@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/model/queries/authLog/NextLoginAttemptQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"NextLoginAttemptQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextLoginAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\n\nexport class NextLoginAttemptQuery extends DatabaseQuery<Date> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Date> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_successful_reset', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: 'password_reset',\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\tGREATEST(\n\t\t\t\t\t\tCOALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window), \n\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_successful_reset'))\n\t\t\t.with('failed_logins', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'fails')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_fail')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: 'login',\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\tCASE WHEN failed_logins.fails = 0 \n\t\t\t\tTHEN NOW() \n\t\t\t\tELSE LEAST(\n\t\t\t\t\tfailed_logins.last_fail + cfg.login_max_backoff, \n\t\t\t\t\tfailed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))\n\t\t\t\t) END`),\n\t\t\t\t'next_allowed_login',\n\t\t\t)\n\t\t\t.from('failed_logins')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new Date()\n\t\t}\n\t\treturn result[0].next_allowed_login\n\t}\n}\n"],"names":["it"],"mappings":";AAEO,MAAM,8BAA8B,cAAoB;AAAA,EAC9D,YACkB,OAChB;AACD,UAAA;AAFiB,SAAA,QAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAAwC;AACrD,UAAM,KAAK,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,yBAAyB,CAAA,OAC9B,GACE,OAAO,IAAI,QAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAA,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA,OAIX;AAAA,MACD;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,uBAAuB,CAAC,EAC/B,KAAK,iBAAiB,CAAA,OACtB,GACE,OAAO,IAAI,QAAQ,UAAU,GAAG,OAAO,EACvC,OAAO,IAAI,QAAQ,iCAAiC,GAAG,WAAW,EAClE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM;AAAA,MACN,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAI,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMN;AAAA,MACN;AAAA,IAAA,EAEA,KAAK,eAAe,EACpB,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,iCAAW,KAAA;AAAA,IACZ;AACA,WAAO,OAAO,CAAC,EAAE;AAAA,EAClB;AACD;"}
+{"version":3,"file":"NextLoginAttemptQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextLoginAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\n\nexport class NextLoginAttemptQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_successful_reset', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: 'password_reset',\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\tGREATEST(\n\t\t\t\t\t\tCOALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window),\n\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_successful_reset'))\n\t\t\t.with('failed_logins', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'fails')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_fail')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: 'login',\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\tCASE WHEN failed_logins.fails = 0\n\t\t\t\tTHEN 0\n\t\t\t\tELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (\n\t\t\t\t\tLEAST(\n\t\t\t\t\t\tfailed_logins.last_fail + cfg.login_max_backoff,\n\t\t\t\t\t\tfailed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))\n\t\t\t\t\t) - NOW()\n\t\t\t\t)))) END`),\n\t\t\t\t'retry_after_seconds',\n\t\t\t)\n\t\t\t.from('failed_logins')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn 0\n\t\t}\n\t\treturn Number(result[0].retry_after_seconds)\n\t}\n}\n"],"names":["it"],"mappings":";AAEO,MAAM,8BAA8B,cAAsB;AAAA,EAChE,YACkB,OAChB;AACD,UAAA;AAFiB,SAAA,QAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,KAAK,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,yBAAyB,CAAA,OAC9B,GACE,OAAO,IAAI,QAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAA,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA,OAIX;AAAA,MACD;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,uBAAuB,CAAC,EAC/B,KAAK,iBAAiB,CAAA,OACtB,GACE,OAAO,IAAI,QAAQ,UAAU,GAAG,OAAO,EACvC,OAAO,IAAI,QAAQ,iCAAiC,GAAG,WAAW,EAClE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM;AAAA,MACN,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAI,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAQH;AAAA,MACT;AAAA,IAAA,EAEA,KAAK,eAAe,EACpB,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,OAAO,OAAO,CAAC,EAAE,mBAAmB;AAAA,EAC5C;AACD;"}

package/dist/production/src/model/queries/authLog/NextMailAttemptQuery.cjs

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class NextMailAttemptQuery extends Database.DatabaseQuery {
+  constructor(email, initType, completionType) {
+    super();
+    this.email = email;
+    this.initType = initType;
+    this.completionType = completionType;
+  }
+  async fetch({ db }) {
+    const qb = Database.SelectBuilder.create().with("cfg", (it) => it.from("config")).with("last_completion", (it) => it.select(new Database.Literal("MAX(person_auth_log.created_at)"), "created_at").from("person_auth_log").join("person", "person", (it2) => it2.columnsEq(["person", "id"], ["person_auth_log", "person_id"])).where({
+      type: this.completionType,
+      success: true,
+      email: this.email
+    })).with("window_start", (it) => it.select(
+      new Database.Literal(`
+						GREATEST(
+							COALESCE(last_completion.created_at, NOW() - cfg.login_attempt_window),
+							NOW() - cfg.login_attempt_window
+						)`),
+      "start_time"
+    ).from("cfg").from("last_completion")).with("attempts", (it) => it.select(new Database.Literal("COUNT(*)"), "attempts").select(new Database.Literal("MAX(person_auth_log.created_at)"), "last_attempt").from("person_auth_log").from("window_start").where({
+      person_input_identifier: this.email,
+      type: this.initType,
+      success: true
+    }).where(new Database.Literal("person_auth_log.created_at >= window_start.start_time"))).select(
+      new Database.Literal(`
+					CASE WHEN attempts.attempts = 0
+					THEN 0
+					ELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (
+						LEAST(
+							attempts.last_attempt + cfg.login_max_backoff,
+							attempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))
+						) - NOW()
+					)))) END`),
+      "retry_after_seconds"
+    ).from("attempts").from("cfg");
+    const result = await qb.getResult(db);
+    if (result.length === 0) {
+      return 0;
+    }
+    return Number(result[0].retry_after_seconds);
+  }
+}
+exports.NextMailAttemptQuery = NextMailAttemptQuery;
+//# sourceMappingURL=NextMailAttemptQuery.cjs.map

package/dist/production/src/model/queries/authLog/NextMailAttemptQuery.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"NextMailAttemptQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextMailAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { AuthActionType } from '../../type/AuthLog.js'\n\n/**\n * Per-email exponential backoff for mail-sending init flows (password reset,\n * passwordless sign-in). Mirrors {@link NextLoginAttemptQuery} but counts\n * *successful* init events (= mails actually sent) against the same email, and\n * treats a successful completion (`completionType`) as the cutoff that resets\n * the backoff to zero.\n *\n * Reuses the existing `login_base_backoff` / `login_max_backoff` /\n * `login_attempt_window` knobs — see ConfigRateLimits docstring for the\n * rationale.\n */\nexport class NextMailAttemptQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t\tprivate readonly initType: AuthActionType,\n\t\tprivate readonly completionType: AuthActionType,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_completion', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: this.completionType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\t\tGREATEST(\n\t\t\t\t\t\t\tCOALESCE(last_completion.created_at, NOW() - cfg.login_attempt_window),\n\t\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_completion'))\n\t\t\t.with('attempts', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'attempts')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_attempt')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: this.initType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\t\tCASE WHEN attempts.attempts = 0\n\t\t\t\t\tTHEN 0\n\t\t\t\t\tELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (\n\t\t\t\t\t\tLEAST(\n\t\t\t\t\t\t\tattempts.last_attempt + cfg.login_max_backoff,\n\t\t\t\t\t\t\tattempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))\n\t\t\t\t\t\t) - NOW()\n\t\t\t\t\t)))) END`),\n\t\t\t\t'retry_after_seconds',\n\t\t\t)\n\t\t\t.from('attempts')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn 0\n\t\t}\n\t\treturn Number(result[0].retry_after_seconds)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal","it"],"mappings":";;;AAcO,MAAM,6BAA6BA,SAAAA,cAAsB;AAAA,EAC/D,YACkB,OACA,UACA,gBAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,WAAA;AACA,SAAA,iBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,mBAAmB,CAAA,OACxB,GACE,OAAO,IAAIC,iBAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAC,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAID,iBAAQ;AAAA;AAAA;AAAA;AAAA,QAIV;AAAA,MACF;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,iBAAiB,CAAC,EACzB,KAAK,YAAY,CAAA,OACjB,GACE,OAAO,IAAIA,SAAAA,QAAQ,UAAU,GAAG,UAAU,EAC1C,OAAO,IAAIA,SAAAA,QAAQ,iCAAiC,GAAG,cAAc,EACrE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAIA,SAAAA,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAIA,iBAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAQF;AAAA,MACV;AAAA,IAAA,EAEA,KAAK,UAAU,EACf,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,OAAO,OAAO,CAAC,EAAE,mBAAmB;AAAA,EAC5C;AACD;;"}

