apiKeyManager: ApiKeyManager) {}\n\n\tasync disablePerson(dbContext: DatabaseContext, person: PersonRow, logger: Logger): Promise<PersonDisableAccessResponse> {\n\t\t// Retried: the api_key update races the target's own background session tracking and loses with a 40001,\n\t\t// which would otherwise leave the person enabled behind an internal error. Nothing here escapes the transaction.\n\t\treturn await dbContext.transaction(async trx => {\n\t\t\tif (person.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_ALREADY_DISABLED', 'Person is already disabled')\n\t\t\t}\n\n\t\t\t// Deactivate person & invalidate all api keys associated with person identity\n\t\t\tawait this.disablePersonAccount(trx, person.id)\n\t\t\tawait this.disableIdentityApiKeys(trx, person.identity_id)\n\n\t\t\treturn new ResponseOk(null)\n\t\t}, { retry: { logger } })\n\t}\n\n\tasync enablePerson(dbContext: DatabaseContext, person: PersonRow): Promise<PersonEnableAccessResponse> {\n\t\tif (person.disabled_at === null) {\n\t\t\treturn new ResponseError('PERSON_ALREADY_ENABLED', 'Person is already enabled')\n\t\t}\n\n\t\t// Only clears the disabled flag — api keys revoked while disabling stay revoked, the person has to sign in again.\n\t\tawait dbContext.commandBus.execute(new EnablePersonCommand(person.id))\n\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate async disablePersonAccount(dbContext: DatabaseContext, personId: string) {\n\t\tawait dbContext.commandBus.execute(new DisablePersonCommand(personId))\n\t}\n\n\tprivate async disableIdentityApiKeys(dbContext: DatabaseContext, personIdentityId: string) {\n\t\tawait this.apiKeyManager.disableIdentityApiKeys(dbContext, personIdentityId)\n\t}\n}\n\nexport type PersonDisableAccessResponse = Response<null, DisablePersonErrorCode>\nexport type PersonEnableAccessResponse = Response<null, EnablePersonErrorCode>\n\nexport { PersonAccessManager }\n"],"names":[],"mappings":";;;AASA,MAAM,oBAAoB;AAAA,EACzB,YAA6B,eAA8B;AAA9B,SAAA,gBAAA;AAAA,EAA+B;AAAA,EAE5D,MAAM,cAAc,WAA4B,QAAmB,QAAsD;AAGxH,WAAO,MAAM,UAAU,YAAY,OAAM,QAAO;AAC/C,UAAI,OAAO,gBAAgB,MAAM;AAChC,eAAO,IAAI,cAAc,2BAA2B,4BAA4B;AAAA,MACjF;AAGA,YAAM,KAAK,qBAAqB,KAAK,OAAO,EAAE;AAC9C,YAAM,KAAK,uBAAuB,KAAK,OAAO,WAAW;AAEzD,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,GAAG,EAAE,OAAO,EAAE,OAAA,GAAU;AAAA,EACzB;AAAA,EAEA,MAAM,aAAa,WAA4B,QAAwD;AACtG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,0BAA0B,2BAA2B;AAAA,IAC/E;AAGA,UAAM,UAAU,WAAW,QAAQ,IAAI,oBAAoB,OAAO,EAAE,CAAC;AAErE,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAc,qBAAqB,WAA4B,UAAkB;AAChF,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,CAAC;AAAA,EACtE;AAAA,EAEA,MAAc,uBAAuB,WAA4B,kBAA0B;AAC1F,UAAM,KAAK,cAAc,uBAAuB,WAAW,gBAAgB;AAAA,EAC5E;AACD;"}

package/dist/development/src/model/service/PersonManager.cjs

@@ -4,14 +4,17 @@ const ChangeProfileCommand = require("../commands/person/ChangeProfileCommand.cj
 const Response = require("../utils/Response.cjs");
 require("../queries/apiKey/ApiKeyQuery.cjs");
 require("@contember/database");
+require("../type/ApiKey.cjs");
 const PersonQuery = require("../queries/person/PersonQuery.cjs");
+const PersonsQuery = require("../queries/person/PersonsQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../type/ApiKey.cjs");
 require("node:crypto");
+const email = require("../utils/email.cjs");
 const TogglePersonPasswordlessCommand = require("../commands/person/TogglePersonPasswordlessCommand.cjs");
 class PersonManager {
   constructor(emailValidator) {
@@ -22,14 +25,18 @@ class PersonManager {
       PersonQuery.PersonQuery.byId(personId)
     );
   }
+  async listPersons(dbContext, filter = {}, limit, offset) {
+    return await dbContext.queryHandler.fetch(new PersonsQuery.PersonsQuery(filter, limit, offset));
+  }
   async changeProfile(dbContext, person, data) {
-    if (data.email !== void 0 && person.email !== data.email) {
+    const emailChanging = data.email !== void 0 && person.email !== email.normalizeEmail(data.email);
+    if (emailChanging) {
       const validationError = await this.emailValidator.validateEmail(dbContext, data.email);
       if (validationError !== null) {
         return new Response.ResponseError(validationError.error, validationError.errorMessage);
       }
     }
-    await dbContext.commandBus.execute(new ChangeProfileCommand.ChangeProfileCommand(person.id, data));
+    await dbContext.commandBus.execute(new ChangeProfileCommand.ChangeProfileCommand(person.id, data, emailChanging));
     return new Response.ResponseOk(null);
   }
   async togglePasswordless(dbContext, person, value) {

package/dist/development/src/model/service/PersonManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator'\nimport { TogglePersonPasswordlessCommand } from '../commands'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\tif (data.email !== undefined && person.email !== data.email) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":["PersonQuery","ResponseError","ChangeProfileCommand","ResponseOk","TogglePersonPasswordlessCommand"],"mappings":";;;;;;;;;;;;;;;AAOA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AAC7F,WAAO,MAAM,UAAU,aAAa;AAAA,MACnCA,YAAAA,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AACzI,QAAI,KAAK,UAAU,UAAa,OAAO,UAAU,KAAK,OAAO;AAC5D,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAK;AACrF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAIC,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,OAAO,IAAI,IAAI,CAAC;AAC5E,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACvH,UAAM,UAAU,WAAW,QAAQ,IAAIC,gCAAAA,gCAAgC,OAAO,IAAI,KAAK,CAAC;AACxF,WAAO,IAAID,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}
+{"version":3,"file":"PersonManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { PersonListRow, PersonQuery, PersonRow, PersonsQuery, PersonsQueryFilter } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { TogglePersonPasswordlessCommand } from '../commands/index.js'\nimport { normalizeEmail } from '../utils/email.js'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync listPersons(\n\t\tdbContext: DatabaseContext,\n\t\tfilter: PersonsQueryFilter = {},\n\t\tlimit?: number | null,\n\t\toffset?: number | null,\n\t): Promise<PersonListRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new PersonsQuery(filter, limit, offset))\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\t// Compare normalized: a case-/whitespace-only edit is not a real change, so\n\t\t// it neither needs re-validation nor should drop the verified status.\n\t\tconst emailChanging = data.email !== undefined && person.email !== normalizeEmail(data.email)\n\t\tif (emailChanging) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email!)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\t// On a real e-mail change via the direct path (admin changeProfile, or\n\t\t// changeMyProfile when no verification applies) the new address has not\n\t\t// been proven, so any prior verification no longer holds — clear it. For\n\t\t// verification-required accounts this re-arms the sign-in gate; for the\n\t\t// rest email_verified_at was already null, so it is a harmless no-op.\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data, emailChanging))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":["PersonQuery","PersonsQuery","normalizeEmail","ResponseError","ChangeProfileCommand","ResponseOk","TogglePersonPasswordlessCommand"],"mappings":";;;;;;;;;;;;;;;;;;AAQA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AAC7F,WAAO,MAAM,UAAU,aAAa;AAAA,MACnCA,YAAAA,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,YACL,WACA,SAA6B,CAAA,GAC7B,OACA,QAC2B;AAC3B,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIC,aAAAA,aAAa,QAAQ,OAAO,MAAM,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AAGzI,UAAM,gBAAgB,KAAK,UAAU,UAAa,OAAO,UAAUC,MAAAA,eAAe,KAAK,KAAK;AAC5F,QAAI,eAAe;AAClB,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAM;AACtF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAIC,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AAMA,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,OAAO,IAAI,MAAM,aAAa,CAAC;AAC3F,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACvH,UAAM,UAAU,WAAW,QAAQ,IAAIC,gCAAAA,gCAAgC,OAAO,IAAI,KAAK,CAAC;AACxF,WAAO,IAAID,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}

package/dist/development/src/model/service/PersonManager.js

@@ -2,14 +2,17 @@ import { ChangeProfileCommand } from "../commands/person/ChangeProfileCommand.js
 import { ResponseError, ResponseOk } from "../utils/Response.js";
 import "../queries/apiKey/ApiKeyQuery.js";
 import "@contember/database";
+import "../type/ApiKey.js";
 import { PersonQuery } from "../queries/person/PersonQuery.js";
+import { PersonsQuery } from "../queries/person/PersonsQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../type/ApiKey.js";
 import "node:crypto";
+import { normalizeEmail } from "../utils/email.js";
 import { TogglePersonPasswordlessCommand } from "../commands/person/TogglePersonPasswordlessCommand.js";
 class PersonManager {
   constructor(emailValidator) {
@@ -20,14 +23,18 @@ class PersonManager {
       PersonQuery.byId(personId)
     );
   }
+  async listPersons(dbContext, filter = {}, limit, offset) {
+    return await dbContext.queryHandler.fetch(new PersonsQuery(filter, limit, offset));
+  }
   async changeProfile(dbContext, person, data) {
-    if (data.email !== void 0 && person.email !== data.email) {
+    const emailChanging = data.email !== void 0 && person.email !== normalizeEmail(data.email);
+    if (emailChanging) {
       const validationError = await this.emailValidator.validateEmail(dbContext, data.email);
       if (validationError !== null) {
         return new ResponseError(validationError.error, validationError.errorMessage);
       }
     }
-    await dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data));
+    await dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data, emailChanging));
     return new ResponseOk(null);
   }
   async togglePasswordless(dbContext, person, value) {

package/dist/development/src/model/service/PersonManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { PersonQuery, PersonRow } from '../queries'\nimport { DatabaseContext } from '../utils'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator'\nimport { TogglePersonPasswordlessCommand } from '../commands'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\tif (data.email !== undefined && person.email !== data.email) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":[],"mappings":";;;;;;;;;;;;;AAOA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AAC7F,WAAO,MAAM,UAAU,aAAa;AAAA,MACnC,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AACzI,QAAI,KAAK,UAAU,UAAa,OAAO,UAAU,KAAK,OAAO;AAC5D,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAK;AACrF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AACA,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,IAAI,IAAI,CAAC;AAC5E,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACvH,UAAM,UAAU,WAAW,QAAQ,IAAI,gCAAgC,OAAO,IAAI,KAAK,CAAC;AACxF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}
+{"version":3,"file":"PersonManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/PersonManager.ts"],"sourcesContent":["import { ChangeProfileCommand, ChangeProfileData } from '../commands/person/ChangeProfileCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { PersonListRow, PersonQuery, PersonRow, PersonsQuery, PersonsQueryFilter } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { TogglePersonPasswordlessCommand } from '../commands/index.js'\nimport { normalizeEmail } from '../utils/email.js'\n\nclass PersonManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t) {\n\t}\n\n\tasync findPersonById(dbContext: DatabaseContext, personId: string): Promise<PersonRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tPersonQuery.byId(personId),\n\t\t)\n\t}\n\n\tasync listPersons(\n\t\tdbContext: DatabaseContext,\n\t\tfilter: PersonsQueryFilter = {},\n\t\tlimit?: number | null,\n\t\toffset?: number | null,\n\t): Promise<PersonListRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new PersonsQuery(filter, limit, offset))\n\t}\n\n\tasync changeProfile(dbContext: DatabaseContext, person: PersonRow, data: ChangeProfileData): Promise<PersonManager.ProfileChangeResponse> {\n\t\t// Compare normalized: a case-/whitespace-only edit is not a real change, so\n\t\t// it neither needs re-validation nor should drop the verified status.\n\t\tconst emailChanging = data.email !== undefined && person.email !== normalizeEmail(data.email)\n\t\tif (emailChanging) {\n\t\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, data.email!)\n\t\t\tif (validationError !== null) {\n\t\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t\t}\n\t\t}\n\t\t// On a real e-mail change via the direct path (admin changeProfile, or\n\t\t// changeMyProfile when no verification applies) the new address has not\n\t\t// been proven, so any prior verification no longer holds — clear it. For\n\t\t// verification-required accounts this re-arms the sign-in gate; for the\n\t\t// rest email_verified_at was already null, so it is a harmless no-op.\n\t\tawait dbContext.commandBus.execute(new ChangeProfileCommand(person.id, data, emailChanging))\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync togglePasswordless(dbContext: DatabaseContext, person: PersonRow, value: boolean): Promise<Response<null, never>> {\n\t\tawait dbContext.commandBus.execute(new TogglePersonPasswordlessCommand(person.id, value))\n\t\treturn new ResponseOk(null)\n\t}\n}\n\nnamespace PersonManager {\n\texport type ProfileChangeResponse = Response<null, EmailValidatorError>\n}\n\nexport { PersonManager }\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAQA,MAAM,cAAc;AAAA,EACnB,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,UAA6C;AAC7F,WAAO,MAAM,UAAU,aAAa;AAAA,MACnC,YAAY,KAAK,QAAQ;AAAA,IAAA;AAAA,EAE3B;AAAA,EAEA,MAAM,YACL,WACA,SAA6B,CAAA,GAC7B,OACA,QAC2B;AAC3B,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,aAAa,QAAQ,OAAO,MAAM,CAAC;AAAA,EAClF;AAAA,EAEA,MAAM,cAAc,WAA4B,QAAmB,MAAuE;AAGzI,UAAM,gBAAgB,KAAK,UAAU,UAAa,OAAO,UAAU,eAAe,KAAK,KAAK;AAC5F,QAAI,eAAe;AAClB,YAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,KAAK,KAAM;AACtF,UAAI,oBAAoB,MAAM;AAC7B,eAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,MAC7E;AAAA,IACD;AAMA,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,OAAO,IAAI,MAAM,aAAa,CAAC;AAC3F,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,mBAAmB,WAA4B,QAAmB,OAAgD;AACvH,UAAM,UAAU,WAAW,QAAQ,IAAI,gCAAgC,OAAO,IAAI,KAAK,CAAC;AACxF,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}

