@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/model/authorization/PermissionsFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"PermissionsFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport { PermissionActions } from './PermissionActions'\nimport { TenantRole } from './Roles'\n\nconst allowedRoles = new Set<string>([TenantRole.LOGIN, TenantRole.PROJECT_ADMIN, TenantRole.ENTRYPOINT_DEPLOYER])\n\nconst projectAdminAllowedInputRoles = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => allowedRoles.has(it))\n}\n\nconst forbiddenRoles = new Set<string>([TenantRole.SUPER_ADMIN, TenantRole.PROJECT_CREATOR])\n\nconst projectAdminUseRolesVerifier = ({ roles }: { roles?: readonly string[] }) => {\n\treturn roles === undefined || roles.every(it => !forbiddenRoles.has(it))\n}\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedInputRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedInputRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CREATE_SESSION_KEY(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(), projectAdminUseRolesVerifier)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(), projectAdminUseRolesVerifier)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":[],"mappings":";;;AAIA,MAAM,eAAe,oBAAI,IAAY,CAAC,WAAW,OAAO,WAAW,eAAe,WAAW,mBAAmB,CAAC;AAEjH,MAAM,gCAAgC,CAAC,EAAE,YAA2C;AACnF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,aAAa,IAAI,EAAE,CAAC;AACrE;AAEA,MAAM,qCAAqB,IAAY,CAAC,WAAW,aAAa,WAAW,eAAe,CAAC;AAE3F,MAAM,+BAA+B,CAAC,EAAE,YAA2C;AAClF,SAAO,UAAU,UAAa,MAAM,MAAM,QAAM,CAAC,eAAe,IAAI,EAAE,CAAC;AACxE;AAEA,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAI,YAAA;AAExB,gBAAY,MAAM,WAAW,aAAa,EAAE,UAAU,YAAY,KAAK,WAAW,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAM,WAAW,OAAO,kBAAkB,cAAc;AACpE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,kBAAkB;AACxE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,2BAA2B;AACjF,gBAAY,MAAM,WAAW,OAAO,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,WAAW;AAClE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,yBAAyB;AAChF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,0BAA0B;AACjF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,eAAe;AACtE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,gBAAgB;AAEvE,gBAAY,MAAM,WAAW,gBAAgB,kBAAkB,YAAY;AAE3E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,YAAY;AAC1E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc;AAC5E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAe;AAC7E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,6BAA6B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,6BAA6B;AAC7G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,6BAA6B;AACxH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,6BAAA,GAAgC,6BAA6B;AAC3H,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,4BAA4B;AACvH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,4BAA4B;AAC5G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,4BAA4B;AACnH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,uBAAA,GAA0B,4BAA4B;AAEpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AAEvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAClF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,kBAAkB;AAEhF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,OAAO;AACrE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,QAAQ;AAEtE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,SAAS;AACvE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AAEzE,gBAAY,MAAM,WAAW,iBAAiB,kBAAkB,cAAc;AAC9E,gBAAY,MAAM,WAAW,qBAAqB,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"PermissionsFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/PermissionsFactory.ts"],"sourcesContent":["import { Permissions } from '@contember/authorization'\nimport {\n\tApiKeyPermissionMeta,\n\tChangeProfilePermissionMeta,\n\tCreateSessionTokenPermissionMeta,\n\tGlobalApiKeyPermissionMeta,\n\tGlobalRoleMutationPermissionMeta,\n\tPermissionActions,\n\tTargetIdentityPermissionMeta,\n} from './PermissionActions.js'\nimport { NON_DELEGABLE_TENANT_ROLES, TenantRole } from './Roles.js'\n\nconst projectAdminAllowsRoles = (roles: readonly string[] | undefined): boolean =>\n\troles === undefined || roles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\nconst projectAdminAllowedSignUpRoles = (meta: { readonly requestedRoles?: readonly string[] }) => projectAdminAllowsRoles(meta.requestedRoles)\n\n/**\n * A key minted with trust-forwarded-info decides what lands in the audit log and what per-IP rate limits key on,\n * so delegated authority may not mint one — same rule the custom-role grants apply via `allowTrustForwardedClientInfo`.\n */\nconst projectAdminAllowsTrustForwardedClientInfo = (meta: { readonly trustForwardedClientInfo?: boolean } | undefined) =>\n\tmeta?.trustForwardedClientInfo !== true\n\nconst projectAdminAllowedApiKey = (meta: ApiKeyPermissionMeta | undefined) => projectAdminAllowsTrustForwardedClientInfo(meta)\n\nconst projectAdminAllowedGlobalApiKeyRoles = (meta: GlobalApiKeyPermissionMeta | undefined) =>\n\tprojectAdminAllowsRoles(meta?.requestedRoles) && projectAdminAllowsTrustForwardedClientInfo(meta)\n\nconst projectAdminAllowedRoleMutation = (meta: GlobalRoleMutationPermissionMeta | undefined) =>\n\tmeta === undefined\n\t|| (\n\t\tprojectAdminAllowsRoles(meta.requestedRoles)\n\t\t&& meta.target.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\t)\n\nconst projectAdminMayTarget = (meta: TargetIdentityPermissionMeta) =>\n\tmeta.target === null || meta.target.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role))\n\nconst projectAdminMayCreateSession = (meta: CreateSessionTokenPermissionMeta) =>\n\tmeta.phase === 'preflight' || meta.target?.globalRoles.every(role => !NON_DELEGABLE_TENANT_ROLES.has(role)) === true\n\nclass PermissionsFactory {\n\tpublic create(): Permissions {\n\t\tconst permissions = new Permissions()\n\n\t\tpermissions.allow(TenantRole.SUPER_ADMIN, { resource: Permissions.ALL, privilege: Permissions.ALL })\n\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_RESET_PASSWORD)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_CREATE_IDP_URL)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_SIGN_IN_IDP)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_PASSWORDLESS_SIGN_IN)\n\t\tpermissions.allow(TenantRole.LOGIN, PermissionActions.PERSON_REQUEST_PASSWORDLESS_SIGN_IN)\n\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PASSWORD)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_CHANGE_MY_PROFILE)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_TOGGLE_PASSWORDLESS)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SIGN_OUT)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_SETUP_OTP)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_REVOKE_SESSION)\n\t\tpermissions.allow(TenantRole.PERSON, PermissionActions.PERSON_DISCONNECT_MY_IDP)\n\n\t\tpermissions.allow(TenantRole.PROJECT_MEMBER, PermissionActions.PROJECT_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_VIEW_PERMISSIONS)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_LIST)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE(), projectAdminAllowedApiKey)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_LIST)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.API_KEY_CREATE_GLOBAL(), projectAdminAllowedGlobalApiKeyRoles)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_SIGN_UP(), projectAdminAllowedSignUpRoles)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_ADD_GLOBAL_ROLES(), projectAdminAllowedRoleMutation)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDENTITY_REMOVE_GLOBAL_ROLES(), projectAdminAllowedRoleMutation)\n\t\tpermissions.allow(\n\t\t\tTenantRole.PROJECT_ADMIN,\n\t\t\tPermissionActions.PERSON_CREATE_SESSION_KEY({ phase: 'preflight' }),\n\t\t\tprojectAdminMayCreateSession,\n\t\t)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_DISABLE(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_FORCE_SIGN_OUT(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_RESET_MFA(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_SESSIONS(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_VIEW_IDP(null), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PROFILE(null, []), projectAdminMayTarget)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_CHANGE_PASSWORD(null), projectAdminMayTarget)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_ADD_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_UPDATE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_REMOVE_MEMBER([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PROJECT_VIEW_SECRETS)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE([]))\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.PERSON_INVITE_UNMANAGED([]))\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_ADD())\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_REMOVE())\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.MAIL_TEMPLATE_LIST())\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ADD)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_UPDATE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_DISABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_ENABLE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.IDP_LIST)\n\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.AUTH_LOG_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CUSTOM_ROLE_VIEW)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.ENTRYPOINT_DEPLOY)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIGURE)\n\t\tpermissions.allow(TenantRole.PROJECT_ADMIN, PermissionActions.CONFIG_VIEW)\n\n\t\tpermissions.allow(TenantRole.PROJECT_CREATOR, PermissionActions.PROJECT_CREATE)\n\t\tpermissions.allow(TenantRole.ENTRYPOINT_DEPLOYER, PermissionActions.ENTRYPOINT_DEPLOY)\n\n\t\treturn permissions\n\t}\n}\n\nexport { PermissionsFactory }\n"],"names":[],"mappings":";;;AAYA,MAAM,0BAA0B,CAAC,UAChC,UAAU,UAAa,MAAM,MAAM,CAAA,SAAQ,CAAC,2BAA2B,IAAI,IAAI,CAAC;AAEjF,MAAM,iCAAiC,CAAC,SAA0D,wBAAwB,KAAK,cAAc;AAM7I,MAAM,6CAA6C,CAAC,SACnD,MAAM,6BAA6B;AAEpC,MAAM,4BAA4B,CAAC,SAA2C,2CAA2C,IAAI;AAE7H,MAAM,uCAAuC,CAAC,SAC7C,wBAAwB,MAAM,cAAc,KAAK,2CAA2C,IAAI;AAEjG,MAAM,kCAAkC,CAAC,SACxC,SAAS,UAER,wBAAwB,KAAK,cAAc,KACxC,KAAK,OAAO,YAAY,MAAM,CAAA,SAAQ,CAAC,2BAA2B,IAAI,IAAI,CAAC;AAGhF,MAAM,wBAAwB,CAAC,SAC9B,KAAK,WAAW,QAAQ,KAAK,OAAO,YAAY,MAAM,CAAA,SAAQ,CAAC,2BAA2B,IAAI,IAAI,CAAC;AAEpG,MAAM,+BAA+B,CAAC,SACrC,KAAK,UAAU,eAAe,KAAK,QAAQ,YAAY,MAAM,UAAQ,CAAC,2BAA2B,IAAI,IAAI,CAAC,MAAM;AAEjH,MAAM,mBAAmB;AAAA,EACjB,SAAsB;AAC5B,UAAM,cAAc,IAAI,YAAA;AAExB,gBAAY,MAAM,WAAW,aAAa,EAAE,UAAU,YAAY,KAAK,WAAW,YAAY,IAAA,CAAK;AAEnG,gBAAY,MAAM,WAAW,OAAO,kBAAkB,cAAc;AACpE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,qBAAqB;AAC3E,gBAAY,MAAM,WAAW,OAAO,kBAAkB,kBAAkB;AACxE,gBAAY,MAAM,WAAW,OAAO,kBAAkB,2BAA2B;AACjF,gBAAY,MAAM,WAAW,OAAO,kBAAkB,mCAAmC;AAEzF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,WAAW;AAClE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,yBAAyB;AAChF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAC/E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,0BAA0B;AACjF,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,eAAe;AACtE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,gBAAgB;AACvE,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,qBAAqB;AAC5E,gBAAY,MAAM,WAAW,QAAQ,kBAAkB,wBAAwB;AAE/E,gBAAY,MAAM,WAAW,gBAAgB,kBAAkB,YAAY;AAE3E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,YAAY;AAC1E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,yBAAyB;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,yBAAyB;AACzG,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAe;AAC7E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,YAAY;AAC1E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAA,GAAyB,oCAAoC;AAE3H,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAA,GAAkB,8BAA8B;AAC9G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,0BAAA,GAA6B,+BAA+B;AAC1H,gBAAY,MAAM,WAAW,eAAe,kBAAkB,6BAAA,GAAgC,+BAA+B;AAC7H,gBAAY;AAAA,MACX,WAAW;AAAA,MACX,kBAAkB,0BAA0B,EAAE,OAAO,aAAa;AAAA,MAClE;AAAA,IAAA;AAED,gBAAY,MAAM,WAAW,eAAe,kBAAkB,eAAe,IAAI,GAAG,qBAAqB;AACzG,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,IAAI,GAAG,qBAAqB;AAChH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB,IAAI,GAAG,qBAAqB;AAC3G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,qBAAqB,IAAI,GAAG,qBAAqB;AAC/G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,gBAAgB,IAAI,GAAG,qBAAqB;AAC1G,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,MAAM,EAAE,GAAG,qBAAqB;AACpH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,uBAAuB,IAAI,GAAG,qBAAqB;AAEjH,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB,CAAA,CAAE,CAAC;AACrF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,mBAAmB,CAAA,CAAE,CAAC;AACpF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB,CAAA,CAAE,CAAC;AACvF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAElF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,cAAc,CAAA,CAAE,CAAC;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,wBAAwB,CAAA,CAAE,CAAC;AAEzF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,mBAAmB;AACjF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,sBAAsB;AACpF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,oBAAoB;AAElF,gBAAY,MAAM,WAAW,eAAe,kBAAkB,OAAO;AACrE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AACzE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,UAAU;AACxE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,QAAQ;AAEtE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,aAAa;AAC3E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,gBAAgB;AAC9E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,iBAAiB;AAC/E,gBAAY,MAAM,WAAW,eAAe,kBAAkB,SAAS;AACvE,gBAAY,MAAM,WAAW,eAAe,kBAAkB,WAAW;AAEzE,gBAAY,MAAM,WAAW,iBAAiB,kBAAkB,cAAc;AAC9E,gBAAY,MAAM,WAAW,qBAAqB,kBAAkB,iBAAiB;AAErF,WAAO;AAAA,EACR;AACD;"}