package/dist/production/src/model/queries/authLog/NextMailAttemptQuery.js

@@ -0,0 +1,47 @@
+import { DatabaseQuery, SelectBuilder, Literal } from "@contember/database";
+class NextMailAttemptQuery extends DatabaseQuery {
+  constructor(email, initType, completionType) {
+    super();
+    this.email = email;
+    this.initType = initType;
+    this.completionType = completionType;
+  }
+  async fetch({ db }) {
+    const qb = SelectBuilder.create().with("cfg", (it) => it.from("config")).with("last_completion", (it) => it.select(new Literal("MAX(person_auth_log.created_at)"), "created_at").from("person_auth_log").join("person", "person", (it2) => it2.columnsEq(["person", "id"], ["person_auth_log", "person_id"])).where({
+      type: this.completionType,
+      success: true,
+      email: this.email
+    })).with("window_start", (it) => it.select(
+      new Literal(`
+						GREATEST(
+							COALESCE(last_completion.created_at, NOW() - cfg.login_attempt_window),
+							NOW() - cfg.login_attempt_window
+						)`),
+      "start_time"
+    ).from("cfg").from("last_completion")).with("attempts", (it) => it.select(new Literal("COUNT(*)"), "attempts").select(new Literal("MAX(person_auth_log.created_at)"), "last_attempt").from("person_auth_log").from("window_start").where({
+      person_input_identifier: this.email,
+      type: this.initType,
+      success: true
+    }).where(new Literal("person_auth_log.created_at >= window_start.start_time"))).select(
+      new Literal(`
+					CASE WHEN attempts.attempts = 0
+					THEN 0
+					ELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (
+						LEAST(
+							attempts.last_attempt + cfg.login_max_backoff,
+							attempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))
+						) - NOW()
+					)))) END`),
+      "retry_after_seconds"
+    ).from("attempts").from("cfg");
+    const result = await qb.getResult(db);
+    if (result.length === 0) {
+      return 0;
+    }
+    return Number(result[0].retry_after_seconds);
+  }
+}
+export {
+  NextMailAttemptQuery
+};
+//# sourceMappingURL=NextMailAttemptQuery.js.map

package/dist/production/src/model/queries/authLog/NextMailAttemptQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NextMailAttemptQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextMailAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { AuthActionType } from '../../type/AuthLog.js'\n\n/**\n * Per-email exponential backoff for mail-sending init flows (password reset,\n * passwordless sign-in). Mirrors {@link NextLoginAttemptQuery} but counts\n * *successful* init events (= mails actually sent) against the same email, and\n * treats a successful completion (`completionType`) as the cutoff that resets\n * the backoff to zero.\n *\n * Reuses the existing `login_base_backoff` / `login_max_backoff` /\n * `login_attempt_window` knobs — see ConfigRateLimits docstring for the\n * rationale.\n */\nexport class NextMailAttemptQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t\tprivate readonly initType: AuthActionType,\n\t\tprivate readonly completionType: AuthActionType,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_completion', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: this.completionType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\t\tGREATEST(\n\t\t\t\t\t\t\tCOALESCE(last_completion.created_at, NOW() - cfg.login_attempt_window),\n\t\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_completion'))\n\t\t\t.with('attempts', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'attempts')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_attempt')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: this.initType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\t\tCASE WHEN attempts.attempts = 0\n\t\t\t\t\tTHEN 0\n\t\t\t\t\tELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (\n\t\t\t\t\t\tLEAST(\n\t\t\t\t\t\t\tattempts.last_attempt + cfg.login_max_backoff,\n\t\t\t\t\t\t\tattempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))\n\t\t\t\t\t\t) - NOW()\n\t\t\t\t\t)))) END`),\n\t\t\t\t'retry_after_seconds',\n\t\t\t)\n\t\t\t.from('attempts')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn 0\n\t\t}\n\t\treturn Number(result[0].retry_after_seconds)\n\t}\n}\n"],"names":["it"],"mappings":";AAcO,MAAM,6BAA6B,cAAsB;AAAA,EAC/D,YACkB,OACA,UACA,gBAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,WAAA;AACA,SAAA,iBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,KAAK,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,mBAAmB,CAAA,OACxB,GACE,OAAO,IAAI,QAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAA,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA,QAIV;AAAA,MACF;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,iBAAiB,CAAC,EACzB,KAAK,YAAY,CAAA,OACjB,GACE,OAAO,IAAI,QAAQ,UAAU,GAAG,UAAU,EAC1C,OAAO,IAAI,QAAQ,iCAAiC,GAAG,cAAc,EACrE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAI,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAQF;AAAA,MACV;AAAA,IAAA,EAEA,KAAK,UAAU,EACf,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,OAAO,OAAO,CAAC,EAAE,mBAAmB;AAAA,EAC5C;AACD;"}

package/dist/production/src/model/queries/authPolicy/AuthPoliciesQuery.cjs

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class AuthPoliciesQuery extends Database.DatabaseQuery {
+  constructor(filter) {
+    super();
+    this.filter = filter;
+  }
+  async fetch({ db }) {
+    let qb = Database.SelectBuilder.create().from("auth_policy").select(new Database.Literal("*"));
+    if (this.filter !== void 0) {
+      const projectId = this.filter.projectId;
+      qb = qb.where((expr) => projectId === null ? expr.isNull("project_id") : expr.compare("project_id", "=", projectId));
+    }
+    return await qb.getResult(db);
+  }
+}
+exports.AuthPoliciesQuery = AuthPoliciesQuery;
+//# sourceMappingURL=AuthPoliciesQuery.cjs.map