package/dist/development/src/model/service/ProjectManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectManager.ts"],"sourcesContent":["import { AddProjectMemberCommand, CreateProjectCommand, SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { PermissionContext } from '../authorization'\nimport { Project, ProjectInitializer, ProjectWithSecrets } from '../type'\nimport { ProjectBySlugQuery, ProjectsByIdentityQuery, ProjectsQuery, ProjectUpdateTimestampQuery } from '../queries'\nimport { SecretsManager } from './SecretsManager'\nimport { DatabaseContext, TokenHash } from '../utils'\nimport { createSetMembershipVariables } from './membershipUtils'\nimport { ImplementationException } from '../../exceptions'\nimport { ProjectRole } from '@contember/schema'\nimport { ApiKeyService, CreateApiKeyResult } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { CreateProjectResponseErrorCode } from '../../schema'\nimport { Logger } from '@contember/logger'\n\nexport class ProjectManager {\n\tconstructor(\n\t\tprivate readonly secretManager: SecretsManager,\n\t\tprivate readonly projectIntializer: ProjectInitializer,\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tpublic async createProject(\n\t\tdbContext: DatabaseContext,\n\t\tlogger: Logger,\n\t\tproject: Pick<ProjectWithSecrets, 'name' | 'slug' | 'config' | 'secrets'>,\n\t\toptions: {\n\t\t\townerIdentityId?: string\n\t\t\tdeployTokenHash?: TokenHash\n\t\t\tnoDeployToken?: boolean\n\t\t},\n\t): Promise<CreateProjectResponse> {\n\t\treturn await dbContext.transaction(async (db): Promise<CreateProjectResponse> => {\n\t\t\tconst bus = db.commandBus\n\n\t\t\tconst now = db.providers.now()\n\t\t\tconst projectId = await bus.execute(new CreateProjectCommand(project, now))\n\t\t\tif (!projectId) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `Project ${project.slug} already exists`)\n\t\t\t}\n\t\t\tfor (const [key, value] of Object.entries(project.secrets)) {\n\t\t\t\tawait bus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tif (options.ownerIdentityId) {\n\t\t\t\tconst memberships = createSetMembershipVariables([{ role: ProjectRole.ADMIN, variables: [] }])\n\t\t\t\tconst addProjectMemberCommand = new AddProjectMemberCommand(projectId, options.ownerIdentityId, memberships)\n\t\t\t\tconst addMemberResult = await db.commandBus.execute(addProjectMemberCommand)\n\t\t\t\tif (!addMemberResult.ok) {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst deployMembership = [{ role: ProjectRole.DEPLOYER, variables: [] }]\n\t\t\tconst deployKeyDescription = `Deploy key for ${project.slug}`\n\t\t\tconst deployResult = options.noDeployToken === true\n\t\t\t\t? undefined\n\t\t\t\t: await this.apiKeyService.createProjectPermanentApiKey(db, projectId, deployMembership, deployKeyDescription, options.deployTokenHash)\n\n\t\t\ttry {\n\t\t\t\tawait this.projectIntializer.initializeProject({\n\t\t\t\t\tid: projectId,\n\t\t\t\t\t...project,\n\t\t\t\t\tupdatedAt: now,\n\t\t\t\t}, logger)\n\t\t\t} catch (e) {\n\t\t\t\tlogger.error(e, { message: 'Project initialization failed' })\n\t\t\t\tawait db.client.connection.rollback()\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'INIT_ERROR',\n\t\t\t\t\t`Project initialization error: ${e instanceof Error && 'message' in e ? e.message : 'unknown'}`,\n\t\t\t\t)\n\t\t\t}\n\n\t\t\treturn new ResponseOk(new CreateProjectResult(deployResult?.result))\n\t\t})\n\t}\n\n\tpublic async updateProject(dbContext: DatabaseContext, id: string, data: Partial<Pick<Project, 'name' | 'config'>>): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new UpdateProjectCommand(id, data))\n\t}\n\n\tpublic async getProjectBySlug(dbContext: DatabaseContext, slug: string): Promise<Project | null> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug))\n\t}\n\n\tpublic async getProjectState(dbContext: DatabaseContext, slug: string, updatedAt: Date): Promise<'valid' | 'updated' | 'not_found'> {\n\t\tconst updatedNew = await dbContext.queryHandler.fetch(new ProjectUpdateTimestampQuery(slug))\n\t\tif (!updatedNew) {\n\t\t\treturn 'not_found'\n\t\t}\n\t\treturn updatedNew > updatedAt ? 'updated' : 'valid'\n\t}\n\n\tpublic async getProjectWithSecretsBySlug(dbContext: DatabaseContext, slug: string, alias: boolean): Promise<ProjectWithSecrets | null> {\n\t\tconst project = await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug, alias))\n\t\tif (!project) {\n\t\t\treturn null\n\t\t}\n\t\tconst secrets = await this.secretManager.readSecrets(dbContext, project.id)\n\t\treturn { ...project, secrets }\n\t}\n\n\tpublic async getProjects(dbContext: DatabaseContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsQuery())\n\t}\n\n\tpublic async getProjectsByIdentity(dbContext: DatabaseContext, identityId: string, permissionContext: PermissionContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsByIdentityQuery(identityId, permissionContext))\n\t}\n}\n\nexport class ProjectInitError extends Error {}\n\nexport type CreateProjectResponse = Response<CreateProjectResult, CreateProjectResponseErrorCode>\n\nexport class CreateProjectResult {\n\tconstructor(public readonly deployerApiKey?: CreateApiKeyResult) {\n\t}\n}\n"],"names":["CreateProjectCommand","ResponseError","SetProjectSecretCommand","createSetMembershipVariables","ProjectRole","AddProjectMemberCommand","ImplementationException","ResponseOk","UpdateProjectCommand","ProjectBySlugQuery","ProjectUpdateTimestampQuery","ProjectsQuery","ProjectsByIdentityQuery"],"mappings":";;;;;;;;;;;;;;;;;;AAcO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,mBACA,eAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAa,cACZ,WACA,QACA,SACA,SAKiC;AACjC,WAAO,MAAM,UAAU,YAAY,OAAO,OAAuC;AAChF,YAAM,MAAM,GAAG;AAEf,YAAM,MAAM,GAAG,UAAU,IAAA;AACzB,YAAM,YAAY,MAAM,IAAI,QAAQ,IAAIA,0CAAqB,SAAS,GAAG,CAAC;AAC1E,UAAI,CAAC,WAAW;AACf,eAAO,IAAIC,SAAAA,cAAc,kBAAkB,WAAW,QAAQ,IAAI,iBAAiB;AAAA,MACpF;AACA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC3D,cAAM,IAAI,QAAQ,IAAIC,gDAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAClF;AACA,UAAI,QAAQ,iBAAiB;AAC5B,cAAM,cAAcC,6CAA6B,CAAC,EAAE,MAAMC,OAAAA,YAAY,OAAO,WAAW,CAAA,EAAC,CAAG,CAAC;AAC7F,cAAM,0BAA0B,IAAIC,wBAAAA,wBAAwB,WAAW,QAAQ,iBAAiB,WAAW;AAC3G,cAAM,kBAAkB,MAAM,GAAG,WAAW,QAAQ,uBAAuB;AAC3E,YAAI,CAAC,gBAAgB,IAAI;AACxB,gBAAM,IAAIC,WAAAA,wBAAA;AAAA,QACX;AAAA,MACD;AAEA,YAAM,mBAAmB,CAAC,EAAE,MAAMF,OAAAA,YAAY,UAAU,WAAW,CAAA,GAAI;AACvE,YAAM,uBAAuB,kBAAkB,QAAQ,IAAI;AAC3D,YAAM,eAAe,QAAQ,kBAAkB,OAC5C,SACA,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,kBAAkB,sBAAsB,QAAQ,eAAe;AAEvI,UAAI;AACH,cAAM,KAAK,kBAAkB,kBAAkB;AAAA,UAC9C,IAAI;AAAA,UACJ,GAAG;AAAA,UACH,WAAW;AAAA,QAAA,GACT,MAAM;AAAA,MACV,SAAS,GAAG;AACX,eAAO,MAAM,GAAG,EAAE,SAAS,iCAAiC;AAC5D,cAAM,GAAG,OAAO,WAAW,SAAA;AAC3B,eAAO,IAAIH,SAAAA;AAAAA,UACV;AAAA,UACA,iCAAiC,aAAa,SAAS,aAAa,IAAI,EAAE,UAAU,SAAS;AAAA,QAAA;AAAA,MAE/F;AAEA,aAAO,IAAIM,SAAAA,WAAW,IAAI,oBAAoB,cAAc,MAAM,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,cAAc,WAA4B,IAAY,MAAgE;AAClI,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,IAAI,IAAI,CAAC;AAAA,EACtE;AAAA,EAEA,MAAa,iBAAiB,WAA4B,MAAuC;AAChG,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIC,mBAAAA,mBAAmB,IAAI,CAAC;AAAA,EACvE;AAAA,EAEA,MAAa,gBAAgB,WAA4B,MAAc,WAA6D;AACnI,UAAM,aAAa,MAAM,UAAU,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,IAAI,CAAC;AAC3F,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,aAAa,YAAY,YAAY;AAAA,EAC7C;AAAA,EAEA,MAAa,4BAA4B,WAA4B,MAAc,OAAoD;AACtI,UAAM,UAAU,MAAM,UAAU,aAAa,MAAM,IAAID,mBAAAA,mBAAmB,MAAM,KAAK,CAAC;AACtF,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,UAAM,UAAU,MAAM,KAAK,cAAc,YAAY,WAAW,QAAQ,EAAE;AAC1E,WAAO,EAAE,GAAG,SAAS,QAAA;AAAA,EACtB;AAAA,EAEA,MAAa,YAAY,WAAgD;AACxE,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIE,cAAAA,eAAe;AAAA,EAC9D;AAAA,EAEA,MAAa,sBAAsB,WAA4B,YAAoB,mBAA0D;AAC5I,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIC,gDAAwB,YAAY,iBAAiB,CAAC;AAAA,EACrG;AACD;AAEO,MAAM,yBAAyB,MAAM;AAAC;AAItC,MAAM,oBAAoB;AAAA,EAChC,YAA4B,gBAAqC;AAArC,SAAA,iBAAA;AAAA,EAC5B;AACD;;;;"}