package/dist/production/src/model/authorization/ProjectScope.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectScope.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { Project } from '../type'\nimport { TenantRole } from './Roles'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { Identity } from './Identity'\n\nexport class ProjectScope implements AuthorizationScope<Identity> {\n\tconstructor(\n\t\tprivate readonly project: Pick<Project, 'slug'>,\n\t\tprivate readonly aclSchema: Acl.Schema,\n\t\tprivate readonly aclSchemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\tconst projectMemberships = await identity.getProjectMemberships(this.project.slug)\n\t\tconst tenantRoles = []\n\t\tif (projectMemberships.length > 0) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_MEMBER)\n\t\t}\n\t\tconst projectRoles = projectMemberships.map(it => it.role)\n\t\tif (projectRoles.includes(ProjectRole.ADMIN)) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_ADMIN)\n\t\t}\n\t\tconst accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships)\n\t\treturn new AccessNode.Union([\n\t\t\tnew AccessNode.Roles(tenantRoles),\n\t\t\taccessNode,\n\t\t])\n\t}\n}\n"],"names":["TenantRole","ProjectRole","AccessNode"],"mappings":";;;;;AAOO,MAAM,aAAqD;AAAA,EACjE,YACkB,SACA,WACA,4BAChB;AAHgB,SAAA,UAAA;AACA,SAAA,YAAA;AACA,SAAA,6BAAA;AAAA,EACf;AAAA,EAEH,MAAM,kBAAkB,UAAyC;AAChE,UAAM,qBAAqB,MAAM,SAAS,sBAAsB,KAAK,QAAQ,IAAI;AACjF,UAAM,cAAc,CAAA;AACpB,QAAI,mBAAmB,SAAS,GAAG;AAClC,kBAAY,KAAKA,MAAAA,WAAW,cAAc;AAAA,IAC3C;AACA,UAAM,eAAe,mBAAmB,IAAI,CAAA,OAAM,GAAG,IAAI;AACzD,QAAI,aAAa,SAASC,OAAAA,YAAY,KAAK,GAAG;AAC7C,kBAAY,KAAKD,MAAAA,WAAW,aAAa;AAAA,IAC1C;AACA,UAAM,aAAa,KAAK,2BAA2B,OAAO,KAAK,WAAW,kBAAkB;AAC5F,WAAO,IAAIE,cAAAA,WAAW,MAAM;AAAA,MAC3B,IAAIA,cAAAA,WAAW,MAAM,WAAW;AAAA,MAChC;AAAA,IAAA,CACA;AAAA,EACF;AACD;;"}
+{"version":3,"file":"ProjectScope.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { Project } from '../type/index.js'\nimport { TenantRole } from './Roles.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'\nimport { Identity } from './Identity.js'\n\nexport class ProjectScope implements AuthorizationScope<Identity> {\n\tconstructor(\n\t\tprivate readonly project: Pick<Project, 'slug'>,\n\t\tprivate readonly aclSchema: Acl.Schema,\n\t\tprivate readonly aclSchemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\tconst projectMemberships = await identity.getProjectMemberships(this.project.slug)\n\t\tconst tenantRoles = []\n\t\tif (projectMemberships.length > 0) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_MEMBER)\n\t\t}\n\t\tconst projectRoles = projectMemberships.map(it => it.role)\n\t\tif (projectRoles.includes(ProjectRole.ADMIN)) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_ADMIN)\n\t\t}\n\t\tconst accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships)\n\t\treturn new AccessNode.Union([\n\t\t\tnew AccessNode.Roles(tenantRoles),\n\t\t\taccessNode,\n\t\t])\n\t}\n}\n"],"names":["TenantRole","ProjectRole","AccessNode"],"mappings":";;;;;AAOO,MAAM,aAAqD;AAAA,EACjE,YACkB,SACA,WACA,4BAChB;AAHgB,SAAA,UAAA;AACA,SAAA,YAAA;AACA,SAAA,6BAAA;AAAA,EACf;AAAA,EAEH,MAAM,kBAAkB,UAAyC;AAChE,UAAM,qBAAqB,MAAM,SAAS,sBAAsB,KAAK,QAAQ,IAAI;AACjF,UAAM,cAAc,CAAA;AACpB,QAAI,mBAAmB,SAAS,GAAG;AAClC,kBAAY,KAAKA,MAAAA,WAAW,cAAc;AAAA,IAC3C;AACA,UAAM,eAAe,mBAAmB,IAAI,CAAA,OAAM,GAAG,IAAI;AACzD,QAAI,aAAa,SAASC,OAAAA,YAAY,KAAK,GAAG;AAC7C,kBAAY,KAAKD,MAAAA,WAAW,aAAa;AAAA,IAC1C;AACA,UAAM,aAAa,KAAK,2BAA2B,OAAO,KAAK,WAAW,kBAAkB;AAC5F,WAAO,IAAIE,cAAAA,WAAW,MAAM;AAAA,MAC3B,IAAIA,cAAAA,WAAW,MAAM,WAAW;AAAA,MAChC;AAAA,IAAA,CACA;AAAA,EACF;AACD;;"}

