@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/model/queries/project/ProjectsByIdentityQuery.cjs

@@ -4,8 +4,11 @@ const Database = require("@contember/database");
 const ProjectsQuery = require("./ProjectsQuery.cjs");
 const PermissionActions = require("../../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../apiKey/ApiKeyQuery.cjs");
+require("../../type/ApiKey.cjs");
+require("../../authorization/CustomRolePermissions.cjs");
 require("../../authorization/PermissionContext.cjs");
-require("../../authorization/PermissionsFactory.cjs");
+require("../../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 class ProjectsByIdentityQuery extends Database.DatabaseQuery {
   constructor(identityId, permissionContext) {

package/dist/production/src/model/queries/project/ProjectsByIdentityQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectsByIdentityQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsByIdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { ProjectsQuery } from './ProjectsQuery'\nimport { PermissionActions, PermissionContext } from '../../authorization'\nimport { Project } from '../../type'\n\nexport class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {\n\tconstructor(private readonly identityId: string, private readonly permissionContext: PermissionContext) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<Project[]> {\n\t\tconst canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({\n\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t})\n\n\t\tif (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {\n\t\t\treturn await new ProjectsQuery().fetch(queryable)\n\t\t}\n\n\t\tconst qb = SelectBuilder.create<Project>()\n\t\t\t.select(['project', 'id'])\n\t\t\t.select(['project', 'name'])\n\t\t\t.select(['project', 'slug'])\n\t\t\t.select(['project', 'config'])\n\t\t\t.from('project')\n\t\t\t.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create() //\n\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t.select('project_id')\n\t\t\t\t\t\t.where({\n\t\t\t\t\t\t\tidentity_id: this.identityId,\n\t\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\tconst qbWithIdentityPermissions = canAuthorizedEntityViewAll\n\t\t\t? qb\n\t\t\t: qb.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create().from('project_membership').select('project_id').where({\n\t\t\t\t\t\tidentity_id: this.permissionContext.identity.id,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\treturn await qbWithIdentityPermissions.getResult(queryable.db)\n\t}\n}\n"],"names":["DatabaseQuery","PermissionActions","ProjectsQuery","SelectBuilder"],"mappings":";;;;;;;;;AAKO,MAAM,gCAAgCA,SAAAA,cAAyB;AAAA,EACrE,YAA6B,YAAqC,mBAAsC;AACvG,UAAA;AAD4B,SAAA,aAAA;AAAqC,SAAA,oBAAA;AAAA,EAElE;AAAA,EAEA,MAAM,MAAM,WAAkD;AAC7D,UAAM,6BAA6B,MAAM,KAAK,kBAAkB,UAAU;AAAA,MACzE,QAAQC,kBAAAA,kBAAkB;AAAA,IAAA,CAC1B;AAED,QAAI,KAAK,eAAe,KAAK,kBAAkB,SAAS,MAAM,4BAA4B;AACzF,aAAO,MAAM,IAAIC,cAAAA,gBAAgB,MAAM,SAAS;AAAA,IACjD;AAEA,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,QAAQ,CAAC,EAC5B,KAAK,SAAS,EACd;AAAA,MAAM,WACN,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChBA,uBAAc,SACZ,KAAK,oBAAoB,EACzB,OAAO,YAAY,EACnB,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MAAA;AAAA,IACH;AAGF,UAAM,4BAA4B,6BAC/B,KACA,GAAG;AAAA,MAAM,WACV,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChBA,uBAAc,SAAS,KAAK,oBAAoB,EAAE,OAAO,YAAY,EAAE,MAAM;AAAA,UAC5E,aAAa,KAAK,kBAAkB,SAAS;AAAA,QAAA,CAC7C;AAAA,MAAA;AAAA,IACF;AAGF,WAAO,MAAM,0BAA0B,UAAU,UAAU,EAAE;AAAA,EAC9D;AACD;;"}
+{"version":3,"file":"ProjectsByIdentityQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsByIdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { ProjectsQuery } from './ProjectsQuery.js'\nimport { PermissionActions, PermissionContext } from '../../authorization/index.js'\nimport { Project } from '../../type/index.js'\n\nexport class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {\n\tconstructor(private readonly identityId: string, private readonly permissionContext: PermissionContext) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<Project[]> {\n\t\tconst canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({\n\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t})\n\n\t\tif (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {\n\t\t\treturn await new ProjectsQuery().fetch(queryable)\n\t\t}\n\n\t\tconst qb = SelectBuilder.create<Project>()\n\t\t\t.select(['project', 'id'])\n\t\t\t.select(['project', 'name'])\n\t\t\t.select(['project', 'slug'])\n\t\t\t.select(['project', 'config'])\n\t\t\t.from('project')\n\t\t\t.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create() //\n\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t.select('project_id')\n\t\t\t\t\t\t.where({\n\t\t\t\t\t\t\tidentity_id: this.identityId,\n\t\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\tconst qbWithIdentityPermissions = canAuthorizedEntityViewAll\n\t\t\t? qb\n\t\t\t: qb.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create().from('project_membership').select('project_id').where({\n\t\t\t\t\t\tidentity_id: this.permissionContext.identity.id,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\treturn await qbWithIdentityPermissions.getResult(queryable.db)\n\t}\n}\n"],"names":["DatabaseQuery","PermissionActions","ProjectsQuery","SelectBuilder"],"mappings":";;;;;;;;;;;;AAKO,MAAM,gCAAgCA,SAAAA,cAAyB;AAAA,EACrE,YAA6B,YAAqC,mBAAsC;AACvG,UAAA;AAD4B,SAAA,aAAA;AAAqC,SAAA,oBAAA;AAAA,EAElE;AAAA,EAEA,MAAM,MAAM,WAAkD;AAC7D,UAAM,6BAA6B,MAAM,KAAK,kBAAkB,UAAU;AAAA,MACzE,QAAQC,kBAAAA,kBAAkB;AAAA,IAAA,CAC1B;AAED,QAAI,KAAK,eAAe,KAAK,kBAAkB,SAAS,MAAM,4BAA4B;AACzF,aAAO,MAAM,IAAIC,cAAAA,gBAAgB,MAAM,SAAS;AAAA,IACjD;AAEA,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,QAAQ,CAAC,EAC5B,KAAK,SAAS,EACd;AAAA,MAAM,WACN,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChBA,uBAAc,SACZ,KAAK,oBAAoB,EACzB,OAAO,YAAY,EACnB,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MAAA;AAAA,IACH;AAGF,UAAM,4BAA4B,6BAC/B,KACA,GAAG;AAAA,MAAM,WACV,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChBA,uBAAc,SAAS,KAAK,oBAAoB,EAAE,OAAO,YAAY,EAAE,MAAM;AAAA,UAC5E,aAAa,KAAK,kBAAkB,SAAS;AAAA,QAAA,CAC7C;AAAA,MAAA;AAAA,IACF;AAGF,WAAO,MAAM,0BAA0B,UAAU,UAAU,EAAE;AAAA,EAC9D;AACD;;"}