package/dist/production/src/model/queries/authPolicy/AuthPoliciesQuery.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPoliciesQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authPolicy/AuthPoliciesQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { AuthPolicyRow } from '../../type/index.js'\n\n/**\n * Lists `auth_policy` rows. Optionally filters to a single project (or to the\n * global scope when `projectId` is explicitly `null`); with no filter, returns\n * every row. Intervals are returned as IPostgresInterval, like ConfigRow.\n */\nexport class AuthPoliciesQuery extends DatabaseQuery<AuthPolicyRow[]> {\n\tconstructor(private readonly filter?: { projectId: string | null }) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<AuthPolicyRow[]> {\n\t\tlet qb = SelectBuilder.create<AuthPolicyRow>()\n\t\t\t.from('auth_policy')\n\t\t\t.select(new Literal('*'))\n\t\tif (this.filter !== undefined) {\n\t\t\tconst projectId = this.filter.projectId\n\t\t\tqb = qb.where(expr => projectId === null ? expr.isNull('project_id') : expr.compare('project_id', '=', projectId))\n\t\t}\n\t\treturn await qb.getResult(db)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal"],"mappings":";;;AAQO,MAAM,0BAA0BA,SAAAA,cAA+B;AAAA,EACrE,YAA6B,QAAuC;AACnE,UAAA;AAD4B,SAAA,SAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAAmD;AAChE,QAAI,KAAKC,SAAAA,cAAc,OAAA,EACrB,KAAK,aAAa,EAClB,OAAO,IAAIC,iBAAQ,GAAG,CAAC;AACzB,QAAI,KAAK,WAAW,QAAW;AAC9B,YAAM,YAAY,KAAK,OAAO;AAC9B,WAAK,GAAG,MAAM,CAAA,SAAQ,cAAc,OAAO,KAAK,OAAO,YAAY,IAAI,KAAK,QAAQ,cAAc,KAAK,SAAS,CAAC;AAAA,IAClH;AACA,WAAO,MAAM,GAAG,UAAU,EAAE;AAAA,EAC7B;AACD;;"}

package/dist/production/src/model/queries/authPolicy/AuthPoliciesQuery.js

@@ -0,0 +1,19 @@
+import { DatabaseQuery, SelectBuilder, Literal } from "@contember/database";
+class AuthPoliciesQuery extends DatabaseQuery {
+  constructor(filter) {
+    super();
+    this.filter = filter;
+  }
+  async fetch({ db }) {
+    let qb = SelectBuilder.create().from("auth_policy").select(new Literal("*"));
+    if (this.filter !== void 0) {
+      const projectId = this.filter.projectId;
+      qb = qb.where((expr) => projectId === null ? expr.isNull("project_id") : expr.compare("project_id", "=", projectId));
+    }
+    return await qb.getResult(db);
+  }
+}
+export {
+  AuthPoliciesQuery
+};
+//# sourceMappingURL=AuthPoliciesQuery.js.map

package/dist/production/src/model/queries/authPolicy/AuthPoliciesQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPoliciesQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authPolicy/AuthPoliciesQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { AuthPolicyRow } from '../../type/index.js'\n\n/**\n * Lists `auth_policy` rows. Optionally filters to a single project (or to the\n * global scope when `projectId` is explicitly `null`); with no filter, returns\n * every row. Intervals are returned as IPostgresInterval, like ConfigRow.\n */\nexport class AuthPoliciesQuery extends DatabaseQuery<AuthPolicyRow[]> {\n\tconstructor(private readonly filter?: { projectId: string | null }) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<AuthPolicyRow[]> {\n\t\tlet qb = SelectBuilder.create<AuthPolicyRow>()\n\t\t\t.from('auth_policy')\n\t\t\t.select(new Literal('*'))\n\t\tif (this.filter !== undefined) {\n\t\t\tconst projectId = this.filter.projectId\n\t\t\tqb = qb.where(expr => projectId === null ? expr.isNull('project_id') : expr.compare('project_id', '=', projectId))\n\t\t}\n\t\treturn await qb.getResult(db)\n\t}\n}\n"],"names":[],"mappings":";AAQO,MAAM,0BAA0B,cAA+B;AAAA,EACrE,YAA6B,QAAuC;AACnE,UAAA;AAD4B,SAAA,SAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAAmD;AAChE,QAAI,KAAK,cAAc,OAAA,EACrB,KAAK,aAAa,EAClB,OAAO,IAAI,QAAQ,GAAG,CAAC;AACzB,QAAI,KAAK,WAAW,QAAW;AAC9B,YAAM,YAAY,KAAK,OAAO;AAC9B,WAAK,GAAG,MAAM,CAAA,SAAQ,cAAc,OAAO,KAAK,OAAO,YAAY,IAAI,KAAK,QAAQ,cAAc,KAAK,SAAS,CAAC;AAAA,IAClH;AACA,WAAO,MAAM,GAAG,UAAU,EAAE;AAAA,EAC7B;AACD;"}

package/dist/production/src/model/queries/configuration/ConfigurationQuery.cjs

@@ -2,13 +2,24 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
 class ConfigurationQuery extends Database.DatabaseQuery {
+  constructor(providers) {
+    super();
+    this.providers = providers;
+  }
   async fetch({ db }) {
     const rows = await Database.SelectBuilder.create().from("config").select(new Database.Literal("*")).getResult(db);
     const result = this.fetchOneOrNull(rows);
     if (!result) {
       throw new Error("Configuration not found");
     }
+    const captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === "number" ? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString("utf8") : null;
     return {
+      signup: {
+        requireEmailVerification: result.signup_require_email_verification
+      },
+      emailChange: {
+        requireVerification: result.require_email_change_verification
+      },
       passwordless: {
         enabled: result.passwordless_enabled,
         url: result.passwordless_url,
@@ -21,15 +32,65 @@ class ConfigurationQuery extends Database.DatabaseQuery {
         requireDigit: result.password_require_digit,
         requireSpecial: result.password_require_special,
         pattern: result.password_pattern,
-        checkBlacklist: result.password_check_blacklist
+        checkBlacklist: result.password_check_blacklist,
+        checkHibp: result.password_check_hibp
       },
       login: {
         baseBackoff: result.login_base_backoff,
         maxBackoff: result.login_max_backoff,
         attemptWindow: result.login_attempt_window,
         revealUserExists: result.login_reveal_user_exits,
+        revealLoginMethod: result.login_reveal_login_method,
         defaultTokenExpiration: result.login_default_token_expiration,
-        maxTokenExpiration: result.login_max_token_expiration
+        maxTokenExpiration: result.login_max_token_expiration,
+        mfaGraceDuration: result.login_mfa_grace_duration,
+        anomalyDetection: {
+          enabled: result.login_anomaly_detection_enabled,
+          historySize: result.login_anomaly_history_size,
+          emailThreshold: result.login_anomaly_email_threshold,
+          stepUpThreshold: result.login_anomaly_step_up_threshold
+        }
+      },
+      captcha: {
+        provider: result.captcha_provider,
+        threshold: result.captcha_threshold,
+        protect: {
+          signUp: result.captcha_protect_sign_up,
+          passwordReset: result.captcha_protect_password_reset,
+          passwordlessInit: result.captcha_protect_passwordless_init,
+          emailVerification: result.captcha_protect_email_verification
+        }
+      },
+      captchaSecret,
+      rateLimits: {
+        signUpPerIp: {
+          limit: result.rate_limit_sign_up_per_ip_limit,
+          window: result.rate_limit_sign_up_per_ip_window
+        },
+        loginPerIp: {
+          limit: result.rate_limit_login_per_ip_limit,
+          window: result.rate_limit_login_per_ip_window
+        },
+        passwordResetPerIp: {
+          limit: result.rate_limit_password_reset_per_ip_limit,
+          window: result.rate_limit_password_reset_per_ip_window
+        },
+        passwordlessInitPerIp: {
+          limit: result.rate_limit_passwordless_init_per_ip_limit,
+          window: result.rate_limit_passwordless_init_per_ip_window
+        },
+        emailOtpPerPerson: {
+          limit: result.rate_limit_email_otp_per_person_limit,
+          window: result.rate_limit_email_otp_per_person_window
+        },
+        emailVerificationPerIp: {
+          limit: result.rate_limit_email_verification_per_ip_limit,
+          window: result.rate_limit_email_verification_per_ip_window
+        }
+      },
+      panel: {
+        globalRoles: result.panel_global_roles,
+        projectRoles: result.panel_project_roles
       }
     };
   }