package/dist/production/src/model/authorization/ProjectScope.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectScope.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { Project } from '../type'\nimport { TenantRole } from './Roles'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { Identity } from './Identity'\n\nexport class ProjectScope implements AuthorizationScope<Identity> {\n\tconstructor(\n\t\tprivate readonly project: Pick<Project, 'slug'>,\n\t\tprivate readonly aclSchema: Acl.Schema,\n\t\tprivate readonly aclSchemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\tconst projectMemberships = await identity.getProjectMemberships(this.project.slug)\n\t\tconst tenantRoles = []\n\t\tif (projectMemberships.length > 0) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_MEMBER)\n\t\t}\n\t\tconst projectRoles = projectMemberships.map(it => it.role)\n\t\tif (projectRoles.includes(ProjectRole.ADMIN)) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_ADMIN)\n\t\t}\n\t\tconst accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships)\n\t\treturn new AccessNode.Union([\n\t\t\tnew AccessNode.Roles(tenantRoles),\n\t\t\taccessNode,\n\t\t])\n\t}\n}\n"],"names":[],"mappings":";;;AAOO,MAAM,aAAqD;AAAA,EACjE,YACkB,SACA,WACA,4BAChB;AAHgB,SAAA,UAAA;AACA,SAAA,YAAA;AACA,SAAA,6BAAA;AAAA,EACf;AAAA,EAEH,MAAM,kBAAkB,UAAyC;AAChE,UAAM,qBAAqB,MAAM,SAAS,sBAAsB,KAAK,QAAQ,IAAI;AACjF,UAAM,cAAc,CAAA;AACpB,QAAI,mBAAmB,SAAS,GAAG;AAClC,kBAAY,KAAK,WAAW,cAAc;AAAA,IAC3C;AACA,UAAM,eAAe,mBAAmB,IAAI,CAAA,OAAM,GAAG,IAAI;AACzD,QAAI,aAAa,SAAS,YAAY,KAAK,GAAG;AAC7C,kBAAY,KAAK,WAAW,aAAa;AAAA,IAC1C;AACA,UAAM,aAAa,KAAK,2BAA2B,OAAO,KAAK,WAAW,kBAAkB;AAC5F,WAAO,IAAI,WAAW,MAAM;AAAA,MAC3B,IAAI,WAAW,MAAM,WAAW;AAAA,MAChC;AAAA,IAAA,CACA;AAAA,EACF;AACD;"}
+{"version":3,"file":"ProjectScope.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScope.ts"],"sourcesContent":["import { AccessNode, AuthorizationScope } from '@contember/authorization'\nimport { Project } from '../type/index.js'\nimport { TenantRole } from './Roles.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'\nimport { Identity } from './Identity.js'\n\nexport class ProjectScope implements AuthorizationScope<Identity> {\n\tconstructor(\n\t\tprivate readonly project: Pick<Project, 'slug'>,\n\t\tprivate readonly aclSchema: Acl.Schema,\n\t\tprivate readonly aclSchemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync getIdentityAccess(identity: Identity): Promise<AccessNode> {\n\t\tconst projectMemberships = await identity.getProjectMemberships(this.project.slug)\n\t\tconst tenantRoles = []\n\t\tif (projectMemberships.length > 0) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_MEMBER)\n\t\t}\n\t\tconst projectRoles = projectMemberships.map(it => it.role)\n\t\tif (projectRoles.includes(ProjectRole.ADMIN)) {\n\t\t\ttenantRoles.push(TenantRole.PROJECT_ADMIN)\n\t\t}\n\t\tconst accessNode = this.aclSchemaAccessNodeFactory.create(this.aclSchema, projectMemberships)\n\t\treturn new AccessNode.Union([\n\t\t\tnew AccessNode.Roles(tenantRoles),\n\t\t\taccessNode,\n\t\t])\n\t}\n}\n"],"names":[],"mappings":";;;AAOO,MAAM,aAAqD;AAAA,EACjE,YACkB,SACA,WACA,4BAChB;AAHgB,SAAA,UAAA;AACA,SAAA,YAAA;AACA,SAAA,6BAAA;AAAA,EACf;AAAA,EAEH,MAAM,kBAAkB,UAAyC;AAChE,UAAM,qBAAqB,MAAM,SAAS,sBAAsB,KAAK,QAAQ,IAAI;AACjF,UAAM,cAAc,CAAA;AACpB,QAAI,mBAAmB,SAAS,GAAG;AAClC,kBAAY,KAAK,WAAW,cAAc;AAAA,IAC3C;AACA,UAAM,eAAe,mBAAmB,IAAI,CAAA,OAAM,GAAG,IAAI;AACzD,QAAI,aAAa,SAAS,YAAY,KAAK,GAAG;AAC7C,kBAAY,KAAK,WAAW,aAAa;AAAA,IAC1C;AACA,UAAM,aAAa,KAAK,2BAA2B,OAAO,KAAK,WAAW,kBAAkB;AAC5F,WAAO,IAAI,WAAW,MAAM;AAAA,MAC3B,IAAI,WAAW,MAAM,WAAW;AAAA,MAChC;AAAA,IAAA,CACA;AAAA,EACF;AACD;"}

package/dist/production/src/model/authorization/ProjectScopeFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectScopeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScopeFactory.ts"],"sourcesContent":["import { Project, ProjectSchemaResolver } from '../type'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { AuthorizationScope } from '@contember/authorization'\nimport { ProjectScope } from './ProjectScope'\nimport { Identity } from './Identity'\n\nexport class ProjectScopeFactory {\n\tconstructor(\n\t\tprivate readonly schemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync create(schemaResolver: ProjectSchemaResolver, project: Pick<Project, 'slug'>): Promise<AuthorizationScope<Identity> | null> {\n\t\tconst schema = await schemaResolver.getSchema(project.slug)\n\t\tif (!schema) {\n\t\t\treturn null\n\t\t}\n\t\treturn new ProjectScope(project, schema.acl, this.schemaAccessNodeFactory)\n\t}\n}\n"],"names":["ProjectScope"],"mappings":";;;AAMO,MAAM,oBAAoB;AAAA,EAChC,YACkB,yBAChB;AADgB,SAAA,0BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,gBAAuC,SAA8E;AACjI,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,IAAI;AAC1D,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO,IAAIA,aAAAA,aAAa,SAAS,OAAO,KAAK,KAAK,uBAAuB;AAAA,EAC1E;AACD;;"}
+{"version":3,"file":"ProjectScopeFactory.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScopeFactory.ts"],"sourcesContent":["import { Project, ProjectSchemaResolver } from '../type/index.js'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'\nimport { AuthorizationScope } from '@contember/authorization'\nimport { ProjectScope } from './ProjectScope.js'\nimport { Identity } from './Identity.js'\n\nexport class ProjectScopeFactory {\n\tconstructor(\n\t\tprivate readonly schemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync create(schemaResolver: ProjectSchemaResolver, project: Pick<Project, 'slug'>): Promise<AuthorizationScope<Identity> | null> {\n\t\tconst schema = await schemaResolver.getSchema(project.slug)\n\t\tif (!schema) {\n\t\t\treturn null\n\t\t}\n\t\treturn new ProjectScope(project, schema.acl, this.schemaAccessNodeFactory)\n\t}\n}\n"],"names":["ProjectScope"],"mappings":";;;AAMO,MAAM,oBAAoB;AAAA,EAChC,YACkB,yBAChB;AADgB,SAAA,0BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,gBAAuC,SAA8E;AACjI,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,IAAI;AAC1D,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO,IAAIA,aAAAA,aAAa,SAAS,OAAO,KAAK,KAAK,uBAAuB;AAAA,EAC1E;AACD;;"}

package/dist/production/src/model/authorization/ProjectScopeFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectScopeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScopeFactory.ts"],"sourcesContent":["import { Project, ProjectSchemaResolver } from '../type'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory'\nimport { AuthorizationScope } from '@contember/authorization'\nimport { ProjectScope } from './ProjectScope'\nimport { Identity } from './Identity'\n\nexport class ProjectScopeFactory {\n\tconstructor(\n\t\tprivate readonly schemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync create(schemaResolver: ProjectSchemaResolver, project: Pick<Project, 'slug'>): Promise<AuthorizationScope<Identity> | null> {\n\t\tconst schema = await schemaResolver.getSchema(project.slug)\n\t\tif (!schema) {\n\t\t\treturn null\n\t\t}\n\t\treturn new ProjectScope(project, schema.acl, this.schemaAccessNodeFactory)\n\t}\n}\n"],"names":[],"mappings":";AAMO,MAAM,oBAAoB;AAAA,EAChC,YACkB,yBAChB;AADgB,SAAA,0BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,gBAAuC,SAA8E;AACjI,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,IAAI;AAC1D,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO,IAAI,aAAa,SAAS,OAAO,KAAK,KAAK,uBAAuB;AAAA,EAC1E;AACD;"}
+{"version":3,"file":"ProjectScopeFactory.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/ProjectScopeFactory.ts"],"sourcesContent":["import { Project, ProjectSchemaResolver } from '../type/index.js'\nimport { AclSchemaAccessNodeFactory } from './AclSchemaAccessNodeFactory.js'\nimport { AuthorizationScope } from '@contember/authorization'\nimport { ProjectScope } from './ProjectScope.js'\nimport { Identity } from './Identity.js'\n\nexport class ProjectScopeFactory {\n\tconstructor(\n\t\tprivate readonly schemaAccessNodeFactory: AclSchemaAccessNodeFactory,\n\t) {}\n\n\tasync create(schemaResolver: ProjectSchemaResolver, project: Pick<Project, 'slug'>): Promise<AuthorizationScope<Identity> | null> {\n\t\tconst schema = await schemaResolver.getSchema(project.slug)\n\t\tif (!schema) {\n\t\t\treturn null\n\t\t}\n\t\treturn new ProjectScope(project, schema.acl, this.schemaAccessNodeFactory)\n\t}\n}\n"],"names":[],"mappings":";AAMO,MAAM,oBAAoB;AAAA,EAChC,YACkB,yBAChB;AADgB,SAAA,0BAAA;AAAA,EACf;AAAA,EAEH,MAAM,OAAO,gBAAuC,SAA8E;AACjI,UAAM,SAAS,MAAM,eAAe,UAAU,QAAQ,IAAI;AAC1D,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO,IAAI,aAAa,SAAS,OAAO,KAAK,KAAK,uBAAuB;AAAA,EAC1E;AACD;"}