+{"version":3,"file":"ProjectManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectManager.ts"],"sourcesContent":["import { AddProjectMemberCommand, CreateProjectCommand, SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { Project, ProjectInitializer, ProjectWithSecrets } from '../type/index.js'\nimport { ProjectBySlugQuery, ProjectsByIdentityQuery, ProjectsQuery, ProjectUpdateTimestampQuery } from '../queries/index.js'\nimport { SecretsManager } from './SecretsManager.js'\nimport { DatabaseContext, TokenHash } from '../utils/index.js'\nimport { createSetMembershipVariables } from './membershipUtils.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { ProjectRole } from '@contember/schema'\nimport { ApiKeyService, CreateApiKeyResult } from './apiKey/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { CreateProjectResponseErrorCode } from '../../schema/index.js'\nimport { Logger } from '@contember/logger'\n\nexport class ProjectManager {\n\tconstructor(\n\t\tprivate readonly secretManager: SecretsManager,\n\t\tprivate readonly projectIntializer: ProjectInitializer,\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tpublic async createProject(\n\t\tdbContext: DatabaseContext,\n\t\tlogger: Logger,\n\t\tproject: Pick<ProjectWithSecrets, 'name' | 'slug' | 'config' | 'secrets'>,\n\t\toptions: {\n\t\t\townerIdentityId?: string\n\t\t\tdeployTokenHash?: TokenHash\n\t\t\tnoDeployToken?: boolean\n\t\t},\n\t): Promise<CreateProjectResponse> {\n\t\treturn await dbContext.transaction(async (db): Promise<CreateProjectResponse> => {\n\t\t\tconst bus = db.commandBus\n\n\t\t\tconst now = db.providers.now()\n\t\t\tconst projectId = await bus.execute(new CreateProjectCommand(project, now))\n\t\t\tif (!projectId) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `Project ${project.slug} already exists`)\n\t\t\t}\n\t\t\tfor (const [key, value] of Object.entries(project.secrets)) {\n\t\t\t\tawait bus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tif (options.ownerIdentityId) {\n\t\t\t\tconst memberships = createSetMembershipVariables([{ role: ProjectRole.ADMIN, variables: [] }])\n\t\t\t\tconst addProjectMemberCommand = new AddProjectMemberCommand(projectId, options.ownerIdentityId, memberships)\n\t\t\t\tconst addMemberResult = await db.commandBus.execute(addProjectMemberCommand)\n\t\t\t\tif (!addMemberResult.ok) {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst deployMembership = [{ role: ProjectRole.DEPLOYER, variables: [] }]\n\t\t\tconst deployKeyDescription = `Deploy key for ${project.slug}`\n\t\t\tconst deployResult = options.noDeployToken === true\n\t\t\t\t? undefined\n\t\t\t\t: await this.apiKeyService.createProjectPermanentApiKey(db, projectId, deployMembership, deployKeyDescription, options.deployTokenHash)\n\n\t\t\ttry {\n\t\t\t\tawait this.projectIntializer.initializeProject({\n\t\t\t\t\tid: projectId,\n\t\t\t\t\t...project,\n\t\t\t\t\tupdatedAt: now,\n\t\t\t\t}, logger)\n\t\t\t} catch (e) {\n\t\t\t\tlogger.error(e, { message: 'Project initialization failed' })\n\t\t\t\tawait db.client.connection.rollback()\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'INIT_ERROR',\n\t\t\t\t\t`Project initialization error: ${e instanceof Error && 'message' in e ? e.message : 'unknown'}`,\n\t\t\t\t)\n\t\t\t}\n\n\t\t\treturn new ResponseOk(new CreateProjectResult(deployResult?.result))\n\t\t})\n\t}\n\n\tpublic async updateProject(dbContext: DatabaseContext, id: string, data: Partial<Pick<Project, 'name' | 'config'>>): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new UpdateProjectCommand(id, data))\n\t}\n\n\tpublic async getProjectBySlug(dbContext: DatabaseContext, slug: string): Promise<Project | null> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug))\n\t}\n\n\tpublic async getProjectState(dbContext: DatabaseContext, slug: string, updatedAt: Date): Promise<'valid' | 'updated' | 'not_found'> {\n\t\tconst updatedNew = await dbContext.queryHandler.fetch(new ProjectUpdateTimestampQuery(slug))\n\t\tif (!updatedNew) {\n\t\t\treturn 'not_found'\n\t\t}\n\t\treturn updatedNew > updatedAt ? 'updated' : 'valid'\n\t}\n\n\tpublic async getProjectWithSecretsBySlug(dbContext: DatabaseContext, slug: string, alias: boolean): Promise<ProjectWithSecrets | null> {\n\t\tconst project = await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug, alias))\n\t\tif (!project) {\n\t\t\treturn null\n\t\t}\n\t\tconst secrets = await this.secretManager.readSecrets(dbContext, project.id)\n\t\treturn { ...project, secrets }\n\t}\n\n\tpublic async getProjects(dbContext: DatabaseContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsQuery())\n\t}\n\n\tpublic async getProjectsByIdentity(dbContext: DatabaseContext, identityId: string, permissionContext: PermissionContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsByIdentityQuery(identityId, permissionContext))\n\t}\n}\n\nexport class ProjectInitError extends Error {}\n\nexport type CreateProjectResponse = Response<CreateProjectResult, CreateProjectResponseErrorCode>\n\nexport class CreateProjectResult {\n\tconstructor(public readonly deployerApiKey?: CreateApiKeyResult) {\n\t}\n}\n"],"names":["CreateProjectCommand","ResponseError","SetProjectSecretCommand","createSetMembershipVariables","ProjectRole","AddProjectMemberCommand","ImplementationException","ResponseOk","UpdateProjectCommand","ProjectBySlugQuery","ProjectUpdateTimestampQuery","ProjectsQuery","ProjectsByIdentityQuery"],"mappings":";;;;;;;;;;;;;;;;;;AAcO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,mBACA,eAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAa,cACZ,WACA,QACA,SACA,SAKiC;AACjC,WAAO,MAAM,UAAU,YAAY,OAAO,OAAuC;AAChF,YAAM,MAAM,GAAG;AAEf,YAAM,MAAM,GAAG,UAAU,IAAA;AACzB,YAAM,YAAY,MAAM,IAAI,QAAQ,IAAIA,0CAAqB,SAAS,GAAG,CAAC;AAC1E,UAAI,CAAC,WAAW;AACf,eAAO,IAAIC,SAAAA,cAAc,kBAAkB,WAAW,QAAQ,IAAI,iBAAiB;AAAA,MACpF;AACA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC3D,cAAM,IAAI,QAAQ,IAAIC,gDAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAClF;AACA,UAAI,QAAQ,iBAAiB;AAC5B,cAAM,cAAcC,6CAA6B,CAAC,EAAE,MAAMC,OAAAA,YAAY,OAAO,WAAW,CAAA,EAAC,CAAG,CAAC;AAC7F,cAAM,0BAA0B,IAAIC,wBAAAA,wBAAwB,WAAW,QAAQ,iBAAiB,WAAW;AAC3G,cAAM,kBAAkB,MAAM,GAAG,WAAW,QAAQ,uBAAuB;AAC3E,YAAI,CAAC,gBAAgB,IAAI;AACxB,gBAAM,IAAIC,WAAAA,wBAAA;AAAA,QACX;AAAA,MACD;AAEA,YAAM,mBAAmB,CAAC,EAAE,MAAMF,OAAAA,YAAY,UAAU,WAAW,CAAA,GAAI;AACvE,YAAM,uBAAuB,kBAAkB,QAAQ,IAAI;AAC3D,YAAM,eAAe,QAAQ,kBAAkB,OAC5C,SACA,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,kBAAkB,sBAAsB,QAAQ,eAAe;AAEvI,UAAI;AACH,cAAM,KAAK,kBAAkB,kBAAkB;AAAA,UAC9C,IAAI;AAAA,UACJ,GAAG;AAAA,UACH,WAAW;AAAA,QAAA,GACT,MAAM;AAAA,MACV,SAAS,GAAG;AACX,eAAO,MAAM,GAAG,EAAE,SAAS,iCAAiC;AAC5D,cAAM,GAAG,OAAO,WAAW,SAAA;AAC3B,eAAO,IAAIH,SAAAA;AAAAA,UACV;AAAA,UACA,iCAAiC,aAAa,SAAS,aAAa,IAAI,EAAE,UAAU,SAAS;AAAA,QAAA;AAAA,MAE/F;AAEA,aAAO,IAAIM,SAAAA,WAAW,IAAI,oBAAoB,cAAc,MAAM,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,cAAc,WAA4B,IAAY,MAAgE;AAClI,UAAM,UAAU,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,IAAI,IAAI,CAAC;AAAA,EACtE;AAAA,EAEA,MAAa,iBAAiB,WAA4B,MAAuC;AAChG,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIC,mBAAAA,mBAAmB,IAAI,CAAC;AAAA,EACvE;AAAA,EAEA,MAAa,gBAAgB,WAA4B,MAAc,WAA6D;AACnI,UAAM,aAAa,MAAM,UAAU,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,IAAI,CAAC;AAC3F,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,aAAa,YAAY,YAAY;AAAA,EAC7C;AAAA,EAEA,MAAa,4BAA4B,WAA4B,MAAc,OAAoD;AACtI,UAAM,UAAU,MAAM,UAAU,aAAa,MAAM,IAAID,mBAAAA,mBAAmB,MAAM,KAAK,CAAC;AACtF,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,UAAM,UAAU,MAAM,KAAK,cAAc,YAAY,WAAW,QAAQ,EAAE;AAC1E,WAAO,EAAE,GAAG,SAAS,QAAA;AAAA,EACtB;AAAA,EAEA,MAAa,YAAY,WAAgD;AACxE,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIE,cAAAA,eAAe;AAAA,EAC9D;AAAA,EAEA,MAAa,sBAAsB,WAA4B,YAAoB,mBAA0D;AAC5I,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIC,gDAAwB,YAAY,iBAAiB,CAAC;AAAA,EACrG;AACD;AAEO,MAAM,yBAAyB,MAAM;AAAC;AAItC,MAAM,oBAAoB;AAAA,EAChC,YAA4B,gBAAqC;AAArC,SAAA,iBAAA;AAAA,EAC5B;AACD;;;;"}