package/dist/production/src/model/queries/project/ProjectsByIdentityQuery.js

@@ -2,8 +2,11 @@ import { DatabaseQuery, SelectBuilder } from "@contember/database";
 import { ProjectsQuery } from "./ProjectsQuery.js";
 import { PermissionActions } from "../../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../apiKey/ApiKeyQuery.js";
+import "../../type/ApiKey.js";
+import "../../authorization/CustomRolePermissions.js";
 import "../../authorization/PermissionContext.js";
-import "../../authorization/PermissionsFactory.js";
+import "../../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 class ProjectsByIdentityQuery extends DatabaseQuery {
   constructor(identityId, permissionContext) {

package/dist/production/src/model/queries/project/ProjectsByIdentityQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectsByIdentityQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsByIdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { ProjectsQuery } from './ProjectsQuery'\nimport { PermissionActions, PermissionContext } from '../../authorization'\nimport { Project } from '../../type'\n\nexport class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {\n\tconstructor(private readonly identityId: string, private readonly permissionContext: PermissionContext) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<Project[]> {\n\t\tconst canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({\n\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t})\n\n\t\tif (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {\n\t\t\treturn await new ProjectsQuery().fetch(queryable)\n\t\t}\n\n\t\tconst qb = SelectBuilder.create<Project>()\n\t\t\t.select(['project', 'id'])\n\t\t\t.select(['project', 'name'])\n\t\t\t.select(['project', 'slug'])\n\t\t\t.select(['project', 'config'])\n\t\t\t.from('project')\n\t\t\t.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create() //\n\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t.select('project_id')\n\t\t\t\t\t\t.where({\n\t\t\t\t\t\t\tidentity_id: this.identityId,\n\t\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\tconst qbWithIdentityPermissions = canAuthorizedEntityViewAll\n\t\t\t? qb\n\t\t\t: qb.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create().from('project_membership').select('project_id').where({\n\t\t\t\t\t\tidentity_id: this.permissionContext.identity.id,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\treturn await qbWithIdentityPermissions.getResult(queryable.db)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;AAKO,MAAM,gCAAgC,cAAyB;AAAA,EACrE,YAA6B,YAAqC,mBAAsC;AACvG,UAAA;AAD4B,SAAA,aAAA;AAAqC,SAAA,oBAAA;AAAA,EAElE;AAAA,EAEA,MAAM,MAAM,WAAkD;AAC7D,UAAM,6BAA6B,MAAM,KAAK,kBAAkB,UAAU;AAAA,MACzE,QAAQ,kBAAkB;AAAA,IAAA,CAC1B;AAED,QAAI,KAAK,eAAe,KAAK,kBAAkB,SAAS,MAAM,4BAA4B;AACzF,aAAO,MAAM,IAAI,gBAAgB,MAAM,SAAS;AAAA,IACjD;AAEA,UAAM,KAAK,cAAc,OAAA,EACvB,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,QAAQ,CAAC,EAC5B,KAAK,SAAS,EACd;AAAA,MAAM,WACN,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChB,cAAc,SACZ,KAAK,oBAAoB,EACzB,OAAO,YAAY,EACnB,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MAAA;AAAA,IACH;AAGF,UAAM,4BAA4B,6BAC/B,KACA,GAAG;AAAA,MAAM,WACV,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChB,cAAc,SAAS,KAAK,oBAAoB,EAAE,OAAO,YAAY,EAAE,MAAM;AAAA,UAC5E,aAAa,KAAK,kBAAkB,SAAS;AAAA,QAAA,CAC7C;AAAA,MAAA;AAAA,IACF;AAGF,WAAO,MAAM,0BAA0B,UAAU,UAAU,EAAE;AAAA,EAC9D;AACD;"}
+{"version":3,"file":"ProjectsByIdentityQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsByIdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { ProjectsQuery } from './ProjectsQuery.js'\nimport { PermissionActions, PermissionContext } from '../../authorization/index.js'\nimport { Project } from '../../type/index.js'\n\nexport class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {\n\tconstructor(private readonly identityId: string, private readonly permissionContext: PermissionContext) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<Project[]> {\n\t\tconst canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({\n\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t})\n\n\t\tif (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {\n\t\t\treturn await new ProjectsQuery().fetch(queryable)\n\t\t}\n\n\t\tconst qb = SelectBuilder.create<Project>()\n\t\t\t.select(['project', 'id'])\n\t\t\t.select(['project', 'name'])\n\t\t\t.select(['project', 'slug'])\n\t\t\t.select(['project', 'config'])\n\t\t\t.from('project')\n\t\t\t.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create() //\n\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t.select('project_id')\n\t\t\t\t\t\t.where({\n\t\t\t\t\t\t\tidentity_id: this.identityId,\n\t\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\tconst qbWithIdentityPermissions = canAuthorizedEntityViewAll\n\t\t\t? qb\n\t\t\t: qb.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create().from('project_membership').select('project_id').where({\n\t\t\t\t\t\tidentity_id: this.permissionContext.identity.id,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\treturn await qbWithIdentityPermissions.getResult(queryable.db)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;AAKO,MAAM,gCAAgC,cAAyB;AAAA,EACrE,YAA6B,YAAqC,mBAAsC;AACvG,UAAA;AAD4B,SAAA,aAAA;AAAqC,SAAA,oBAAA;AAAA,EAElE;AAAA,EAEA,MAAM,MAAM,WAAkD;AAC7D,UAAM,6BAA6B,MAAM,KAAK,kBAAkB,UAAU;AAAA,MACzE,QAAQ,kBAAkB;AAAA,IAAA,CAC1B;AAED,QAAI,KAAK,eAAe,KAAK,kBAAkB,SAAS,MAAM,4BAA4B;AACzF,aAAO,MAAM,IAAI,gBAAgB,MAAM,SAAS;AAAA,IACjD;AAEA,UAAM,KAAK,cAAc,OAAA,EACvB,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,QAAQ,CAAC,EAC5B,KAAK,SAAS,EACd;AAAA,MAAM,WACN,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChB,cAAc,SACZ,KAAK,oBAAoB,EACzB,OAAO,YAAY,EACnB,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MAAA;AAAA,IACH;AAGF,UAAM,4BAA4B,6BAC/B,KACA,GAAG;AAAA,MAAM,WACV,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChB,cAAc,SAAS,KAAK,oBAAoB,EAAE,OAAO,YAAY,EAAE,MAAM;AAAA,UAC5E,aAAa,KAAK,kBAAkB,SAAS;AAAA,QAAA,CAC7C;AAAA,MAAA;AAAA,IACF;AAGF,WAAO,MAAM,0BAA0B,UAAU,UAAU,EAAE;AAAA,EAC9D;AACD;"}