package/dist/production/src/model/authorization/Roles.cjs

@@ -11,5 +11,13 @@ var TenantRole = /* @__PURE__ */ ((TenantRole2) => {
   TenantRole2["ENTRYPOINT_DEPLOYER"] = "entrypoint_deployer";
   return TenantRole2;
 })(TenantRole || {});
+const NON_DELEGABLE_TENANT_ROLES = /* @__PURE__ */ new Set([
+  "super_admin",
+  "project_creator"
+  /* PROJECT_CREATOR */
+]);
+const ROLE_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;
+exports.NON_DELEGABLE_TENANT_ROLES = NON_DELEGABLE_TENANT_ROLES;
+exports.ROLE_SLUG_PATTERN = ROLE_SLUG_PATTERN;
 exports.TenantRole = TenantRole;
 //# sourceMappingURL=Roles.cjs.map

package/dist/production/src/model/authorization/Roles.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Roles.ts"],"sourcesContent":["export enum TenantRole {\n\tLOGIN = 'login',\n\tSELF = 'self',\n\tPERSON = 'person',\n\tSUPER_ADMIN = 'super_admin',\n\tPROJECT_CREATOR = 'project_creator',\n\tPROJECT_MEMBER = 'project_member',\n\tPROJECT_ADMIN = 'project_admin',\n\tENTRYPOINT_DEPLOYER = 'entrypoint_deployer',\n}\n"],"names":["TenantRole"],"mappings":";;AAAO,IAAK,+BAAAA,gBAAL;AACNA,cAAA,OAAA,IAAQ;AACRA,cAAA,MAAA,IAAO;AACPA,cAAA,QAAA,IAAS;AACTA,cAAA,aAAA,IAAc;AACdA,cAAA,iBAAA,IAAkB;AAClBA,cAAA,gBAAA,IAAiB;AACjBA,cAAA,eAAA,IAAgB;AAChBA,cAAA,qBAAA,IAAsB;AARX,SAAAA;AAAA,GAAA,cAAA,CAAA,CAAA;;"}
+{"version":3,"file":"Roles.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Roles.ts"],"sourcesContent":["export enum TenantRole {\n\tLOGIN = 'login',\n\tSELF = 'self',\n\tPERSON = 'person',\n\tSUPER_ADMIN = 'super_admin',\n\tPROJECT_CREATOR = 'project_creator',\n\tPROJECT_MEMBER = 'project_member',\n\tPROJECT_ADMIN = 'project_admin',\n\tENTRYPOINT_DEPLOYER = 'entrypoint_deployer',\n}\n\n/**\n * Roles no delegated authority may ever grant, hold as a target, or impersonate.\n * Enforced by the static PROJECT_ADMIN verifiers and by custom-role grants alike —\n * keep it the single source, so a newly protected role cannot be added to one path only.\n */\nexport const NON_DELEGABLE_TENANT_ROLES: ReadonlySet<string> = new Set([\n\tTenantRole.SUPER_ADMIN,\n\tTenantRole.PROJECT_CREATOR,\n])\n\n/** Shared by custom-role slug validation and by role references inside grant configuration. */\nexport const ROLE_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/\n"],"names":["TenantRole"],"mappings":";;AAAO,IAAK,+BAAAA,gBAAL;AACNA,cAAA,OAAA,IAAQ;AACRA,cAAA,MAAA,IAAO;AACPA,cAAA,QAAA,IAAS;AACTA,cAAA,aAAA,IAAc;AACdA,cAAA,iBAAA,IAAkB;AAClBA,cAAA,gBAAA,IAAiB;AACjBA,cAAA,eAAA,IAAgB;AAChBA,cAAA,qBAAA,IAAsB;AARX,SAAAA;AAAA,GAAA,cAAA,CAAA,CAAA;AAgBL,MAAM,iDAAsD,IAAI;AAAA,EACtE;AAAA,EACA;AAAA;AACD,CAAC;AAGM,MAAM,oBAAoB;;;;"}

package/dist/production/src/model/authorization/Roles.js

@@ -9,7 +9,15 @@ var TenantRole = /* @__PURE__ */ ((TenantRole2) => {
   TenantRole2["ENTRYPOINT_DEPLOYER"] = "entrypoint_deployer";
   return TenantRole2;
 })(TenantRole || {});
+const NON_DELEGABLE_TENANT_ROLES = /* @__PURE__ */ new Set([
+  "super_admin",
+  "project_creator"
+  /* PROJECT_CREATOR */
+]);
+const ROLE_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/;
 export {
+  NON_DELEGABLE_TENANT_ROLES,
+  ROLE_SLUG_PATTERN,
   TenantRole
 };
 //# sourceMappingURL=Roles.js.map

package/dist/production/src/model/authorization/Roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"Roles.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Roles.ts"],"sourcesContent":["export enum TenantRole {\n\tLOGIN = 'login',\n\tSELF = 'self',\n\tPERSON = 'person',\n\tSUPER_ADMIN = 'super_admin',\n\tPROJECT_CREATOR = 'project_creator',\n\tPROJECT_MEMBER = 'project_member',\n\tPROJECT_ADMIN = 'project_admin',\n\tENTRYPOINT_DEPLOYER = 'entrypoint_deployer',\n}\n"],"names":["TenantRole"],"mappings":"AAAO,IAAK,+BAAAA,gBAAL;AACNA,cAAA,OAAA,IAAQ;AACRA,cAAA,MAAA,IAAO;AACPA,cAAA,QAAA,IAAS;AACTA,cAAA,aAAA,IAAc;AACdA,cAAA,iBAAA,IAAkB;AAClBA,cAAA,gBAAA,IAAiB;AACjBA,cAAA,eAAA,IAAgB;AAChBA,cAAA,qBAAA,IAAsB;AARX,SAAAA;AAAA,GAAA,cAAA,CAAA,CAAA;"}
+{"version":3,"file":"Roles.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/Roles.ts"],"sourcesContent":["export enum TenantRole {\n\tLOGIN = 'login',\n\tSELF = 'self',\n\tPERSON = 'person',\n\tSUPER_ADMIN = 'super_admin',\n\tPROJECT_CREATOR = 'project_creator',\n\tPROJECT_MEMBER = 'project_member',\n\tPROJECT_ADMIN = 'project_admin',\n\tENTRYPOINT_DEPLOYER = 'entrypoint_deployer',\n}\n\n/**\n * Roles no delegated authority may ever grant, hold as a target, or impersonate.\n * Enforced by the static PROJECT_ADMIN verifiers and by custom-role grants alike —\n * keep it the single source, so a newly protected role cannot be added to one path only.\n */\nexport const NON_DELEGABLE_TENANT_ROLES: ReadonlySet<string> = new Set([\n\tTenantRole.SUPER_ADMIN,\n\tTenantRole.PROJECT_CREATOR,\n])\n\n/** Shared by custom-role slug validation and by role references inside grant configuration. */\nexport const ROLE_SLUG_PATTERN = /^[a-z][a-z0-9_]*$/\n"],"names":["TenantRole"],"mappings":"AAAO,IAAK,+BAAAA,gBAAL;AACNA,cAAA,OAAA,IAAQ;AACRA,cAAA,MAAA,IAAO;AACPA,cAAA,QAAA,IAAS;AACTA,cAAA,aAAA,IAAc;AACdA,cAAA,iBAAA,IAAkB;AAClBA,cAAA,gBAAA,IAAiB;AACjBA,cAAA,eAAA,IAAgB;AAChBA,cAAA,qBAAA,IAAsB;AARX,SAAAA;AAAA,GAAA,cAAA,CAAA,CAAA;AAgBL,MAAM,iDAAsD,IAAI;AAAA,EACtE;AAAA,EACA;AAAA;AACD,CAAC;AAGM,MAAM,oBAAoB;"}

package/dist/production/src/model/authorization/TargetIdentityPermission.cjs

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../type/ApiKey.cjs");
+const IdentityHasProjectMembershipsQuery = require("../queries/membership/IdentityHasProjectMembershipsQuery.cjs");
+const IdentityQuery = require("../queries/identity/IdentityQuery.cjs");
+require("./PermissionActions.cjs");
+require("@contember/authorization");
+const Roles = require("./Roles.cjs");
+require("./CustomRolePermissions.cjs");
+require("./PermissionContext.cjs");
+require("@contember/schema");
+const batchQuery = require("../../utils/batchQuery.cjs");
+const projectMembershipPresenceLoader = batchQuery.batchLoader(
+  async (identityIds, db) => await db.queryHandler.fetch(new IdentityHasProjectMembershipsQuery.IdentityHasProjectMembershipsQuery(identityIds)),
+  (identityId, identitiesWithMemberships) => identitiesWithMemberships.has(identityId)
+);
+const targetIdentityLoader = batchQuery.batchLoader(
+  async (identityIds, db) => {
+    const identities = await db.queryHandler.fetch(new IdentityQuery.IdentityQuery(identityIds));
+    return Object.fromEntries(identities.map((identity) => [identity.id, identity]));
+  },
+  (identityId, identities) => identities[identityId]
+);
+const createTargetIdentityPermissionTarget = async (db, identity) => ({
+  id: identity.id,
+  globalRoles: identity.roles,
+  hasProjectMemberships: identity.roles.includes(Roles.TenantRole.SUPER_ADMIN) || identity.roles.includes(Roles.TenantRole.PROJECT_ADMIN) || await db.batchLoad(projectMembershipPresenceLoader, identity.id)
+});
+const createPersonPermissionTarget = async (db, person) => person === null ? null : await createTargetIdentityPermissionTarget(db, { id: person.identity_id, roles: person.roles });
+exports.createPersonPermissionTarget = createPersonPermissionTarget;
+exports.createTargetIdentityPermissionTarget = createTargetIdentityPermissionTarget;
+exports.targetIdentityLoader = targetIdentityLoader;
+//# sourceMappingURL=TargetIdentityPermission.cjs.map