package/dist/development/src/model/service/ProjectManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectManager.ts"],"sourcesContent":["import { AddProjectMemberCommand, CreateProjectCommand, SetProjectSecretCommand, UpdateProjectCommand } from '../commands'\nimport { PermissionContext } from '../authorization'\nimport { Project, ProjectInitializer, ProjectWithSecrets } from '../type'\nimport { ProjectBySlugQuery, ProjectsByIdentityQuery, ProjectsQuery, ProjectUpdateTimestampQuery } from '../queries'\nimport { SecretsManager } from './SecretsManager'\nimport { DatabaseContext, TokenHash } from '../utils'\nimport { createSetMembershipVariables } from './membershipUtils'\nimport { ImplementationException } from '../../exceptions'\nimport { ProjectRole } from '@contember/schema'\nimport { ApiKeyService, CreateApiKeyResult } from './apiKey'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { CreateProjectResponseErrorCode } from '../../schema'\nimport { Logger } from '@contember/logger'\n\nexport class ProjectManager {\n\tconstructor(\n\t\tprivate readonly secretManager: SecretsManager,\n\t\tprivate readonly projectIntializer: ProjectInitializer,\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tpublic async createProject(\n\t\tdbContext: DatabaseContext,\n\t\tlogger: Logger,\n\t\tproject: Pick<ProjectWithSecrets, 'name' | 'slug' | 'config' | 'secrets'>,\n\t\toptions: {\n\t\t\townerIdentityId?: string\n\t\t\tdeployTokenHash?: TokenHash\n\t\t\tnoDeployToken?: boolean\n\t\t},\n\t): Promise<CreateProjectResponse> {\n\t\treturn await dbContext.transaction(async (db): Promise<CreateProjectResponse> => {\n\t\t\tconst bus = db.commandBus\n\n\t\t\tconst now = db.providers.now()\n\t\t\tconst projectId = await bus.execute(new CreateProjectCommand(project, now))\n\t\t\tif (!projectId) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `Project ${project.slug} already exists`)\n\t\t\t}\n\t\t\tfor (const [key, value] of Object.entries(project.secrets)) {\n\t\t\t\tawait bus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tif (options.ownerIdentityId) {\n\t\t\t\tconst memberships = createSetMembershipVariables([{ role: ProjectRole.ADMIN, variables: [] }])\n\t\t\t\tconst addProjectMemberCommand = new AddProjectMemberCommand(projectId, options.ownerIdentityId, memberships)\n\t\t\t\tconst addMemberResult = await db.commandBus.execute(addProjectMemberCommand)\n\t\t\t\tif (!addMemberResult.ok) {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst deployMembership = [{ role: ProjectRole.DEPLOYER, variables: [] }]\n\t\t\tconst deployKeyDescription = `Deploy key for ${project.slug}`\n\t\t\tconst deployResult = options.noDeployToken === true\n\t\t\t\t? undefined\n\t\t\t\t: await this.apiKeyService.createProjectPermanentApiKey(db, projectId, deployMembership, deployKeyDescription, options.deployTokenHash)\n\n\t\t\ttry {\n\t\t\t\tawait this.projectIntializer.initializeProject({\n\t\t\t\t\tid: projectId,\n\t\t\t\t\t...project,\n\t\t\t\t\tupdatedAt: now,\n\t\t\t\t}, logger)\n\t\t\t} catch (e) {\n\t\t\t\tlogger.error(e, { message: 'Project initialization failed' })\n\t\t\t\tawait db.client.connection.rollback()\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'INIT_ERROR',\n\t\t\t\t\t`Project initialization error: ${e instanceof Error && 'message' in e ? e.message : 'unknown'}`,\n\t\t\t\t)\n\t\t\t}\n\n\t\t\treturn new ResponseOk(new CreateProjectResult(deployResult?.result))\n\t\t})\n\t}\n\n\tpublic async updateProject(dbContext: DatabaseContext, id: string, data: Partial<Pick<Project, 'name' | 'config'>>): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new UpdateProjectCommand(id, data))\n\t}\n\n\tpublic async getProjectBySlug(dbContext: DatabaseContext, slug: string): Promise<Project | null> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug))\n\t}\n\n\tpublic async getProjectState(dbContext: DatabaseContext, slug: string, updatedAt: Date): Promise<'valid' | 'updated' | 'not_found'> {\n\t\tconst updatedNew = await dbContext.queryHandler.fetch(new ProjectUpdateTimestampQuery(slug))\n\t\tif (!updatedNew) {\n\t\t\treturn 'not_found'\n\t\t}\n\t\treturn updatedNew > updatedAt ? 'updated' : 'valid'\n\t}\n\n\tpublic async getProjectWithSecretsBySlug(dbContext: DatabaseContext, slug: string, alias: boolean): Promise<ProjectWithSecrets | null> {\n\t\tconst project = await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug, alias))\n\t\tif (!project) {\n\t\t\treturn null\n\t\t}\n\t\tconst secrets = await this.secretManager.readSecrets(dbContext, project.id)\n\t\treturn { ...project, secrets }\n\t}\n\n\tpublic async getProjects(dbContext: DatabaseContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsQuery())\n\t}\n\n\tpublic async getProjectsByIdentity(dbContext: DatabaseContext, identityId: string, permissionContext: PermissionContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsByIdentityQuery(identityId, permissionContext))\n\t}\n}\n\nexport class ProjectInitError extends Error {}\n\nexport type CreateProjectResponse = Response<CreateProjectResult, CreateProjectResponseErrorCode>\n\nexport class CreateProjectResult {\n\tconstructor(public readonly deployerApiKey?: CreateApiKeyResult) {\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAcO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,mBACA,eAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAa,cACZ,WACA,QACA,SACA,SAKiC;AACjC,WAAO,MAAM,UAAU,YAAY,OAAO,OAAuC;AAChF,YAAM,MAAM,GAAG;AAEf,YAAM,MAAM,GAAG,UAAU,IAAA;AACzB,YAAM,YAAY,MAAM,IAAI,QAAQ,IAAI,qBAAqB,SAAS,GAAG,CAAC;AAC1E,UAAI,CAAC,WAAW;AACf,eAAO,IAAI,cAAc,kBAAkB,WAAW,QAAQ,IAAI,iBAAiB;AAAA,MACpF;AACA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC3D,cAAM,IAAI,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAClF;AACA,UAAI,QAAQ,iBAAiB;AAC5B,cAAM,cAAc,6BAA6B,CAAC,EAAE,MAAM,YAAY,OAAO,WAAW,CAAA,EAAC,CAAG,CAAC;AAC7F,cAAM,0BAA0B,IAAI,wBAAwB,WAAW,QAAQ,iBAAiB,WAAW;AAC3G,cAAM,kBAAkB,MAAM,GAAG,WAAW,QAAQ,uBAAuB;AAC3E,YAAI,CAAC,gBAAgB,IAAI;AACxB,gBAAM,IAAI,wBAAA;AAAA,QACX;AAAA,MACD;AAEA,YAAM,mBAAmB,CAAC,EAAE,MAAM,YAAY,UAAU,WAAW,CAAA,GAAI;AACvE,YAAM,uBAAuB,kBAAkB,QAAQ,IAAI;AAC3D,YAAM,eAAe,QAAQ,kBAAkB,OAC5C,SACA,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,kBAAkB,sBAAsB,QAAQ,eAAe;AAEvI,UAAI;AACH,cAAM,KAAK,kBAAkB,kBAAkB;AAAA,UAC9C,IAAI;AAAA,UACJ,GAAG;AAAA,UACH,WAAW;AAAA,QAAA,GACT,MAAM;AAAA,MACV,SAAS,GAAG;AACX,eAAO,MAAM,GAAG,EAAE,SAAS,iCAAiC;AAC5D,cAAM,GAAG,OAAO,WAAW,SAAA;AAC3B,eAAO,IAAI;AAAA,UACV;AAAA,UACA,iCAAiC,aAAa,SAAS,aAAa,IAAI,EAAE,UAAU,SAAS;AAAA,QAAA;AAAA,MAE/F;AAEA,aAAO,IAAI,WAAW,IAAI,oBAAoB,cAAc,MAAM,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,cAAc,WAA4B,IAAY,MAAgE;AAClI,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,IAAI,IAAI,CAAC;AAAA,EACtE;AAAA,EAEA,MAAa,iBAAiB,WAA4B,MAAuC;AAChG,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,IAAI,CAAC;AAAA,EACvE;AAAA,EAEA,MAAa,gBAAgB,WAA4B,MAAc,WAA6D;AACnI,UAAM,aAAa,MAAM,UAAU,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAC3F,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,aAAa,YAAY,YAAY;AAAA,EAC7C;AAAA,EAEA,MAAa,4BAA4B,WAA4B,MAAc,OAAoD;AACtI,UAAM,UAAU,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,MAAM,KAAK,CAAC;AACtF,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,UAAM,UAAU,MAAM,KAAK,cAAc,YAAY,WAAW,QAAQ,EAAE;AAC1E,WAAO,EAAE,GAAG,SAAS,QAAA;AAAA,EACtB;AAAA,EAEA,MAAa,YAAY,WAAgD;AACxE,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,eAAe;AAAA,EAC9D;AAAA,EAEA,MAAa,sBAAsB,WAA4B,YAAoB,mBAA0D;AAC5I,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,wBAAwB,YAAY,iBAAiB,CAAC;AAAA,EACrG;AACD;AAEO,MAAM,yBAAyB,MAAM;AAAC;AAItC,MAAM,oBAAoB;AAAA,EAChC,YAA4B,gBAAqC;AAArC,SAAA,iBAAA;AAAA,EAC5B;AACD;"}
+{"version":3,"file":"ProjectManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectManager.ts"],"sourcesContent":["import { AddProjectMemberCommand, CreateProjectCommand, SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { Project, ProjectInitializer, ProjectWithSecrets } from '../type/index.js'\nimport { ProjectBySlugQuery, ProjectsByIdentityQuery, ProjectsQuery, ProjectUpdateTimestampQuery } from '../queries/index.js'\nimport { SecretsManager } from './SecretsManager.js'\nimport { DatabaseContext, TokenHash } from '../utils/index.js'\nimport { createSetMembershipVariables } from './membershipUtils.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { ProjectRole } from '@contember/schema'\nimport { ApiKeyService, CreateApiKeyResult } from './apiKey/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { CreateProjectResponseErrorCode } from '../../schema/index.js'\nimport { Logger } from '@contember/logger'\n\nexport class ProjectManager {\n\tconstructor(\n\t\tprivate readonly secretManager: SecretsManager,\n\t\tprivate readonly projectIntializer: ProjectInitializer,\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t) {}\n\n\tpublic async createProject(\n\t\tdbContext: DatabaseContext,\n\t\tlogger: Logger,\n\t\tproject: Pick<ProjectWithSecrets, 'name' | 'slug' | 'config' | 'secrets'>,\n\t\toptions: {\n\t\t\townerIdentityId?: string\n\t\t\tdeployTokenHash?: TokenHash\n\t\t\tnoDeployToken?: boolean\n\t\t},\n\t): Promise<CreateProjectResponse> {\n\t\treturn await dbContext.transaction(async (db): Promise<CreateProjectResponse> => {\n\t\t\tconst bus = db.commandBus\n\n\t\t\tconst now = db.providers.now()\n\t\t\tconst projectId = await bus.execute(new CreateProjectCommand(project, now))\n\t\t\tif (!projectId) {\n\t\t\t\treturn new ResponseError('ALREADY_EXISTS', `Project ${project.slug} already exists`)\n\t\t\t}\n\t\t\tfor (const [key, value] of Object.entries(project.secrets)) {\n\t\t\t\tawait bus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tif (options.ownerIdentityId) {\n\t\t\t\tconst memberships = createSetMembershipVariables([{ role: ProjectRole.ADMIN, variables: [] }])\n\t\t\t\tconst addProjectMemberCommand = new AddProjectMemberCommand(projectId, options.ownerIdentityId, memberships)\n\t\t\t\tconst addMemberResult = await db.commandBus.execute(addProjectMemberCommand)\n\t\t\t\tif (!addMemberResult.ok) {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst deployMembership = [{ role: ProjectRole.DEPLOYER, variables: [] }]\n\t\t\tconst deployKeyDescription = `Deploy key for ${project.slug}`\n\t\t\tconst deployResult = options.noDeployToken === true\n\t\t\t\t? undefined\n\t\t\t\t: await this.apiKeyService.createProjectPermanentApiKey(db, projectId, deployMembership, deployKeyDescription, options.deployTokenHash)\n\n\t\t\ttry {\n\t\t\t\tawait this.projectIntializer.initializeProject({\n\t\t\t\t\tid: projectId,\n\t\t\t\t\t...project,\n\t\t\t\t\tupdatedAt: now,\n\t\t\t\t}, logger)\n\t\t\t} catch (e) {\n\t\t\t\tlogger.error(e, { message: 'Project initialization failed' })\n\t\t\t\tawait db.client.connection.rollback()\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\t'INIT_ERROR',\n\t\t\t\t\t`Project initialization error: ${e instanceof Error && 'message' in e ? e.message : 'unknown'}`,\n\t\t\t\t)\n\t\t\t}\n\n\t\t\treturn new ResponseOk(new CreateProjectResult(deployResult?.result))\n\t\t})\n\t}\n\n\tpublic async updateProject(dbContext: DatabaseContext, id: string, data: Partial<Pick<Project, 'name' | 'config'>>): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new UpdateProjectCommand(id, data))\n\t}\n\n\tpublic async getProjectBySlug(dbContext: DatabaseContext, slug: string): Promise<Project | null> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug))\n\t}\n\n\tpublic async getProjectState(dbContext: DatabaseContext, slug: string, updatedAt: Date): Promise<'valid' | 'updated' | 'not_found'> {\n\t\tconst updatedNew = await dbContext.queryHandler.fetch(new ProjectUpdateTimestampQuery(slug))\n\t\tif (!updatedNew) {\n\t\t\treturn 'not_found'\n\t\t}\n\t\treturn updatedNew > updatedAt ? 'updated' : 'valid'\n\t}\n\n\tpublic async getProjectWithSecretsBySlug(dbContext: DatabaseContext, slug: string, alias: boolean): Promise<ProjectWithSecrets | null> {\n\t\tconst project = await dbContext.queryHandler.fetch(new ProjectBySlugQuery(slug, alias))\n\t\tif (!project) {\n\t\t\treturn null\n\t\t}\n\t\tconst secrets = await this.secretManager.readSecrets(dbContext, project.id)\n\t\treturn { ...project, secrets }\n\t}\n\n\tpublic async getProjects(dbContext: DatabaseContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsQuery())\n\t}\n\n\tpublic async getProjectsByIdentity(dbContext: DatabaseContext, identityId: string, permissionContext: PermissionContext): Promise<Project[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectsByIdentityQuery(identityId, permissionContext))\n\t}\n}\n\nexport class ProjectInitError extends Error {}\n\nexport type CreateProjectResponse = Response<CreateProjectResult, CreateProjectResponseErrorCode>\n\nexport class CreateProjectResult {\n\tconstructor(public readonly deployerApiKey?: CreateApiKeyResult) {\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAcO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,mBACA,eAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,oBAAA;AACA,SAAA,gBAAA;AAAA,EACf;AAAA,EAEH,MAAa,cACZ,WACA,QACA,SACA,SAKiC;AACjC,WAAO,MAAM,UAAU,YAAY,OAAO,OAAuC;AAChF,YAAM,MAAM,GAAG;AAEf,YAAM,MAAM,GAAG,UAAU,IAAA;AACzB,YAAM,YAAY,MAAM,IAAI,QAAQ,IAAI,qBAAqB,SAAS,GAAG,CAAC;AAC1E,UAAI,CAAC,WAAW;AACf,eAAO,IAAI,cAAc,kBAAkB,WAAW,QAAQ,IAAI,iBAAiB;AAAA,MACpF;AACA,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC3D,cAAM,IAAI,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAClF;AACA,UAAI,QAAQ,iBAAiB;AAC5B,cAAM,cAAc,6BAA6B,CAAC,EAAE,MAAM,YAAY,OAAO,WAAW,CAAA,EAAC,CAAG,CAAC;AAC7F,cAAM,0BAA0B,IAAI,wBAAwB,WAAW,QAAQ,iBAAiB,WAAW;AAC3G,cAAM,kBAAkB,MAAM,GAAG,WAAW,QAAQ,uBAAuB;AAC3E,YAAI,CAAC,gBAAgB,IAAI;AACxB,gBAAM,IAAI,wBAAA;AAAA,QACX;AAAA,MACD;AAEA,YAAM,mBAAmB,CAAC,EAAE,MAAM,YAAY,UAAU,WAAW,CAAA,GAAI;AACvE,YAAM,uBAAuB,kBAAkB,QAAQ,IAAI;AAC3D,YAAM,eAAe,QAAQ,kBAAkB,OAC5C,SACA,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,kBAAkB,sBAAsB,QAAQ,eAAe;AAEvI,UAAI;AACH,cAAM,KAAK,kBAAkB,kBAAkB;AAAA,UAC9C,IAAI;AAAA,UACJ,GAAG;AAAA,UACH,WAAW;AAAA,QAAA,GACT,MAAM;AAAA,MACV,SAAS,GAAG;AACX,eAAO,MAAM,GAAG,EAAE,SAAS,iCAAiC;AAC5D,cAAM,GAAG,OAAO,WAAW,SAAA;AAC3B,eAAO,IAAI;AAAA,UACV;AAAA,UACA,iCAAiC,aAAa,SAAS,aAAa,IAAI,EAAE,UAAU,SAAS;AAAA,QAAA;AAAA,MAE/F;AAEA,aAAO,IAAI,WAAW,IAAI,oBAAoB,cAAc,MAAM,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AAAA,EAEA,MAAa,cAAc,WAA4B,IAAY,MAAgE;AAClI,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,IAAI,IAAI,CAAC;AAAA,EACtE;AAAA,EAEA,MAAa,iBAAiB,WAA4B,MAAuC;AAChG,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,IAAI,CAAC;AAAA,EACvE;AAAA,EAEA,MAAa,gBAAgB,WAA4B,MAAc,WAA6D;AACnI,UAAM,aAAa,MAAM,UAAU,aAAa,MAAM,IAAI,4BAA4B,IAAI,CAAC;AAC3F,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,aAAa,YAAY,YAAY;AAAA,EAC7C;AAAA,EAEA,MAAa,4BAA4B,WAA4B,MAAc,OAAoD;AACtI,UAAM,UAAU,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,MAAM,KAAK,CAAC;AACtF,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,UAAM,UAAU,MAAM,KAAK,cAAc,YAAY,WAAW,QAAQ,EAAE;AAC1E,WAAO,EAAE,GAAG,SAAS,QAAA;AAAA,EACtB;AAAA,EAEA,MAAa,YAAY,WAAgD;AACxE,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,eAAe;AAAA,EAC9D;AAAA,EAEA,MAAa,sBAAsB,WAA4B,YAAoB,mBAA0D;AAC5I,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,wBAAwB,YAAY,iBAAiB,CAAC;AAAA,EACrG;AACD;AAEO,MAAM,yBAAyB,MAAM;AAAC;AAItC,MAAM,oBAAoB;AAAA,EAChC,YAA4B,gBAAqC;AAArC,SAAA,iBAAA;AAAA,EAC5B;AACD;"}