package/dist/production/src/model/queries/configuration/ConfigurationQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\treturn {\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal"],"mappings":";;;AAGO,MAAM,2BAA2BA,SAAAA,cAAsB;AAAA,EAC7D,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAIC,SAAAA,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,WAAO;AAAA,MACN,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,MAAA;AAAA,MAExB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,MAAA;AAAA,IAC5B;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"ConfigurationQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config.js'\nimport { Providers } from '../../providers.js'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tconstructor(private readonly providers: Providers) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\tconst captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === 'number'\n\t\t\t? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString('utf8')\n\t\t\t: null\n\n\t\treturn {\n\t\t\tsignup: {\n\t\t\t\trequireEmailVerification: result.signup_require_email_verification,\n\t\t\t},\n\t\t\temailChange: {\n\t\t\t\trequireVerification: result.require_email_change_verification,\n\t\t\t},\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t\tcheckHibp: result.password_check_hibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\trevealLoginMethod: result.login_reveal_login_method,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t\tmfaGraceDuration: result.login_mfa_grace_duration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: result.login_anomaly_detection_enabled,\n\t\t\t\t\thistorySize: result.login_anomaly_history_size,\n\t\t\t\t\temailThreshold: result.login_anomaly_email_threshold,\n\t\t\t\t\tstepUpThreshold: result.login_anomaly_step_up_threshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: result.captcha_provider,\n\t\t\t\tthreshold: result.captcha_threshold,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: result.captcha_protect_sign_up,\n\t\t\t\t\tpasswordReset: result.captcha_protect_password_reset,\n\t\t\t\t\tpasswordlessInit: result.captcha_protect_passwordless_init,\n\t\t\t\t\temailVerification: result.captcha_protect_email_verification,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptchaSecret,\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_sign_up_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_sign_up_per_ip_window,\n\t\t\t\t},\n\t\t\t\tloginPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_login_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_login_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordResetPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_password_reset_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_password_reset_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordlessInitPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_passwordless_init_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_passwordless_init_per_ip_window,\n\t\t\t\t},\n\t\t\t\temailOtpPerPerson: {\n\t\t\t\t\tlimit: result.rate_limit_email_otp_per_person_limit,\n\t\t\t\t\twindow: result.rate_limit_email_otp_per_person_window,\n\t\t\t\t},\n\t\t\t\temailVerificationPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_email_verification_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_email_verification_per_ip_window,\n\t\t\t\t},\n\t\t\t},\n\t\t\tpanel: {\n\t\t\t\tglobalRoles: result.panel_global_roles,\n\t\t\t\tprojectRoles: result.panel_project_roles,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal"],"mappings":";;;AAIO,MAAM,2BAA2BA,SAAAA,cAAsB;AAAA,EAC7D,YAA6B,WAAsB;AAClD,UAAA;AAD4B,SAAA,YAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAIC,SAAAA,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,UAAM,gBAAgB,OAAO,kBAAkB,OAAO,OAAO,2BAA2B,YACpF,MAAM,KAAK,UAAU,QAAQ,OAAO,gBAAgB,OAAO,sBAAsB,GAAG,MAAM,SAAS,MAAM,IAC1G;AAEH,WAAO;AAAA,MACN,QAAQ;AAAA,QACP,0BAA0B,OAAO;AAAA,MAAA;AAAA,MAElC,aAAa;AAAA,QACZ,qBAAqB,OAAO;AAAA,MAAA;AAAA,MAE7B,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,QACvB,WAAW,OAAO;AAAA,MAAA;AAAA,MAEnB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,mBAAmB,OAAO;AAAA,QAC1B,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,QAC3B,kBAAkB,OAAO;AAAA,QACzB,kBAAkB;AAAA,UACjB,SAAS,OAAO;AAAA,UAChB,aAAa,OAAO;AAAA,UACpB,gBAAgB,OAAO;AAAA,UACvB,iBAAiB,OAAO;AAAA,QAAA;AAAA,MACzB;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,eAAe,OAAO;AAAA,UACtB,kBAAkB,OAAO;AAAA,UACzB,mBAAmB,OAAO;AAAA,QAAA;AAAA,MAC3B;AAAA,MAED;AAAA,MACA,YAAY;AAAA,QACX,aAAa;AAAA,UACZ,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,YAAY;AAAA,UACX,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,oBAAoB;AAAA,UACnB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,uBAAuB;AAAA,UACtB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,mBAAmB;AAAA,UAClB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,wBAAwB;AAAA,UACvB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,MAChB;AAAA,MAED,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,cAAc,OAAO;AAAA,MAAA;AAAA,IACtB;AAAA,EAEF;AACD;;"}

package/dist/production/src/model/queries/configuration/ConfigurationQuery.js

@@ -1,12 +1,23 @@
 import { DatabaseQuery, SelectBuilder, Literal } from "@contember/database";
 class ConfigurationQuery extends DatabaseQuery {
+  constructor(providers) {
+    super();
+    this.providers = providers;
+  }
   async fetch({ db }) {
     const rows = await SelectBuilder.create().from("config").select(new Literal("*")).getResult(db);
     const result = this.fetchOneOrNull(rows);
     if (!result) {
       throw new Error("Configuration not found");
     }
+    const captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === "number" ? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString("utf8") : null;
     return {
+      signup: {
+        requireEmailVerification: result.signup_require_email_verification
+      },
+      emailChange: {
+        requireVerification: result.require_email_change_verification
+      },
       passwordless: {
         enabled: result.passwordless_enabled,
         url: result.passwordless_url,
@@ -19,15 +30,65 @@ class ConfigurationQuery extends DatabaseQuery {
         requireDigit: result.password_require_digit,
         requireSpecial: result.password_require_special,
         pattern: result.password_pattern,
-        checkBlacklist: result.password_check_blacklist
+        checkBlacklist: result.password_check_blacklist,
+        checkHibp: result.password_check_hibp
       },
       login: {
         baseBackoff: result.login_base_backoff,
         maxBackoff: result.login_max_backoff,
         attemptWindow: result.login_attempt_window,
         revealUserExists: result.login_reveal_user_exits,
+        revealLoginMethod: result.login_reveal_login_method,
         defaultTokenExpiration: result.login_default_token_expiration,
-        maxTokenExpiration: result.login_max_token_expiration
+        maxTokenExpiration: result.login_max_token_expiration,
+        mfaGraceDuration: result.login_mfa_grace_duration,
+        anomalyDetection: {
+          enabled: result.login_anomaly_detection_enabled,
+          historySize: result.login_anomaly_history_size,
+          emailThreshold: result.login_anomaly_email_threshold,
+          stepUpThreshold: result.login_anomaly_step_up_threshold
+        }
+      },
+      captcha: {
+        provider: result.captcha_provider,
+        threshold: result.captcha_threshold,
+        protect: {
+          signUp: result.captcha_protect_sign_up,
+          passwordReset: result.captcha_protect_password_reset,
+          passwordlessInit: result.captcha_protect_passwordless_init,
+          emailVerification: result.captcha_protect_email_verification
+        }
+      },
+      captchaSecret,
+      rateLimits: {
+        signUpPerIp: {
+          limit: result.rate_limit_sign_up_per_ip_limit,
+          window: result.rate_limit_sign_up_per_ip_window
+        },
+        loginPerIp: {
+          limit: result.rate_limit_login_per_ip_limit,
+          window: result.rate_limit_login_per_ip_window
+        },
+        passwordResetPerIp: {
+          limit: result.rate_limit_password_reset_per_ip_limit,
+          window: result.rate_limit_password_reset_per_ip_window
+        },
+        passwordlessInitPerIp: {
+          limit: result.rate_limit_passwordless_init_per_ip_limit,
+          window: result.rate_limit_passwordless_init_per_ip_window
+        },
+        emailOtpPerPerson: {
+          limit: result.rate_limit_email_otp_per_person_limit,
+          window: result.rate_limit_email_otp_per_person_window
+        },
+        emailVerificationPerIp: {
+          limit: result.rate_limit_email_verification_per_ip_limit,
+          window: result.rate_limit_email_verification_per_ip_window
+        }
+      },
+      panel: {
+        globalRoles: result.panel_global_roles,
+        projectRoles: result.panel_project_roles
       }
     };
   }