package/dist/production/src/model/authorization/TargetIdentityPermission.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TargetIdentityPermission.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/TargetIdentityPermission.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { IdentityHasProjectMembershipsQuery, IdentityQuery, IdentityQueryResult } from '../queries/index.js'\nimport { TargetIdentityPermissionTarget } from './PermissionActions.js'\nimport { TenantRole } from './Roles.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\n\nconst projectMembershipPresenceLoader = batchLoader<string, ReadonlySet<string>, boolean>(\n\tasync (identityIds, db) => await db.queryHandler.fetch(new IdentityHasProjectMembershipsQuery(identityIds)),\n\t(identityId, identitiesWithMemberships) => identitiesWithMemberships.has(identityId),\n)\n\n/** Batches the identity lookup that precedes a target-identity permission check. */\nexport const targetIdentityLoader = batchLoader<string, Record<string, IdentityQueryResult>, IdentityQueryResult | undefined>(\n\tasync (identityIds, db) => {\n\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(identityIds))\n\t\treturn Object.fromEntries(identities.map(identity => [identity.id, identity]))\n\t},\n\t(identityId, identities) => identities[identityId],\n)\n\nexport const createTargetIdentityPermissionTarget = async (\n\tdb: DatabaseContext,\n\tidentity: { readonly id: string; readonly roles: readonly string[] },\n): Promise<TargetIdentityPermissionTarget> => ({\n\tid: identity.id,\n\tglobalRoles: identity.roles,\n\thasProjectMemberships: identity.roles.includes(TenantRole.SUPER_ADMIN)\n\t\t|| identity.roles.includes(TenantRole.PROJECT_ADMIN)\n\t\t|| await db.batchLoad(projectMembershipPresenceLoader, identity.id),\n})\n\n/** Convenience for the common case where the caller already holds the target's person row. */\nexport const createPersonPermissionTarget = async (\n\tdb: DatabaseContext,\n\tperson: { readonly identity_id: string; readonly roles: readonly string[] } | null,\n): Promise<TargetIdentityPermissionTarget | null> =>\n\tperson === null ? null : await createTargetIdentityPermissionTarget(db, { id: person.identity_id, roles: person.roles })\n"],"names":["batchLoader","IdentityHasProjectMembershipsQuery","IdentityQuery","TenantRole"],"mappings":";;;;;;;;;;;;;;AAMA,MAAM,kCAAkCA,WAAAA;AAAAA,EACvC,OAAO,aAAa,OAAO,MAAM,GAAG,aAAa,MAAM,IAAIC,sEAAmC,WAAW,CAAC;AAAA,EAC1G,CAAC,YAAY,8BAA8B,0BAA0B,IAAI,UAAU;AACpF;AAGO,MAAM,uBAAuBD,WAAAA;AAAAA,EACnC,OAAO,aAAa,OAAO;AAC1B,UAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIE,cAAAA,cAAc,WAAW,CAAC;AAC7E,WAAO,OAAO,YAAY,WAAW,IAAI,CAAA,aAAY,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AAAA,EAC9E;AAAA,EACA,CAAC,YAAY,eAAe,WAAW,UAAU;AAClD;AAEO,MAAM,uCAAuC,OACnD,IACA,cAC8C;AAAA,EAC9C,IAAI,SAAS;AAAA,EACb,aAAa,SAAS;AAAA,EACtB,uBAAuB,SAAS,MAAM,SAASC,MAAAA,WAAW,WAAW,KACjE,SAAS,MAAM,SAASA,MAAAA,WAAW,aAAa,KAChD,MAAM,GAAG,UAAU,iCAAiC,SAAS,EAAE;AACpE;AAGO,MAAM,+BAA+B,OAC3C,IACA,WAEA,WAAW,OAAO,OAAO,MAAM,qCAAqC,IAAI,EAAE,IAAI,OAAO,aAAa,OAAO,OAAO,OAAO;;;;"}

package/dist/production/src/model/authorization/TargetIdentityPermission.js

@@ -0,0 +1,35 @@
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../type/ApiKey.js";
+import { IdentityHasProjectMembershipsQuery } from "../queries/membership/IdentityHasProjectMembershipsQuery.js";
+import { IdentityQuery } from "../queries/identity/IdentityQuery.js";
+import "./PermissionActions.js";
+import "@contember/authorization";
+import { TenantRole } from "./Roles.js";
+import "./CustomRolePermissions.js";
+import "./PermissionContext.js";
+import "@contember/schema";
+import { batchLoader } from "../../utils/batchQuery.js";
+const projectMembershipPresenceLoader = batchLoader(
+  async (identityIds, db) => await db.queryHandler.fetch(new IdentityHasProjectMembershipsQuery(identityIds)),
+  (identityId, identitiesWithMemberships) => identitiesWithMemberships.has(identityId)
+);
+const targetIdentityLoader = batchLoader(
+  async (identityIds, db) => {
+    const identities = await db.queryHandler.fetch(new IdentityQuery(identityIds));
+    return Object.fromEntries(identities.map((identity) => [identity.id, identity]));
+  },
+  (identityId, identities) => identities[identityId]
+);
+const createTargetIdentityPermissionTarget = async (db, identity) => ({
+  id: identity.id,
+  globalRoles: identity.roles,
+  hasProjectMemberships: identity.roles.includes(TenantRole.SUPER_ADMIN) || identity.roles.includes(TenantRole.PROJECT_ADMIN) || await db.batchLoad(projectMembershipPresenceLoader, identity.id)
+});
+const createPersonPermissionTarget = async (db, person) => person === null ? null : await createTargetIdentityPermissionTarget(db, { id: person.identity_id, roles: person.roles });
+export {
+  createPersonPermissionTarget,
+  createTargetIdentityPermissionTarget,
+  targetIdentityLoader
+};
+//# sourceMappingURL=TargetIdentityPermission.js.map

package/dist/production/src/model/authorization/TargetIdentityPermission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TargetIdentityPermission.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/TargetIdentityPermission.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { IdentityHasProjectMembershipsQuery, IdentityQuery, IdentityQueryResult } from '../queries/index.js'\nimport { TargetIdentityPermissionTarget } from './PermissionActions.js'\nimport { TenantRole } from './Roles.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\n\nconst projectMembershipPresenceLoader = batchLoader<string, ReadonlySet<string>, boolean>(\n\tasync (identityIds, db) => await db.queryHandler.fetch(new IdentityHasProjectMembershipsQuery(identityIds)),\n\t(identityId, identitiesWithMemberships) => identitiesWithMemberships.has(identityId),\n)\n\n/** Batches the identity lookup that precedes a target-identity permission check. */\nexport const targetIdentityLoader = batchLoader<string, Record<string, IdentityQueryResult>, IdentityQueryResult | undefined>(\n\tasync (identityIds, db) => {\n\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(identityIds))\n\t\treturn Object.fromEntries(identities.map(identity => [identity.id, identity]))\n\t},\n\t(identityId, identities) => identities[identityId],\n)\n\nexport const createTargetIdentityPermissionTarget = async (\n\tdb: DatabaseContext,\n\tidentity: { readonly id: string; readonly roles: readonly string[] },\n): Promise<TargetIdentityPermissionTarget> => ({\n\tid: identity.id,\n\tglobalRoles: identity.roles,\n\thasProjectMemberships: identity.roles.includes(TenantRole.SUPER_ADMIN)\n\t\t|| identity.roles.includes(TenantRole.PROJECT_ADMIN)\n\t\t|| await db.batchLoad(projectMembershipPresenceLoader, identity.id),\n})\n\n/** Convenience for the common case where the caller already holds the target's person row. */\nexport const createPersonPermissionTarget = async (\n\tdb: DatabaseContext,\n\tperson: { readonly identity_id: string; readonly roles: readonly string[] } | null,\n): Promise<TargetIdentityPermissionTarget | null> =>\n\tperson === null ? null : await createTargetIdentityPermissionTarget(db, { id: person.identity_id, roles: person.roles })\n"],"names":[],"mappings":";;;;;;;;;;;;AAMA,MAAM,kCAAkC;AAAA,EACvC,OAAO,aAAa,OAAO,MAAM,GAAG,aAAa,MAAM,IAAI,mCAAmC,WAAW,CAAC;AAAA,EAC1G,CAAC,YAAY,8BAA8B,0BAA0B,IAAI,UAAU;AACpF;AAGO,MAAM,uBAAuB;AAAA,EACnC,OAAO,aAAa,OAAO;AAC1B,UAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,cAAc,WAAW,CAAC;AAC7E,WAAO,OAAO,YAAY,WAAW,IAAI,CAAA,aAAY,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AAAA,EAC9E;AAAA,EACA,CAAC,YAAY,eAAe,WAAW,UAAU;AAClD;AAEO,MAAM,uCAAuC,OACnD,IACA,cAC8C;AAAA,EAC9C,IAAI,SAAS;AAAA,EACb,aAAa,SAAS;AAAA,EACtB,uBAAuB,SAAS,MAAM,SAAS,WAAW,WAAW,KACjE,SAAS,MAAM,SAAS,WAAW,aAAa,KAChD,MAAM,GAAG,UAAU,iCAAiC,SAAS,EAAE;AACpE;AAGO,MAAM,+BAA+B,OAC3C,IACA,WAEA,WAAW,OAAO,OAAO,MAAM,qCAAqC,IAAI,EAAE,IAAI,OAAO,aAAa,OAAO,OAAO,OAAO;"}