package/dist/production/src/model/queries/project/ProjectsQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectsQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { Project } from '../../type'\n\nexport class ProjectsQuery extends DatabaseQuery<Project[]> {\n\tasync fetch({ db }: DatabaseQueryable): Promise<Project[]> {\n\t\treturn await SelectBuilder.create<Project>()\n\t\t\t.select('id')\n\t\t\t.select('name')\n\t\t\t.select('slug')\n\t\t\t.select('config')\n\t\t\t.from('project')\n\t\t\t.orderBy('slug')\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder"],"mappings":";;;AAGO,MAAM,sBAAsBA,SAAAA,cAAyB;AAAA,EAC3D,MAAM,MAAM,EAAE,MAA6C;AAC1D,WAAO,MAAMC,SAAAA,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,QAAQ,EACf,KAAK,SAAS,EACd,QAAQ,MAAM,EACd,UAAU,EAAE;AAAA,EACf;AACD;;"}
+{"version":3,"file":"ProjectsQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { Project } from '../../type/index.js'\n\nexport class ProjectsQuery extends DatabaseQuery<Project[]> {\n\tasync fetch({ db }: DatabaseQueryable): Promise<Project[]> {\n\t\treturn await SelectBuilder.create<Project>()\n\t\t\t.select('id')\n\t\t\t.select('name')\n\t\t\t.select('slug')\n\t\t\t.select('config')\n\t\t\t.from('project')\n\t\t\t.orderBy('slug')\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder"],"mappings":";;;AAGO,MAAM,sBAAsBA,SAAAA,cAAyB;AAAA,EAC3D,MAAM,MAAM,EAAE,MAA6C;AAC1D,WAAO,MAAMC,SAAAA,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,QAAQ,EACf,KAAK,SAAS,EACd,QAAQ,MAAM,EACd,UAAU,EAAE;AAAA,EACf;AACD;;"}

package/dist/production/src/model/queries/project/ProjectsQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectsQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { Project } from '../../type'\n\nexport class ProjectsQuery extends DatabaseQuery<Project[]> {\n\tasync fetch({ db }: DatabaseQueryable): Promise<Project[]> {\n\t\treturn await SelectBuilder.create<Project>()\n\t\t\t.select('id')\n\t\t\t.select('name')\n\t\t\t.select('slug')\n\t\t\t.select('config')\n\t\t\t.from('project')\n\t\t\t.orderBy('slug')\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,sBAAsB,cAAyB;AAAA,EAC3D,MAAM,MAAM,EAAE,MAA6C;AAC1D,WAAO,MAAM,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,QAAQ,EACf,KAAK,SAAS,EACd,QAAQ,MAAM,EACd,UAAU,EAAE;AAAA,EACf;AACD;"}
+{"version":3,"file":"ProjectsQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { Project } from '../../type/index.js'\n\nexport class ProjectsQuery extends DatabaseQuery<Project[]> {\n\tasync fetch({ db }: DatabaseQueryable): Promise<Project[]> {\n\t\treturn await SelectBuilder.create<Project>()\n\t\t\t.select('id')\n\t\t\t.select('name')\n\t\t\t.select('slug')\n\t\t\t.select('config')\n\t\t\t.from('project')\n\t\t\t.orderBy('slug')\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,sBAAsB,cAAyB;AAAA,EAC3D,MAAM,MAAM,EAAE,MAA6C;AAC1D,WAAO,MAAM,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,QAAQ,EACf,KAAK,SAAS,EACd,QAAQ,MAAM,EACd,UAAU,EAAE;AAAA,EACf;AACD;"}

package/dist/production/src/model/queries/rateLimit/RateLimitCountQuery.cjs

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class RateLimitCountQuery extends Database.DatabaseQuery {
+  constructor(scope, keyHash, windowSeconds) {
+    super();
+    this.scope = scope;
+    this.keyHash = keyHash;
+    this.windowSeconds = windowSeconds;
+  }
+  async fetch({ db }) {
+    const rows = await Database.SelectBuilder.create().from("rate_limit_event").select(new Database.Literal("count(*)::text as count")).where({ scope: this.scope, key_hash: this.keyHash }).where(new Database.Literal("occurred_at >= NOW() - make_interval(secs => ?)", [this.windowSeconds])).getResult(db);
+    return Number(rows[0]?.count ?? "0");
+  }
+}
+exports.RateLimitCountQuery = RateLimitCountQuery;
+//# sourceMappingURL=RateLimitCountQuery.cjs.map

package/dist/production/src/model/queries/rateLimit/RateLimitCountQuery.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitCountQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/rateLimit/RateLimitCountQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RateLimitCountQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t\tprivate readonly windowSeconds: number,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\t// The window start is computed against the database clock (NOW()), not the\n\t\t// application clock, so the limiter cannot be weakened by app/DB clock skew\n\t\t// or by clock divergence between engine instances. See NextLoginAttemptQuery.\n\t\tconst rows = await SelectBuilder.create<{ count: string }>()\n\t\t\t.from('rate_limit_event')\n\t\t\t.select(new Literal('count(*)::text as count'))\n\t\t\t.where({ scope: this.scope, key_hash: this.keyHash })\n\t\t\t.where(new Literal('occurred_at >= NOW() - make_interval(secs => ?)', [this.windowSeconds]))\n\t\t\t.getResult(db)\n\t\treturn Number(rows[0]?.count ?? '0')\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal"],"mappings":";;;AAGO,MAAM,4BAA4BA,SAAAA,cAAsB;AAAA,EAC9D,YACkB,OACA,SACA,eAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,UAAA;AACA,SAAA,gBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AAIvD,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,KAAK,kBAAkB,EACvB,OAAO,IAAIC,SAAAA,QAAQ,yBAAyB,CAAC,EAC7C,MAAM,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,QAAA,CAAS,EACnD,MAAM,IAAIA,SAAAA,QAAQ,mDAAmD,CAAC,KAAK,aAAa,CAAC,CAAC,EAC1F,UAAU,EAAE;AACd,WAAO,OAAO,KAAK,CAAC,GAAG,SAAS,GAAG;AAAA,EACpC;AACD;;"}