package/dist/production/src/model/queries/configuration/ConfigurationQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\treturn {\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,2BAA2B,cAAsB;AAAA,EAC7D,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAI,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,WAAO;AAAA,MACN,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,MAAA;AAAA,MAExB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,MAAA;AAAA,IAC5B;AAAA,EAEF;AACD;"}
+{"version":3,"file":"ConfigurationQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config.js'\nimport { Providers } from '../../providers.js'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tconstructor(private readonly providers: Providers) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\tconst captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === 'number'\n\t\t\t? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString('utf8')\n\t\t\t: null\n\n\t\treturn {\n\t\t\tsignup: {\n\t\t\t\trequireEmailVerification: result.signup_require_email_verification,\n\t\t\t},\n\t\t\temailChange: {\n\t\t\t\trequireVerification: result.require_email_change_verification,\n\t\t\t},\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t\tcheckHibp: result.password_check_hibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\trevealLoginMethod: result.login_reveal_login_method,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t\tmfaGraceDuration: result.login_mfa_grace_duration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: result.login_anomaly_detection_enabled,\n\t\t\t\t\thistorySize: result.login_anomaly_history_size,\n\t\t\t\t\temailThreshold: result.login_anomaly_email_threshold,\n\t\t\t\t\tstepUpThreshold: result.login_anomaly_step_up_threshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: result.captcha_provider,\n\t\t\t\tthreshold: result.captcha_threshold,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: result.captcha_protect_sign_up,\n\t\t\t\t\tpasswordReset: result.captcha_protect_password_reset,\n\t\t\t\t\tpasswordlessInit: result.captcha_protect_passwordless_init,\n\t\t\t\t\temailVerification: result.captcha_protect_email_verification,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptchaSecret,\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_sign_up_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_sign_up_per_ip_window,\n\t\t\t\t},\n\t\t\t\tloginPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_login_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_login_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordResetPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_password_reset_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_password_reset_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordlessInitPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_passwordless_init_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_passwordless_init_per_ip_window,\n\t\t\t\t},\n\t\t\t\temailOtpPerPerson: {\n\t\t\t\t\tlimit: result.rate_limit_email_otp_per_person_limit,\n\t\t\t\t\twindow: result.rate_limit_email_otp_per_person_window,\n\t\t\t\t},\n\t\t\t\temailVerificationPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_email_verification_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_email_verification_per_ip_window,\n\t\t\t\t},\n\t\t\t},\n\t\t\tpanel: {\n\t\t\t\tglobalRoles: result.panel_global_roles,\n\t\t\t\tprojectRoles: result.panel_project_roles,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,2BAA2B,cAAsB;AAAA,EAC7D,YAA6B,WAAsB;AAClD,UAAA;AAD4B,SAAA,YAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAI,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,UAAM,gBAAgB,OAAO,kBAAkB,OAAO,OAAO,2BAA2B,YACpF,MAAM,KAAK,UAAU,QAAQ,OAAO,gBAAgB,OAAO,sBAAsB,GAAG,MAAM,SAAS,MAAM,IAC1G;AAEH,WAAO;AAAA,MACN,QAAQ;AAAA,QACP,0BAA0B,OAAO;AAAA,MAAA;AAAA,MAElC,aAAa;AAAA,QACZ,qBAAqB,OAAO;AAAA,MAAA;AAAA,MAE7B,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,QACvB,WAAW,OAAO;AAAA,MAAA;AAAA,MAEnB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,mBAAmB,OAAO;AAAA,QAC1B,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,QAC3B,kBAAkB,OAAO;AAAA,QACzB,kBAAkB;AAAA,UACjB,SAAS,OAAO;AAAA,UAChB,aAAa,OAAO;AAAA,UACpB,gBAAgB,OAAO;AAAA,UACvB,iBAAiB,OAAO;AAAA,QAAA;AAAA,MACzB;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,eAAe,OAAO;AAAA,UACtB,kBAAkB,OAAO;AAAA,UACzB,mBAAmB,OAAO;AAAA,QAAA;AAAA,MAC3B;AAAA,MAED;AAAA,MACA,YAAY;AAAA,QACX,aAAa;AAAA,UACZ,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,YAAY;AAAA,UACX,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,oBAAoB;AAAA,UACnB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,uBAAuB;AAAA,UACtB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,mBAAmB;AAAA,UAClB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,wBAAwB;AAAA,UACvB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,MAChB;AAAA,MAED,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,cAAc,OAAO;AAAA,MAAA;AAAA,IACtB;AAAA,EAEF;AACD;"}

package/dist/production/src/model/queries/customRole/CustomRolesQuery.cjs

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class CustomRolesQuery extends Database.DatabaseQuery {
+  constructor(filter) {
+    super();
+    this.filter = filter;
+  }
+  async fetch({ db }) {
+    const filter = this.filter;
+    let qb = Database.SelectBuilder.create().from("custom_role").select(new Database.Literal("*")).orderBy("slug");
+    if (filter?.slugs !== void 0) {
+      const slugs = filter.slugs;
+      qb = qb.where((expr) => expr.in("slug", slugs));
+    }
+    if (filter?.lock !== void 0) {
+      qb = qb.lock(filter.lock);
+    }
+    return await qb.getResult(db);
+  }
+}
+exports.CustomRolesQuery = CustomRolesQuery;
+//# sourceMappingURL=CustomRolesQuery.cjs.map

