@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/model/service/AuthPolicyResolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyResolver.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { AllProjectRolesByIdentityQuery, AuthPoliciesQuery } from '../queries/index.js'\nimport { AuthPolicyRow, EffectivePolicy } from '../type/index.js'\nimport { IPostgresInterval } from 'postgres-interval'\nimport { intervalToSeconds } from '../utils/interval.js'\n\n/**\n * Resolves the effective auth policy for an identity by aggregating all matching\n * `auth_policy` rows across the identity's entire role set (global roles + every\n * project-membership role across all projects).\n *\n * Shared by A06 (consumes `mfaRequired`) and A19 (consumes the session fields).\n *\n * Aggregation:\n * - `mfaRequired` = OR of every matched row's `mfa_required` (NULL = no opinion).\n * - session fields = strictest wins: the shortest `tokenExpiration` / `idleTimeout`\n *   and the logical AND of `rememberMeAllowed` (any matched `false` wins).\n *\n * When nothing matches, the result is the inert baseline\n * (`mfaRequired=false`, session fields null) — i.e. today's behavior.\n */\nexport class AuthPolicyResolver {\n\tasync resolveForIdentity(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<EffectivePolicy> {\n\t\tconst policies = await db.queryHandler.fetch(new AuthPoliciesQuery())\n\t\t// Fast path: with no policies configured, enforcement is inert and we skip\n\t\t// the cross-project role query entirely (preserves today's query shape).\n\t\tif (policies.length === 0) {\n\t\t\treturn { mfaRequired: false, tokenExpiration: null, idleTimeout: null, graceDuration: null, rememberMeAllowed: null }\n\t\t}\n\t\tconst projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId))\n\n\t\t// Map of project_id -> set of roles held in that project.\n\t\tconst rolesByProject = new Map<string, Set<string>>()\n\t\tfor (const { projectId, role } of projectRoles) {\n\t\t\tlet set = rolesByProject.get(projectId)\n\t\t\tif (!set) {\n\t\t\t\tset = new Set<string>()\n\t\t\t\trolesByProject.set(projectId, set)\n\t\t\t}\n\t\t\tset.add(role)\n\t\t}\n\n\t\tconst globalRoleSet = new Set(globalRoles)\n\n\t\tconst matched = policies.filter(policy => this.matches(policy, globalRoleSet, rolesByProject))\n\n\t\treturn this.aggregate(matched)\n\t}\n\n\tprivate matches(policy: AuthPolicyRow, globalRoles: Set<string>, rolesByProject: Map<string, Set<string>>): boolean {\n\t\tif (policy.scope === 'global') {\n\t\t\treturn policy.roles.some(role => globalRoles.has(role))\n\t\t}\n\t\tif (policy.scope === 'project') {\n\t\t\tif (policy.project_id === null) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst projectRoles = rolesByProject.get(policy.project_id)\n\t\t\tif (!projectRoles) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\treturn policy.roles.some(role => projectRoles.has(role))\n\t\t}\n\t\treturn false\n\t}\n\n\tprivate aggregate(policies: readonly AuthPolicyRow[]): EffectivePolicy {\n\t\tlet mfaRequired = false\n\t\tlet tokenExpiration: IPostgresInterval | null = null\n\t\tlet idleTimeout: IPostgresInterval | null = null\n\t\tlet graceDuration: IPostgresInterval | null = null\n\t\tlet rememberMeAllowed: boolean | null = null\n\n\t\tfor (const policy of policies) {\n\t\t\tif (policy.mfa_required === true) {\n\t\t\t\tmfaRequired = true\n\t\t\t}\n\t\t\ttokenExpiration = this.shortest(tokenExpiration, policy.token_expiration)\n\t\t\tidleTimeout = this.shortest(idleTimeout, policy.idle_timeout)\n\t\t\tgraceDuration = this.shortest(graceDuration, policy.grace_duration)\n\t\t\tif (policy.remember_me_allowed === false) {\n\t\t\t\trememberMeAllowed = false\n\t\t\t} else if (policy.remember_me_allowed === true && rememberMeAllowed === null) {\n\t\t\t\trememberMeAllowed = true\n\t\t\t}\n\t\t}\n\n\t\treturn { mfaRequired, tokenExpiration, idleTimeout, graceDuration, rememberMeAllowed }\n\t}\n\n\t/** Strictest wins: returns the shorter of two intervals (NULL = unconstrained). */\n\tprivate shortest(current: IPostgresInterval | null, candidate: IPostgresInterval | null): IPostgresInterval | null {\n\t\tif (candidate === null) {\n\t\t\treturn current\n\t\t}\n\t\tif (current === null) {\n\t\t\treturn candidate\n\t\t}\n\t\treturn intervalToSeconds(candidate) < intervalToSeconds(current) ? candidate : current\n\t}\n}\n"],"names":["AuthPoliciesQuery","AllProjectRolesByIdentityQuery","intervalToSeconds"],"mappings":";;;;;;;;;;;;;;AAqBO,MAAM,mBAAmB;AAAA,EAC/B,MAAM,mBAAmB,IAAqB,YAAoB,aAA0D;AAC3H,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIA,kBAAAA,mBAAmB;AAGpE,QAAI,SAAS,WAAW,GAAG;AAC1B,aAAO,EAAE,aAAa,OAAO,iBAAiB,MAAM,aAAa,MAAM,eAAe,MAAM,mBAAmB,KAAA;AAAA,IAChH;AACA,UAAM,eAAe,MAAM,GAAG,aAAa,MAAM,IAAIC,+BAAAA,+BAA+B,UAAU,CAAC;AAG/F,UAAM,qCAAqB,IAAA;AAC3B,eAAW,EAAE,WAAW,KAAA,KAAU,cAAc;AAC/C,UAAI,MAAM,eAAe,IAAI,SAAS;AACtC,UAAI,CAAC,KAAK;AACT,kCAAU,IAAA;AACV,uBAAe,IAAI,WAAW,GAAG;AAAA,MAClC;AACA,UAAI,IAAI,IAAI;AAAA,IACb;AAEA,UAAM,gBAAgB,IAAI,IAAI,WAAW;AAEzC,UAAM,UAAU,SAAS,OAAO,CAAA,WAAU,KAAK,QAAQ,QAAQ,eAAe,cAAc,CAAC;AAE7F,WAAO,KAAK,UAAU,OAAO;AAAA,EAC9B;AAAA,EAEQ,QAAQ,QAAuB,aAA0B,gBAAmD;AACnH,QAAI,OAAO,UAAU,UAAU;AAC9B,aAAO,OAAO,MAAM,KAAK,UAAQ,YAAY,IAAI,IAAI,CAAC;AAAA,IACvD;AACA,QAAI,OAAO,UAAU,WAAW;AAC/B,UAAI,OAAO,eAAe,MAAM;AAC/B,eAAO;AAAA,MACR;AACA,YAAM,eAAe,eAAe,IAAI,OAAO,UAAU;AACzD,UAAI,CAAC,cAAc;AAClB,eAAO;AAAA,MACR;AACA,aAAO,OAAO,MAAM,KAAK,UAAQ,aAAa,IAAI,IAAI,CAAC;AAAA,IACxD;AACA,WAAO;AAAA,EACR;AAAA,EAEQ,UAAU,UAAqD;AACtE,QAAI,cAAc;AAClB,QAAI,kBAA4C;AAChD,QAAI,cAAwC;AAC5C,QAAI,gBAA0C;AAC9C,QAAI,oBAAoC;AAExC,eAAW,UAAU,UAAU;AAC9B,UAAI,OAAO,iBAAiB,MAAM;AACjC,sBAAc;AAAA,MACf;AACA,wBAAkB,KAAK,SAAS,iBAAiB,OAAO,gBAAgB;AACxE,oBAAc,KAAK,SAAS,aAAa,OAAO,YAAY;AAC5D,sBAAgB,KAAK,SAAS,eAAe,OAAO,cAAc;AAClE,UAAI,OAAO,wBAAwB,OAAO;AACzC,4BAAoB;AAAA,MACrB,WAAW,OAAO,wBAAwB,QAAQ,sBAAsB,MAAM;AAC7E,4BAAoB;AAAA,MACrB;AAAA,IACD;AAEA,WAAO,EAAE,aAAa,iBAAiB,aAAa,eAAe,kBAAA;AAAA,EACpE;AAAA;AAAA,EAGQ,SAAS,SAAmC,WAA+D;AAClH,QAAI,cAAc,MAAM;AACvB,aAAO;AAAA,IACR;AACA,QAAI,YAAY,MAAM;AACrB,aAAO;AAAA,IACR;AACA,WAAOC,SAAAA,kBAAkB,SAAS,IAAIA,SAAAA,kBAAkB,OAAO,IAAI,YAAY;AAAA,EAChF;AACD;;"}

package/dist/production/src/model/service/AuthPolicyResolver.js

@@ -0,0 +1,84 @@
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../type/ApiKey.js";
+import { AuthPoliciesQuery } from "../queries/authPolicy/AuthPoliciesQuery.js";
+import { AllProjectRolesByIdentityQuery } from "../queries/membership/AllProjectRolesByIdentityQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
+import "../authorization/PermissionContext.js";
+import "../authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import { intervalToSeconds } from "../utils/interval.js";
+class AuthPolicyResolver {
+  async resolveForIdentity(db, identityId, globalRoles) {
+    const policies = await db.queryHandler.fetch(new AuthPoliciesQuery());
