@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/migrations/2026-05-21-150000-email-otp-rate-limit.cjs

@@ -0,0 +1,18 @@
+"use strict";
+const sql = `
+    ALTER TABLE "config"
+        -- Unlike the per-IP throttles above (which default to 0 = opt-in), the
+        -- email-OTP limiter ships ON with a generous default. It is a brute-force
+        -- / email-bomb backstop for a second factor, keyed by person: a legitimate
+        -- user never requests 10 codes in 10 minutes, so the default does not change
+        -- behavior for real users, but it caps an attacker (who already knows the
+        -- password) from re-issuing codes to reset the per-code 3-attempt counter.
+        -- Set limit = 0 to disable.
+        ADD COLUMN "rate_limit_email_otp_per_person_limit"   INTEGER  NOT NULL DEFAULT 10,
+        ADD COLUMN "rate_limit_email_otp_per_person_window"  INTERVAL NOT NULL DEFAULT '10 minutes';
+`;
+async function _20260521150000emailotpratelimit(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260521150000emailotpratelimit;
+//# sourceMappingURL=2026-05-21-150000-email-otp-rate-limit.cjs.map

package/dist/production/src/migrations/2026-05-21-150000-email-otp-rate-limit.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-21-150000-email-otp-rate-limit.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-21-150000-email-otp-rate-limit.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n    ALTER TABLE \"config\"\n        -- Unlike the per-IP throttles above (which default to 0 = opt-in), the\n        -- email-OTP limiter ships ON with a generous default. It is a brute-force\n        -- / email-bomb backstop for a second factor, keyed by person: a legitimate\n        -- user never requests 10 codes in 10 minutes, so the default does not change\n        -- behavior for real users, but it caps an attacker (who already knows the\n        -- password) from re-issuing codes to reset the per-code 3-attempt counter.\n        -- Set limit = 0 to disable.\n        ADD COLUMN \"rate_limit_email_otp_per_person_limit\"   INTEGER  NOT NULL DEFAULT 10,\n        ADD COLUMN \"rate_limit_email_otp_per_person_window\"  INTERVAL NOT NULL DEFAULT '10 minutes';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaZ,eAAA,iCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-05-21-150000-email-otp-rate-limit.js

@@ -0,0 +1,19 @@
+const sql = `
+    ALTER TABLE "config"
+        -- Unlike the per-IP throttles above (which default to 0 = opt-in), the
+        -- email-OTP limiter ships ON with a generous default. It is a brute-force
+        -- / email-bomb backstop for a second factor, keyed by person: a legitimate
+        -- user never requests 10 codes in 10 minutes, so the default does not change
+        -- behavior for real users, but it caps an attacker (who already knows the
+        -- password) from re-issuing codes to reset the per-code 3-attempt counter.
+        -- Set limit = 0 to disable.
+        ADD COLUMN "rate_limit_email_otp_per_person_limit"   INTEGER  NOT NULL DEFAULT 10,
+        ADD COLUMN "rate_limit_email_otp_per_person_window"  INTERVAL NOT NULL DEFAULT '10 minutes';
+`;
+async function _20260521150000emailotpratelimit(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260521150000emailotpratelimit as default
+};
+//# sourceMappingURL=2026-05-21-150000-email-otp-rate-limit.js.map

package/dist/production/src/migrations/2026-05-21-150000-email-otp-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-21-150000-email-otp-rate-limit.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-21-150000-email-otp-rate-limit.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n    ALTER TABLE \"config\"\n        -- Unlike the per-IP throttles above (which default to 0 = opt-in), the\n        -- email-OTP limiter ships ON with a generous default. It is a brute-force\n        -- / email-bomb backstop for a second factor, keyed by person: a legitimate\n        -- user never requests 10 codes in 10 minutes, so the default does not change\n        -- behavior for real users, but it caps an attacker (who already knows the\n        -- password) from re-issuing codes to reset the per-code 3-attempt counter.\n        -- Set limit = 0 to disable.\n        ADD COLUMN \"rate_limit_email_otp_per_person_limit\"   INTEGER  NOT NULL DEFAULT 10,\n        ADD COLUMN \"rate_limit_email_otp_per_person_window\"  INTERVAL NOT NULL DEFAULT '10 minutes';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaZ,eAAA,iCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-05-26-120000-email-verification-types.cjs

@@ -0,0 +1,15 @@
+"use strict";
+const sql = `
+ALTER TYPE "person_token_type" ADD VALUE IF NOT EXISTS 'email_verification';
+ALTER TYPE "person_token_type" ADD VALUE IF NOT EXISTS 'email_change';
+
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_verify_init';
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_verify_complete';
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_change_init';
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_change_complete';
+`;
+async function _20260526120000emailverificationtypes(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260526120000emailverificationtypes;
+//# sourceMappingURL=2026-05-26-120000-email-verification-types.cjs.map

package/dist/production/src/migrations/2026-05-26-120000-email-verification-types.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-120000-email-verification-types.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-120000-email-verification-types.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// New enum values are added in their own migration so the values are committed\n// before any later migration (or runtime code) inserts rows using them — a new\n// enum value cannot be used in the same transaction that adds it.\nconst sql = `\nALTER TYPE \"person_token_type\" ADD VALUE IF NOT EXISTS 'email_verification';\nALTER TYPE \"person_token_type\" ADD VALUE IF NOT EXISTS 'email_change';\n\nALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_verify_init';\nALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_verify_complete';\nALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_change_init';\nALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_change_complete';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAKA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,eAAA,sCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-05-26-120000-email-verification-types.js