package/dist/production/src/model/queries/customRole/CustomRolesQuery.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRolesQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/customRole/CustomRolesQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, LockType, SelectBuilder } from '@contember/database'\nimport { CustomRoleRow } from '../../type/index.js'\n\n/** Lists `custom_role` rows, optionally restricted to the given slugs. */\nexport class CustomRolesQuery extends DatabaseQuery<CustomRoleRow[]> {\n\tconstructor(\n\t\tprivate readonly filter?: {\n\t\t\treadonly slugs?: readonly string[]\n\t\t\treadonly lock?: LockType\n\t\t},\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<CustomRoleRow[]> {\n\t\tconst filter = this.filter\n\t\tlet qb = SelectBuilder.create<CustomRoleRow>()\n\t\t\t.from('custom_role')\n\t\t\t.select(new Literal('*'))\n\t\t\t.orderBy('slug')\n\t\tif (filter?.slugs !== undefined) {\n\t\t\tconst slugs = filter.slugs\n\t\t\tqb = qb.where(expr => expr.in('slug', slugs))\n\t\t}\n\t\tif (filter?.lock !== undefined) {\n\t\t\tqb = qb.lock(filter.lock)\n\t\t}\n\t\treturn await qb.getResult(db)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal"],"mappings":";;;AAIO,MAAM,yBAAyBA,SAAAA,cAA+B;AAAA,EACpE,YACkB,QAIhB;AACD,UAAA;AALiB,SAAA,SAAA;AAAA,EAMlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAAmD;AAChE,UAAM,SAAS,KAAK;AACpB,QAAI,KAAKC,SAAAA,cAAc,OAAA,EACrB,KAAK,aAAa,EAClB,OAAO,IAAIC,SAAAA,QAAQ,GAAG,CAAC,EACvB,QAAQ,MAAM;AAChB,QAAI,QAAQ,UAAU,QAAW;AAChC,YAAM,QAAQ,OAAO;AACrB,WAAK,GAAG,MAAM,CAAA,SAAQ,KAAK,GAAG,QAAQ,KAAK,CAAC;AAAA,IAC7C;AACA,QAAI,QAAQ,SAAS,QAAW;AAC/B,WAAK,GAAG,KAAK,OAAO,IAAI;AAAA,IACzB;AACA,WAAO,MAAM,GAAG,UAAU,EAAE;AAAA,EAC7B;AACD;;"}

package/dist/production/src/model/queries/customRole/CustomRolesQuery.js

@@ -0,0 +1,23 @@
+import { DatabaseQuery, SelectBuilder, Literal } from "@contember/database";
+class CustomRolesQuery extends DatabaseQuery {
+  constructor(filter) {
+    super();
+    this.filter = filter;
+  }
+  async fetch({ db }) {
+    const filter = this.filter;
+    let qb = SelectBuilder.create().from("custom_role").select(new Literal("*")).orderBy("slug");
+    if (filter?.slugs !== void 0) {
+      const slugs = filter.slugs;
+      qb = qb.where((expr) => expr.in("slug", slugs));
+    }
+    if (filter?.lock !== void 0) {
+      qb = qb.lock(filter.lock);
+    }
+    return await qb.getResult(db);
+  }
+}
+export {
+  CustomRolesQuery
+};
+//# sourceMappingURL=CustomRolesQuery.js.map

package/dist/production/src/model/queries/customRole/CustomRolesQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRolesQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/customRole/CustomRolesQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, LockType, SelectBuilder } from '@contember/database'\nimport { CustomRoleRow } from '../../type/index.js'\n\n/** Lists `custom_role` rows, optionally restricted to the given slugs. */\nexport class CustomRolesQuery extends DatabaseQuery<CustomRoleRow[]> {\n\tconstructor(\n\t\tprivate readonly filter?: {\n\t\t\treadonly slugs?: readonly string[]\n\t\t\treadonly lock?: LockType\n\t\t},\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<CustomRoleRow[]> {\n\t\tconst filter = this.filter\n\t\tlet qb = SelectBuilder.create<CustomRoleRow>()\n\t\t\t.from('custom_role')\n\t\t\t.select(new Literal('*'))\n\t\t\t.orderBy('slug')\n\t\tif (filter?.slugs !== undefined) {\n\t\t\tconst slugs = filter.slugs\n\t\t\tqb = qb.where(expr => expr.in('slug', slugs))\n\t\t}\n\t\tif (filter?.lock !== undefined) {\n\t\t\tqb = qb.lock(filter.lock)\n\t\t}\n\t\treturn await qb.getResult(db)\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,yBAAyB,cAA+B;AAAA,EACpE,YACkB,QAIhB;AACD,UAAA;AALiB,SAAA,SAAA;AAAA,EAMlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAAmD;AAChE,UAAM,SAAS,KAAK;AACpB,QAAI,KAAK,cAAc,OAAA,EACrB,KAAK,aAAa,EAClB,OAAO,IAAI,QAAQ,GAAG,CAAC,EACvB,QAAQ,MAAM;AAChB,QAAI,QAAQ,UAAU,QAAW;AAChC,YAAM,QAAQ,OAAO;AACrB,WAAK,GAAG,MAAM,CAAA,SAAQ,KAAK,GAAG,QAAQ,KAAK,CAAC;AAAA,IAC7C;AACA,QAAI,QAAQ,SAAS,QAAW;AAC/B,WAAK,GAAG,KAAK,OAAO,IAAI;AAAA,IACzB;AACA,WAAO,MAAM,GAAG,UAAU,EAAE;AAAA,EAC7B;AACD;"}

package/dist/production/src/model/queries/identity/IdentitiesHoldingRoleCountQuery.cjs

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class IdentitiesHoldingRoleCountQuery extends Database.DatabaseQuery {
+  constructor(role) {
+    super();
+    this.role = role;
+  }
+  async fetch({ db }) {
+    const rows = await Database.SelectBuilder.create().select((expr) => expr.raw("count(*)::int"), "count").from("identity").where((expr) => expr.raw("roles \\? ?", this.role)).getResult(db);
+    return rows[0]?.count ?? 0;
+  }
+}
+exports.IdentitiesHoldingRoleCountQuery = IdentitiesHoldingRoleCountQuery;
+//# sourceMappingURL=IdentitiesHoldingRoleCountQuery.cjs.map

package/dist/production/src/model/queries/identity/IdentitiesHoldingRoleCountQuery.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentitiesHoldingRoleCountQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/identity/IdentitiesHoldingRoleCountQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\n/** Counts identities whose global `roles` contain the given role string. */\nexport class IdentitiesHoldingRoleCountQuery extends DatabaseQuery<number> {\n\tconstructor(private readonly role: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\tconst rows = await SelectBuilder.create<{ count: number }>()\n\t\t\t.select(expr => expr.raw('count(*)::int'), 'count')\n\t\t\t.from('identity')\n\t\t\t.where(expr => expr.raw('roles \\\\? ?', this.role))\n\t\t\t.getResult(db)\n\t\treturn rows[0]?.count ?? 0\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder"],"mappings":";;;AAGO,MAAM,wCAAwCA,SAAAA,cAAsB;AAAA,EAC1E,YAA6B,MAAc;AAC1C,UAAA;AAD4B,SAAA,OAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAMC,uBAAc,OAAA,EAC/B,OAAO,CAAA,SAAQ,KAAK,IAAI,eAAe,GAAG,OAAO,EACjD,KAAK,UAAU,EACf,MAAM,CAAA,SAAQ,KAAK,IAAI,eAAe,KAAK,IAAI,CAAC,EAChD,UAAU,EAAE;AACd,WAAO,KAAK,CAAC,GAAG,SAAS;AAAA,EAC1B;AACD;;"}

package/dist/production/src/model/queries/identity/IdentitiesHoldingRoleCountQuery.js