+    if (policies.length === 0) {
+      return { mfaRequired: false, tokenExpiration: null, idleTimeout: null, graceDuration: null, rememberMeAllowed: null };
+    }
+    const projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId));
+    const rolesByProject = /* @__PURE__ */ new Map();
+    for (const { projectId, role } of projectRoles) {
+      let set = rolesByProject.get(projectId);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        rolesByProject.set(projectId, set);
+      }
+      set.add(role);
+    }
+    const globalRoleSet = new Set(globalRoles);
+    const matched = policies.filter((policy) => this.matches(policy, globalRoleSet, rolesByProject));
+    return this.aggregate(matched);
+  }
+  matches(policy, globalRoles, rolesByProject) {
+    if (policy.scope === "global") {
+      return policy.roles.some((role) => globalRoles.has(role));
+    }
+    if (policy.scope === "project") {
+      if (policy.project_id === null) {
+        return false;
+      }
+      const projectRoles = rolesByProject.get(policy.project_id);
+      if (!projectRoles) {
+        return false;
+      }
+      return policy.roles.some((role) => projectRoles.has(role));
+    }
+    return false;
+  }
+  aggregate(policies) {
+    let mfaRequired = false;
+    let tokenExpiration = null;
+    let idleTimeout = null;
+    let graceDuration = null;
+    let rememberMeAllowed = null;
+    for (const policy of policies) {
+      if (policy.mfa_required === true) {
+        mfaRequired = true;
+      }
+      tokenExpiration = this.shortest(tokenExpiration, policy.token_expiration);
+      idleTimeout = this.shortest(idleTimeout, policy.idle_timeout);
+      graceDuration = this.shortest(graceDuration, policy.grace_duration);
+      if (policy.remember_me_allowed === false) {
+        rememberMeAllowed = false;
+      } else if (policy.remember_me_allowed === true && rememberMeAllowed === null) {
+        rememberMeAllowed = true;
+      }
+    }
+    return { mfaRequired, tokenExpiration, idleTimeout, graceDuration, rememberMeAllowed };
+  }
+  /** Strictest wins: returns the shorter of two intervals (NULL = unconstrained). */
+  shortest(current, candidate) {
+    if (candidate === null) {
+      return current;
+    }
+    if (current === null) {
+      return candidate;
+    }
+    return intervalToSeconds(candidate) < intervalToSeconds(current) ? candidate : current;
+  }
+}
+export {
+  AuthPolicyResolver
+};
+//# sourceMappingURL=AuthPolicyResolver.js.map

package/dist/production/src/model/service/AuthPolicyResolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyResolver.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { AllProjectRolesByIdentityQuery, AuthPoliciesQuery } from '../queries/index.js'\nimport { AuthPolicyRow, EffectivePolicy } from '../type/index.js'\nimport { IPostgresInterval } from 'postgres-interval'\nimport { intervalToSeconds } from '../utils/interval.js'\n\n/**\n * Resolves the effective auth policy for an identity by aggregating all matching\n * `auth_policy` rows across the identity's entire role set (global roles + every\n * project-membership role across all projects).\n *\n * Shared by A06 (consumes `mfaRequired`) and A19 (consumes the session fields).\n *\n * Aggregation:\n * - `mfaRequired` = OR of every matched row's `mfa_required` (NULL = no opinion).