package/dist/development/src/model/service/ProjectMemberManager.cjs

@@ -12,8 +12,9 @@ const ProjectMembersQuery = require("../queries/membership/ProjectMembersQuery.c
 const PermissionActions = require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
 const Roles = require("../authorization/Roles.cjs");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 const schema = require("@contember/schema");
 const array = require("../../utils/array.cjs");
 const membershipUtils = require("./membershipUtils.cjs");

package/dist/development/src/model/service/ProjectMemberManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMemberManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectMemberManager.ts"],"sourcesContent":["import {\n\tAddProjectMemberCommand,\n\tMembershipUpdateInput,\n\tRemoveProjectMemberCommand,\n\tRemoveProjectMemberResponse,\n\tUpdateProjectMemberCommand,\n\tUpdateProjectMemberResponse,\n} from '../commands'\nimport { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries'\nimport { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema'\nimport { AccessVerifier, PermissionActions, TenantRole } from '../authorization'\nimport { indexListBy, notEmpty } from '../../utils/array'\nimport { createSetMembershipVariables } from './membershipUtils'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { Response } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\n\nexport class ProjectMemberManager {\n\tasync addProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t): Promise<AddProjectMemberResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await db.commandBus.execute(\n\t\t\t\tnew AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),\n\t\t\t)\n\t\t})\n\t}\n\n\tasync updateProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly MembershipUpdateInput[],\n\t): Promise<UpdateProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships)),\n\t\t)\n\t}\n\n\tasync removeProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string): Promise<RemoveProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId)),\n\t\t)\n\t}\n\n\tasync getAllProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\treturn [\n\t\t\t...this.getImplicitProjectMemberships(identity),\n\t\t\t...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier),\n\t\t]\n\t}\n\n\tasync getEffectiveProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst implicit = this.getImplicitProjectMemberships(identity)\n\t\tif (implicit.length > 0) {\n\t\t\treturn implicit\n\t\t}\n\t\treturn await this.getStoredProjectsMemberships(dbContext, project, identity, undefined)\n\t}\n\n\tasync getStoredProjectsMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst memberships = await dbContext.queryHandler.fetch(\n\t\t\tnew ProjectMembershipByIdentityQuery(project, [identity.id]),\n\t\t)\n\t\tif (verifier === undefined) {\n\t\t\treturn memberships\n\t\t}\n\t\treturn await this.filterMemberships(memberships, verifier)\n\t}\n\n\tprivate getImplicitProjectMemberships(identity: { id: string; roles?: readonly string[] }): readonly Acl.Membership[] {\n\t\tif (identity.roles?.includes(TenantRole.SUPER_ADMIN) || identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {\n\t\t\treturn [{ role: ProjectRole.ADMIN, variables: [] }]\n\t\t}\n\t\treturn []\n\t}\n\n\tasync getProjectMembers(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\taccessVerifier: AccessVerifier,\n\t\tinput: ProjectMembersInput,\n\t): Promise<GetProjectMembersResponse> {\n\t\treturn dbContext.transaction(async db => {\n\t\t\tconst members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))\n\t\t\tconst memberships = await db.queryHandler.fetch(\n\t\t\t\tnew ProjectMembershipByIdentityQuery(\n\t\t\t\t\t{ id: projectId },\n\t\t\t\t\tmembers.map(it => it.id),\n\t\t\t\t),\n\t\t\t)\n\t\t\tconst filteredMemberships = await this.filterMemberships(memberships, accessVerifier)\n\t\t\tconst byIdentity = indexListBy(filteredMemberships, 'identityId')\n\t\t\treturn members\n\t\t\t\t.map(it => (byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null))\n\t\t\t\t.filter(notEmpty)\n\t\t})\n\t}\n\n\tprivate async filterMemberships<T extends Acl.Membership>(\n\t\tmemberships: readonly T[],\n\t\tverifier: AccessVerifier,\n\t): Promise<T[]> {\n\t\tconst filteredMemberships: T[] = []\n\t\tnextMembership: for (const membership of memberships) {\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst variables: { values: Acl.MembershipVariable['values']; name: string }[] = []\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)\n\t\t\t\tif (values.length === 0) {\n\t\t\t\t\tcontinue nextMembership\n\t\t\t\t}\n\t\t\t\tvariables.push({ name: variable.name, values })\n\t\t\t}\n\t\t\tfilteredMemberships.push({ ...membership, variables })\n\t\t}\n\n\t\treturn filteredMemberships\n\t}\n\n\tprivate async filterProjectMembershipVariableValues(\n\t\tmembership: Acl.Membership,\n\t\tvariable: Acl.MembershipVariable,\n\t\tverifier: AccessVerifier,\n\t): Promise<Acl.MembershipVariable['values']> {\n\t\tconst values = await Promise.all(\n\t\t\tvariable.values.map(async (value): Promise<string | null> => {\n\t\t\t\tconst subMembership = {\n\t\t\t\t\trole: membership.role,\n\t\t\t\t\tvariables: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: variable.name,\n\t\t\t\t\t\t\tvalues: [value],\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t}\n\n\t\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership])))) {\n\t\t\t\t\treturn null\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t}),\n\t\t)\n\t\treturn values.filter(notEmpty)\n\t}\n}\n\nexport type AddProjectMemberResponse = Response<null, AddProjectMemberErrorCode>\n\nexport type GetProjectMembersResponse = {\n\tidentity: { id: string }\n\tmemberships: readonly Acl.Membership[]\n}[]\n"],"names":["AddProjectMemberCommand","createSetMembershipVariables","UpdateProjectMemberCommand","RemoveProjectMemberCommand","ProjectMembershipByIdentityQuery","TenantRole","ProjectRole","ProjectMembersQuery","indexListBy","notEmpty","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAqB;AAAA,EACjC,MAAM,iBACL,WACA,WACA,YACA,aACoC;AACpC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,GAAG,WAAW;AAAA,QAC1B,IAAIA,wBAAAA,wBAAwB,WAAW,YAAYC,gBAAAA,6BAA6B,WAAW,CAAC;AAAA,MAAA;AAAA,IAE9F,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,oBACL,WACA,WACA,YACA,aACuC;AACvC,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAIC,sDAA2B,WAAW,YAAY,WAAW,CAAC;AAAA,IAAA;AAAA,EAE5G;AAAA,EAEA,MAAM,oBAAoB,WAA4B,WAAmB,YAA0D;AAClI,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAIC,2BAAAA,2BAA2B,WAAW,UAAU,CAAC;AAAA,IAAA;AAAA,EAE/F;AAAA,EAEA,MAAM,yBACL,WACA,SACA,UACA,UACqC;AACrC,WAAO;AAAA,MACN,GAAG,KAAK,8BAA8B,QAAQ;AAAA,MAC9C,GAAG,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,QAAQ;AAAA,IAAA;AAAA,EAEnF;AAAA,EAEA,MAAM,+BACL,WACA,SACA,UACqC;AACrC,UAAM,WAAW,KAAK,8BAA8B,QAAQ;AAC5D,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,MAAS;AAAA,EACvF;AAAA,EAEA,MAAM,6BACL,WACA,SACA,UACA,UACqC;AACrC,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAIC,kEAAiC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,IAAA;AAE5D,QAAI,aAAa,QAAW;AAC3B,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,kBAAkB,aAAa,QAAQ;AAAA,EAC1D;AAAA,EAEQ,8BAA8B,UAAgF;AACrH,QAAI,SAAS,OAAO,SAASC,MAAAA,WAAW,WAAW,KAAK,SAAS,OAAO,SAASA,MAAAA,WAAW,aAAa,GAAG;AAC3G,aAAO,CAAC,EAAE,MAAMC,OAAAA,YAAY,OAAO,WAAW,CAAA,GAAI;AAAA,IACnD;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAM,kBACL,WACA,WACA,gBACA,OACqC;AACrC,WAAO,UAAU,YAAY,OAAM,OAAM;AACxC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,WAAW,KAAK,CAAC;AACrF,YAAM,cAAc,MAAM,GAAG,aAAa;AAAA,QACzC,IAAIH,iCAAAA;AAAAA,UACH,EAAE,IAAI,UAAA;AAAA,UACN,QAAQ,IAAI,CAAA,OAAM,GAAG,EAAE;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,sBAAsB,MAAM,KAAK,kBAAkB,aAAa,cAAc;AACpF,YAAM,aAAaI,MAAAA,YAAY,qBAAqB,YAAY;AAChE,aAAO,QACL,IAAI,CAAA,OAAO,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa,WAAW,GAAG,EAAE,EAAA,IAAM,IAAK,EACvF,OAAOC,cAAQ;AAAA,IAClB,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,aACA,UACe;AACf,UAAM,sBAA2B,CAAA;AACjC,mBAAgB,YAAW,cAAc,aAAa;AACrD,UAAI,CAAE,MAAM,SAASC,oCAAkB,oBAAoB,CAAC,EAAE,MAAM,WAAW,MAAM,WAAW,GAAC,CAAG,CAAC,CAAC,GAAI;AACzG;AAAA,MACD;AACA,YAAM,YAA0E,CAAA;AAChF,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,SAAS,MAAM,KAAK,sCAAsC,YAAY,UAAU,QAAQ;AAC9F,YAAI,OAAO,WAAW,GAAG;AACxB,mBAAS;AAAA,QACV;AACA,kBAAU,KAAK,EAAE,MAAM,SAAS,MAAM,QAAQ;AAAA,MAC/C;AACA,0BAAoB,KAAK,EAAE,GAAG,YAAY,WAAW;AAAA,IACtD;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,sCACb,YACA,UACA,UAC4C;AAC5C,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC5B,SAAS,OAAO,IAAI,OAAO,UAAkC;AAC5D,cAAM,gBAAgB;AAAA,UACrB,MAAM,WAAW;AAAA,UACjB,WAAW;AAAA,YACV;AAAA,cACC,MAAM,SAAS;AAAA,cACf,QAAQ,CAAC,KAAK;AAAA,YAAA;AAAA,UACf;AAAA,QACD;AAGD,YAAI,CAAE,MAAM,SAASA,kBAAAA,kBAAkB,oBAAoB,CAAC,aAAa,CAAC,CAAC,GAAI;AAC9E,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,MACR,CAAC;AAAA,IAAA;AAEF,WAAO,OAAO,OAAOD,cAAQ;AAAA,EAC9B;AACD;;"}
+{"version":3,"file":"ProjectMemberManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectMemberManager.ts"],"sourcesContent":["import {\n\tAddProjectMemberCommand,\n\tMembershipUpdateInput,\n\tRemoveProjectMemberCommand,\n\tRemoveProjectMemberResponse,\n\tUpdateProjectMemberCommand,\n\tUpdateProjectMemberResponse,\n} from '../commands/index.js'\nimport { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries/index.js'\nimport { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema/index.js'\nimport { AccessVerifier, PermissionActions, TenantRole } from '../authorization/index.js'\nimport { indexListBy, notEmpty } from '../../utils/array.js'\nimport { createSetMembershipVariables } from './membershipUtils.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { Response } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class ProjectMemberManager {\n\tasync addProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t): Promise<AddProjectMemberResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await db.commandBus.execute(\n\t\t\t\tnew AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),\n\t\t\t)\n\t\t})\n\t}\n\n\tasync updateProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly MembershipUpdateInput[],\n\t): Promise<UpdateProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships)),\n\t\t)\n\t}\n\n\tasync removeProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string): Promise<RemoveProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId)),\n\t\t)\n\t}\n\n\tasync getAllProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\treturn [\n\t\t\t...this.getImplicitProjectMemberships(identity),\n\t\t\t...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier),\n\t\t]\n\t}\n\n\tasync getEffectiveProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst implicit = this.getImplicitProjectMemberships(identity)\n\t\tif (implicit.length > 0) {\n\t\t\treturn implicit\n\t\t}\n\t\treturn await this.getStoredProjectsMemberships(dbContext, project, identity, undefined)\n\t}\n\n\tasync getStoredProjectsMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst memberships = await dbContext.queryHandler.fetch(\n\t\t\tnew ProjectMembershipByIdentityQuery(project, [identity.id]),\n\t\t)\n\t\tif (verifier === undefined) {\n\t\t\treturn memberships\n\t\t}\n\t\treturn await this.filterMemberships(memberships, verifier)\n\t}\n\n\tprivate getImplicitProjectMemberships(identity: { id: string; roles?: readonly string[] }): readonly Acl.Membership[] {\n\t\tif (identity.roles?.includes(TenantRole.SUPER_ADMIN) || identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {\n\t\t\treturn [{ role: ProjectRole.ADMIN, variables: [] }]\n\t\t}\n\t\treturn []\n\t}\n\n\tasync getProjectMembers(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\taccessVerifier: AccessVerifier,\n\t\tinput: ProjectMembersInput,\n\t): Promise<GetProjectMembersResponse> {\n\t\treturn dbContext.transaction(async db => {\n\t\t\tconst members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))\n\t\t\tconst memberships = await db.queryHandler.fetch(\n\t\t\t\tnew ProjectMembershipByIdentityQuery(\n\t\t\t\t\t{ id: projectId },\n\t\t\t\t\tmembers.map(it => it.id),\n\t\t\t\t),\n\t\t\t)\n\t\t\tconst filteredMemberships = await this.filterMemberships(memberships, accessVerifier)\n\t\t\tconst byIdentity = indexListBy(filteredMemberships, 'identityId')\n\t\t\treturn members\n\t\t\t\t.map(it => (byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null))\n\t\t\t\t.filter(notEmpty)\n\t\t})\n\t}\n\n\tprivate async filterMemberships<T extends Acl.Membership>(\n\t\tmemberships: readonly T[],\n\t\tverifier: AccessVerifier,\n\t): Promise<T[]> {\n\t\tconst filteredMemberships: T[] = []\n\t\tnextMembership: for (const membership of memberships) {\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst variables: { values: Acl.MembershipVariable['values']; name: string }[] = []\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)\n\t\t\t\tif (values.length === 0) {\n\t\t\t\t\tcontinue nextMembership\n\t\t\t\t}\n\t\t\t\tvariables.push({ name: variable.name, values })\n\t\t\t}\n\t\t\tfilteredMemberships.push({ ...membership, variables })\n\t\t}\n\n\t\treturn filteredMemberships\n\t}\n\n\tprivate async filterProjectMembershipVariableValues(\n\t\tmembership: Acl.Membership,\n\t\tvariable: Acl.MembershipVariable,\n\t\tverifier: AccessVerifier,\n\t): Promise<Acl.MembershipVariable['values']> {\n\t\tconst values = await Promise.all(\n\t\t\tvariable.values.map(async (value): Promise<string | null> => {\n\t\t\t\tconst subMembership = {\n\t\t\t\t\trole: membership.role,\n\t\t\t\t\tvariables: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: variable.name,\n\t\t\t\t\t\t\tvalues: [value],\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t}\n\n\t\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership])))) {\n\t\t\t\t\treturn null\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t}),\n\t\t)\n\t\treturn values.filter(notEmpty)\n\t}\n}\n\nexport type AddProjectMemberResponse = Response<null, AddProjectMemberErrorCode>\n\nexport type GetProjectMembersResponse = {\n\tidentity: { id: string }\n\tmemberships: readonly Acl.Membership[]\n}[]\n"],"names":["AddProjectMemberCommand","createSetMembershipVariables","UpdateProjectMemberCommand","RemoveProjectMemberCommand","ProjectMembershipByIdentityQuery","TenantRole","ProjectRole","ProjectMembersQuery","indexListBy","notEmpty","PermissionActions"],"mappings":";;;;;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAqB;AAAA,EACjC,MAAM,iBACL,WACA,WACA,YACA,aACoC;AACpC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,GAAG,WAAW;AAAA,QAC1B,IAAIA,wBAAAA,wBAAwB,WAAW,YAAYC,gBAAAA,6BAA6B,WAAW,CAAC;AAAA,MAAA;AAAA,IAE9F,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,oBACL,WACA,WACA,YACA,aACuC;AACvC,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAIC,sDAA2B,WAAW,YAAY,WAAW,CAAC;AAAA,IAAA;AAAA,EAE5G;AAAA,EAEA,MAAM,oBAAoB,WAA4B,WAAmB,YAA0D;AAClI,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAIC,2BAAAA,2BAA2B,WAAW,UAAU,CAAC;AAAA,IAAA;AAAA,EAE/F;AAAA,EAEA,MAAM,yBACL,WACA,SACA,UACA,UACqC;AACrC,WAAO;AAAA,MACN,GAAG,KAAK,8BAA8B,QAAQ;AAAA,MAC9C,GAAG,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,QAAQ;AAAA,IAAA;AAAA,EAEnF;AAAA,EAEA,MAAM,+BACL,WACA,SACA,UACqC;AACrC,UAAM,WAAW,KAAK,8BAA8B,QAAQ;AAC5D,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,MAAS;AAAA,EACvF;AAAA,EAEA,MAAM,6BACL,WACA,SACA,UACA,UACqC;AACrC,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAIC,kEAAiC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,IAAA;AAE5D,QAAI,aAAa,QAAW;AAC3B,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,kBAAkB,aAAa,QAAQ;AAAA,EAC1D;AAAA,EAEQ,8BAA8B,UAAgF;AACrH,QAAI,SAAS,OAAO,SAASC,MAAAA,WAAW,WAAW,KAAK,SAAS,OAAO,SAASA,MAAAA,WAAW,aAAa,GAAG;AAC3G,aAAO,CAAC,EAAE,MAAMC,OAAAA,YAAY,OAAO,WAAW,CAAA,GAAI;AAAA,IACnD;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAM,kBACL,WACA,WACA,gBACA,OACqC;AACrC,WAAO,UAAU,YAAY,OAAM,OAAM;AACxC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,WAAW,KAAK,CAAC;AACrF,YAAM,cAAc,MAAM,GAAG,aAAa;AAAA,QACzC,IAAIH,iCAAAA;AAAAA,UACH,EAAE,IAAI,UAAA;AAAA,UACN,QAAQ,IAAI,CAAA,OAAM,GAAG,EAAE;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,sBAAsB,MAAM,KAAK,kBAAkB,aAAa,cAAc;AACpF,YAAM,aAAaI,MAAAA,YAAY,qBAAqB,YAAY;AAChE,aAAO,QACL,IAAI,CAAA,OAAO,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa,WAAW,GAAG,EAAE,EAAA,IAAM,IAAK,EACvF,OAAOC,cAAQ;AAAA,IAClB,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,aACA,UACe;AACf,UAAM,sBAA2B,CAAA;AACjC,mBAAgB,YAAW,cAAc,aAAa;AACrD,UAAI,CAAE,MAAM,SAASC,oCAAkB,oBAAoB,CAAC,EAAE,MAAM,WAAW,MAAM,WAAW,GAAC,CAAG,CAAC,CAAC,GAAI;AACzG;AAAA,MACD;AACA,YAAM,YAA0E,CAAA;AAChF,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,SAAS,MAAM,KAAK,sCAAsC,YAAY,UAAU,QAAQ;AAC9F,YAAI,OAAO,WAAW,GAAG;AACxB,mBAAS;AAAA,QACV;AACA,kBAAU,KAAK,EAAE,MAAM,SAAS,MAAM,QAAQ;AAAA,MAC/C;AACA,0BAAoB,KAAK,EAAE,GAAG,YAAY,WAAW;AAAA,IACtD;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,sCACb,YACA,UACA,UAC4C;AAC5C,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC5B,SAAS,OAAO,IAAI,OAAO,UAAkC;AAC5D,cAAM,gBAAgB;AAAA,UACrB,MAAM,WAAW;AAAA,UACjB,WAAW;AAAA,YACV;AAAA,cACC,MAAM,SAAS;AAAA,cACf,QAAQ,CAAC,KAAK;AAAA,YAAA;AAAA,UACf;AAAA,QACD;AAGD,YAAI,CAAE,MAAM,SAASA,kBAAAA,kBAAkB,oBAAoB,CAAC,aAAa,CAAC,CAAC,GAAI;AAC9E,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,MACR,CAAC;AAAA,IAAA;AAEF,WAAO,OAAO,OAAOD,cAAQ;AAAA,EAC9B;AACD;;"}