@@ -0,0 +1,15 @@
+import { DatabaseQuery, SelectBuilder } from "@contember/database";
+class IdentitiesHoldingRoleCountQuery extends DatabaseQuery {
+  constructor(role) {
+    super();
+    this.role = role;
+  }
+  async fetch({ db }) {
+    const rows = await SelectBuilder.create().select((expr) => expr.raw("count(*)::int"), "count").from("identity").where((expr) => expr.raw("roles \\? ?", this.role)).getResult(db);
+    return rows[0]?.count ?? 0;
+  }
+}
+export {
+  IdentitiesHoldingRoleCountQuery
+};
+//# sourceMappingURL=IdentitiesHoldingRoleCountQuery.js.map

package/dist/production/src/model/queries/identity/IdentitiesHoldingRoleCountQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentitiesHoldingRoleCountQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/identity/IdentitiesHoldingRoleCountQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\n/** Counts identities whose global `roles` contain the given role string. */\nexport class IdentitiesHoldingRoleCountQuery extends DatabaseQuery<number> {\n\tconstructor(private readonly role: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\tconst rows = await SelectBuilder.create<{ count: number }>()\n\t\t\t.select(expr => expr.raw('count(*)::int'), 'count')\n\t\t\t.from('identity')\n\t\t\t.where(expr => expr.raw('roles \\\\? ?', this.role))\n\t\t\t.getResult(db)\n\t\treturn rows[0]?.count ?? 0\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,wCAAwC,cAAsB;AAAA,EAC1E,YAA6B,MAAc;AAC1C,UAAA;AAD4B,SAAA,OAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,OAAO,CAAA,SAAQ,KAAK,IAAI,eAAe,GAAG,OAAO,EACjD,KAAK,UAAU,EACf,MAAM,CAAA,SAAQ,KAAK,IAAI,eAAe,KAAK,IAAI,CAAC,EAChD,UAAU,EAAE;AACd,WAAO,KAAK,CAAC,GAAG,SAAS;AAAA,EAC1B;AACD;"}

package/dist/production/src/model/queries/identity/IdentityQuery.cjs

@@ -2,12 +2,17 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
 class IdentityQuery extends Database.DatabaseQuery {
-  constructor(ids) {
+  constructor(ids, lock) {
     super();
     this.ids = ids;
+    this.lock = lock;
   }
   async fetch(queryable) {
-    const qb = await Database.SelectBuilder.create().select("id").select("description").select("roles").from("identity").where((expr) => expr.in("id", this.ids)).getResult(queryable.db);
+    let query = Database.SelectBuilder.create().select("id").select("description").select("roles").from("identity").where((expr) => expr.in("id", this.ids));
+    if (this.lock !== void 0) {
+      query = query.lock(this.lock);
+    }
+    const qb = await query.getResult(queryable.db);
     return qb.map((it) => ({ ...it, description: it.description || "" }));
   }
 }

package/dist/production/src/model/queries/identity/IdentityQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/identity/IdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\nexport class IdentityQuery extends DatabaseQuery<IdentityQueryResult[]> {\n\tconstructor(private readonly ids: string[]) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<IdentityQueryResult[]> {\n\t\tconst qb = await SelectBuilder.create<{ id: string; description: string | null; roles: string[] }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.select('roles')\n\t\t\t.from('identity')\n\t\t\t.where(expr => expr.in('id', this.ids))\n\t\t\t.getResult(queryable.db)\n\n\t\treturn qb.map(it => ({ ...it, description: it.description || '' }))\n\t}\n}\n\nexport interface IdentityQueryResult {\n\tid: string\n\tdescription: string\n\troles: string[]\n}\n"],"names":["DatabaseQuery","SelectBuilder"],"mappings":";;;AAEO,MAAM,sBAAsBA,SAAAA,cAAqC;AAAA,EACvE,YAA6B,KAAe;AAC3C,UAAA;AAD4B,SAAA,MAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,WAA8D;AACzE,UAAM,KAAK,MAAMC,uBAAc,OAAA,EAC7B,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,OAAO,OAAO,EACd,KAAK,UAAU,EACf,MAAM,CAAA,SAAQ,KAAK,GAAG,MAAM,KAAK,GAAG,CAAC,EACrC,UAAU,UAAU,EAAE;AAExB,WAAO,GAAG,IAAI,CAAA,QAAO,EAAE,GAAG,IAAI,aAAa,GAAG,eAAe,GAAA,EAAK;AAAA,EACnE;AACD;;"}
+{"version":3,"file":"IdentityQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/identity/IdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, LockType, SelectBuilder } from '@contember/database'\n\nexport class IdentityQuery extends DatabaseQuery<IdentityQueryResult[]> {\n\tconstructor(\n\t\tprivate readonly ids: string[],\n\t\tprivate readonly lock?: LockType,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<IdentityQueryResult[]> {\n\t\tlet query = SelectBuilder.create<{ id: string; description: string | null; roles: string[] }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.select('roles')\n\t\t\t.from('identity')\n\t\t\t.where(expr => expr.in('id', this.ids))\n\t\tif (this.lock !== undefined) {\n\t\t\tquery = query.lock(this.lock)\n\t\t}\n\t\tconst qb = await query.getResult(queryable.db)\n\n\t\treturn qb.map(it => ({ ...it, description: it.description || '' }))\n\t}\n}\n\nexport interface IdentityQueryResult {\n\tid: string\n\tdescription: string\n\troles: string[]\n}\n"],"names":["DatabaseQuery","SelectBuilder"],"mappings":";;;AAEO,MAAM,sBAAsBA,SAAAA,cAAqC;AAAA,EACvE,YACkB,KACA,MAChB;AACD,UAAA;AAHiB,SAAA,MAAA;AACA,SAAA,OAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,WAA8D;AACzE,QAAI,QAAQC,uBAAc,SACxB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,OAAO,OAAO,EACd,KAAK,UAAU,EACf,MAAM,CAAA,SAAQ,KAAK,GAAG,MAAM,KAAK,GAAG,CAAC;AACvC,QAAI,KAAK,SAAS,QAAW;AAC5B,cAAQ,MAAM,KAAK,KAAK,IAAI;AAAA,IAC7B;AACA,UAAM,KAAK,MAAM,MAAM,UAAU,UAAU,EAAE;AAE7C,WAAO,GAAG,IAAI,CAAA,QAAO,EAAE,GAAG,IAAI,aAAa,GAAG,eAAe,GAAA,EAAK;AAAA,EACnE;AACD;;"}

package/dist/production/src/model/queries/identity/IdentityQuery.js

@@ -1,11 +1,16 @@
 import { DatabaseQuery, SelectBuilder } from "@contember/database";
 class IdentityQuery extends DatabaseQuery {
-  constructor(ids) {
+  constructor(ids, lock) {
     super();
     this.ids = ids;
+    this.lock = lock;
   }
   async fetch(queryable) {
-    const qb = await SelectBuilder.create().select("id").select("description").select("roles").from("identity").where((expr) => expr.in("id", this.ids)).getResult(queryable.db);
+    let query = SelectBuilder.create().select("id").select("description").select("roles").from("identity").where((expr) => expr.in("id", this.ids));
+    if (this.lock !== void 0) {
+      query = query.lock(this.lock);
+    }
+    const qb = await query.getResult(queryable.db);
     return qb.map((it) => ({ ...it, description: it.description || "" }));
   }
 }