package/dist/production/src/model/commands/CommandBus.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CommandBus.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/commands/CommandBus.ts"],"sourcesContent":["import { Command } from './Command'\nimport { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers'\n\nexport class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tconstructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}\n\n\tpublic async execute<T>(command: Command<T>): Promise<T> {\n\t\treturn await command.execute({ db: this.client, providers: this.providers, bus: this })\n\t}\n\n\tasync transaction<T>(\n\t\ttransactionScope: (wrapper: CommandBus<Connection.TransactionLike>) => Promise<T> | T,\n\t): Promise<T> {\n\t\treturn await this.client.transaction(client => transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)))\n\t}\n}\n"],"names":[],"mappings":";;AAIO,MAAM,WAAyF;AAAA,EACrG,YAA4B,QAAiD,WAAsB;AAAvE,SAAA,SAAA;AAAiD,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpG,MAAa,QAAW,SAAiC;AACxD,WAAO,MAAM,QAAQ,QAAQ,EAAE,IAAI,KAAK,QAAQ,WAAW,KAAK,WAAW,KAAK,KAAA,CAAM;AAAA,EACvF;AAAA,EAEA,MAAM,YACL,kBACa;AACb,WAAO,MAAM,KAAK,OAAO,YAAY,CAAA,WAAU,iBAAiB,IAAI,WAAuC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACpI;AACD;;"}
+{"version":3,"file":"CommandBus.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/commands/CommandBus.ts"],"sourcesContent":["import { Command } from './Command.js'\nimport { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers.js'\n\nexport class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tconstructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}\n\n\tpublic async execute<T>(command: Command<T>): Promise<T> {\n\t\treturn await command.execute({ db: this.client, providers: this.providers, bus: this })\n\t}\n\n\tasync transaction<T>(\n\t\ttransactionScope: (wrapper: CommandBus<Connection.TransactionLike>) => Promise<T> | T,\n\t): Promise<T> {\n\t\treturn await this.client.transaction(client => transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)))\n\t}\n}\n"],"names":[],"mappings":";;AAIO,MAAM,WAAyF;AAAA,EACrG,YAA4B,QAAiD,WAAsB;AAAvE,SAAA,SAAA;AAAiD,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpG,MAAa,QAAW,SAAiC;AACxD,WAAO,MAAM,QAAQ,QAAQ,EAAE,IAAI,KAAK,QAAQ,WAAW,KAAK,WAAW,KAAK,KAAA,CAAM;AAAA,EACvF;AAAA,EAEA,MAAM,YACL,kBACa;AACb,WAAO,MAAM,KAAK,OAAO,YAAY,CAAA,WAAU,iBAAiB,IAAI,WAAuC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACpI;AACD;;"}

package/dist/production/src/model/commands/CommandBus.js.map

@@ -1 +1 @@
-{"version":3,"file":"CommandBus.js","sources":["../../../../../../packages/engine-tenant-api/src/model/commands/CommandBus.ts"],"sourcesContent":["import { Command } from './Command'\nimport { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers'\n\nexport class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tconstructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}\n\n\tpublic async execute<T>(command: Command<T>): Promise<T> {\n\t\treturn await command.execute({ db: this.client, providers: this.providers, bus: this })\n\t}\n\n\tasync transaction<T>(\n\t\ttransactionScope: (wrapper: CommandBus<Connection.TransactionLike>) => Promise<T> | T,\n\t): Promise<T> {\n\t\treturn await this.client.transaction(client => transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)))\n\t}\n}\n"],"names":[],"mappings":"AAIO,MAAM,WAAyF;AAAA,EACrG,YAA4B,QAAiD,WAAsB;AAAvE,SAAA,SAAA;AAAiD,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpG,MAAa,QAAW,SAAiC;AACxD,WAAO,MAAM,QAAQ,QAAQ,EAAE,IAAI,KAAK,QAAQ,WAAW,KAAK,WAAW,KAAK,KAAA,CAAM;AAAA,EACvF;AAAA,EAEA,MAAM,YACL,kBACa;AACb,WAAO,MAAM,KAAK,OAAO,YAAY,CAAA,WAAU,iBAAiB,IAAI,WAAuC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACpI;AACD;"}
+{"version":3,"file":"CommandBus.js","sources":["../../../../../../packages/engine-tenant-api/src/model/commands/CommandBus.ts"],"sourcesContent":["import { Command } from './Command.js'\nimport { Client, Connection } from '@contember/database'\nimport { Providers } from '../providers.js'\n\nexport class CommandBus<ConnectionType extends Connection.ConnectionLike = Connection.ConnectionLike> {\n\tconstructor(public readonly client: Client<ConnectionType>, private readonly providers: Providers) {}\n\n\tpublic async execute<T>(command: Command<T>): Promise<T> {\n\t\treturn await command.execute({ db: this.client, providers: this.providers, bus: this })\n\t}\n\n\tasync transaction<T>(\n\t\ttransactionScope: (wrapper: CommandBus<Connection.TransactionLike>) => Promise<T> | T,\n\t): Promise<T> {\n\t\treturn await this.client.transaction(client => transactionScope(new CommandBus<Connection.TransactionLike>(client, this.providers)))\n\t}\n}\n"],"names":[],"mappings":"AAIO,MAAM,WAAyF;AAAA,EACrG,YAA4B,QAAiD,WAAsB;AAAvE,SAAA,SAAA;AAAiD,SAAA,YAAA;AAAA,EAAuB;AAAA,EAEpG,MAAa,QAAW,SAAiC;AACxD,WAAO,MAAM,QAAQ,QAAQ,EAAE,IAAI,KAAK,QAAQ,WAAW,KAAK,WAAW,KAAK,KAAA,CAAM;AAAA,EACvF;AAAA,EAEA,MAAM,YACL,kBACa;AACb,WAAO,MAAM,KAAK,OAAO,YAAY,CAAA,WAAU,iBAAiB,IAAI,WAAuC,QAAQ,KAAK,SAAS,CAAC,CAAC;AAAA,EACpI;AACD;"}

package/dist/production/src/model/commands/apiKey/ApiKeyHelper.cjs

@@ -2,8 +2,14 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const ApiKey = require("../../type/ApiKey.cjs");
 const time = require("../../utils/time.cjs");
+const Database = require("@contember/database");
 const DEFAULT_EXPIRATION = 30;
 class ApiKeyHelper {
+  /**
+   * App-clock expiry Date. Kept only for ProlongApiKeyCommand's significance
+   * throttle (a write-rate optimization, not an auth gate). The value actually
+   * stored / compared runs on the DB clock — see {@link getExpirationLiteral}.
+   */
   static getExpiration(providers, type, expiration) {
     switch (type) {
       case ApiKey.ApiKey.Type.PERMANENT:
@@ -14,6 +20,19 @@ class ApiKeyHelper {
         return null;
     }
   }
+  /** Lifetime of a session key in seconds (`expiration` minutes, default 30). */
+  static getSessionExpirationSeconds(expiration) {
+    return (expiration || DEFAULT_EXPIRATION) * 60;
+  }
+  /**
+   * DB-clock expiry expression for issuance: `now() + <lifetime>` evaluated on the
+   * database clock, so the expiry gate (ApiKeyByTokenQuery's `is_expired`) compares
+   * against the same clock and cannot be weakened by app/DB skew. NULL for
+   * non-session keys (they never expire). See engine-tenant-api/CLAUDE.md.
+   */
+  static getExpirationLiteral(type, expiration) {
+    return type === ApiKey.ApiKey.Type.SESSION ? new Database.Literal("now() + make_interval(secs => ?)", [ApiKeyHelper.getSessionExpirationSeconds(expiration)]) : null;
+  }
 }
 exports.ApiKeyHelper = ApiKeyHelper;
 //# sourceMappingURL=ApiKeyHelper.cjs.map

package/dist/production/src/model/commands/apiKey/ApiKeyHelper.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyHelper.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type'\nimport { Providers } from '../../providers'\nimport { plusMinutes } from '../../utils/time'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n}\n"],"names":["ApiKey","plusMinutes"],"mappings":";;;;AAIA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA,EACzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAOC,KAAAA,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAKD,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AACD;;"}
+{"version":3,"file":"ApiKeyHelper.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type/index.js'\nimport { Providers } from '../../providers.js'\nimport { plusMinutes } from '../../utils/time.js'\nimport { Literal } from '@contember/database'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\t/**\n\t * App-clock expiry Date. Kept only for ProlongApiKeyCommand's significance\n\t * throttle (a write-rate optimization, not an auth gate). The value actually\n\t * stored / compared runs on the DB clock — see {@link getExpirationLiteral}.\n\t */\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n\n\t/** Lifetime of a session key in seconds (`expiration` minutes, default 30). */\n\tpublic static getSessionExpirationSeconds(expiration?: number | null): number {\n\t\treturn (expiration || DEFAULT_EXPIRATION) * 60\n\t}\n\n\t/**\n\t * DB-clock expiry expression for issuance: `now() + <lifetime>` evaluated on the\n\t * database clock, so the expiry gate (ApiKeyByTokenQuery's `is_expired`) compares\n\t * against the same clock and cannot be weakened by app/DB skew. NULL for\n\t * non-session keys (they never expire). See engine-tenant-api/CLAUDE.md.\n\t */\n\tpublic static getExpirationLiteral(type: ApiKey.Type, expiration?: number | null): Literal | null {\n\t\treturn type === ApiKey.Type.SESSION\n\t\t\t? new Literal('now() + make_interval(secs => ?)', [ApiKeyHelper.getSessionExpirationSeconds(expiration)])\n\t\t\t: null\n\t}\n}\n"],"names":["ApiKey","plusMinutes","Literal"],"mappings":";;;;;AAKA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAOC,KAAAA,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAKD,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AAAA;AAAA,EAGA,OAAc,4BAA4B,YAAoC;AAC7E,YAAQ,cAAc,sBAAsB;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAc,qBAAqB,MAAmB,YAA4C;AACjG,WAAO,SAASA,OAAAA,OAAO,KAAK,UACzB,IAAIE,SAAAA,QAAQ,oCAAoC,CAAC,aAAa,4BAA4B,UAAU,CAAC,CAAC,IACtG;AAAA,EACJ;AACD;;"}