package/dist/production/src/model/queries/rateLimit/RateLimitCountQuery.js

@@ -0,0 +1,17 @@
+import { DatabaseQuery, SelectBuilder, Literal } from "@contember/database";
+class RateLimitCountQuery extends DatabaseQuery {
+  constructor(scope, keyHash, windowSeconds) {
+    super();
+    this.scope = scope;
+    this.keyHash = keyHash;
+    this.windowSeconds = windowSeconds;
+  }
+  async fetch({ db }) {
+    const rows = await SelectBuilder.create().from("rate_limit_event").select(new Literal("count(*)::text as count")).where({ scope: this.scope, key_hash: this.keyHash }).where(new Literal("occurred_at >= NOW() - make_interval(secs => ?)", [this.windowSeconds])).getResult(db);
+    return Number(rows[0]?.count ?? "0");
+  }
+}
+export {
+  RateLimitCountQuery
+};
+//# sourceMappingURL=RateLimitCountQuery.js.map

package/dist/production/src/model/queries/rateLimit/RateLimitCountQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitCountQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/rateLimit/RateLimitCountQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RateLimitCountQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t\tprivate readonly windowSeconds: number,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\t// The window start is computed against the database clock (NOW()), not the\n\t\t// application clock, so the limiter cannot be weakened by app/DB clock skew\n\t\t// or by clock divergence between engine instances. See NextLoginAttemptQuery.\n\t\tconst rows = await SelectBuilder.create<{ count: string }>()\n\t\t\t.from('rate_limit_event')\n\t\t\t.select(new Literal('count(*)::text as count'))\n\t\t\t.where({ scope: this.scope, key_hash: this.keyHash })\n\t\t\t.where(new Literal('occurred_at >= NOW() - make_interval(secs => ?)', [this.windowSeconds]))\n\t\t\t.getResult(db)\n\t\treturn Number(rows[0]?.count ?? '0')\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,4BAA4B,cAAsB;AAAA,EAC9D,YACkB,OACA,SACA,eAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,UAAA;AACA,SAAA,gBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AAIvD,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,KAAK,kBAAkB,EACvB,OAAO,IAAI,QAAQ,yBAAyB,CAAC,EAC7C,MAAM,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,QAAA,CAAS,EACnD,MAAM,IAAI,QAAQ,mDAAmD,CAAC,KAAK,aAAa,CAAC,CAAC,EAC1F,UAAU,EAAE;AACd,WAAO,OAAO,KAAK,CAAC,GAAG,SAAS,GAAG;AAAA,EACpC;AACD;"}

package/dist/production/src/model/service/AuthLogService.cjs

@@ -1,16 +1,28 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const CreateAuthLogEntryCommand = require("../commands/authLog/CreateAuthLogEntryCommand.cjs");
+const UnpersistedApiKeyManager = require("./apiKey/UnpersistedApiKeyManager.cjs");
+const invokedBy = (identityId) => UnpersistedApiKeyManager.isUnpersistedIdentityId(identityId) ? { metadata: { invokedByUnpersistedIdentityId: identityId } } : { invokedById: identityId };
 class AuthLogService {
   async logAuthAction(db, ctx, data) {
     const dataContainer = data.response.ok ? data.response.result ?? {} : data.response.metadata ?? {};
     const authData = typeof dataContainer === "object" && dataContainer !== null && AuthLogService.Key in dataContainer ? dataContainer[AuthLogService.Key] : void 0;
+    const baseMetadata = data.metadata && typeof data.metadata === "object" && !Array.isArray(data.metadata) ? data.metadata : {};
+    const metadata = { ...baseMetadata };
+    if (ctx.forwarderIp !== void 0) {
+      metadata.forwarderIp = ctx.forwarderIp;
+    }
+    if (ctx.forwarderUserAgent !== void 0) {
+      metadata.forwarderUserAgent = ctx.forwarderUserAgent;
+    }
+    const invoker = invokedBy(ctx.identityId);
+    Object.assign(metadata, invoker.metadata);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
         success: data.response.ok,
         personInputIdentifier: data.personInput ?? authData?.data?.personInput,
         personId: data.personId ?? authData?.data?.personId,
-        invokedById: ctx.identityId,
+        invokedById: invoker.invokedById,
         type: data.type,
         identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
         errorCode: data.response.ok ? null : data.response.error,
@@ -18,7 +30,31 @@ class AuthLogService {
         errorMessage: data.response.ok ? void 0 : data.response.errorMessage,
         ipAddress: ctx.clientIp,
         userAgent: ctx.userAgent,
-        metadata: {}
+        metadata,
+        targetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,
+        eventData: data.eventData ?? authData?.data?.eventData,
+        geoCountry: ctx.geoCountry,
+        deviceFingerprint: ctx.deviceFingerprint
+      })
+    );
+  }
+  /**
+   * Focused, response-agnostic emit for internal auth-path events (A19) that
+   * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth
+   * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
+   */
+  async logSessionEvent(db, entry) {
+    const invoker = invokedBy(entry.identityId);
+    await db.commandBus.execute(
+      new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
+        type: entry.type,
+        invokedById: invoker.invokedById,
+        metadata: invoker.metadata,
+        personId: entry.personId ?? void 0,
+        success: entry.success,
+        ipAddress: entry.ipAddress,
+        userAgent: entry.userAgent,
+        eventData: entry.eventData
       })
     );
   }

package/dist/production/src/model/service/AuthLogService.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand'\nimport { Response } from '../utils/Response'\nimport { AuthActionType } from '../type/AuthLog'\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: { identityId: string; clientIp?: string; userAgent?: string },\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: ctx.identityId,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata: {},\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["CreateAuthLogEntryCommand","AuthLogService"],"mappings":";;;AAKA,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KACA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,IAAI;AAAA,QACjB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf,UAAU,CAAA;AAAA,MAAC,CACX;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUC,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAiBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GAlBJ,mBAAA,iBAAA,CAAA,EAAA;;"}
+{"version":3,"file":"AuthLogService.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\nimport { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'\n\n/**\n * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a\n * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort\n * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is\n * still recorded, just not as a reference.\n */\nconst invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>\n\tisUnpersistedIdentityId(identityId)\n\t\t? { metadata: { invokedByUnpersistedIdentityId: identityId } }\n\t\t: { invokedById: identityId }\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\t\tconst invoker = invokedBy(ctx.identityId)\n\t\tObject.assign(metadata, invoker.metadata)\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tconst invoker = invokedBy(entry.identityId)\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\tmetadata: invoker.metadata,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["isUnpersistedIdentityId","CreateAuthLogEntryCommand","AuthLogService"],"mappings":";;;;AAaA,MAAM,YAAY,CAAC,eAClBA,iDAAwB,UAAU,IAC/B,EAAE,UAAU,EAAE,gCAAgC,WAAA,EAAW,IACzD,EAAE,aAAa,WAAA;AAEnB,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AACA,UAAM,UAAU,UAAU,IAAI,UAAU;AACxC,WAAO,OAAO,UAAU,QAAQ,QAAQ;AAExC,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIC,oDAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,QAAQ;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,UAAU,UAAU,MAAM,UAAU;AAC1C,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,UAAU,QAAQ;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUC,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;;"}