package/dist/development/src/model/service/ProjectMemberManager.js

@@ -10,8 +10,9 @@ import { ProjectMembersQuery } from "../queries/membership/ProjectMembersQuery.j
 import { PermissionActions } from "../authorization/PermissionActions.js";
 import "@contember/authorization";
 import { TenantRole } from "../authorization/Roles.js";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import { ProjectRole } from "@contember/schema";
 import { indexListBy, notEmpty } from "../../utils/array.js";
 import { createSetMembershipVariables } from "./membershipUtils.js";

package/dist/development/src/model/service/ProjectMemberManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMemberManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectMemberManager.ts"],"sourcesContent":["import {\n\tAddProjectMemberCommand,\n\tMembershipUpdateInput,\n\tRemoveProjectMemberCommand,\n\tRemoveProjectMemberResponse,\n\tUpdateProjectMemberCommand,\n\tUpdateProjectMemberResponse,\n} from '../commands'\nimport { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries'\nimport { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema'\nimport { AccessVerifier, PermissionActions, TenantRole } from '../authorization'\nimport { indexListBy, notEmpty } from '../../utils/array'\nimport { createSetMembershipVariables } from './membershipUtils'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { Response } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\n\nexport class ProjectMemberManager {\n\tasync addProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t): Promise<AddProjectMemberResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await db.commandBus.execute(\n\t\t\t\tnew AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),\n\t\t\t)\n\t\t})\n\t}\n\n\tasync updateProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly MembershipUpdateInput[],\n\t): Promise<UpdateProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships)),\n\t\t)\n\t}\n\n\tasync removeProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string): Promise<RemoveProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId)),\n\t\t)\n\t}\n\n\tasync getAllProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\treturn [\n\t\t\t...this.getImplicitProjectMemberships(identity),\n\t\t\t...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier),\n\t\t]\n\t}\n\n\tasync getEffectiveProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst implicit = this.getImplicitProjectMemberships(identity)\n\t\tif (implicit.length > 0) {\n\t\t\treturn implicit\n\t\t}\n\t\treturn await this.getStoredProjectsMemberships(dbContext, project, identity, undefined)\n\t}\n\n\tasync getStoredProjectsMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst memberships = await dbContext.queryHandler.fetch(\n\t\t\tnew ProjectMembershipByIdentityQuery(project, [identity.id]),\n\t\t)\n\t\tif (verifier === undefined) {\n\t\t\treturn memberships\n\t\t}\n\t\treturn await this.filterMemberships(memberships, verifier)\n\t}\n\n\tprivate getImplicitProjectMemberships(identity: { id: string; roles?: readonly string[] }): readonly Acl.Membership[] {\n\t\tif (identity.roles?.includes(TenantRole.SUPER_ADMIN) || identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {\n\t\t\treturn [{ role: ProjectRole.ADMIN, variables: [] }]\n\t\t}\n\t\treturn []\n\t}\n\n\tasync getProjectMembers(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\taccessVerifier: AccessVerifier,\n\t\tinput: ProjectMembersInput,\n\t): Promise<GetProjectMembersResponse> {\n\t\treturn dbContext.transaction(async db => {\n\t\t\tconst members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))\n\t\t\tconst memberships = await db.queryHandler.fetch(\n\t\t\t\tnew ProjectMembershipByIdentityQuery(\n\t\t\t\t\t{ id: projectId },\n\t\t\t\t\tmembers.map(it => it.id),\n\t\t\t\t),\n\t\t\t)\n\t\t\tconst filteredMemberships = await this.filterMemberships(memberships, accessVerifier)\n\t\t\tconst byIdentity = indexListBy(filteredMemberships, 'identityId')\n\t\t\treturn members\n\t\t\t\t.map(it => (byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null))\n\t\t\t\t.filter(notEmpty)\n\t\t})\n\t}\n\n\tprivate async filterMemberships<T extends Acl.Membership>(\n\t\tmemberships: readonly T[],\n\t\tverifier: AccessVerifier,\n\t): Promise<T[]> {\n\t\tconst filteredMemberships: T[] = []\n\t\tnextMembership: for (const membership of memberships) {\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst variables: { values: Acl.MembershipVariable['values']; name: string }[] = []\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)\n\t\t\t\tif (values.length === 0) {\n\t\t\t\t\tcontinue nextMembership\n\t\t\t\t}\n\t\t\t\tvariables.push({ name: variable.name, values })\n\t\t\t}\n\t\t\tfilteredMemberships.push({ ...membership, variables })\n\t\t}\n\n\t\treturn filteredMemberships\n\t}\n\n\tprivate async filterProjectMembershipVariableValues(\n\t\tmembership: Acl.Membership,\n\t\tvariable: Acl.MembershipVariable,\n\t\tverifier: AccessVerifier,\n\t): Promise<Acl.MembershipVariable['values']> {\n\t\tconst values = await Promise.all(\n\t\t\tvariable.values.map(async (value): Promise<string | null> => {\n\t\t\t\tconst subMembership = {\n\t\t\t\t\trole: membership.role,\n\t\t\t\t\tvariables: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: variable.name,\n\t\t\t\t\t\t\tvalues: [value],\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t}\n\n\t\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership])))) {\n\t\t\t\t\treturn null\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t}),\n\t\t)\n\t\treturn values.filter(notEmpty)\n\t}\n}\n\nexport type AddProjectMemberResponse = Response<null, AddProjectMemberErrorCode>\n\nexport type GetProjectMembersResponse = {\n\tidentity: { id: string }\n\tmemberships: readonly Acl.Membership[]\n}[]\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAqB;AAAA,EACjC,MAAM,iBACL,WACA,WACA,YACA,aACoC;AACpC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,GAAG,WAAW;AAAA,QAC1B,IAAI,wBAAwB,WAAW,YAAY,6BAA6B,WAAW,CAAC;AAAA,MAAA;AAAA,IAE9F,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,oBACL,WACA,WACA,YACA,aACuC;AACvC,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,YAAY,WAAW,CAAC;AAAA,IAAA;AAAA,EAE5G;AAAA,EAEA,MAAM,oBAAoB,WAA4B,WAAmB,YAA0D;AAClI,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,UAAU,CAAC;AAAA,IAAA;AAAA,EAE/F;AAAA,EAEA,MAAM,yBACL,WACA,SACA,UACA,UACqC;AACrC,WAAO;AAAA,MACN,GAAG,KAAK,8BAA8B,QAAQ;AAAA,MAC9C,GAAG,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,QAAQ;AAAA,IAAA;AAAA,EAEnF;AAAA,EAEA,MAAM,+BACL,WACA,SACA,UACqC;AACrC,UAAM,WAAW,KAAK,8BAA8B,QAAQ;AAC5D,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,MAAS;AAAA,EACvF;AAAA,EAEA,MAAM,6BACL,WACA,SACA,UACA,UACqC;AACrC,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAI,iCAAiC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,IAAA;AAE5D,QAAI,aAAa,QAAW;AAC3B,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,kBAAkB,aAAa,QAAQ;AAAA,EAC1D;AAAA,EAEQ,8BAA8B,UAAgF;AACrH,QAAI,SAAS,OAAO,SAAS,WAAW,WAAW,KAAK,SAAS,OAAO,SAAS,WAAW,aAAa,GAAG;AAC3G,aAAO,CAAC,EAAE,MAAM,YAAY,OAAO,WAAW,CAAA,GAAI;AAAA,IACnD;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAM,kBACL,WACA,WACA,gBACA,OACqC;AACrC,WAAO,UAAU,YAAY,OAAM,OAAM;AACxC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,CAAC;AACrF,YAAM,cAAc,MAAM,GAAG,aAAa;AAAA,QACzC,IAAI;AAAA,UACH,EAAE,IAAI,UAAA;AAAA,UACN,QAAQ,IAAI,CAAA,OAAM,GAAG,EAAE;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,sBAAsB,MAAM,KAAK,kBAAkB,aAAa,cAAc;AACpF,YAAM,aAAa,YAAY,qBAAqB,YAAY;AAChE,aAAO,QACL,IAAI,CAAA,OAAO,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa,WAAW,GAAG,EAAE,EAAA,IAAM,IAAK,EACvF,OAAO,QAAQ;AAAA,IAClB,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,aACA,UACe;AACf,UAAM,sBAA2B,CAAA;AACjC,mBAAgB,YAAW,cAAc,aAAa;AACrD,UAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,EAAE,MAAM,WAAW,MAAM,WAAW,GAAC,CAAG,CAAC,CAAC,GAAI;AACzG;AAAA,MACD;AACA,YAAM,YAA0E,CAAA;AAChF,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,SAAS,MAAM,KAAK,sCAAsC,YAAY,UAAU,QAAQ;AAC9F,YAAI,OAAO,WAAW,GAAG;AACxB,mBAAS;AAAA,QACV;AACA,kBAAU,KAAK,EAAE,MAAM,SAAS,MAAM,QAAQ;AAAA,MAC/C;AACA,0BAAoB,KAAK,EAAE,GAAG,YAAY,WAAW;AAAA,IACtD;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,sCACb,YACA,UACA,UAC4C;AAC5C,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC5B,SAAS,OAAO,IAAI,OAAO,UAAkC;AAC5D,cAAM,gBAAgB;AAAA,UACrB,MAAM,WAAW;AAAA,UACjB,WAAW;AAAA,YACV;AAAA,cACC,MAAM,SAAS;AAAA,cACf,QAAQ,CAAC,KAAK;AAAA,YAAA;AAAA,UACf;AAAA,QACD;AAGD,YAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,aAAa,CAAC,CAAC,GAAI;AAC9E,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,MACR,CAAC;AAAA,IAAA;AAEF,WAAO,OAAO,OAAO,QAAQ;AAAA,EAC9B;AACD;"}
+{"version":3,"file":"ProjectMemberManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectMemberManager.ts"],"sourcesContent":["import {\n\tAddProjectMemberCommand,\n\tMembershipUpdateInput,\n\tRemoveProjectMemberCommand,\n\tRemoveProjectMemberResponse,\n\tUpdateProjectMemberCommand,\n\tUpdateProjectMemberResponse,\n} from '../commands/index.js'\nimport { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries/index.js'\nimport { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema/index.js'\nimport { AccessVerifier, PermissionActions, TenantRole } from '../authorization/index.js'\nimport { indexListBy, notEmpty } from '../../utils/array.js'\nimport { createSetMembershipVariables } from './membershipUtils.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { Response } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class ProjectMemberManager {\n\tasync addProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t): Promise<AddProjectMemberResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await db.commandBus.execute(\n\t\t\t\tnew AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),\n\t\t\t)\n\t\t})\n\t}\n\n\tasync updateProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly MembershipUpdateInput[],\n\t): Promise<UpdateProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships)),\n\t\t)\n\t}\n\n\tasync removeProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string): Promise<RemoveProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId)),\n\t\t)\n\t}\n\n\tasync getAllProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\treturn [\n\t\t\t...this.getImplicitProjectMemberships(identity),\n\t\t\t...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier),\n\t\t]\n\t}\n\n\tasync getEffectiveProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst implicit = this.getImplicitProjectMemberships(identity)\n\t\tif (implicit.length > 0) {\n\t\t\treturn implicit\n\t\t}\n\t\treturn await this.getStoredProjectsMemberships(dbContext, project, identity, undefined)\n\t}\n\n\tasync getStoredProjectsMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } | { slug: string },\n\t\tidentity: { id: string },\n\t\tverifier: AccessVerifier | undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst memberships = await dbContext.queryHandler.fetch(\n\t\t\tnew ProjectMembershipByIdentityQuery(project, [identity.id]),\n\t\t)\n\t\tif (verifier === undefined) {\n\t\t\treturn memberships\n\t\t}\n\t\treturn await this.filterMemberships(memberships, verifier)\n\t}\n\n\tprivate getImplicitProjectMemberships(identity: { id: string; roles?: readonly string[] }): readonly Acl.Membership[] {\n\t\tif (identity.roles?.includes(TenantRole.SUPER_ADMIN) || identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {\n\t\t\treturn [{ role: ProjectRole.ADMIN, variables: [] }]\n\t\t}\n\t\treturn []\n\t}\n\n\tasync getProjectMembers(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\taccessVerifier: AccessVerifier,\n\t\tinput: ProjectMembersInput,\n\t): Promise<GetProjectMembersResponse> {\n\t\treturn dbContext.transaction(async db => {\n\t\t\tconst members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))\n\t\t\tconst memberships = await db.queryHandler.fetch(\n\t\t\t\tnew ProjectMembershipByIdentityQuery(\n\t\t\t\t\t{ id: projectId },\n\t\t\t\t\tmembers.map(it => it.id),\n\t\t\t\t),\n\t\t\t)\n\t\t\tconst filteredMemberships = await this.filterMemberships(memberships, accessVerifier)\n\t\t\tconst byIdentity = indexListBy(filteredMemberships, 'identityId')\n\t\t\treturn members\n\t\t\t\t.map(it => (byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null))\n\t\t\t\t.filter(notEmpty)\n\t\t})\n\t}\n\n\tprivate async filterMemberships<T extends Acl.Membership>(\n\t\tmemberships: readonly T[],\n\t\tverifier: AccessVerifier,\n\t): Promise<T[]> {\n\t\tconst filteredMemberships: T[] = []\n\t\tnextMembership: for (const membership of memberships) {\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst variables: { values: Acl.MembershipVariable['values']; name: string }[] = []\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)\n\t\t\t\tif (values.length === 0) {\n\t\t\t\t\tcontinue nextMembership\n\t\t\t\t}\n\t\t\t\tvariables.push({ name: variable.name, values })\n\t\t\t}\n\t\t\tfilteredMemberships.push({ ...membership, variables })\n\t\t}\n\n\t\treturn filteredMemberships\n\t}\n\n\tprivate async filterProjectMembershipVariableValues(\n\t\tmembership: Acl.Membership,\n\t\tvariable: Acl.MembershipVariable,\n\t\tverifier: AccessVerifier,\n\t): Promise<Acl.MembershipVariable['values']> {\n\t\tconst values = await Promise.all(\n\t\t\tvariable.values.map(async (value): Promise<string | null> => {\n\t\t\t\tconst subMembership = {\n\t\t\t\t\trole: membership.role,\n\t\t\t\t\tvariables: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: variable.name,\n\t\t\t\t\t\t\tvalues: [value],\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t}\n\n\t\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership])))) {\n\t\t\t\t\treturn null\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t}),\n\t\t)\n\t\treturn values.filter(notEmpty)\n\t}\n}\n\nexport type AddProjectMemberResponse = Response<null, AddProjectMemberErrorCode>\n\nexport type GetProjectMembersResponse = {\n\tidentity: { id: string }\n\tmemberships: readonly Acl.Membership[]\n}[]\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAqB;AAAA,EACjC,MAAM,iBACL,WACA,WACA,YACA,aACoC;AACpC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,GAAG,WAAW;AAAA,QAC1B,IAAI,wBAAwB,WAAW,YAAY,6BAA6B,WAAW,CAAC;AAAA,MAAA;AAAA,IAE9F,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,oBACL,WACA,WACA,YACA,aACuC;AACvC,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,YAAY,WAAW,CAAC;AAAA,IAAA;AAAA,EAE5G;AAAA,EAEA,MAAM,oBAAoB,WAA4B,WAAmB,YAA0D;AAClI,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,UAAU,CAAC;AAAA,IAAA;AAAA,EAE/F;AAAA,EAEA,MAAM,yBACL,WACA,SACA,UACA,UACqC;AACrC,WAAO;AAAA,MACN,GAAG,KAAK,8BAA8B,QAAQ;AAAA,MAC9C,GAAG,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,QAAQ;AAAA,IAAA;AAAA,EAEnF;AAAA,EAEA,MAAM,+BACL,WACA,SACA,UACqC;AACrC,UAAM,WAAW,KAAK,8BAA8B,QAAQ;AAC5D,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,MAAS;AAAA,EACvF;AAAA,EAEA,MAAM,6BACL,WACA,SACA,UACA,UACqC;AACrC,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAI,iCAAiC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,IAAA;AAE5D,QAAI,aAAa,QAAW;AAC3B,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,kBAAkB,aAAa,QAAQ;AAAA,EAC1D;AAAA,EAEQ,8BAA8B,UAAgF;AACrH,QAAI,SAAS,OAAO,SAAS,WAAW,WAAW,KAAK,SAAS,OAAO,SAAS,WAAW,aAAa,GAAG;AAC3G,aAAO,CAAC,EAAE,MAAM,YAAY,OAAO,WAAW,CAAA,GAAI;AAAA,IACnD;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAM,kBACL,WACA,WACA,gBACA,OACqC;AACrC,WAAO,UAAU,YAAY,OAAM,OAAM;AACxC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,CAAC;AACrF,YAAM,cAAc,MAAM,GAAG,aAAa;AAAA,QACzC,IAAI;AAAA,UACH,EAAE,IAAI,UAAA;AAAA,UACN,QAAQ,IAAI,CAAA,OAAM,GAAG,EAAE;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,sBAAsB,MAAM,KAAK,kBAAkB,aAAa,cAAc;AACpF,YAAM,aAAa,YAAY,qBAAqB,YAAY;AAChE,aAAO,QACL,IAAI,CAAA,OAAO,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa,WAAW,GAAG,EAAE,EAAA,IAAM,IAAK,EACvF,OAAO,QAAQ;AAAA,IAClB,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,aACA,UACe;AACf,UAAM,sBAA2B,CAAA;AACjC,mBAAgB,YAAW,cAAc,aAAa;AACrD,UAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,EAAE,MAAM,WAAW,MAAM,WAAW,GAAC,CAAG,CAAC,CAAC,GAAI;AACzG;AAAA,MACD;AACA,YAAM,YAA0E,CAAA;AAChF,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,SAAS,MAAM,KAAK,sCAAsC,YAAY,UAAU,QAAQ;AAC9F,YAAI,OAAO,WAAW,GAAG;AACxB,mBAAS;AAAA,QACV;AACA,kBAAU,KAAK,EAAE,MAAM,SAAS,MAAM,QAAQ;AAAA,MAC/C;AACA,0BAAoB,KAAK,EAAE,GAAG,YAAY,WAAW;AAAA,IACtD;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,sCACb,YACA,UACA,UAC4C;AAC5C,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC5B,SAAS,OAAO,IAAI,OAAO,UAAkC;AAC5D,cAAM,gBAAgB;AAAA,UACrB,MAAM,WAAW;AAAA,UACjB,WAAW;AAAA,YACV;AAAA,cACC,MAAM,SAAS;AAAA,cACf,QAAQ,CAAC,KAAK;AAAA,YAAA;AAAA,UACf;AAAA,QACD;AAGD,YAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,aAAa,CAAC,CAAC,GAAI;AAC9E,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,MACR,CAAC;AAAA,IAAA;AAEF,WAAO,OAAO,OAAO,QAAQ;AAAA,EAC9B;AACD;"}