package/dist/production/src/model/commands/apiKey/ApiKeyHelper.js

@@ -1,7 +1,13 @@
 import { ApiKey } from "../../type/ApiKey.js";
 import { plusMinutes } from "../../utils/time.js";
+import { Literal } from "@contember/database";
 const DEFAULT_EXPIRATION = 30;
 class ApiKeyHelper {
+  /**
+   * App-clock expiry Date. Kept only for ProlongApiKeyCommand's significance
+   * throttle (a write-rate optimization, not an auth gate). The value actually
+   * stored / compared runs on the DB clock — see {@link getExpirationLiteral}.
+   */
   static getExpiration(providers, type, expiration) {
     switch (type) {
       case ApiKey.Type.PERMANENT:
@@ -12,6 +18,19 @@ class ApiKeyHelper {
         return null;
     }
   }
+  /** Lifetime of a session key in seconds (`expiration` minutes, default 30). */
+  static getSessionExpirationSeconds(expiration) {
+    return (expiration || DEFAULT_EXPIRATION) * 60;
+  }
+  /**
+   * DB-clock expiry expression for issuance: `now() + <lifetime>` evaluated on the
+   * database clock, so the expiry gate (ApiKeyByTokenQuery's `is_expired`) compares
+   * against the same clock and cannot be weakened by app/DB skew. NULL for
+   * non-session keys (they never expire). See engine-tenant-api/CLAUDE.md.
+   */
+  static getExpirationLiteral(type, expiration) {
+    return type === ApiKey.Type.SESSION ? new Literal("now() + make_interval(secs => ?)", [ApiKeyHelper.getSessionExpirationSeconds(expiration)]) : null;
+  }
 }
 export {
   ApiKeyHelper

package/dist/production/src/model/commands/apiKey/ApiKeyHelper.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyHelper.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type'\nimport { Providers } from '../../providers'\nimport { plusMinutes } from '../../utils/time'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAIA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA,EACzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAK,OAAO,KAAK;AAChB,eAAO,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AACD;"}
+{"version":3,"file":"ApiKeyHelper.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type/index.js'\nimport { Providers } from '../../providers.js'\nimport { plusMinutes } from '../../utils/time.js'\nimport { Literal } from '@contember/database'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\t/**\n\t * App-clock expiry Date. Kept only for ProlongApiKeyCommand's significance\n\t * throttle (a write-rate optimization, not an auth gate). The value actually\n\t * stored / compared runs on the DB clock — see {@link getExpirationLiteral}.\n\t */\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n\n\t/** Lifetime of a session key in seconds (`expiration` minutes, default 30). */\n\tpublic static getSessionExpirationSeconds(expiration?: number | null): number {\n\t\treturn (expiration || DEFAULT_EXPIRATION) * 60\n\t}\n\n\t/**\n\t * DB-clock expiry expression for issuance: `now() + <lifetime>` evaluated on the\n\t * database clock, so the expiry gate (ApiKeyByTokenQuery's `is_expired`) compares\n\t * against the same clock and cannot be weakened by app/DB skew. NULL for\n\t * non-session keys (they never expire). See engine-tenant-api/CLAUDE.md.\n\t */\n\tpublic static getExpirationLiteral(type: ApiKey.Type, expiration?: number | null): Literal | null {\n\t\treturn type === ApiKey.Type.SESSION\n\t\t\t? new Literal('now() + make_interval(secs => ?)', [ApiKeyHelper.getSessionExpirationSeconds(expiration)])\n\t\t\t: null\n\t}\n}\n"],"names":[],"mappings":";;;AAKA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAK,OAAO,KAAK;AAChB,eAAO,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AAAA;AAAA,EAGA,OAAc,4BAA4B,YAAoC;AAC7E,YAAQ,cAAc,sBAAsB;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAc,qBAAqB,MAAmB,YAA4C;AACjG,WAAO,SAAS,OAAO,KAAK,UACzB,IAAI,QAAQ,oCAAoC,CAAC,aAAa,4BAA4B,UAAU,CAAC,CAAC,IACtG;AAAA,EACJ;AACD;"}

package/dist/production/src/model/commands/apiKey/CreateApiKeyCommand.cjs

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ApiKey = require("../../type/ApiKey.cjs");
 const ApiKeyHelper = require("./ApiKeyHelper.cjs");
 const Database = require("@contember/database");
-require("../../type/ApiKey.cjs");
 const token = require("../../utils/token.cjs");
 class CreateApiKeyCommand {
   constructor(args) {
@@ -16,15 +16,29 @@ class CreateApiKeyCommand {
       token$1 = await token.generateToken(providers);
       tokenHash = token.computeTokenHash(token$1);
     }
+    const args = this.args;
+    const sessionPolicy = args.type === ApiKey.ApiKey.Type.SESSION ? {
+      issued_at: providers.now(),
+      // display/ordering only, never compared
+      idle_timeout: args.idleTimeout ?? null,
+      max_expires_at: args.maxExpirationSeconds != null ? new Database.Literal("now() + make_interval(secs => ?)", [args.maxExpirationSeconds]) : null
+    } : { issued_at: null, idle_timeout: null, max_expires_at: null };
     await Database.InsertBuilder.create().into("api_key").values({
       id: apiKeyId,
       token_hash: tokenHash,
       type: this.args.type,
       identity_id: this.args.identityId,
       disabled_at: null,
-      expires_at: ApiKeyHelper.ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),
+      // expires_at on the DB clock so the verify gate compares like-for-like.
+      expires_at: ApiKeyHelper.ApiKeyHelper.getExpirationLiteral(this.args.type, this.args.expiration),
       expiration: this.args.expiration || null,
-      created_at: providers.now()
+      created_at: providers.now(),
+      created_ip: this.args.requestInfo?.ip || null,
+      created_user_agent: this.args.requestInfo?.userAgent || null,
+      trust_forwarded_info: this.args.trustForwardedInfo ?? false,
+      issued_at: sessionPolicy.issued_at,
+      idle_timeout: sessionPolicy.idle_timeout,
+      max_expires_at: sessionPolicy.max_expires_at
     }).execute(db);
     return new CreateApiKeyCommandResult(apiKeyId, token$1);
   }

package/dist/production/src/model/commands/apiKey/CreateApiKeyCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["token","generateToken","computeTokenHash","InsertBuilder","ApiKeyHelper"],"mappings":";;;;;;AAwBO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAIA;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACfA,gBAAQ,MAAMC,MAAAA,cAAc,SAAS;AACrC,kBAAYC,MAAAA,iBAAiBF,OAAK;AAAA,IACnC;AAEA,UAAMG,SAAAA,cAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAYC,aAAAA,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAUJ,OAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4BA,QAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAAA;AAAA,EACxD;AACD;;;"}
+{"version":3,"file":"CreateApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from './ProlongApiKeyCommand.js'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n\t/**\n\t * A19 session-policy snapshot, fixed at sign-in. NULLs preserve today's\n\t * behavior (no idle timeout, no absolute cap on the sliding window).\n\t * `idleTimeout` is a Postgres interval literal (e.g. `'15 minutes'`).\n\t */\n\tidleTimeout?: string | null\n\t/**\n\t * Absolute lifetime cap in seconds (A19). Written as `now() + interval` on the DB\n\t * clock so the cap is compared against the same clock. NULL = uncapped.\n\t */\n\tmaxExpirationSeconds?: number | null\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\t// Session-policy snapshot (A19). Only session keys carry it; permanent/one-off\n\t\t// keys have no session policy → NULL (preserving today's behavior).\n\t\tconst args = this.args\n\t\tconst sessionPolicy = args.type === ApiKey.Type.SESSION\n\t\t\t? {\n\t\t\t\tissued_at: providers.now(), // display/ordering only, never compared\n\t\t\t\tidle_timeout: args.idleTimeout ?? null,\n\t\t\t\tmax_expires_at: args.maxExpirationSeconds != null\n\t\t\t\t\t? new Literal('now() + make_interval(secs => ?)', [args.maxExpirationSeconds])\n\t\t\t\t\t: null,\n\t\t\t}\n\t\t\t: { issued_at: null, idle_timeout: null, max_expires_at: null }\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\t// expires_at on the DB clock so the verify gate compares like-for-like.\n\t\t\t\texpires_at: ApiKeyHelper.getExpirationLiteral(this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tcreated_ip: this.args.requestInfo?.ip || null,\n\t\t\t\tcreated_user_agent: this.args.requestInfo?.userAgent || null,\n\t\t\t\ttrust_forwarded_info: this.args.trustForwardedInfo ?? false,\n\t\t\t\tissued_at: sessionPolicy.issued_at,\n\t\t\t\tidle_timeout: sessionPolicy.idle_timeout,\n\t\t\t\tmax_expires_at: sessionPolicy.max_expires_at,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["token","generateToken","computeTokenHash","ApiKey","Literal","InsertBuilder","ApiKeyHelper"],"mappings":";;;;;;AAwCO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAIA;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACfA,gBAAQ,MAAMC,MAAAA,cAAc,SAAS;AACrC,kBAAYC,MAAAA,iBAAiBF,OAAK;AAAA,IACnC;AAIA,UAAM,OAAO,KAAK;AAClB,UAAM,gBAAgB,KAAK,SAASG,OAAAA,OAAO,KAAK,UAC7C;AAAA,MACD,WAAW,UAAU,IAAA;AAAA;AAAA,MACrB,cAAc,KAAK,eAAe;AAAA,MAClC,gBAAgB,KAAK,wBAAwB,OAC1C,IAAIC,iBAAQ,oCAAoC,CAAC,KAAK,oBAAoB,CAAC,IAC3E;AAAA,IAAA,IAEF,EAAE,WAAW,MAAM,cAAc,MAAM,gBAAgB,KAAA;AAC1D,UAAMC,SAAAA,cAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA;AAAA,MAEb,YAAYC,aAAAA,aAAa,qBAAqB,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MAClF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,KAAK,KAAK,aAAa,MAAM;AAAA,MACzC,oBAAoB,KAAK,KAAK,aAAa,aAAa;AAAA,MACxD,sBAAsB,KAAK,KAAK,sBAAsB;AAAA,MACtD,WAAW,cAAc;AAAA,MACzB,cAAc,cAAc;AAAA,MAC5B,gBAAgB,cAAc;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAUN,OAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4BA,QAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAAA;AAAA,EACxD;AACD;;;"}