package/dist/production/src/model/service/AuthLogService.js

@@ -1,14 +1,26 @@
 import { CreateAuthLogEntryCommand } from "../commands/authLog/CreateAuthLogEntryCommand.js";
+import { isUnpersistedIdentityId } from "./apiKey/UnpersistedApiKeyManager.js";
+const invokedBy = (identityId) => isUnpersistedIdentityId(identityId) ? { metadata: { invokedByUnpersistedIdentityId: identityId } } : { invokedById: identityId };
 class AuthLogService {
   async logAuthAction(db, ctx, data) {
     const dataContainer = data.response.ok ? data.response.result ?? {} : data.response.metadata ?? {};
     const authData = typeof dataContainer === "object" && dataContainer !== null && AuthLogService.Key in dataContainer ? dataContainer[AuthLogService.Key] : void 0;
+    const baseMetadata = data.metadata && typeof data.metadata === "object" && !Array.isArray(data.metadata) ? data.metadata : {};
+    const metadata = { ...baseMetadata };
+    if (ctx.forwarderIp !== void 0) {
+      metadata.forwarderIp = ctx.forwarderIp;
+    }
+    if (ctx.forwarderUserAgent !== void 0) {
+      metadata.forwarderUserAgent = ctx.forwarderUserAgent;
+    }
+    const invoker = invokedBy(ctx.identityId);
+    Object.assign(metadata, invoker.metadata);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand({
         success: data.response.ok,
         personInputIdentifier: data.personInput ?? authData?.data?.personInput,
         personId: data.personId ?? authData?.data?.personId,
-        invokedById: ctx.identityId,
+        invokedById: invoker.invokedById,
         type: data.type,
         identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
         errorCode: data.response.ok ? null : data.response.error,
@@ -16,7 +28,31 @@ class AuthLogService {
         errorMessage: data.response.ok ? void 0 : data.response.errorMessage,
         ipAddress: ctx.clientIp,
         userAgent: ctx.userAgent,
-        metadata: {}
+        metadata,
+        targetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,
+        eventData: data.eventData ?? authData?.data?.eventData,
+        geoCountry: ctx.geoCountry,
+        deviceFingerprint: ctx.deviceFingerprint
+      })
+    );
+  }
+  /**
+   * Focused, response-agnostic emit for internal auth-path events (A19) that
+   * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth
+   * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
+   */
+  async logSessionEvent(db, entry) {
+    const invoker = invokedBy(entry.identityId);
+    await db.commandBus.execute(
+      new CreateAuthLogEntryCommand({
+        type: entry.type,
+        invokedById: invoker.invokedById,
+        metadata: invoker.metadata,
+        personId: entry.personId ?? void 0,
+        success: entry.success,
+        ipAddress: entry.ipAddress,
+        userAgent: entry.userAgent,
+        eventData: entry.eventData
       })
     );
   }

package/dist/production/src/model/service/AuthLogService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand'\nimport { Response } from '../utils/Response'\nimport { AuthActionType } from '../type/AuthLog'\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: { identityId: string; clientIp?: string; userAgent?: string },\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: ctx.identityId,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata: {},\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["AuthLogService"],"mappings":";AAKA,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KACA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,IAAI;AAAA,QACjB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf,UAAU,CAAA;AAAA,MAAC,CACX;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUA,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAiBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GAlBJ,mBAAA,iBAAA,CAAA,EAAA;"}
+{"version":3,"file":"AuthLogService.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\nimport { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'\n\n/**\n * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a\n * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort\n * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is\n * still recorded, just not as a reference.\n */\nconst invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>\n\tisUnpersistedIdentityId(identityId)\n\t\t? { metadata: { invokedByUnpersistedIdentityId: identityId } }\n\t\t: { invokedById: identityId }\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\t\tconst invoker = invokedBy(ctx.identityId)\n\t\tObject.assign(metadata, invoker.metadata)\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tconst invoker = invokedBy(entry.identityId)\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\tmetadata: invoker.metadata,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["AuthLogService"],"mappings":";;AAaA,MAAM,YAAY,CAAC,eAClB,wBAAwB,UAAU,IAC/B,EAAE,UAAU,EAAE,gCAAgC,WAAA,EAAW,IACzD,EAAE,aAAa,WAAA;AAEnB,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AACA,UAAM,UAAU,UAAU,IAAI,UAAU;AACxC,WAAO,OAAO,UAAU,QAAQ,QAAQ;AAExC,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,QAAQ;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,UAAU,UAAU,MAAM,UAAU;AAC1C,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,UAAU,QAAQ;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUA,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;"}

package/dist/production/src/model/service/AuthPolicyManager.cjs

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Response = require("../utils/Response.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../type/ApiKey.cjs");
+const AuthPoliciesQuery = require("../queries/authPolicy/AuthPoliciesQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
+const CreateAuthPolicyCommand = require("../commands/authPolicy/CreateAuthPolicyCommand.cjs");
+const UpdateAuthPolicyCommand = require("../commands/authPolicy/UpdateAuthPolicyCommand.cjs");
+const DeleteAuthPolicyCommand = require("../commands/authPolicy/DeleteAuthPolicyCommand.cjs");
+class AuthPolicyManager {
+  constructor(projectManager) {
+    this.projectManager = projectManager;
+  }
+  async listPolicies(db) {
+    return db.queryHandler.fetch(new AuthPoliciesQuery.AuthPoliciesQuery());
+  }
+  async createPolicy(db, input) {
+    const projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null);
+    if (!projectResult.ok) {
+      return new Response.ResponseError(projectResult.error, projectResult.errorMessage);
+    }
+    const id = await db.commandBus.execute(
+      new CreateAuthPolicyCommand.CreateAuthPolicyCommand({
+        scope: input.scope,
+        projectId: projectResult.projectId,
+        roles: input.roles,
+        mfaRequired: input.mfaRequired ?? null,
+        tokenExpiration: input.tokenExpiration ?? null,
+        idleTimeout: input.idleTimeout ?? null,
+        graceDuration: input.graceDuration ?? null,
+        rememberMeAllowed: input.rememberMeAllowed ?? null
+      })
+    );
+    return new Response.ResponseOk({ id });
+  }
+  async updatePolicy(db, id, input) {
+    const projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null);
+    if (!projectResult.ok) {
+      return new Response.ResponseError(projectResult.error, projectResult.errorMessage);
+    }
+    const updated = await db.commandBus.execute(
+      new UpdateAuthPolicyCommand.UpdateAuthPolicyCommand(id, {
+        scope: input.scope,
+        projectId: projectResult.projectId,
+        roles: input.roles,
+        mfaRequired: input.mfaRequired ?? null,
+        tokenExpiration: input.tokenExpiration ?? null,
+        idleTimeout: input.idleTimeout ?? null,
+        graceDuration: input.graceDuration ?? null,
+        rememberMeAllowed: input.rememberMeAllowed ?? null
+      })
+    );
+    if (!updated) {
+      return new Response.ResponseError("NOT_FOUND", `Auth policy ${id} not found`);
+    }
+    return new Response.ResponseOk(null);
+  }
+  async deletePolicy(db, id) {
+    const deleted = await db.commandBus.execute(new DeleteAuthPolicyCommand.DeleteAuthPolicyCommand(id));
+    if (!deleted) {
+      return new Response.ResponseError("NOT_FOUND", `Auth policy ${id} not found`);
+    }
+    return new Response.ResponseOk(null);
+  }
+  /**
+   * Validates scope/project consistency and resolves a slug to project_id.
+   * `scope='project'` requires a project (which must exist); `scope='global'`
+   * forbids one.
+   */
+  async resolveProjectId(db, scope, projectSlug) {
+    if (scope === "global") {
+      if (projectSlug !== null) {
+        return { ok: false, error: "PROJECT_NOT_ALLOWED", errorMessage: "A global auth policy must not reference a project" };
+      }
+      return { ok: true, projectId: null };
+    }
+    if (projectSlug === null) {
+      return { ok: false, error: "PROJECT_REQUIRED", errorMessage: "A project-scoped auth policy requires a project" };
+    }
+    const project = await this.projectManager.getProjectBySlug(db, projectSlug);
+    if (!project) {
+      return { ok: false, error: "PROJECT_NOT_FOUND", errorMessage: `Project ${projectSlug} not found` };
+    }
+    return { ok: true, projectId: project.id };
+  }
+}
+exports.AuthPolicyManager = AuthPolicyManager;
+//# sourceMappingURL=AuthPolicyManager.cjs.map