@@ -0,0 +1,16 @@
+const sql = `
+ALTER TYPE "person_token_type" ADD VALUE IF NOT EXISTS 'email_verification';
+ALTER TYPE "person_token_type" ADD VALUE IF NOT EXISTS 'email_change';
+
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_verify_init';
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_verify_complete';
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_change_init';
+ALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_change_complete';
+`;
+async function _20260526120000emailverificationtypes(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260526120000emailverificationtypes as default
+};
+//# sourceMappingURL=2026-05-26-120000-email-verification-types.js.map

package/dist/production/src/migrations/2026-05-26-120000-email-verification-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-120000-email-verification-types.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-120000-email-verification-types.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// New enum values are added in their own migration so the values are committed\n// before any later migration (or runtime code) inserts rows using them — a new\n// enum value cannot be used in the same transaction that adds it.\nconst sql = `\nALTER TYPE \"person_token_type\" ADD VALUE IF NOT EXISTS 'email_verification';\nALTER TYPE \"person_token_type\" ADD VALUE IF NOT EXISTS 'email_change';\n\nALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_verify_init';\nALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_verify_complete';\nALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_change_init';\nALTER TYPE auth_log_type ADD VALUE IF NOT EXISTS 'email_change_complete';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAKA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,eAAA,sCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-05-26-120010-email-verification.cjs

@@ -0,0 +1,28 @@
+"use strict";
+const sql = `
+ALTER TABLE "person"
+	-- Timestamp the email was proven owned; NULL = not verified. Existing
+	-- accounts stay NULL (no backfill) but are NOT locked out — see the
+	-- per-person flag below.
+	ADD COLUMN "email_verified_at" TIMESTAMPTZ,
+	-- Captured at sign-up from config.signup_require_email_verification. Flipping
+	-- the tenant-wide flag must only affect NEW accounts, so the requirement is
+	-- frozen per person here rather than read live at sign-in. Existing accounts
+	-- default to FALSE and therefore keep signing in regardless of the flag.
+	ADD COLUMN "email_verification_required" BOOLEAN NOT NULL DEFAULT FALSE;
+
+-- Generic per-token payload. Used by email_change tokens to carry the pending
+-- new address until the token is confirmed; NULL for all other token types.
+ALTER TABLE "person_token"
+	ADD COLUMN "meta" JSONB;
+
+-- Opt-in: disabled by default so upgrading the engine alone does not start
+-- requiring verification for existing deployments.
+ALTER TABLE "config"
+	ADD COLUMN "signup_require_email_verification" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260526120010emailverification(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260526120010emailverification;
+//# sourceMappingURL=2026-05-26-120010-email-verification.cjs.map

package/dist/production/src/migrations/2026-05-26-120010-email-verification.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-120010-email-verification.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-120010-email-verification.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\nALTER TABLE \"person\"\n\t-- Timestamp the email was proven owned; NULL = not verified. Existing\n\t-- accounts stay NULL (no backfill) but are NOT locked out — see the\n\t-- per-person flag below.\n\tADD COLUMN \"email_verified_at\" TIMESTAMPTZ,\n\t-- Captured at sign-up from config.signup_require_email_verification. Flipping\n\t-- the tenant-wide flag must only affect NEW accounts, so the requirement is\n\t-- frozen per person here rather than read live at sign-in. Existing accounts\n\t-- default to FALSE and therefore keep signing in regardless of the flag.\n\tADD COLUMN \"email_verification_required\" BOOLEAN NOT NULL DEFAULT FALSE;\n\n-- Generic per-token payload. Used by email_change tokens to carry the pending\n-- new address until the token is confirmed; NULL for all other token types.\nALTER TABLE \"person_token\"\n\tADD COLUMN \"meta\" JSONB;\n\n-- Opt-in: disabled by default so upgrading the engine alone does not start\n-- requiring verification for existing deployments.\nALTER TABLE \"config\"\n\tADD COLUMN \"signup_require_email_verification\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBZ,eAAA,iCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-05-26-120010-email-verification.js

@@ -0,0 +1,29 @@
+const sql = `
+ALTER TABLE "person"
+	-- Timestamp the email was proven owned; NULL = not verified. Existing
+	-- accounts stay NULL (no backfill) but are NOT locked out — see the
+	-- per-person flag below.
+	ADD COLUMN "email_verified_at" TIMESTAMPTZ,
+	-- Captured at sign-up from config.signup_require_email_verification. Flipping
+	-- the tenant-wide flag must only affect NEW accounts, so the requirement is
+	-- frozen per person here rather than read live at sign-in. Existing accounts
+	-- default to FALSE and therefore keep signing in regardless of the flag.
+	ADD COLUMN "email_verification_required" BOOLEAN NOT NULL DEFAULT FALSE;
+
+-- Generic per-token payload. Used by email_change tokens to carry the pending
+-- new address until the token is confirmed; NULL for all other token types.
+ALTER TABLE "person_token"
+	ADD COLUMN "meta" JSONB;
+
+-- Opt-in: disabled by default so upgrading the engine alone does not start
+-- requiring verification for existing deployments.
+ALTER TABLE "config"
+	ADD COLUMN "signup_require_email_verification" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260526120010emailverification(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260526120010emailverification as default
+};
+//# sourceMappingURL=2026-05-26-120010-email-verification.js.map