\n * - session fields = strictest wins: the shortest `tokenExpiration` / `idleTimeout`\n *   and the logical AND of `rememberMeAllowed` (any matched `false` wins).\n *\n * When nothing matches, the result is the inert baseline\n * (`mfaRequired=false`, session fields null) — i.e. today's behavior.\n */\nexport class AuthPolicyResolver {\n\tasync resolveForIdentity(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<EffectivePolicy> {\n\t\tconst policies = await db.queryHandler.fetch(new AuthPoliciesQuery())\n\t\t// Fast path: with no policies configured, enforcement is inert and we skip\n\t\t// the cross-project role query entirely (preserves today's query shape).\n\t\tif (policies.length === 0) {\n\t\t\treturn { mfaRequired: false, tokenExpiration: null, idleTimeout: null, graceDuration: null, rememberMeAllowed: null }\n\t\t}\n\t\tconst projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId))\n\n\t\t// Map of project_id -> set of roles held in that project.\n\t\tconst rolesByProject = new Map<string, Set<string>>()\n\t\tfor (const { projectId, role } of projectRoles) {\n\t\t\tlet set = rolesByProject.get(projectId)\n\t\t\tif (!set) {\n\t\t\t\tset = new Set<string>()\n\t\t\t\trolesByProject.set(projectId, set)\n\t\t\t}\n\t\t\tset.add(role)\n\t\t}\n\n\t\tconst globalRoleSet = new Set(globalRoles)\n\n\t\tconst matched = policies.filter(policy => this.matches(policy, globalRoleSet, rolesByProject))\n\n\t\treturn this.aggregate(matched)\n\t}\n\n\tprivate matches(policy: AuthPolicyRow, globalRoles: Set<string>, rolesByProject: Map<string, Set<string>>): boolean {\n\t\tif (policy.scope === 'global') {\n\t\t\treturn policy.roles.some(role => globalRoles.has(role))\n\t\t}\n\t\tif (policy.scope === 'project') {\n\t\t\tif (policy.project_id === null) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst projectRoles = rolesByProject.get(policy.project_id)\n\t\t\tif (!projectRoles) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\treturn policy.roles.some(role => projectRoles.has(role))\n\t\t}\n\t\treturn false\n\t}\n\n\tprivate aggregate(policies: readonly AuthPolicyRow[]): EffectivePolicy {\n\t\tlet mfaRequired = false\n\t\tlet tokenExpiration: IPostgresInterval | null = null\n\t\tlet idleTimeout: IPostgresInterval | null = null\n\t\tlet graceDuration: IPostgresInterval | null = null\n\t\tlet rememberMeAllowed: boolean | null = null\n\n\t\tfor (const policy of policies) {\n\t\t\tif (policy.mfa_required === true) {\n\t\t\t\tmfaRequired = true\n\t\t\t}\n\t\t\ttokenExpiration = this.shortest(tokenExpiration, policy.token_expiration)\n\t\t\tidleTimeout = this.shortest(idleTimeout, policy.idle_timeout)\n\t\t\tgraceDuration = this.shortest(graceDuration, policy.grace_duration)\n\t\t\tif (policy.remember_me_allowed === false) {\n\t\t\t\trememberMeAllowed = false\n\t\t\t} else if (policy.remember_me_allowed === true && rememberMeAllowed === null) {\n\t\t\t\trememberMeAllowed = true\n\t\t\t}\n\t\t}\n\n\t\treturn { mfaRequired, tokenExpiration, idleTimeout, graceDuration, rememberMeAllowed }\n\t}\n\n\t/** Strictest wins: returns the shorter of two intervals (NULL = unconstrained). */\n\tprivate shortest(current: IPostgresInterval | null, candidate: IPostgresInterval | null): IPostgresInterval | null {\n\t\tif (candidate === null) {\n\t\t\treturn current\n\t\t}\n\t\tif (current === null) {\n\t\t\treturn candidate\n\t\t}\n\t\treturn intervalToSeconds(candidate) < intervalToSeconds(current) ? candidate : current\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAqBO,MAAM,mBAAmB;AAAA,EAC/B,MAAM,mBAAmB,IAAqB,YAAoB,aAA0D;AAC3H,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAI,mBAAmB;AAGpE,QAAI,SAAS,WAAW,GAAG;AAC1B,aAAO,EAAE,aAAa,OAAO,iBAAiB,MAAM,aAAa,MAAM,eAAe,MAAM,mBAAmB,KAAA;AAAA,IAChH;AACA,UAAM,eAAe,MAAM,GAAG,aAAa,MAAM,IAAI,+BAA+B,UAAU,CAAC;AAG/F,UAAM,qCAAqB,IAAA;AAC3B,eAAW,EAAE,WAAW,KAAA,KAAU,cAAc;AAC/C,UAAI,MAAM,eAAe,IAAI,SAAS;AACtC,UAAI,CAAC,KAAK;AACT,kCAAU,IAAA;AACV,uBAAe,IAAI,WAAW,GAAG;AAAA,MAClC;AACA,UAAI,IAAI,IAAI;AAAA,IACb;AAEA,UAAM,gBAAgB,IAAI,IAAI,WAAW;AAEzC,UAAM,UAAU,SAAS,OAAO,CAAA,WAAU,KAAK,QAAQ,QAAQ,eAAe,cAAc,CAAC;AAE7F,WAAO,KAAK,UAAU,OAAO;AAAA,EAC9B;AAAA,EAEQ,QAAQ,QAAuB,aAA0B,gBAAmD;AACnH,QAAI,OAAO,UAAU,UAAU;AAC9B,aAAO,OAAO,MAAM,KAAK,UAAQ,YAAY,IAAI,IAAI,CAAC;AAAA,IACvD;AACA,QAAI,OAAO,UAAU,WAAW;AAC/B,UAAI,OAAO,eAAe,MAAM;AAC/B,eAAO;AAAA,MACR;AACA,YAAM,eAAe,eAAe,IAAI,OAAO,UAAU;AACzD,UAAI,CAAC,cAAc;AAClB,eAAO;AAAA,MACR;AACA,aAAO,OAAO,MAAM,KAAK,UAAQ,aAAa,IAAI,IAAI,CAAC;AAAA,IACxD;AACA,WAAO;AAAA,EACR;AAAA,EAEQ,UAAU,UAAqD;AACtE,QAAI,cAAc;AAClB,QAAI,kBAA4C;AAChD,QAAI,cAAwC;AAC5C,QAAI,gBAA0C;AAC9C,QAAI,oBAAoC;AAExC,eAAW,UAAU,UAAU;AAC9B,UAAI,OAAO,iBAAiB,MAAM;AACjC,sBAAc;AAAA,MACf;AACA,wBAAkB,KAAK,SAAS,iBAAiB,OAAO,gBAAgB;AACxE,oBAAc,KAAK,SAAS,aAAa,OAAO,YAAY;AAC5D,sBAAgB,KAAK,SAAS,eAAe,OAAO,cAAc;AAClE,UAAI,OAAO,wBAAwB,OAAO;AACzC,4BAAoB;AAAA,MACrB,WAAW,OAAO,wBAAwB,QAAQ,sBAAsB,MAAM;AAC7E,4BAAoB;AAAA,MACrB;AAAA,IACD;AAEA,WAAO,EAAE,aAAa,iBAAiB,aAAa,eAAe,kBAAA;AAAA,EACpE;AAAA;AAAA,EAGQ,SAAS,SAAmC,WAA+D;AAClH,QAAI,cAAc,MAAM;AACvB,aAAO;AAAA,IACR;AACA,QAAI,YAAY,MAAM;AACrB,aAAO;AAAA,IACR;AACA,WAAO,kBAAkB,SAAS,IAAI,kBAAkB,OAAO,IAAI,YAAY;AAAA,EAChF;AACD;"}

package/dist/production/src/model/service/BackupCodeManager.cjs

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+require("../type/ApiKey.cjs");
+const token = require("../utils/token.cjs");
+const ConsumeBackupCodeCommand = require("../commands/backupCode/ConsumeBackupCodeCommand.cjs");
+const CreateBackupCodeCommand = require("../commands/backupCode/CreateBackupCodeCommand.cjs");
+const DeleteBackupCodesCommand = require("../commands/backupCode/DeleteBackupCodesCommand.cjs");
+const BACKUP_CODE_COUNT = 10;
+const BACKUP_CODE_LENGTH = 10;
+const ALPHABET = "abcdefghijkmnpqrstuvwxyz23456789";
+class BackupCodeManager {
+  constructor(mailer, providers) {
+    this.mailer = mailer;
+    this.providers = providers;
+  }
+  /**
+   * Replaces the whole set: deletes any existing codes for the person, issues
+   * {@link BACKUP_CODE_COUNT} fresh ones, stores their hashes and returns the
+   * formatted plaintext codes (to be shown once).
+   */
+  async generate(dbContext, personId) {
+    const codes = [];
+    for (let i = 0; i < BACKUP_CODE_COUNT; i++) {
+      codes.push(await this.generateCode());
+    }
+    await dbContext.transaction(async (tx) => {
+      await tx.commandBus.execute(new DeleteBackupCodesCommand.DeleteBackupCodesCommand(personId));
+      for (const code of codes) {
+        await tx.commandBus.execute(new CreateBackupCodeCommand.CreateBackupCodeCommand(personId, this.hash(this.normalize(code))));
+      }
+    });
+    return codes;
+  }
+  /**
+   * Normalizes the supplied code, then atomically consumes a single unused
+   * matching code. Returns whether a code was actually consumed. Safe against
+   * double-spend (see {@link ConsumeBackupCodeCommand}).