package/dist/development/src/model/service/RateLimiter.cjs

@@ -0,0 +1,68 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const RateLimitCountQuery = require("../queries/rateLimit/RateLimitCountQuery.cjs");
+const RecordRateLimitEventCommand = require("../commands/rateLimit/RecordRateLimitEventCommand.cjs");
+const interval = require("../utils/interval.cjs");
+class RateLimiter {
+  constructor(providers) {
+    this.providers = providers;
+  }
+  hashKey(key) {
+    return this.providers.hash(key, "sha256");
+  }
+  resolveWindow(scope, config) {
+    const r = config.rateLimits;
+    switch (scope) {
+      case "sign_up_per_ip":
+        return { limit: r.signUpPerIp.limit, windowSeconds: interval.intervalToSeconds(r.signUpPerIp.window) };
+      case "login_per_ip":
+        return { limit: r.loginPerIp.limit, windowSeconds: interval.intervalToSeconds(r.loginPerIp.window) };
+      case "password_reset_per_ip":
+        return { limit: r.passwordResetPerIp.limit, windowSeconds: interval.intervalToSeconds(r.passwordResetPerIp.window) };
+      case "passwordless_init_per_ip":
+        return { limit: r.passwordlessInitPerIp.limit, windowSeconds: interval.intervalToSeconds(r.passwordlessInitPerIp.window) };
+      case "email_otp_per_person":
+        return { limit: r.emailOtpPerPerson.limit, windowSeconds: interval.intervalToSeconds(r.emailOtpPerPerson.window) };
+      case "email_verification_per_ip":
+        return { limit: r.emailVerificationPerIp.limit, windowSeconds: interval.intervalToSeconds(r.emailVerificationPerIp.window) };
+    }
+  }
+  /**
+   * Check whether the next attempt fits within the configured window without
+   * recording it. Use {@link record} after a successful gating decision.
+   */
+  async check(db, scope, key, config) {
+    const { limit, windowSeconds } = this.resolveWindow(scope, config);
+    if (limit <= 0 || windowSeconds <= 0) {
+      return { ok: true };
+    }
+    const count = await db.queryHandler.fetch(new RateLimitCountQuery.RateLimitCountQuery(scope, this.hashKey(key), windowSeconds));
+    if (count < limit) {
+      return { ok: true };
+    }
+    return { ok: false, retryAfterSeconds: windowSeconds };
+  }
+  async record(db, scope, key) {
+    await db.commandBus.execute(new RecordRateLimitEventCommand.RecordRateLimitEventCommand(scope, this.hashKey(key)));
+  }
+  /**
+   * Combined check + record. Returns the decision; only records on success.
+   *
+   * Not atomic: the COUNT and the INSERT are separate statements, so under
+   * concurrent requests for the same key a few attempts beyond the limit can
+   * slip through (the window is a soft ceiling). That is acceptable for abuse
+   * mitigation — do not rely on it as a hard quota.
+   */
+  async consume(db, scope, key, config) {
+    if (!key) {
+      return { ok: true };
+    }
+    const decision = await this.check(db, scope, key, config);
+    if (decision.ok) {
+      await this.record(db, scope, key);
+    }
+    return decision;
+  }
+}
+exports.RateLimiter = RateLimiter;
+//# sourceMappingURL=RateLimiter.cjs.map

package/dist/development/src/model/service/RateLimiter.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiter.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RateLimiter.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { Config } from '../type/Config.js'\nimport { RateLimitCountQuery } from '../queries/rateLimit/RateLimitCountQuery.js'\nimport { RecordRateLimitEventCommand } from '../commands/rateLimit/RecordRateLimitEventCommand.js'\nimport { RateLimitScope } from '../type/RateLimit.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nexport interface RateLimitWindow {\n\treadonly limit: number\n\treadonly window: {/* IPostgresInterval shape */}\n}\n\nexport interface RateLimitDecision {\n\treadonly ok: boolean\n\treadonly retryAfterSeconds?: number\n}\n\n/**\n * Sliding-window rate limiter backed by the `rate_limit_event` table.\n *\n * Cost: one COUNT(*) and (on success) one INSERT per check. The event row is\n * recorded only when the call passes — denied calls do not extend the window,\n * matching the spec's \"max N successful attempts per window\".\n *\n * The raw key (IP, email, ...) is hashed with the configured provider so the\n * raw value is not stored at rest. Note this is pseudonymization, not strong\n * anonymization: an unsalted SHA-256 of a low-entropy input (e.g. an IPv4\n * address) is recoverable by brute force, so treat key_hash as sensitive.\n */\nexport class RateLimiter {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'hash'>,\n\t) {}\n\n\tprivate hashKey(key: string): Buffer {\n\t\treturn this.providers.hash(key, 'sha256')\n\t}\n\n\tprivate resolveWindow(scope: RateLimitScope, config: Config): { limit: number; windowSeconds: number } {\n\t\tconst r = config.rateLimits\n\t\tswitch (scope) {\n\t\t\tcase 'sign_up_per_ip':\n\t\t\t\treturn { limit: r.signUpPerIp.limit, windowSeconds: intervalToSeconds(r.signUpPerIp.window as any) }\n\t\t\tcase 'login_per_ip':\n\t\t\t\treturn { limit: r.loginPerIp.limit, windowSeconds: intervalToSeconds(r.loginPerIp.window as any) }\n\t\t\tcase 'password_reset_per_ip':\n\t\t\t\treturn { limit: r.passwordResetPerIp.limit, windowSeconds: intervalToSeconds(r.passwordResetPerIp.window as any) }\n\t\t\tcase 'passwordless_init_per_ip':\n\t\t\t\treturn { limit: r.passwordlessInitPerIp.limit, windowSeconds: intervalToSeconds(r.passwordlessInitPerIp.window as any) }\n\t\t\tcase 'email_otp_per_person':\n\t\t\t\treturn { limit: r.emailOtpPerPerson.limit, windowSeconds: intervalToSeconds(r.emailOtpPerPerson.window as any) }\n\t\t\tcase 'email_verification_per_ip':\n\t\t\t\treturn { limit: r.emailVerificationPerIp.limit, windowSeconds: intervalToSeconds(r.emailVerificationPerIp.window as any) }\n\t\t}\n\t}\n\n\t/**\n\t * Check whether the next attempt fits within the configured window without\n\t * recording it. Use {@link record} after a successful gating decision.\n\t */\n\tasync check(db: DatabaseContext, scope: RateLimitScope, key: string, config: Config): Promise<RateLimitDecision> {\n\t\tconst { limit, windowSeconds } = this.resolveWindow(scope, config)\n\t\tif (limit <= 0 || windowSeconds <= 0) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowSeconds))\n\t\tif (count < limit) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\treturn { ok: false, retryAfterSeconds: windowSeconds }\n\t}\n\n\tasync record(db: DatabaseContext, scope: RateLimitScope, key: string): Promise<void> {\n\t\tawait db.commandBus.execute(new RecordRateLimitEventCommand(scope, this.hashKey(key)))\n\t}\n\n\t/**\n\t * Combined check + record. Returns the decision; only records on success.\n\t *\n\t * Not atomic: the COUNT and the INSERT are separate statements, so under\n\t * concurrent requests for the same key a few attempts beyond the limit can\n\t * slip through (the window is a soft ceiling). That is acceptable for abuse\n\t * mitigation — do not rely on it as a hard quota.\n\t */\n\tasync consume(db: DatabaseContext, scope: RateLimitScope, key: string | null | undefined, config: Config): Promise<RateLimitDecision> {\n\t\tif (!key) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst decision = await this.check(db, scope, key, config)\n\t\tif (decision.ok) {\n\t\t\tawait this.record(db, scope, key)\n\t\t}\n\t\treturn decision\n\t}\n}\n"],"names":["intervalToSeconds","RateLimitCountQuery","RecordRateLimitEventCommand"],"mappings":";;;;;AA8BO,MAAM,YAAY;AAAA,EACxB,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEK,QAAQ,KAAqB;AACpC,WAAO,KAAK,UAAU,KAAK,KAAK,QAAQ;AAAA,EACzC;AAAA,EAEQ,cAAc,OAAuB,QAA0D;AACtG,UAAM,IAAI,OAAO;AACjB,YAAQ,OAAA;AAAA,MACP,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,YAAY,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,YAAY,MAAa,EAAA;AAAA,MAClG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,WAAW,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,WAAW,MAAa,EAAA;AAAA,MAChG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,mBAAmB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,mBAAmB,MAAa,EAAA;AAAA,MAChH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,sBAAsB,MAAa,EAAA;AAAA,MACtH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,kBAAkB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,kBAAkB,MAAa,EAAA;AAAA,MAC9G,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,uBAAuB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,uBAAuB,MAAa,EAAA;AAAA,IAAE;AAAA,EAE5H;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,IAAqB,OAAuB,KAAa,QAA4C;AAChH,UAAM,EAAE,OAAO,cAAA,IAAkB,KAAK,cAAc,OAAO,MAAM;AACjE,QAAI,SAAS,KAAK,iBAAiB,GAAG;AACrC,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,QAAQ,MAAM,GAAG,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,OAAO,KAAK,QAAQ,GAAG,GAAG,aAAa,CAAC;AAC1G,QAAI,QAAQ,OAAO;AAClB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,WAAO,EAAE,IAAI,OAAO,mBAAmB,cAAA;AAAA,EACxC;AAAA,EAEA,MAAM,OAAO,IAAqB,OAAuB,KAA4B;AACpF,UAAM,GAAG,WAAW,QAAQ,IAAIC,4BAAAA,4BAA4B,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,IAAqB,OAAuB,KAAgC,QAA4C;AACrI,QAAI,CAAC,KAAK;AACT,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM;AACxD,QAAI,SAAS,IAAI;AAChB,YAAM,KAAK,OAAO,IAAI,OAAO,GAAG;AAAA,IACjC;AACA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/service/RateLimiter.js