package/dist/production/src/migrations/2026-05-26-120010-email-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-120010-email-verification.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-120010-email-verification.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\nALTER TABLE \"person\"\n\t-- Timestamp the email was proven owned; NULL = not verified. Existing\n\t-- accounts stay NULL (no backfill) but are NOT locked out — see the\n\t-- per-person flag below.\n\tADD COLUMN \"email_verified_at\" TIMESTAMPTZ,\n\t-- Captured at sign-up from config.signup_require_email_verification. Flipping\n\t-- the tenant-wide flag must only affect NEW accounts, so the requirement is\n\t-- frozen per person here rather than read live at sign-in. Existing accounts\n\t-- default to FALSE and therefore keep signing in regardless of the flag.\n\tADD COLUMN \"email_verification_required\" BOOLEAN NOT NULL DEFAULT FALSE;\n\n-- Generic per-token payload. Used by email_change tokens to carry the pending\n-- new address until the token is confirmed; NULL for all other token types.\nALTER TABLE \"person_token\"\n\tADD COLUMN \"meta\" JSONB;\n\n-- Opt-in: disabled by default so upgrading the engine alone does not start\n-- requiring verification for existing deployments.\nALTER TABLE \"config\"\n\tADD COLUMN \"signup_require_email_verification\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAuBZ,eAAA,iCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-05-26-130000-email-change-verification-config.cjs

@@ -0,0 +1,19 @@
+"use strict";
+const sql = `
+-- Verification of a user-initiated e-mail change is a separate policy from
+-- signup verification (config.signup_require_email_verification): an account
+-- may not require verification to sign in, yet changing the address of an
+-- existing account should still prove ownership of the new address before it
+-- replaces the old one. Defaults to FALSE so an engine upgrade does not change
+-- existing changeMyProfile behavior — the address keeps swapping immediately.
+-- Opt in by setting it to TRUE: changing your own e-mail then goes through
+-- confirmEmailChange (the old address stays active until the new one is
+-- confirmed).
+ALTER TABLE "config"
+	ADD COLUMN "require_email_change_verification" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260526130000emailchangeverificationconfig(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260526130000emailchangeverificationconfig;
+//# sourceMappingURL=2026-05-26-130000-email-change-verification-config.cjs.map

package/dist/production/src/migrations/2026-05-26-130000-email-change-verification-config.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-130000-email-change-verification-config.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-130000-email-change-verification-config.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- Verification of a user-initiated e-mail change is a separate policy from\n-- signup verification (config.signup_require_email_verification): an account\n-- may not require verification to sign in, yet changing the address of an\n-- existing account should still prove ownership of the new address before it\n-- replaces the old one. Defaults to FALSE so an engine upgrade does not change\n-- existing changeMyProfile behavior — the address keeps swapping immediately.\n-- Opt in by setting it to TRUE: changing your own e-mail then goes through\n-- confirmEmailChange (the old address stays active until the new one is\n-- confirmed).\nALTER TABLE \"config\"\n\tADD COLUMN \"require_email_change_verification\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcZ,eAAA,6CAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-05-26-130000-email-change-verification-config.js

@@ -0,0 +1,20 @@
+const sql = `
+-- Verification of a user-initiated e-mail change is a separate policy from
+-- signup verification (config.signup_require_email_verification): an account
+-- may not require verification to sign in, yet changing the address of an
+-- existing account should still prove ownership of the new address before it
+-- replaces the old one. Defaults to FALSE so an engine upgrade does not change
+-- existing changeMyProfile behavior — the address keeps swapping immediately.
+-- Opt in by setting it to TRUE: changing your own e-mail then goes through
+-- confirmEmailChange (the old address stays active until the new one is
+-- confirmed).
+ALTER TABLE "config"
+	ADD COLUMN "require_email_change_verification" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260526130000emailchangeverificationconfig(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260526130000emailchangeverificationconfig as default
+};
+//# sourceMappingURL=2026-05-26-130000-email-change-verification-config.js.map

package/dist/production/src/migrations/2026-05-26-130000-email-change-verification-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-130000-email-change-verification-config.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-130000-email-change-verification-config.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- Verification of a user-initiated e-mail change is a separate policy from\n-- signup verification (config.signup_require_email_verification): an account\n-- may not require verification to sign in, yet changing the address of an\n-- existing account should still prove ownership of the new address before it\n-- replaces the old one. Defaults to FALSE so an engine upgrade does not change\n-- existing changeMyProfile behavior — the address keeps swapping immediately.\n-- Opt in by setting it to TRUE: changing your own e-mail then goes through\n-- confirmEmailChange (the old address stays active until the new one is\n-- confirmed).\nALTER TABLE \"config\"\n\tADD COLUMN \"require_email_change_verification\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAcZ,eAAA,6CAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-05-26-130010-idp-require-verified-email.cjs

@@ -0,0 +1,15 @@
+"use strict";
+const sql = `
+-- When TRUE, a non-exclusive identity provider may only auto-link to (or sign
+-- in) an existing account by e-mail if the provider asserts the e-mail is
+-- verified (the OIDC "email_verified" claim). This blocks account takeover via
+-- a provider that returns an unverified / attacker-controlled e-mail. Defaults
+-- to FALSE to preserve existing behavior; tighten per provider as needed.
+ALTER TABLE "identity_provider"
+	ADD COLUMN "require_verified_email" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260526130010idprequireverifiedemail(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260526130010idprequireverifiedemail;
+//# sourceMappingURL=2026-05-26-130010-idp-require-verified-email.cjs.map

package/dist/production/src/migrations/2026-05-26-130010-idp-require-verified-email.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-130010-idp-require-verified-email.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-130010-idp-require-verified-email.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- When TRUE, a non-exclusive identity provider may only auto-link to (or sign\n-- in) an existing account by e-mail if the provider asserts the e-mail is\n-- verified (the OIDC \"email_verified\" claim). This blocks account takeover via\n-- a provider that returns an unverified / attacker-controlled e-mail. Defaults\n-- to FALSE to preserve existing behavior; tighten per provider as needed.\nALTER TABLE \"identity_provider\"\n\tADD COLUMN \"require_verified_email\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,eAAA,uCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-05-26-130010-idp-require-verified-email.js