+   */
+  async verifyAndConsume(dbContext, person, code) {
+    const normalized = this.normalize(code);
+    if (normalized.length === 0) {
+      return false;
+    }
+    const consumed = await dbContext.commandBus.execute(new ConsumeBackupCodeCommand.ConsumeBackupCodeCommand(person.id, this.hash(normalized)));
+    if (consumed && await this.countUnused(dbContext, person.id) === 0) {
+      try {
+        await this.mailer.sendBackupCodesExhaustedEmail(dbContext, { email: person.email ?? "" }, { projectId: null, variant: "" });
+      } catch {
+      }
+    }
+    return consumed;
+  }
+  async deleteForPerson(dbContext, personId) {
+    await dbContext.commandBus.execute(new DeleteBackupCodesCommand.DeleteBackupCodesCommand(personId));
+  }
+  /** Number of still-usable backup codes for the person. */
+  async countUnused(dbContext, personId) {
+    const rows = await Database.SelectBuilder.create().from("person_backup_code").select(new Database.Literal("count(*)::text as count")).where({ person_id: personId }).where((expr) => expr.isNull("used_at")).getResult(dbContext.client);
+    return Number(rows[0]?.count ?? "0");
+  }
+  /** Strips formatting (hyphens/whitespace) and lowercases — display formatting must not affect verification. */
+  normalize(code) {
+    return code.replace(/[\s-]/g, "").toLowerCase();
+  }
+  hash(normalizedCode) {
+    return token.computeTokenHash(normalizedCode);
+  }
+  async generateCode() {
+    const bytes = await this.providers.randomBytes(BACKUP_CODE_LENGTH);
+    let raw = "";
+    for (let i = 0; i < BACKUP_CODE_LENGTH; i++) {
+      raw += ALPHABET[bytes[i] % ALPHABET.length];
+    }
+    const mid = Math.floor(BACKUP_CODE_LENGTH / 2);
+    return `${raw.slice(0, mid)}-${raw.slice(mid)}`;
+  }
+}
+exports.BackupCodeManager = BackupCodeManager;
+//# sourceMappingURL=BackupCodeManager.cjs.map

package/dist/production/src/model/service/BackupCodeManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackupCodeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/BackupCodeManager.ts"],"sourcesContent":["import { Literal, SelectBuilder } from '@contember/database'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { ConsumeBackupCodeCommand, CreateBackupCodeCommand, DeleteBackupCodesCommand } from '../commands/index.js'\nimport { computeTokenHash } from '../utils/token.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonRow } from '../queries/index.js'\n\n/** Number of backup codes issued per generation. */\nconst BACKUP_CODE_COUNT = 10\n/** Number of significant characters per backup code (before formatting). */\nconst BACKUP_CODE_LENGTH = 10\n/**\n * Unambiguous lowercase alphabet, without the easily confused characters\n * 0/1/l/o. 32 symbols (base32-style).\n */\nconst ALPHABET = 'abcdefghijkmnpqrstuvwxyz23456789'\n\n/**\n * Manages MFA backup/recovery codes (the `person_backup_code` table).\n *\n * Codes only exist for a person who has enrolled TOTP. Behavior for everyone\n * else is unchanged. Plaintext codes are shown exactly once (on generation);\n * only their sha256 hashes are stored.\n */\nexport class BackupCodeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly providers: Pick<Providers, 'uuid' | 'now' | 'randomBytes'>,\n\t) {}\n\n\t/**\n\t * Replaces the whole set: deletes any existing codes for the person, issues\n\t * {@link BACKUP_CODE_COUNT} fresh ones, stores their hashes and returns the\n\t * formatted plaintext codes (to be shown once).\n\t */\n\tasync generate(dbContext: DatabaseContext, personId: string): Promise<string[]> {\n\t\tconst codes: string[] = []\n\t\tfor (let i = 0; i < BACKUP_CODE_COUNT; i++) {\n\t\t\tcodes.push(await this.generateCode())\n\t\t}\n\t\t// Replace the whole set atomically: a mid-flow failure must never leave the\n\t\t// person with a partial set that doesn't match the plaintext codes returned\n\t\t// to (and shown once to) the caller.