@@ -0,0 +1,68 @@
+import { RateLimitCountQuery } from "../queries/rateLimit/RateLimitCountQuery.js";
+import { RecordRateLimitEventCommand } from "../commands/rateLimit/RecordRateLimitEventCommand.js";
+import { intervalToSeconds } from "../utils/interval.js";
+class RateLimiter {
+  constructor(providers) {
+    this.providers = providers;
+  }
+  hashKey(key) {
+    return this.providers.hash(key, "sha256");
+  }
+  resolveWindow(scope, config) {
+    const r = config.rateLimits;
+    switch (scope) {
+      case "sign_up_per_ip":
+        return { limit: r.signUpPerIp.limit, windowSeconds: intervalToSeconds(r.signUpPerIp.window) };
+      case "login_per_ip":
+        return { limit: r.loginPerIp.limit, windowSeconds: intervalToSeconds(r.loginPerIp.window) };
+      case "password_reset_per_ip":
+        return { limit: r.passwordResetPerIp.limit, windowSeconds: intervalToSeconds(r.passwordResetPerIp.window) };
+      case "passwordless_init_per_ip":
+        return { limit: r.passwordlessInitPerIp.limit, windowSeconds: intervalToSeconds(r.passwordlessInitPerIp.window) };
+      case "email_otp_per_person":
+        return { limit: r.emailOtpPerPerson.limit, windowSeconds: intervalToSeconds(r.emailOtpPerPerson.window) };
+      case "email_verification_per_ip":
+        return { limit: r.emailVerificationPerIp.limit, windowSeconds: intervalToSeconds(r.emailVerificationPerIp.window) };
+    }
+  }
+  /**
+   * Check whether the next attempt fits within the configured window without
+   * recording it. Use {@link record} after a successful gating decision.
+   */
+  async check(db, scope, key, config) {
+    const { limit, windowSeconds } = this.resolveWindow(scope, config);
+    if (limit <= 0 || windowSeconds <= 0) {
+      return { ok: true };
+    }
+    const count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowSeconds));
+    if (count < limit) {
+      return { ok: true };
+    }
+    return { ok: false, retryAfterSeconds: windowSeconds };
+  }
+  async record(db, scope, key) {
+    await db.commandBus.execute(new RecordRateLimitEventCommand(scope, this.hashKey(key)));
+  }
+  /**
+   * Combined check + record. Returns the decision; only records on success.
+   *
+   * Not atomic: the COUNT and the INSERT are separate statements, so under
+   * concurrent requests for the same key a few attempts beyond the limit can
+   * slip through (the window is a soft ceiling). That is acceptable for abuse
+   * mitigation — do not rely on it as a hard quota.
+   */
+  async consume(db, scope, key, config) {
+    if (!key) {
+      return { ok: true };
+    }
+    const decision = await this.check(db, scope, key, config);
+    if (decision.ok) {
+      await this.record(db, scope, key);
+    }
+    return decision;
+  }
+}
+export {
+  RateLimiter
+};
+//# sourceMappingURL=RateLimiter.js.map

package/dist/development/src/model/service/RateLimiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimiter.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RateLimiter.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { Config } from '../type/Config.js'\nimport { RateLimitCountQuery } from '../queries/rateLimit/RateLimitCountQuery.js'\nimport { RecordRateLimitEventCommand } from '../commands/rateLimit/RecordRateLimitEventCommand.js'\nimport { RateLimitScope } from '../type/RateLimit.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nexport interface RateLimitWindow {\n\treadonly limit: number\n\treadonly window: {/* IPostgresInterval shape */}\n}\n\nexport interface RateLimitDecision {\n\treadonly ok: boolean\n\treadonly retryAfterSeconds?: number\n}\n\n/**\n * Sliding-window rate limiter backed by the `rate_limit_event` table.\n *\n * Cost: one COUNT(*) and (on success) one INSERT per check. The event row is\n * recorded only when the call passes — denied calls do not extend the window,\n * matching the spec's \"max N successful attempts per window\".\n *\n * The raw key (IP, email, ...) is hashed with the configured provider so the\n * raw value is not stored at rest. Note this is pseudonymization, not strong\n * anonymization: an unsalted SHA-256 of a low-entropy input (e.g. an IPv4\n * address) is recoverable by brute force, so treat key_hash as sensitive.\n */\nexport class RateLimiter {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'hash'>,\n\t) {}\n\n\tprivate hashKey(key: string): Buffer {\n\t\treturn this.providers.hash(key, 'sha256')\n\t}\n\n\tprivate resolveWindow(scope: RateLimitScope, config: Config): { limit: number; windowSeconds: number } {\n\t\tconst r = config.rateLimits\n\t\tswitch (scope) {\n\t\t\tcase 'sign_up_per_ip':\n\t\t\t\treturn { limit: r.signUpPerIp.limit, windowSeconds: intervalToSeconds(r.signUpPerIp.window as any) }\n\t\t\tcase 'login_per_ip':\n\t\t\t\treturn { limit: r.loginPerIp.limit, windowSeconds: intervalToSeconds(r.loginPerIp.window as any) }\n\t\t\tcase 'password_reset_per_ip':\n\t\t\t\treturn { limit: r.passwordResetPerIp.limit, windowSeconds: intervalToSeconds(r.passwordResetPerIp.window as any) }\n\t\t\tcase 'passwordless_init_per_ip':\n\t\t\t\treturn { limit: r.passwordlessInitPerIp.limit, windowSeconds: intervalToSeconds(r.passwordlessInitPerIp.window as any) }\n\t\t\tcase 'email_otp_per_person':\n\t\t\t\treturn { limit: r.emailOtpPerPerson.limit, windowSeconds: intervalToSeconds(r.emailOtpPerPerson.window as any) }\n\t\t\tcase 'email_verification_per_ip':\n\t\t\t\treturn { limit: r.emailVerificationPerIp.limit, windowSeconds: intervalToSeconds(r.emailVerificationPerIp.window as any) }\n\t\t}\n\t}\n\n\t/**\n\t * Check whether the next attempt fits within the configured window without\n\t * recording it. Use {@link record} after a successful gating decision.\n\t */\n\tasync check(db: DatabaseContext, scope: RateLimitScope, key: string, config: Config): Promise<RateLimitDecision> {\n\t\tconst { limit, windowSeconds } = this.resolveWindow(scope, config)\n\t\tif (limit <= 0 || windowSeconds <= 0) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowSeconds))\n\t\tif (count < limit) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\treturn { ok: false, retryAfterSeconds: windowSeconds }\n\t}\n\n\tasync record(db: DatabaseContext, scope: RateLimitScope, key: string): Promise<void> {\n\t\tawait db.commandBus.execute(new RecordRateLimitEventCommand(scope, this.hashKey(key)))\n\t}\n\n\t/**\n\t * Combined check + record. Returns the decision; only records on success.\n\t *\n\t * Not atomic: the COUNT and the INSERT are separate statements, so under\n\t * concurrent requests for the same key a few attempts beyond the limit can\n\t * slip through (the window is a soft ceiling). That is acceptable for abuse\n\t * mitigation — do not rely on it as a hard quota.\n\t */\n\tasync consume(db: DatabaseContext, scope: RateLimitScope, key: string | null | undefined, config: Config): Promise<RateLimitDecision> {\n\t\tif (!key) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst decision = await this.check(db, scope, key, config)\n\t\tif (decision.ok) {\n\t\t\tawait this.record(db, scope, key)\n\t\t}\n\t\treturn decision\n\t}\n}\n"],"names":[],"mappings":";;;AA8BO,MAAM,YAAY;AAAA,EACxB,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEK,QAAQ,KAAqB;AACpC,WAAO,KAAK,UAAU,KAAK,KAAK,QAAQ;AAAA,EACzC;AAAA,EAEQ,cAAc,OAAuB,QAA0D;AACtG,UAAM,IAAI,OAAO;AACjB,YAAQ,OAAA;AAAA,MACP,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,YAAY,OAAO,eAAe,kBAAkB,EAAE,YAAY,MAAa,EAAA;AAAA,MAClG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,WAAW,OAAO,eAAe,kBAAkB,EAAE,WAAW,MAAa,EAAA;AAAA,MAChG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,mBAAmB,OAAO,eAAe,kBAAkB,EAAE,mBAAmB,MAAa,EAAA;AAAA,MAChH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,eAAe,kBAAkB,EAAE,sBAAsB,MAAa,EAAA;AAAA,MACtH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,kBAAkB,OAAO,eAAe,kBAAkB,EAAE,kBAAkB,MAAa,EAAA;AAAA,MAC9G,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,uBAAuB,OAAO,eAAe,kBAAkB,EAAE,uBAAuB,MAAa,EAAA;AAAA,IAAE;AAAA,EAE5H;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,IAAqB,OAAuB,KAAa,QAA4C;AAChH,UAAM,EAAE,OAAO,cAAA,IAAkB,KAAK,cAAc,OAAO,MAAM;AACjE,QAAI,SAAS,KAAK,iBAAiB,GAAG;AACrC,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,QAAQ,MAAM,GAAG,aAAa,MAAM,IAAI,oBAAoB,OAAO,KAAK,QAAQ,GAAG,GAAG,aAAa,CAAC;AAC1G,QAAI,QAAQ,OAAO;AAClB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,WAAO,EAAE,IAAI,OAAO,mBAAmB,cAAA;AAAA,EACxC;AAAA,EAEA,MAAM,OAAO,IAAqB,OAAuB,KAA4B;AACpF,UAAM,GAAG,WAAW,QAAQ,IAAI,4BAA4B,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,IAAqB,OAAuB,KAAgC,QAA4C;AACrI,QAAI,CAAC,KAAK;AACT,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM;AACxD,QAAI,SAAS,IAAI;AAChB,YAAM,KAAK,OAAO,IAAI,OAAO,GAAG;AAAA,IACjC;AACA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/service/RolesManager.cjs

@@ -5,38 +5,37 @@ require("@contember/database");
 require("node:crypto");
 const Response = require("../utils/Response.cjs");
 const PatchIdentityGlobalRoles = require("../commands/identity/PatchIdentityGlobalRoles.cjs");
-require("../authorization/PermissionActions.cjs");
-require("@contember/authorization");
-const Roles = require("../authorization/Roles.cjs");
-require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
-require("@contember/schema");
+const GlobalRoleValidator = require("./GlobalRoleValidator.cjs");
 class RolesManager {
+  constructor(globalRoleValidator = new GlobalRoleValidator.GlobalRoleValidator()) {
+    this.globalRoleValidator = globalRoleValidator;
+  }
   async addGlobalRoles(dbContext, identityId, roles) {
+    return await dbContext.transaction(async (db) => {
+      const validation = await this.validateAddedGlobalRoles(db, roles);
+      if (!validation.ok) {
+        return validation;
+      }
+      return await this.addValidatedGlobalRoles(db, identityId, roles);
+    }, { isolation: "readCommitted" });
+  }
+  async addValidatedGlobalRoles(dbContext, identityId, roles) {
     return this.patchGlobalRoles(dbContext, identityId, roles, []);
   }
+  async validateAddedGlobalRoles(dbContext, roles) {
+    const invalidRole = await this.globalRoleValidator.findInvalidRole(dbContext, roles);
+    return invalidRole === null ? new Response.ResponseOk(null) : new Response.ResponseError("INVALID_ROLE", `Role ${invalidRole} is not valid or globally assignable`);
+  }
   async removeGlobalRoles(dbContext, identityId, roles) {
     return this.patchGlobalRoles(dbContext, identityId, [], roles);
   }
   async patchGlobalRoles(dbContext, identityId, addRoles, removeRoles) {
-    const rolesValidationError = this.validateRoles([...addRoles, ...removeRoles]);
-    if (rolesValidationError) {
-      return rolesValidationError;
-    }
     const result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles.PatchIdentityGlobalRoles(identityId, addRoles, removeRoles));
     if (!result) {
       return new Response.ResponseError("IDENTITY_NOT_FOUND", `Identity ${identityId} not found`);
     }
     return new Response.ResponseOk(null);
   }
-  validateRoles(roles) {
-    for (const role of roles) {
-      if (!Object.values(Roles.TenantRole).includes(role)) {
-        return new Response.ResponseError("INVALID_ROLE", `Role ${role} is not valid`);
-      }
-    }
-    return null;
-  }
 }
 exports.RolesManager = RolesManager;
 //# sourceMappingURL=RolesManager.cjs.map

package/dist/development/src/model/service/RolesManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"RolesManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { PatchIdentityGlobalRoles } from '../commands'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response'\nimport { TenantRole } from '../authorization'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst rolesValidationError = this.validateRoles([...addRoles, ...removeRoles])\n\t\tif (rolesValidationError) {\n\t\t\treturn rolesValidationError\n\t\t}\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tprivate validateRoles(roles: string[]): Response<null, GlobalRolesErrorCode> | null {\n\t\tfor (const role of roles) {\n\t\t\tif (!Object.values(TenantRole).includes(role as TenantRole)) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${role} is not valid`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":["PatchIdentityGlobalRoles","ResponseError","ResponseOk","TenantRole"],"mappings":";;;;;;;;;;;;;AAKO,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAIA,yBAAAA,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAIC,SAAAA,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAOC,MAAAA,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAIF,SAAAA,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"RolesManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { PatchIdentityGlobalRoles } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { GlobalRoleValidator } from './GlobalRoleValidator.js'\nimport { Connection } from '@contember/database'\n\nexport class RolesManager {\n\tconstructor(\n\t\tprivate readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),\n\t) {\n\t}\n\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\tconst validation = await this.validateAddedGlobalRoles(db, roles)\n\t\t\tif (!validation.ok) {\n\t\t\t\treturn validation\n\t\t\t}\n\t\t\treturn await this.addValidatedGlobalRoles(db, identityId, roles)\n\t\t}, { isolation: 'readCommitted' })\n\t}\n\n\tasync addValidatedGlobalRoles(\n\t\tdbContext: DatabaseContext<Connection.TransactionLike>,\n\t\tidentityId: string,\n\t\troles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync validateAddedGlobalRoles(dbContext: DatabaseContext, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst invalidRole = await this.globalRoleValidator.findInvalidRole(dbContext, roles)\n\t\treturn invalidRole === null\n\t\t\t? new ResponseOk(null)\n\t\t\t: new ResponseError('INVALID_ROLE', `Role ${invalidRole} is not valid or globally assignable`)\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t| 'IDENTITY_NOT_FOUND'\n\t| 'INVALID_ROLE'\n"],"names":["GlobalRoleValidator","ResponseOk","ResponseError","PatchIdentityGlobalRoles"],"mappings":";;;;;;;;AAMO,MAAM,aAAa;AAAA,EACzB,YACkB,sBAA2C,IAAIA,oBAAAA,uBAC/D;AADgB,SAAA,sBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,YAAM,aAAa,MAAM,KAAK,yBAAyB,IAAI,KAAK;AAChE,UAAI,CAAC,WAAW,IAAI;AACnB,eAAO;AAAA,MACR;AACA,aAAO,MAAM,KAAK,wBAAwB,IAAI,YAAY,KAAK;AAAA,IAChE,GAAG,EAAE,WAAW,iBAAiB;AAAA,EAClC;AAAA,EAEA,MAAM,wBACL,WACA,YACA,OACgD;AAChD,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,yBAAyB,WAA4B,OAAyE;AACnI,UAAM,cAAc,MAAM,KAAK,oBAAoB,gBAAgB,WAAW,KAAK;AACnF,WAAO,gBAAgB,OACpB,IAAIC,SAAAA,WAAW,IAAI,IACnB,IAAIC,SAAAA,cAAc,gBAAgB,QAAQ,WAAW,sCAAsC;AAAA,EAC/F;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAID,SAAAA,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAID,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}