@@ -0,0 +1,16 @@
+const sql = `
+-- When TRUE, a non-exclusive identity provider may only auto-link to (or sign
+-- in) an existing account by e-mail if the provider asserts the e-mail is
+-- verified (the OIDC "email_verified" claim). This blocks account takeover via
+-- a provider that returns an unverified / attacker-controlled e-mail. Defaults
+-- to FALSE to preserve existing behavior; tighten per provider as needed.
+ALTER TABLE "identity_provider"
+	ADD COLUMN "require_verified_email" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260526130010idprequireverifiedemail(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260526130010idprequireverifiedemail as default
+};
+//# sourceMappingURL=2026-05-26-130010-idp-require-verified-email.js.map

package/dist/production/src/migrations/2026-05-26-130010-idp-require-verified-email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-130010-idp-require-verified-email.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-130010-idp-require-verified-email.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- When TRUE, a non-exclusive identity provider may only auto-link to (or sign\n-- in) an existing account by e-mail if the provider asserts the e-mail is\n-- verified (the OIDC \"email_verified\" claim). This blocks account takeover via\n-- a provider that returns an unverified / attacker-controlled e-mail. Defaults\n-- to FALSE to preserve existing behavior; tighten per provider as needed.\nALTER TABLE \"identity_provider\"\n\tADD COLUMN \"require_verified_email\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,eAAA,uCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-05-26-130020-email-verification-rate-limit.cjs

@@ -0,0 +1,17 @@
+"use strict";
+const sql = `
+-- Per-IP rate limit for requestEmailVerification, mirroring the existing
+-- password-reset / passwordless-init limits. requestEmailVerification is an
+-- unauthenticated, email-sending endpoint of the same class as password reset,
+-- so it gets its own budget rather than sharing one. Defaults to limit 0, which
+-- the RateLimiter treats as "disabled" — an engine upgrade therefore adds no
+-- throttling until an operator configures emailVerificationPerIp.
+ALTER TABLE "config"
+	ADD COLUMN "rate_limit_email_verification_per_ip_limit"  INTEGER  NOT NULL DEFAULT 0,
+	ADD COLUMN "rate_limit_email_verification_per_ip_window" INTERVAL NOT NULL DEFAULT '1 hour';
+`;
+async function _20260526130020emailverificationratelimit(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260526130020emailverificationratelimit;
+//# sourceMappingURL=2026-05-26-130020-email-verification-rate-limit.cjs.map

package/dist/production/src/migrations/2026-05-26-130020-email-verification-rate-limit.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-130020-email-verification-rate-limit.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-130020-email-verification-rate-limit.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- Per-IP rate limit for requestEmailVerification, mirroring the existing\n-- password-reset / passwordless-init limits. requestEmailVerification is an\n-- unauthenticated, email-sending endpoint of the same class as password reset,\n-- so it gets its own budget rather than sharing one. Defaults to limit 0, which\n-- the RateLimiter treats as \"disabled\" — an engine upgrade therefore adds no\n-- throttling until an operator configures emailVerificationPerIp.\nALTER TABLE \"config\"\n\tADD COLUMN \"rate_limit_email_verification_per_ip_limit\"  INTEGER  NOT NULL DEFAULT 0,\n\tADD COLUMN \"rate_limit_email_verification_per_ip_window\" INTERVAL NOT NULL DEFAULT '1 hour';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYZ,eAAA,0CAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-05-26-130020-email-verification-rate-limit.js

@@ -0,0 +1,18 @@
+const sql = `
+-- Per-IP rate limit for requestEmailVerification, mirroring the existing
+-- password-reset / passwordless-init limits. requestEmailVerification is an
+-- unauthenticated, email-sending endpoint of the same class as password reset,
+-- so it gets its own budget rather than sharing one. Defaults to limit 0, which
+-- the RateLimiter treats as "disabled" — an engine upgrade therefore adds no
+-- throttling until an operator configures emailVerificationPerIp.
+ALTER TABLE "config"
+	ADD COLUMN "rate_limit_email_verification_per_ip_limit"  INTEGER  NOT NULL DEFAULT 0,
+	ADD COLUMN "rate_limit_email_verification_per_ip_window" INTERVAL NOT NULL DEFAULT '1 hour';
+`;
+async function _20260526130020emailverificationratelimit(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260526130020emailverificationratelimit as default
+};
+//# sourceMappingURL=2026-05-26-130020-email-verification-rate-limit.js.map

package/dist/production/src/migrations/2026-05-26-130020-email-verification-rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-130020-email-verification-rate-limit.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-130020-email-verification-rate-limit.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- Per-IP rate limit for requestEmailVerification, mirroring the existing\n-- password-reset / passwordless-init limits. requestEmailVerification is an\n-- unauthenticated, email-sending endpoint of the same class as password reset,\n-- so it gets its own budget rather than sharing one. Defaults to limit 0, which\n-- the RateLimiter treats as \"disabled\" — an engine upgrade therefore adds no\n-- throttling until an operator configures emailVerificationPerIp.\nALTER TABLE \"config\"\n\tADD COLUMN \"rate_limit_email_verification_per_ip_limit\"  INTEGER  NOT NULL DEFAULT 0,\n\tADD COLUMN \"rate_limit_email_verification_per_ip_window\" INTERVAL NOT NULL DEFAULT '1 hour';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAYZ,eAAA,0CAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-05-26-130030-captcha-protect-flows.cjs