package/dist/production/src/model/service/AuthPolicyManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { AuthPoliciesQuery } from '../queries/index.js'\nimport { CreateAuthPolicyCommand, DeleteAuthPolicyCommand, UpdateAuthPolicyCommand } from '../commands/index.js'\nimport { AuthPolicyRow, AuthPolicyScope } from '../type/index.js'\nimport { CreateAuthPolicyErrorCode, DeleteAuthPolicyErrorCode, UpdateAuthPolicyErrorCode } from '../../schema/index.js'\n\nexport type AuthPolicyInputValues = {\n\tscope: AuthPolicyScope\n\t/** Project slug; resolved to project_id. Required for scope='project', forbidden for scope='global'. */\n\tproject?: string | null\n\troles: string[]\n\tmfaRequired?: boolean | null\n\ttokenExpiration?: string | null\n\tidleTimeout?: string | null\n\tgraceDuration?: string | null\n\trememberMeAllowed?: boolean | null\n}\n\n/**\n * CRUD over the `auth_policy` table (shared infra reused by A19). Project is\n * always addressed by slug in the API and resolved to project_id here.\n */\nexport class AuthPolicyManager {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync listPolicies(db: DatabaseContext): Promise<AuthPolicyRow[]> {\n\t\treturn db.queryHandler.fetch(new AuthPoliciesQuery())\n\t}\n\n\tasync createPolicy(db: DatabaseContext, input: AuthPolicyInputValues): Promise<Response<{ id: string }, CreateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst id = await db.commandBus.execute(\n\t\t\tnew CreateAuthPolicyCommand({\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\treturn new ResponseOk({ id })\n\t}\n\n\tasync updatePolicy(db: DatabaseContext, id: string, input: AuthPolicyInputValues): Promise<Response<null, UpdateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst updated = await db.commandBus.execute(\n\t\t\tnew UpdateAuthPolicyCommand(id, {\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\tif (!updated) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync deletePolicy(db: DatabaseContext, id: string): Promise<Response<null, DeleteAuthPolicyErrorCode>> {\n\t\tconst deleted = await db.commandBus.execute(new DeleteAuthPolicyCommand(id))\n\t\tif (!deleted) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\t/**\n\t * Validates scope/project consistency and resolves a slug to project_id.\n\t * `scope='project'` requires a project (which must exist); `scope='global'`\n\t * forbids one.\n\t */\n\tprivate async resolveProjectId(\n\t\tdb: DatabaseContext,\n\t\tscope: AuthPolicyScope,\n\t\tprojectSlug: string | null,\n\t): Promise<\n\t\t{ ok: true; projectId: string | null } | {\n\t\t\tok: false\n\t\t\terror: 'PROJECT_REQUIRED' | 'PROJECT_NOT_ALLOWED' | 'PROJECT_NOT_FOUND'\n\t\t\terrorMessage: string\n\t\t}\n\t> {\n\t\tif (scope === 'global') {\n\t\t\tif (projectSlug !== null) {\n\t\t\t\treturn { ok: false, error: 'PROJECT_NOT_ALLOWED', errorMessage: 'A global auth policy must not reference a project' }\n\t\t\t}\n\t\t\treturn { ok: true, projectId: null }\n\t\t}\n\t\t// scope === 'project'\n\t\tif (projectSlug === null) {\n\t\t\treturn { ok: false, error: 'PROJECT_REQUIRED', errorMessage: 'A project-scoped auth policy requires a project' }\n\t\t}\n\t\tconst project = await this.projectManager.getProjectBySlug(db, projectSlug)\n\t\tif (!project) {\n\t\t\treturn { ok: false, error: 'PROJECT_NOT_FOUND', errorMessage: `Project ${projectSlug} not found` }\n\t\t}\n\t\treturn { ok: true, projectId: project.id }\n\t}\n}\n"],"names":["AuthPoliciesQuery","ResponseError","CreateAuthPolicyCommand","ResponseOk","UpdateAuthPolicyCommand","DeleteAuthPolicyCommand"],"mappings":";;;;;;;;;;;;;;;;;AAwBO,MAAM,kBAAkB;AAAA,EAC9B,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,IAA+C;AACjE,WAAO,GAAG,aAAa,MAAM,IAAIA,kBAAAA,mBAAmB;AAAA,EACrD;AAAA,EAEA,MAAM,aAAa,IAAqB,OAA4F;AACnI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAIC,SAAAA,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,KAAK,MAAM,GAAG,WAAW;AAAA,MAC9B,IAAIC,gDAAwB;AAAA,QAC3B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,WAAO,IAAIC,SAAAA,WAAW,EAAE,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAY,OAAkF;AACrI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAIF,SAAAA,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,UAAU,MAAM,GAAG,WAAW;AAAA,MACnC,IAAIG,wBAAAA,wBAAwB,IAAI;AAAA,QAC/B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,QAAI,CAAC,SAAS;AACb,aAAO,IAAIH,SAAAA,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAIE,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAgE;AACvG,UAAM,UAAU,MAAM,GAAG,WAAW,QAAQ,IAAIE,wBAAAA,wBAAwB,EAAE,CAAC;AAC3E,QAAI,CAAC,SAAS;AACb,aAAO,IAAIJ,SAAAA,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAIE,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,iBACb,IACA,OACA,aAOC;AACD,QAAI,UAAU,UAAU;AACvB,UAAI,gBAAgB,MAAM;AACzB,eAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB,cAAc,oDAAA;AAAA,MACjE;AACA,aAAO,EAAE,IAAI,MAAM,WAAW,KAAA;AAAA,IAC/B;AAEA,QAAI,gBAAgB,MAAM;AACzB,aAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,cAAc,kDAAA;AAAA,IAC9D;AACA,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,IAAI,WAAW;AAC1E,QAAI,CAAC,SAAS;AACb,aAAO,EAAE,IAAI,OAAO,OAAO,qBAAqB,cAAc,WAAW,WAAW,aAAA;AAAA,IACrF;AACA,WAAO,EAAE,IAAI,MAAM,WAAW,QAAQ,GAAA;AAAA,EACvC;AACD;;"}