package/dist/production/src/model/queries/identity/IdentityQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/identity/IdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\nexport class IdentityQuery extends DatabaseQuery<IdentityQueryResult[]> {\n\tconstructor(private readonly ids: string[]) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<IdentityQueryResult[]> {\n\t\tconst qb = await SelectBuilder.create<{ id: string; description: string | null; roles: string[] }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.select('roles')\n\t\t\t.from('identity')\n\t\t\t.where(expr => expr.in('id', this.ids))\n\t\t\t.getResult(queryable.db)\n\n\t\treturn qb.map(it => ({ ...it, description: it.description || '' }))\n\t}\n}\n\nexport interface IdentityQueryResult {\n\tid: string\n\tdescription: string\n\troles: string[]\n}\n"],"names":[],"mappings":";AAEO,MAAM,sBAAsB,cAAqC;AAAA,EACvE,YAA6B,KAAe;AAC3C,UAAA;AAD4B,SAAA,MAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,WAA8D;AACzE,UAAM,KAAK,MAAM,cAAc,OAAA,EAC7B,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,OAAO,OAAO,EACd,KAAK,UAAU,EACf,MAAM,CAAA,SAAQ,KAAK,GAAG,MAAM,KAAK,GAAG,CAAC,EACrC,UAAU,UAAU,EAAE;AAExB,WAAO,GAAG,IAAI,CAAA,QAAO,EAAE,GAAG,IAAI,aAAa,GAAG,eAAe,GAAA,EAAK;AAAA,EACnE;AACD;"}
+{"version":3,"file":"IdentityQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/identity/IdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, LockType, SelectBuilder } from '@contember/database'\n\nexport class IdentityQuery extends DatabaseQuery<IdentityQueryResult[]> {\n\tconstructor(\n\t\tprivate readonly ids: string[],\n\t\tprivate readonly lock?: LockType,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<IdentityQueryResult[]> {\n\t\tlet query = SelectBuilder.create<{ id: string; description: string | null; roles: string[] }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.select('roles')\n\t\t\t.from('identity')\n\t\t\t.where(expr => expr.in('id', this.ids))\n\t\tif (this.lock !== undefined) {\n\t\t\tquery = query.lock(this.lock)\n\t\t}\n\t\tconst qb = await query.getResult(queryable.db)\n\n\t\treturn qb.map(it => ({ ...it, description: it.description || '' }))\n\t}\n}\n\nexport interface IdentityQueryResult {\n\tid: string\n\tdescription: string\n\troles: string[]\n}\n"],"names":[],"mappings":";AAEO,MAAM,sBAAsB,cAAqC;AAAA,EACvE,YACkB,KACA,MAChB;AACD,UAAA;AAHiB,SAAA,MAAA;AACA,SAAA,OAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,WAA8D;AACzE,QAAI,QAAQ,cAAc,SACxB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,OAAO,OAAO,EACd,KAAK,UAAU,EACf,MAAM,CAAA,SAAQ,KAAK,GAAG,MAAM,KAAK,GAAG,CAAC;AACvC,QAAI,KAAK,SAAS,QAAW;AAC5B,cAAQ,MAAM,KAAK,KAAK,IAAI;AAAA,IAC7B;AACA,UAAM,KAAK,MAAM,MAAM,UAAU,UAAU,EAAE;AAE7C,WAAO,GAAG,IAAI,CAAA,QAAO,EAAE,GAAG,IAAI,aAAa,GAAG,eAAe,GAAA,EAAK;AAAA,EACnE;AACD;"}

package/dist/production/src/model/queries/idp/IdentityProviderBySlugQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProviderBySlugQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/IdentityProviderBySlugQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable } from '@contember/database'\nimport { createBaseIdpQuery } from './helpers'\nimport { IdentityProviderRow } from './types'\n\nexport class IdentityProviderBySlugQuery extends DatabaseQuery<IdentityProviderRow | null> {\n\tconstructor(private readonly slug: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<IdentityProviderRow | null> {\n\t\tconst rows = await createBaseIdpQuery()\n\t\t\t.where({\n\t\t\t\tslug: this.slug,\n\t\t\t})\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n"],"names":["DatabaseQuery","createBaseIdpQuery"],"mappings":";;;;AAIO,MAAM,oCAAoCA,SAAAA,cAA0C;AAAA,EAC1F,YAA6B,MAAc;AAC1C,UAAA;AAD4B,SAAA,OAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA8D;AAC3E,UAAM,OAAO,MAAMC,2BAAA,EACjB,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,IAAA,CACX,EACA,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;;"}
+{"version":3,"file":"IdentityProviderBySlugQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/IdentityProviderBySlugQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable } from '@contember/database'\nimport { createBaseIdpQuery } from './helpers.js'\nimport { IdentityProviderRow } from './types.js'\n\nexport class IdentityProviderBySlugQuery extends DatabaseQuery<IdentityProviderRow | null> {\n\tconstructor(private readonly slug: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<IdentityProviderRow | null> {\n\t\tconst rows = await createBaseIdpQuery()\n\t\t\t.where({\n\t\t\t\tslug: this.slug,\n\t\t\t})\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n"],"names":["DatabaseQuery","createBaseIdpQuery"],"mappings":";;;;AAIO,MAAM,oCAAoCA,SAAAA,cAA0C;AAAA,EAC1F,YAA6B,MAAc;AAC1C,UAAA;AAD4B,SAAA,OAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA8D;AAC3E,UAAM,OAAO,MAAMC,2BAAA,EACjB,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,IAAA,CACX,EACA,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;;"}

package/dist/production/src/model/queries/idp/IdentityProviderBySlugQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProviderBySlugQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/IdentityProviderBySlugQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable } from '@contember/database'\nimport { createBaseIdpQuery } from './helpers'\nimport { IdentityProviderRow } from './types'\n\nexport class IdentityProviderBySlugQuery extends DatabaseQuery<IdentityProviderRow | null> {\n\tconstructor(private readonly slug: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<IdentityProviderRow | null> {\n\t\tconst rows = await createBaseIdpQuery()\n\t\t\t.where({\n\t\t\t\tslug: this.slug,\n\t\t\t})\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n"],"names":[],"mappings":";;AAIO,MAAM,oCAAoC,cAA0C;AAAA,EAC1F,YAA6B,MAAc;AAC1C,UAAA;AAD4B,SAAA,OAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA8D;AAC3E,UAAM,OAAO,MAAM,mBAAA,EACjB,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,IAAA,CACX,EACA,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;"}
+{"version":3,"file":"IdentityProviderBySlugQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/IdentityProviderBySlugQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable } from '@contember/database'\nimport { createBaseIdpQuery } from './helpers.js'\nimport { IdentityProviderRow } from './types.js'\n\nexport class IdentityProviderBySlugQuery extends DatabaseQuery<IdentityProviderRow | null> {\n\tconstructor(private readonly slug: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<IdentityProviderRow | null> {\n\t\tconst rows = await createBaseIdpQuery()\n\t\t\t.where({\n\t\t\t\tslug: this.slug,\n\t\t\t})\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n"],"names":[],"mappings":";;AAIO,MAAM,oCAAoC,cAA0C;AAAA,EAC1F,YAA6B,MAAc;AAC1C,UAAA;AAD4B,SAAA,OAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA8D;AAC3E,UAAM,OAAO,MAAM,mBAAA,EACjB,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,IAAA,CACX,EACA,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;"}