@@ -0,0 +1,22 @@
+"use strict";
+const sql = `
+-- Per-flow captcha enforcement. A single captcha provider/secret is shared, but
+-- which mutations actually require a captcha token is now configurable instead
+-- of an all-or-nothing global switch (different deployments expose different
+-- subsets publicly — e.g. open registration vs admin-only signUp).
+--
+-- The historically-protected flows default to TRUE so configuring a provider
+-- keeps protecting them exactly as before. requestEmailVerification is a
+-- newly-added gate (never shipped enforced), so it defaults to FALSE — opt in
+-- explicitly if that resend endpoint is publicly exposed.
+ALTER TABLE "config"
+	ADD COLUMN "captcha_protect_sign_up"           BOOLEAN NOT NULL DEFAULT TRUE,
+	ADD COLUMN "captcha_protect_password_reset"     BOOLEAN NOT NULL DEFAULT TRUE,
+	ADD COLUMN "captcha_protect_passwordless_init"  BOOLEAN NOT NULL DEFAULT TRUE,
+	ADD COLUMN "captcha_protect_email_verification" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260526130030captchaprotectflows(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260526130030captchaprotectflows;
+//# sourceMappingURL=2026-05-26-130030-captcha-protect-flows.cjs.map

package/dist/production/src/migrations/2026-05-26-130030-captcha-protect-flows.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-130030-captcha-protect-flows.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-130030-captcha-protect-flows.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- Per-flow captcha enforcement. A single captcha provider/secret is shared, but\n-- which mutations actually require a captcha token is now configurable instead\n-- of an all-or-nothing global switch (different deployments expose different\n-- subsets publicly — e.g. open registration vs admin-only signUp).\n--\n-- The historically-protected flows default to TRUE so configuring a provider\n-- keeps protecting them exactly as before. requestEmailVerification is a\n-- newly-added gate (never shipped enforced), so it defaults to FALSE — opt in\n-- explicitly if that resend endpoint is publicly exposed.\nALTER TABLE \"config\"\n\tADD COLUMN \"captcha_protect_sign_up\"           BOOLEAN NOT NULL DEFAULT TRUE,\n\tADD COLUMN \"captcha_protect_password_reset\"     BOOLEAN NOT NULL DEFAULT TRUE,\n\tADD COLUMN \"captcha_protect_passwordless_init\"  BOOLEAN NOT NULL DEFAULT TRUE,\n\tADD COLUMN \"captcha_protect_email_verification\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBZ,eAAA,mCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-05-26-130030-captcha-protect-flows.js

@@ -0,0 +1,23 @@
+const sql = `
+-- Per-flow captcha enforcement. A single captcha provider/secret is shared, but
+-- which mutations actually require a captcha token is now configurable instead
+-- of an all-or-nothing global switch (different deployments expose different
+-- subsets publicly — e.g. open registration vs admin-only signUp).
+--
+-- The historically-protected flows default to TRUE so configuring a provider
+-- keeps protecting them exactly as before. requestEmailVerification is a
+-- newly-added gate (never shipped enforced), so it defaults to FALSE — opt in
+-- explicitly if that resend endpoint is publicly exposed.
+ALTER TABLE "config"
+	ADD COLUMN "captcha_protect_sign_up"           BOOLEAN NOT NULL DEFAULT TRUE,
+	ADD COLUMN "captcha_protect_password_reset"     BOOLEAN NOT NULL DEFAULT TRUE,
+	ADD COLUMN "captcha_protect_passwordless_init"  BOOLEAN NOT NULL DEFAULT TRUE,
+	ADD COLUMN "captcha_protect_email_verification" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260526130030captchaprotectflows(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260526130030captchaprotectflows as default
+};
+//# sourceMappingURL=2026-05-26-130030-captcha-protect-flows.js.map

package/dist/production/src/migrations/2026-05-26-130030-captcha-protect-flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-130030-captcha-protect-flows.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-130030-captcha-protect-flows.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- Per-flow captcha enforcement. A single captcha provider/secret is shared, but\n-- which mutations actually require a captcha token is now configurable instead\n-- of an all-or-nothing global switch (different deployments expose different\n-- subsets publicly — e.g. open registration vs admin-only signUp).\n--\n-- The historically-protected flows default to TRUE so configuring a provider\n-- keeps protecting them exactly as before. requestEmailVerification is a\n-- newly-added gate (never shipped enforced), so it defaults to FALSE — opt in\n-- explicitly if that resend endpoint is publicly exposed.\nALTER TABLE \"config\"\n\tADD COLUMN \"captcha_protect_sign_up\"           BOOLEAN NOT NULL DEFAULT TRUE,\n\tADD COLUMN \"captcha_protect_password_reset\"     BOOLEAN NOT NULL DEFAULT TRUE,\n\tADD COLUMN \"captcha_protect_passwordless_init\"  BOOLEAN NOT NULL DEFAULT TRUE,\n\tADD COLUMN \"captcha_protect_email_verification\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiBZ,eAAA,mCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-05-26-140000-idp-session.cjs