package/dist/production/src/model/service/AuthPolicyManager.js

@@ -0,0 +1,96 @@
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../type/ApiKey.js";
+import { AuthPoliciesQuery } from "../queries/authPolicy/AuthPoliciesQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
+import "../authorization/PermissionContext.js";
+import "../authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
+import { CreateAuthPolicyCommand } from "../commands/authPolicy/CreateAuthPolicyCommand.js";
+import { UpdateAuthPolicyCommand } from "../commands/authPolicy/UpdateAuthPolicyCommand.js";
+import { DeleteAuthPolicyCommand } from "../commands/authPolicy/DeleteAuthPolicyCommand.js";
+class AuthPolicyManager {
+  constructor(projectManager) {
+    this.projectManager = projectManager;
+  }
+  async listPolicies(db) {
+    return db.queryHandler.fetch(new AuthPoliciesQuery());
+  }
+  async createPolicy(db, input) {
+    const projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null);
+    if (!projectResult.ok) {
+      return new ResponseError(projectResult.error, projectResult.errorMessage);
+    }
+    const id = await db.commandBus.execute(
+      new CreateAuthPolicyCommand({
+        scope: input.scope,
+        projectId: projectResult.projectId,
+        roles: input.roles,
+        mfaRequired: input.mfaRequired ?? null,
+        tokenExpiration: input.tokenExpiration ?? null,
+        idleTimeout: input.idleTimeout ?? null,
+        graceDuration: input.graceDuration ?? null,
+        rememberMeAllowed: input.rememberMeAllowed ?? null
+      })
+    );
+    return new ResponseOk({ id });
+  }
+  async updatePolicy(db, id, input) {
+    const projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null);
+    if (!projectResult.ok) {
+      return new ResponseError(projectResult.error, projectResult.errorMessage);
+    }
+    const updated = await db.commandBus.execute(
+      new UpdateAuthPolicyCommand(id, {
+        scope: input.scope,
+        projectId: projectResult.projectId,
+        roles: input.roles,
+        mfaRequired: input.mfaRequired ?? null,
+        tokenExpiration: input.tokenExpiration ?? null,
+        idleTimeout: input.idleTimeout ?? null,
+        graceDuration: input.graceDuration ?? null,
+        rememberMeAllowed: input.rememberMeAllowed ?? null
+      })
+    );
+    if (!updated) {
+      return new ResponseError("NOT_FOUND", `Auth policy ${id} not found`);
+    }
+    return new ResponseOk(null);
+  }
+  async deletePolicy(db, id) {
+    const deleted = await db.commandBus.execute(new DeleteAuthPolicyCommand(id));
+    if (!deleted) {
+      return new ResponseError("NOT_FOUND", `Auth policy ${id} not found`);
+    }
+    return new ResponseOk(null);
+  }
+  /**
+   * Validates scope/project consistency and resolves a slug to project_id.
+   * `scope='project'` requires a project (which must exist); `scope='global'`
+   * forbids one.
+   */
+  async resolveProjectId(db, scope, projectSlug) {
+    if (scope === "global") {
+      if (projectSlug !== null) {
+        return { ok: false, error: "PROJECT_NOT_ALLOWED", errorMessage: "A global auth policy must not reference a project" };
+      }
+      return { ok: true, projectId: null };
+    }
+    if (projectSlug === null) {
+      return { ok: false, error: "PROJECT_REQUIRED", errorMessage: "A project-scoped auth policy requires a project" };
+    }
+    const project = await this.projectManager.getProjectBySlug(db, projectSlug);
+    if (!project) {
+      return { ok: false, error: "PROJECT_NOT_FOUND", errorMessage: `Project ${projectSlug} not found` };
+    }
+    return { ok: true, projectId: project.id };
+  }
+}
+export {
+  AuthPolicyManager
+};
+//# sourceMappingURL=AuthPolicyManager.js.map