package/dist/production/src/model/commands/apiKey/CreateApiKeyCommand.js

@@ -1,6 +1,6 @@
+import { ApiKey } from "../../type/ApiKey.js";
 import { ApiKeyHelper } from "./ApiKeyHelper.js";
-import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
-import "../../type/ApiKey.js";
+import { Literal, InsertBuilder as InsertBuilder$1 } from "@contember/database";
 import { generateToken, computeTokenHash } from "../../utils/token.js";
 class CreateApiKeyCommand {
   constructor(args) {
@@ -14,15 +14,29 @@ class CreateApiKeyCommand {
       token = await generateToken(providers);
       tokenHash = computeTokenHash(token);
     }
+    const args = this.args;
+    const sessionPolicy = args.type === ApiKey.Type.SESSION ? {
+      issued_at: providers.now(),
+      // display/ordering only, never compared
+      idle_timeout: args.idleTimeout ?? null,
+      max_expires_at: args.maxExpirationSeconds != null ? new Literal("now() + make_interval(secs => ?)", [args.maxExpirationSeconds]) : null
+    } : { issued_at: null, idle_timeout: null, max_expires_at: null };
     await InsertBuilder$1.create().into("api_key").values({
       id: apiKeyId,
       token_hash: tokenHash,
       type: this.args.type,
       identity_id: this.args.identityId,
       disabled_at: null,
-      expires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),
+      // expires_at on the DB clock so the verify gate compares like-for-like.
+      expires_at: ApiKeyHelper.getExpirationLiteral(this.args.type, this.args.expiration),
       expiration: this.args.expiration || null,
-      created_at: providers.now()
+      created_at: providers.now(),
+      created_ip: this.args.requestInfo?.ip || null,
+      created_user_agent: this.args.requestInfo?.userAgent || null,
+      trust_forwarded_info: this.args.trustForwardedInfo ?? false,
+      issued_at: sessionPolicy.issued_at,
+      idle_timeout: sessionPolicy.idle_timeout,
+      max_expires_at: sessionPolicy.max_expires_at
     }).execute(db);
     return new CreateApiKeyCommandResult(apiKeyId, token);
   }

package/dist/production/src/model/commands/apiKey/CreateApiKeyCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { ApiKeyHelper } from './ApiKeyHelper'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;;AAwBO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAI;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACf,cAAQ,MAAM,cAAc,SAAS;AACrC,kBAAY,iBAAiB,KAAK;AAAA,IACnC;AAEA,UAAMA,gBAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAY,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAU,KAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4B,OAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAA;AAAA,EACxD;AACD;"}
+{"version":3,"file":"CreateApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from './ProlongApiKeyCommand.js'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n\t/**\n\t * A19 session-policy snapshot, fixed at sign-in. NULLs preserve today's\n\t * behavior (no idle timeout, no absolute cap on the sliding window).\n\t * `idleTimeout` is a Postgres interval literal (e.g. `'15 minutes'`).\n\t */\n\tidleTimeout?: string | null\n\t/**\n\t * Absolute lifetime cap in seconds (A19). Written as `now() + interval` on the DB\n\t * clock so the cap is compared against the same clock. NULL = uncapped.\n\t */\n\tmaxExpirationSeconds?: number | null\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\t// Session-policy snapshot (A19). Only session keys carry it; permanent/one-off\n\t\t// keys have no session policy → NULL (preserving today's behavior).\n\t\tconst args = this.args\n\t\tconst sessionPolicy = args.type === ApiKey.Type.SESSION\n\t\t\t? {\n\t\t\t\tissued_at: providers.now(), // display/ordering only, never compared\n\t\t\t\tidle_timeout: args.idleTimeout ?? null,\n\t\t\t\tmax_expires_at: args.maxExpirationSeconds != null\n\t\t\t\t\t? new Literal('now() + make_interval(secs => ?)', [args.maxExpirationSeconds])\n\t\t\t\t\t: null,\n\t\t\t}\n\t\t\t: { issued_at: null, idle_timeout: null, max_expires_at: null }\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\t// expires_at on the DB clock so the verify gate compares like-for-like.\n\t\t\t\texpires_at: ApiKeyHelper.getExpirationLiteral(this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tcreated_ip: this.args.requestInfo?.ip || null,\n\t\t\t\tcreated_user_agent: this.args.requestInfo?.userAgent || null,\n\t\t\t\ttrust_forwarded_info: this.args.trustForwardedInfo ?? false,\n\t\t\t\tissued_at: sessionPolicy.issued_at,\n\t\t\t\tidle_timeout: sessionPolicy.idle_timeout,\n\t\t\t\tmax_expires_at: sessionPolicy.max_expires_at,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;;AAwCO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAI;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACf,cAAQ,MAAM,cAAc,SAAS;AACrC,kBAAY,iBAAiB,KAAK;AAAA,IACnC;AAIA,UAAM,OAAO,KAAK;AAClB,UAAM,gBAAgB,KAAK,SAAS,OAAO,KAAK,UAC7C;AAAA,MACD,WAAW,UAAU,IAAA;AAAA;AAAA,MACrB,cAAc,KAAK,eAAe;AAAA,MAClC,gBAAgB,KAAK,wBAAwB,OAC1C,IAAI,QAAQ,oCAAoC,CAAC,KAAK,oBAAoB,CAAC,IAC3E;AAAA,IAAA,IAEF,EAAE,WAAW,MAAM,cAAc,MAAM,gBAAgB,KAAA;AAC1D,UAAMA,gBAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA;AAAA,MAEb,YAAY,aAAa,qBAAqB,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MAClF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,KAAK,KAAK,aAAa,MAAM;AAAA,MACzC,oBAAoB,KAAK,KAAK,aAAa,aAAa;AAAA,MACxD,sBAAsB,KAAK,KAAK,sBAAsB;AAAA,MACtD,WAAW,cAAc;AAAA,MACzB,cAAc,cAAc;AAAA,MAC5B,gBAAgB,cAAc;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAU,KAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4B,OAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAA;AAAA,EACxD;AACD;"}

package/dist/production/src/model/commands/apiKey/DisableApiKeyCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisableApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableApiKeyCommand implements Command<boolean> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,qBAAiD;AAAA,EAC7D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;;"}
+{"version":3,"file":"DisableApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableApiKeyCommand implements Command<boolean> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,qBAAiD;AAAA,EAC7D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;;"}

package/dist/production/src/model/commands/apiKey/DisableApiKeyCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisableApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableApiKeyCommand implements Command<boolean> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,qBAAiD;AAAA,EAC7D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;"}
+{"version":3,"file":"DisableApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableApiKeyCommand implements Command<boolean> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,qBAAiD;AAAA,EAC7D,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;"}

package/dist/production/src/model/commands/apiKey/DisableIdentityApiKeysCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisableIdentityApiKeysCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableIdentityApiKeysCommand implements Command<void> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,8BAAuD;AAAA,EACnE,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}
+{"version":3,"file":"DisableIdentityApiKeysCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableIdentityApiKeysCommand implements Command<void> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,8BAAuD;AAAA,EACnE,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}

package/dist/production/src/model/commands/apiKey/DisableIdentityApiKeysCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisableIdentityApiKeysCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableIdentityApiKeysCommand implements Command<void> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,8BAAuD;AAAA,EACnE,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}
+{"version":3,"file":"DisableIdentityApiKeysCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableIdentityApiKeysCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableIdentityApiKeysCommand implements Command<void> {\n\tconstructor(private readonly identityId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,8BAAuD;AAAA,EACnE,YAA6B,YAAoB;AAApB,SAAA,aAAA;AAAA,EAAqB;AAAA,EAElD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}

package/dist/production/src/model/commands/apiKey/DisableOneOffApiKeyCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"DisableOneOffApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableOneOffApiKeyCommand implements Command<void> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t\ttype: ApiKey.Type.ONE_OFF,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder","ApiKey"],"mappings":";;;;AAIO,MAAM,2BAAoD;AAAA,EAChE,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,MACT,MAAMC,OAAAA,OAAO,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}
+{"version":3,"file":"DisableOneOffApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableOneOffApiKeyCommand implements Command<void> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t\ttype: ApiKey.Type.ONE_OFF,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder","ApiKey"],"mappings":";;;;AAIO,MAAM,2BAAoD;AAAA,EAChE,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,MACT,MAAMC,OAAAA,OAAO,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;;"}

package/dist/production/src/model/commands/apiKey/DisableOneOffApiKeyCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"DisableOneOffApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command'\nimport { ApiKey } from '../../type'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableOneOffApiKeyCommand implements Command<void> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t\ttype: ApiKey.Type.ONE_OFF,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAIO,MAAM,2BAAoD;AAAA,EAChE,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,MACT,MAAM,OAAO,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}
+{"version":3,"file":"DisableOneOffApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/DisableOneOffApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class DisableOneOffApiKeyCommand implements Command<void> {\n\tconstructor(private readonly apiKeyId: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({\n\t\t\t\tid: this.apiKeyId,\n\t\t\t\ttype: ApiKey.Type.ONE_OFF,\n\t\t\t})\n\t\t\t.values({ disabled_at: new Date() })\n\n\t\tawait qb.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAIO,MAAM,2BAAoD;AAAA,EAChE,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,MACT,MAAM,OAAO,KAAK;AAAA,IAAA,CAClB,EACA,OAAO,EAAE,aAAa,oBAAI,KAAA,GAAQ;AAEpC,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AACD;"}