@@ -0,0 +1,31 @@
+"use strict";
+const sql = `
+CREATE TABLE "idp_session" (
+	"id"                   UUID        NOT NULL PRIMARY KEY,
+	"api_key_id"           UUID        NOT NULL,
+	"identity_provider_id" UUID        NOT NULL,
+	"idp_session_id"       TEXT,
+	"tokens"               BYTEA,
+	"tokens_version"       INT,
+	"idp_expires_at"       TIMESTAMPTZ,
+	"token_obtained_at"    TIMESTAMPTZ,
+	"last_validated_at"    TIMESTAMPTZ NOT NULL DEFAULT now(),
+	"created_at"           TIMESTAMPTZ NOT NULL DEFAULT now(),
+	CONSTRAINT "idp_session_api_key" FOREIGN KEY ("api_key_id")
+		REFERENCES "api_key" ("id") ON DELETE CASCADE,
+	CONSTRAINT "idp_session_idp" FOREIGN KEY ("identity_provider_id")
+		REFERENCES "identity_provider" ("id") ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX "idp_session_api_key_id" ON "idp_session" ("api_key_id");
+CREATE INDEX "idp_session_sid" ON "idp_session" ("identity_provider_id", "idp_session_id");
+
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_session_revalidated';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_session_revoked';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_session_revalidation_failed';
+`;
+async function _20260526140000idpsession(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260526140000idpsession;
+//# sourceMappingURL=2026-05-26-140000-idp-session.cjs.map

package/dist/production/src/migrations/2026-05-26-140000-idp-session.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-140000-idp-session.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-140000-idp-session.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\nCREATE TABLE \"idp_session\" (\n\t\"id\"                   UUID        NOT NULL PRIMARY KEY,\n\t\"api_key_id\"           UUID        NOT NULL,\n\t\"identity_provider_id\" UUID        NOT NULL,\n\t\"idp_session_id\"       TEXT,\n\t\"tokens\"               BYTEA,\n\t\"tokens_version\"       INT,\n\t\"idp_expires_at\"       TIMESTAMPTZ,\n\t\"token_obtained_at\"    TIMESTAMPTZ,\n\t\"last_validated_at\"    TIMESTAMPTZ NOT NULL DEFAULT now(),\n\t\"created_at\"           TIMESTAMPTZ NOT NULL DEFAULT now(),\n\tCONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\")\n\t\tREFERENCES \"api_key\" (\"id\") ON DELETE CASCADE,\n\tCONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\")\n\t\tREFERENCES \"identity_provider\" (\"id\") ON DELETE CASCADE\n);\n\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" (\"identity_provider_id\", \"idp_session_id\");\n\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_session_revalidated';\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_session_revoked';\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_session_revalidation_failed';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0BZ,eAAA,0BAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-05-26-140000-idp-session.js

@@ -0,0 +1,32 @@
+const sql = `
+CREATE TABLE "idp_session" (
+	"id"                   UUID        NOT NULL PRIMARY KEY,
+	"api_key_id"           UUID        NOT NULL,
+	"identity_provider_id" UUID        NOT NULL,
+	"idp_session_id"       TEXT,
+	"tokens"               BYTEA,
+	"tokens_version"       INT,
+	"idp_expires_at"       TIMESTAMPTZ,
+	"token_obtained_at"    TIMESTAMPTZ,
+	"last_validated_at"    TIMESTAMPTZ NOT NULL DEFAULT now(),
+	"created_at"           TIMESTAMPTZ NOT NULL DEFAULT now(),
+	CONSTRAINT "idp_session_api_key" FOREIGN KEY ("api_key_id")
+		REFERENCES "api_key" ("id") ON DELETE CASCADE,
+	CONSTRAINT "idp_session_idp" FOREIGN KEY ("identity_provider_id")
+		REFERENCES "identity_provider" ("id") ON DELETE CASCADE
+);
+
+CREATE UNIQUE INDEX "idp_session_api_key_id" ON "idp_session" ("api_key_id");
+CREATE INDEX "idp_session_sid" ON "idp_session" ("identity_provider_id", "idp_session_id");
+
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_session_revalidated';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_session_revoked';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_session_revalidation_failed';
+`;
+async function _20260526140000idpsession(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260526140000idpsession as default
+};
+//# sourceMappingURL=2026-05-26-140000-idp-session.js.map

package/dist/production/src/migrations/2026-05-26-140000-idp-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-05-26-140000-idp-session.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-05-26-140000-idp-session.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\nCREATE TABLE \"idp_session\" (\n\t\"id\"                   UUID        NOT NULL PRIMARY KEY,\n\t\"api_key_id\"           UUID        NOT NULL,\n\t\"identity_provider_id\" UUID        NOT NULL,\n\t\"idp_session_id\"       TEXT,\n\t\"tokens\"               BYTEA,\n\t\"tokens_version\"       INT,\n\t\"idp_expires_at\"       TIMESTAMPTZ,\n\t\"token_obtained_at\"    TIMESTAMPTZ,\n\t\"last_validated_at\"    TIMESTAMPTZ NOT NULL DEFAULT now(),\n\t\"created_at\"           TIMESTAMPTZ NOT NULL DEFAULT now(),\n\tCONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\")\n\t\tREFERENCES \"api_key\" (\"id\") ON DELETE CASCADE,\n\tCONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\")\n\t\tREFERENCES \"identity_provider\" (\"id\") ON DELETE CASCADE\n);\n\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" (\"identity_provider_id\", \"idp_session_id\");\n\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_session_revalidated';\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_session_revoked';\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_session_revalidation_failed';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0BZ,eAAA,0BAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-06-08-100000-idp-assume-email-verified.cjs