package/dist/production/src/model/service/AuthPolicyManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { AuthPoliciesQuery } from '../queries/index.js'\nimport { CreateAuthPolicyCommand, DeleteAuthPolicyCommand, UpdateAuthPolicyCommand } from '../commands/index.js'\nimport { AuthPolicyRow, AuthPolicyScope } from '../type/index.js'\nimport { CreateAuthPolicyErrorCode, DeleteAuthPolicyErrorCode, UpdateAuthPolicyErrorCode } from '../../schema/index.js'\n\nexport type AuthPolicyInputValues = {\n\tscope: AuthPolicyScope\n\t/** Project slug; resolved to project_id. Required for scope='project', forbidden for scope='global'. */\n\tproject?: string | null\n\troles: string[]\n\tmfaRequired?: boolean | null\n\ttokenExpiration?: string | null\n\tidleTimeout?: string | null\n\tgraceDuration?: string | null\n\trememberMeAllowed?: boolean | null\n}\n\n/**\n * CRUD over the `auth_policy` table (shared infra reused by A19). Project is\n * always addressed by slug in the API and resolved to project_id here.\n */\nexport class AuthPolicyManager {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync listPolicies(db: DatabaseContext): Promise<AuthPolicyRow[]> {\n\t\treturn db.queryHandler.fetch(new AuthPoliciesQuery())\n\t}\n\n\tasync createPolicy(db: DatabaseContext, input: AuthPolicyInputValues): Promise<Response<{ id: string }, CreateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst id = await db.commandBus.execute(\n\t\t\tnew CreateAuthPolicyCommand({\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\treturn new ResponseOk({ id })\n\t}\n\n\tasync updatePolicy(db: DatabaseContext, id: string, input: AuthPolicyInputValues): Promise<Response<null, UpdateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst updated = await db.commandBus.execute(\n\t\t\tnew UpdateAuthPolicyCommand(id, {\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\tif (!updated) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync deletePolicy(db: DatabaseContext, id: string): Promise<Response<null, DeleteAuthPolicyErrorCode>> {\n\t\tconst deleted = await db.commandBus.execute(new DeleteAuthPolicyCommand(id))\n\t\tif (!deleted) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\t/**\n\t * Validates scope/project consistency and resolves a slug to project_id.\n\t * `scope='project'` requires a project (which must exist); `scope='global'`\n\t * forbids one.\n\t */\n\tprivate async resolveProjectId(\n\t\tdb: DatabaseContext,\n\t\tscope: AuthPolicyScope,\n\t\tprojectSlug: string | null,\n\t): Promise<\n\t\t{ ok: true; projectId: string | null } | {\n\t\t\tok: false\n\t\t\terror: 'PROJECT_REQUIRED' | 'PROJECT_NOT_ALLOWED' | 'PROJECT_NOT_FOUND'\n\t\t\terrorMessage: string\n\t\t}\n\t> {\n\t\tif (scope === 'global') {\n\t\t\tif (projectSlug !== null) {\n\t\t\t\treturn { ok: false, error: 'PROJECT_NOT_ALLOWED', errorMessage: 'A global auth policy must not reference a project' }\n\t\t\t}\n\t\t\treturn { ok: true, projectId: null }\n\t\t}\n\t\t// scope === 'project'\n\t\tif (projectSlug === null) {\n\t\t\treturn { ok: false, error: 'PROJECT_REQUIRED', errorMessage: 'A project-scoped auth policy requires a project' }\n\t\t}\n\t\tconst project = await this.projectManager.getProjectBySlug(db, projectSlug)\n\t\tif (!project) {\n\t\t\treturn { ok: false, error: 'PROJECT_NOT_FOUND', errorMessage: `Project ${projectSlug} not found` }\n\t\t}\n\t\treturn { ok: true, projectId: project.id }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAwBO,MAAM,kBAAkB;AAAA,EAC9B,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,IAA+C;AACjE,WAAO,GAAG,aAAa,MAAM,IAAI,mBAAmB;AAAA,EACrD;AAAA,EAEA,MAAM,aAAa,IAAqB,OAA4F;AACnI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAI,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,KAAK,MAAM,GAAG,WAAW;AAAA,MAC9B,IAAI,wBAAwB;AAAA,QAC3B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,WAAO,IAAI,WAAW,EAAE,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAY,OAAkF;AACrI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAI,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,UAAU,MAAM,GAAG,WAAW;AAAA,MACnC,IAAI,wBAAwB,IAAI;AAAA,QAC/B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,QAAI,CAAC,SAAS;AACb,aAAO,IAAI,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAgE;AACvG,UAAM,UAAU,MAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,EAAE,CAAC;AAC3E,QAAI,CAAC,SAAS;AACb,aAAO,IAAI,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,iBACb,IACA,OACA,aAOC;AACD,QAAI,UAAU,UAAU;AACvB,UAAI,gBAAgB,MAAM;AACzB,eAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB,cAAc,oDAAA;AAAA,MACjE;AACA,aAAO,EAAE,IAAI,MAAM,WAAW,KAAA;AAAA,IAC/B;AAEA,QAAI,gBAAgB,MAAM;AACzB,aAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,cAAc,kDAAA;AAAA,IAC9D;AACA,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,IAAI,WAAW;AAC1E,QAAI,CAAC,SAAS;AACb,aAAO,EAAE,IAAI,OAAO,OAAO,qBAAqB,cAAc,WAAW,WAAW,aAAA;AAAA,IACrF;AACA,WAAO,EAAE,IAAI,MAAM,WAAW,QAAQ,GAAA;AAAA,EACvC;AACD;"}

package/dist/production/src/model/service/AuthPolicyResolver.cjs

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../type/ApiKey.cjs");
+const AuthPoliciesQuery = require("../queries/authPolicy/AuthPoliciesQuery.cjs");
+const AllProjectRolesByIdentityQuery = require("../queries/membership/AllProjectRolesByIdentityQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+const interval = require("../utils/interval.cjs");
+class AuthPolicyResolver {
+  async resolveForIdentity(db, identityId, globalRoles) {
+    const policies = await db.queryHandler.fetch(new AuthPoliciesQuery.AuthPoliciesQuery());
+    if (policies.length === 0) {
+      return { mfaRequired: false, tokenExpiration: null, idleTimeout: null, graceDuration: null, rememberMeAllowed: null };
+    }
+    const projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery.AllProjectRolesByIdentityQuery(identityId));
+    const rolesByProject = /* @__PURE__ */ new Map();
+    for (const { projectId, role } of projectRoles) {
+      let set = rolesByProject.get(projectId);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        rolesByProject.set(projectId, set);
+      }
+      set.add(role);
+    }
+    const globalRoleSet = new Set(globalRoles);
+    const matched = policies.filter((policy) => this.matches(policy, globalRoleSet, rolesByProject));
+    return this.aggregate(matched);
+  }
+  matches(policy, globalRoles, rolesByProject) {
+    if (policy.scope === "global") {
+      return policy.roles.some((role) => globalRoles.has(role));
+    }
+    if (policy.scope === "project") {
+      if (policy.project_id === null) {
+        return false;
+      }
+      const projectRoles = rolesByProject.get(policy.project_id);
+      if (!projectRoles) {
+        return false;
+      }
+      return policy.roles.some((role) => projectRoles.has(role));
+    }
+    return false;
+  }
+  aggregate(policies) {
+    let mfaRequired = false;
+    let tokenExpiration = null;
+    let idleTimeout = null;
+    let graceDuration = null;
+    let rememberMeAllowed = null;
+    for (const policy of policies) {
+      if (policy.mfa_required === true) {
+        mfaRequired = true;
+      }
+      tokenExpiration = this.shortest(tokenExpiration, policy.token_expiration);
+      idleTimeout = this.shortest(idleTimeout, policy.idle_timeout);
+      graceDuration = this.shortest(graceDuration, policy.grace_duration);
+      if (policy.remember_me_allowed === false) {
+        rememberMeAllowed = false;
+      } else if (policy.remember_me_allowed === true && rememberMeAllowed === null) {
+        rememberMeAllowed = true;
+      }
+    }
+    return { mfaRequired, tokenExpiration, idleTimeout, graceDuration, rememberMeAllowed };
+  }
+  /** Strictest wins: returns the shorter of two intervals (NULL = unconstrained). */
+  shortest(current, candidate) {
+    if (candidate === null) {
+      return current;
+    }
+    if (current === null) {
+      return candidate;
+    }
+    return interval.intervalToSeconds(candidate) < interval.intervalToSeconds(current) ? candidate : current;
+  }
+}
+exports.AuthPolicyResolver = AuthPolicyResolver;
+//# sourceMappingURL=AuthPolicyResolver.cjs.map