@@ -0,0 +1,15 @@
+"use strict";
+const sql = `
+-- When TRUE, e-mail addresses asserted by this identity provider are treated as
+-- verified even if the provider does not send an "email_verified" claim. Use only
+-- for trusted providers (e.g. an enterprise IdP that vouches for its accounts) so
+-- that "require_verified_email" can stay on without the IdP emitting the claim.
+-- Defaults to FALSE to preserve existing behavior.
+ALTER TABLE "identity_provider"
+	ADD COLUMN "assume_email_verified" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260608100000idpassumeemailverified(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260608100000idpassumeemailverified;
+//# sourceMappingURL=2026-06-08-100000-idp-assume-email-verified.cjs.map

package/dist/production/src/migrations/2026-06-08-100000-idp-assume-email-verified.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-06-08-100000-idp-assume-email-verified.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-06-08-100000-idp-assume-email-verified.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- When TRUE, e-mail addresses asserted by this identity provider are treated as\n-- verified even if the provider does not send an \"email_verified\" claim. Use only\n-- for trusted providers (e.g. an enterprise IdP that vouches for its accounts) so\n-- that \"require_verified_email\" can stay on without the IdP emitting the claim.\n-- Defaults to FALSE to preserve existing behavior.\nALTER TABLE \"identity_provider\"\n\tADD COLUMN \"assume_email_verified\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,eAAA,sCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-06-08-100000-idp-assume-email-verified.js

@@ -0,0 +1,16 @@
+const sql = `
+-- When TRUE, e-mail addresses asserted by this identity provider are treated as
+-- verified even if the provider does not send an "email_verified" claim. Use only
+-- for trusted providers (e.g. an enterprise IdP that vouches for its accounts) so
+-- that "require_verified_email" can stay on without the IdP emitting the claim.
+-- Defaults to FALSE to preserve existing behavior.
+ALTER TABLE "identity_provider"
+	ADD COLUMN "assume_email_verified" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260608100000idpassumeemailverified(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260608100000idpassumeemailverified as default
+};
+//# sourceMappingURL=2026-06-08-100000-idp-assume-email-verified.js.map

package/dist/production/src/migrations/2026-06-08-100000-idp-assume-email-verified.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-06-08-100000-idp-assume-email-verified.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-06-08-100000-idp-assume-email-verified.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- When TRUE, e-mail addresses asserted by this identity provider are treated as\n-- verified even if the provider does not send an \"email_verified\" claim. Use only\n-- for trusted providers (e.g. an enterprise IdP that vouches for its accounts) so\n-- that \"require_verified_email\" can stay on without the IdP emitting the claim.\n-- Defaults to FALSE to preserve existing behavior.\nALTER TABLE \"identity_provider\"\n\tADD COLUMN \"assume_email_verified\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUZ,eAAA,sCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-06-16-120000-login-anomaly-detection.cjs

@@ -0,0 +1,30 @@
+"use strict";
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'unusual_login_detected';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'step_up_required';
+
+-- Per-sign-in risk inputs persisted alongside every login attempt. Nullable:
+-- geo_country is only populated when a trusted reverse-proxy geo header is
+-- present, device_fingerprint is a hash of the user-agent (never the raw UA in
+-- a second column). Both feed the next sign-in's history comparison.
+ALTER TABLE "person_auth_log"
+	ADD COLUMN "geo_country" TEXT,
+	ADD COLUMN "device_fingerprint" TEXT;
+
+-- Anomaly-detection policy (opt-in, default disabled). Thresholds compare the
+-- current sign-in's cumulative risk score against the last N successful logins.
+ALTER TABLE "config"
+	ADD COLUMN "login_anomaly_detection_enabled" BOOLEAN NOT NULL DEFAULT FALSE,
+	-- How many recent successful logins to compare against (the "known" set).
+	ADD COLUMN "login_anomaly_history_size" INTEGER NOT NULL DEFAULT 10,
+	-- Score >= email threshold sends an UNUSUAL_LOGIN email; score >= step-up
+	-- threshold additionally forces a second factor. 0 thresholds combined with
+	-- the disabled flag keep the feature inert until explicitly turned on.
+	ADD COLUMN "login_anomaly_email_threshold" INTEGER NOT NULL DEFAULT 1,
+	ADD COLUMN "login_anomaly_step_up_threshold" INTEGER NOT NULL DEFAULT 3;
+`;
+async function _20260616120000loginanomalydetection(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260616120000loginanomalydetection;
+//# sourceMappingURL=2026-06-16-120000-login-anomaly-detection.cjs.map

package/dist/production/src/migrations/2026-06-16-120000-login-anomaly-detection.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-06-16-120000-login-anomaly-detection.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-06-16-120000-login-anomaly-detection.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// A03 — anomaly detection on sign-in. Additive and opt-in: every new config\n// column ships with a feature-off default, so upgrading the engine alone never\n// changes login behaviour. The two new auth_log_type values are wired by their\n// call sites in this same change (LoginRiskAnalyzer / SignInManager).\nconst sql = `\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'unusual_login_detected';\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'step_up_required';\n\n-- Per-sign-in risk inputs persisted alongside every login attempt. Nullable:\n-- geo_country is only populated when a trusted reverse-proxy geo header is\n-- present, device_fingerprint is a hash of the user-agent (never the raw UA in\n-- a second column). Both feed the next sign-in's history comparison.\nALTER TABLE \"person_auth_log\"\n\tADD COLUMN \"geo_country\" TEXT,\n\tADD COLUMN \"device_fingerprint\" TEXT;\n\n-- Anomaly-detection policy (opt-in, default disabled). Thresholds compare the\n-- current sign-in's cumulative risk score against the last N successful logins.\nALTER TABLE \"config\"\n\tADD COLUMN \"login_anomaly_detection_enabled\" BOOLEAN NOT NULL DEFAULT FALSE,\n\t-- How many recent successful logins to compare against (the \"known\" set).\n\tADD COLUMN \"login_anomaly_history_size\" INTEGER NOT NULL DEFAULT 10,\n\t-- Score >= email threshold sends an UNUSUAL_LOGIN email; score >= step-up\n\t-- threshold additionally forces a second factor. 0 thresholds combined with\n\t-- the disabled flag keep the feature inert until explicitly turned on.\n\tADD COLUMN \"login_anomaly_email_threshold\" INTEGER NOT NULL DEFAULT 1,\n\tADD COLUMN \"login_anomaly_step_up_threshold\" INTEGER NOT NULL DEFAULT 3;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAMA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyBZ,eAAA,qCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-06-16-120000-login-anomaly-detection.js

@@ -0,0 +1,31 @@
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'unusual_login_detected';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'step_up_required';
+
+-- Per-sign-in risk inputs persisted alongside every login attempt. Nullable:
+-- geo_country is only populated when a trusted reverse-proxy geo header is
+-- present, device_fingerprint is a hash of the user-agent (never the raw UA in
+-- a second column). Both feed the next sign-in's history comparison.
+ALTER TABLE "person_auth_log"
+	ADD COLUMN "geo_country" TEXT,
+	ADD COLUMN "device_fingerprint" TEXT;
+
+-- Anomaly-detection policy (opt-in, default disabled). Thresholds compare the
+-- current sign-in's cumulative risk score against the last N successful logins.
+ALTER TABLE "config"
+	ADD COLUMN "login_anomaly_detection_enabled" BOOLEAN NOT NULL DEFAULT FALSE,
+	-- How many recent successful logins to compare against (the "known" set).
+	ADD COLUMN "login_anomaly_history_size" INTEGER NOT NULL DEFAULT 10,
+	-- Score >= email threshold sends an UNUSUAL_LOGIN email; score >= step-up
+	-- threshold additionally forces a second factor. 0 thresholds combined with
+	-- the disabled flag keep the feature inert until explicitly turned on.
+	ADD COLUMN "login_anomaly_email_threshold" INTEGER NOT NULL DEFAULT 1,
+	ADD COLUMN "login_anomaly_step_up_threshold" INTEGER NOT NULL DEFAULT 3;
+`;
+async function _20260616120000loginanomalydetection(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260616120000loginanomalydetection as default
+};
+//# sourceMappingURL=2026-06-16-120000-login-anomaly-detection.js.map

package/dist/production/src/migrations/2026-06-16-120000-login-anomaly-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-06-16-120000-login-anomaly-detection.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-06-16-120000-login-anomaly-detection.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// A03 — anomaly detection on sign-in. Additive and opt-in: every new config\n// column ships with a feature-off default, so upgrading the engine alone never\n// changes login behaviour. The two new auth_log_type values are wired by their\n// call sites in this same change (LoginRiskAnalyzer / SignInManager).\nconst sql = `\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'unusual_login_detected';\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'step_up_required';\n\n-- Per-sign-in risk inputs persisted alongside every login attempt. Nullable:\n-- geo_country is only populated when a trusted reverse-proxy geo header is\n-- present, device_fingerprint is a hash of the user-agent (never the raw UA in\n-- a second column). Both feed the next sign-in's history comparison.\nALTER TABLE \"person_auth_log\"\n\tADD COLUMN \"geo_country\" TEXT,\n\tADD COLUMN \"device_fingerprint\" TEXT;\n\n-- Anomaly-detection policy (opt-in, default disabled). Thresholds compare the\n-- current sign-in's cumulative risk score against the last N successful logins.\nALTER TABLE \"config\"\n\tADD COLUMN \"login_anomaly_detection_enabled\" BOOLEAN NOT NULL DEFAULT FALSE,\n\t-- How many recent successful logins to compare against (the \"known\" set).\n\tADD COLUMN \"login_anomaly_history_size\" INTEGER NOT NULL DEFAULT 10,\n\t-- Score >= email threshold sends an UNUSUAL_LOGIN email; score >= step-up\n\t-- threshold additionally forces a second factor. 0 thresholds combined with\n\t-- the disabled flag keep the feature inert until explicitly turned on.\n\tADD COLUMN \"login_anomaly_email_threshold\" INTEGER NOT NULL DEFAULT 1,\n\tADD COLUMN \"login_anomaly_step_up_threshold\" INTEGER NOT NULL DEFAULT 3;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAMA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAyBZ,eAAA,qCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-06-16-130000-idp-logout.cjs

@@ -0,0 +1,10 @@
+"use strict";
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_logout_initiated';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_backchannel_logout';
+`;
+async function _20260616130000idplogout(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260616130000idplogout;
+//# sourceMappingURL=2026-06-16-130000-idp-logout.cjs.map

package/dist/production/src/migrations/2026-06-16-130000-idp-logout.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-06-16-130000-idp-logout.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-06-16-130000-idp-logout.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_logout_initiated';\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_backchannel_logout';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAKZ,eAAA,yBAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}