\n\t\tawait dbContext.transaction(async tx => {\n\t\t\tawait tx.commandBus.execute(new DeleteBackupCodesCommand(personId))\n\t\t\tfor (const code of codes) {\n\t\t\t\t// Hash the normalized form so verification (which normalizes its input) matches.\n\t\t\t\tawait tx.commandBus.execute(new CreateBackupCodeCommand(personId, this.hash(this.normalize(code))))\n\t\t\t}\n\t\t})\n\t\treturn codes\n\t}\n\n\t/**\n\t * Normalizes the supplied code, then atomically consumes a single unused\n\t * matching code. Returns whether a code was actually consumed. Safe against\n\t * double-spend (see {@link ConsumeBackupCodeCommand}).\n\t */\n\tasync verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean> {\n\t\tconst normalized = this.normalize(code)\n\t\tif (normalized.length === 0) {\n\t\t\treturn false\n\t\t}\n\t\tconst consumed = await dbContext.commandBus.execute(new ConsumeBackupCodeCommand(person.id, this.hash(normalized)))\n\t\tif (consumed && (await this.countUnused(dbContext, person.id)) === 0) {\n\t\t\t// Best-effort: notify the person they have no backup codes left. A failed\n\t\t\t// email must never block or fail sign-in, so swallow any error.\n\t\t\ttry {\n\t\t\t\tawait this.mailer.sendBackupCodesExhaustedEmail(dbContext, { email: person.email ?? '' }, { projectId: null, variant: '' })\n\t\t\t} catch {\n\t\t\t\t// ignore\n\t\t\t}\n\t\t}\n\t\treturn consumed\n\t}\n\n\tasync deleteForPerson(dbContext: DatabaseContext, personId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DeleteBackupCodesCommand(personId))\n\t}\n\n\t/** Number of still-usable backup codes for the person. */\n\tasync countUnused(dbContext: DatabaseContext, personId: string): Promise<number> {\n\t\tconst rows = await SelectBuilder.create<{ count: string }>()\n\t\t\t.from('person_backup_code')\n\t\t\t.select(new Literal('count(*)::text as count'))\n\t\t\t.where({ person_id: personId })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.getResult(dbContext.client)\n\t\treturn Number(rows[0]?.count ?? '0')\n\t}\n\n\t/** Strips formatting (hyphens/whitespace) and lowercases — display formatting must not affect verification. */\n\tprivate normalize(code: string): string {\n\t\treturn code.replace(/[\\s-]/g, '').toLowerCase()\n\t}\n\n\tprivate hash(normalizedCode: string): string {\n\t\treturn computeTokenHash(normalizedCode)\n\t}\n\n\tprivate async generateCode(): Promise<string> {\n\t\tconst bytes = await this.providers.randomBytes(BACKUP_CODE_LENGTH)\n\t\tlet raw = ''\n\t\tfor (let i = 0; i < BACKUP_CODE_LENGTH; i++) {\n\t\t\traw += ALPHABET[bytes[i] % ALPHABET.length]\n\t\t}\n\t\t// Single hyphen in the middle for readability, e.g. \"abcde-fghij\".\n\t\tconst mid = Math.floor(BACKUP_CODE_LENGTH / 2)\n\t\treturn `${raw.slice(0, mid)}-${raw.slice(mid)}`\n\t}\n}\n"],"names":["DeleteBackupCodesCommand","CreateBackupCodeCommand","ConsumeBackupCodeCommand","SelectBuilder","Literal","computeTokenHash"],"mappings":";;;;;;;;AASA,MAAM,oBAAoB;AAE1B,MAAM,qBAAqB;AAK3B,MAAM,WAAW;AASV,MAAM,kBAAkB;AAAA,EAC9B,YACkB,QACA,WAChB;AAFgB,SAAA,SAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOH,MAAM,SAAS,WAA4B,UAAqC;AAC/E,UAAM,QAAkB,CAAA;AACxB,aAAS,IAAI,GAAG,IAAI,mBAAmB,KAAK;AAC3C,YAAM,KAAK,MAAM,KAAK,aAAA,CAAc;AAAA,IACrC;AAIA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,YAAM,GAAG,WAAW,QAAQ,IAAIA,yBAAAA,yBAAyB,QAAQ,CAAC;AAClE,iBAAW,QAAQ,OAAO;AAEzB,cAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,UAAU,KAAK,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC;AAAA,MACnG;AAAA,IACD,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBAAiB,WAA4B,QAAmB,MAAgC;AACrG,UAAM,aAAa,KAAK,UAAU,IAAI;AACtC,QAAI,WAAW,WAAW,GAAG;AAC5B,aAAO;AAAA,IACR;AACA,UAAM,WAAW,MAAM,UAAU,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,OAAO,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC;AAClH,QAAI,YAAa,MAAM,KAAK,YAAY,WAAW,OAAO,EAAE,MAAO,GAAG;AAGrE,UAAI;AACH,cAAM,KAAK,OAAO,8BAA8B,WAAW,EAAE,OAAO,OAAO,SAAS,GAAA,GAAM,EAAE,WAAW,MAAM,SAAS,IAAI;AAAA,MAC3H,QAAQ;AAAA,MAER;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,gBAAgB,WAA4B,UAAiC;AAClF,UAAM,UAAU,WAAW,QAAQ,IAAIF,yBAAAA,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AAAA;AAAA,EAGA,MAAM,YAAY,WAA4B,UAAmC;AAChF,UAAM,OAAO,MAAMG,uBAAc,OAAA,EAC/B,KAAK,oBAAoB,EACzB,OAAO,IAAIC,SAAAA,QAAQ,yBAAyB,CAAC,EAC7C,MAAM,EAAE,WAAW,SAAA,CAAU,EAC7B,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,UAAU,UAAU,MAAM;AAC5B,WAAO,OAAO,KAAK,CAAC,GAAG,SAAS,GAAG;AAAA,EACpC;AAAA;AAAA,EAGQ,UAAU,MAAsB;AACvC,WAAO,KAAK,QAAQ,UAAU,EAAE,EAAE,YAAA;AAAA,EACnC;AAAA,EAEQ,KAAK,gBAAgC;AAC5C,WAAOC,MAAAA,iBAAiB,cAAc;AAAA,EACvC;AAAA,EAEA,MAAc,eAAgC;AAC7C,UAAM,QAAQ,MAAM,KAAK,UAAU,YAAY,kBAAkB;AACjE,QAAI,MAAM;AACV,aAAS,IAAI,GAAG,IAAI,oBAAoB,KAAK;AAC5C,aAAO,SAAS,MAAM,CAAC,IAAI,SAAS,MAAM;AAAA,IAC3C;AAEA,UAAM,MAAM,KAAK,MAAM,qBAAqB,CAAC;AAC7C,WAAO,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC;AAAA,EAC9C;AACD;;"}

package/dist/production/src/model/service/BackupCodeManager.js

@@ -0,0 +1,80 @@
+import { SelectBuilder, Literal } from "@contember/database";
+import "../type/ApiKey.js";
+import { computeTokenHash } from "../utils/token.js";
+import { ConsumeBackupCodeCommand } from "../commands/backupCode/ConsumeBackupCodeCommand.js";
+import { CreateBackupCodeCommand } from "../commands/backupCode/CreateBackupCodeCommand.js";
+import { DeleteBackupCodesCommand } from "../commands/backupCode/DeleteBackupCodesCommand.js";
+const BACKUP_CODE_COUNT = 10;
+const BACKUP_CODE_LENGTH = 10;
+const ALPHABET = "abcdefghijkmnpqrstuvwxyz23456789";
+class BackupCodeManager {
+  constructor(mailer, providers) {
+    this.mailer = mailer;
+    this.providers = providers;
+  }
+  /**
+   * Replaces the whole set: deletes any existing codes for the person, issues
+   * {@link BACKUP_CODE_COUNT} fresh ones, stores their hashes and returns the
+   * formatted plaintext codes (to be shown once).
+   */
+  async generate(dbContext, personId) {
+    const codes = [];
+    for (let i = 0; i < BACKUP_CODE_COUNT; i++) {
+      codes.push(await this.generateCode());
+    }
+    await dbContext.transaction(async (tx) => {
+      await tx.commandBus.execute(new DeleteBackupCodesCommand(personId));
+      for (const code of codes) {
+        await tx.commandBus.execute(new CreateBackupCodeCommand(personId, this.hash(this.normalize(code))));
+      }
+    });
+    return codes;
+  }
+  /**
+   * Normalizes the supplied code, then atomically consumes a single unused
+   * matching code. Returns whether a code was actually consumed. Safe against
+   * double-spend (see {@link ConsumeBackupCodeCommand}).
+   */
+  async verifyAndConsume(dbContext, person, code) {
+    const normalized = this.normalize(code);
+    if (normalized.length === 0) {
+      return false;
+    }
+    const consumed = await dbContext.commandBus.execute(new ConsumeBackupCodeCommand(person.id, this.hash(normalized)));
+    if (consumed && await this.countUnused(dbContext, person.id) === 0) {
+      try {
+        await this.mailer.sendBackupCodesExhaustedEmail(dbContext, { email: person.email ?? "" }, { projectId: null, variant: "" });
+      } catch {
+      }
+    }
+    return consumed;
+  }
+  async deleteForPerson(dbContext, personId) {
+    await dbContext.commandBus.execute(new DeleteBackupCodesCommand(personId));
+  }
+  /** Number of still-usable backup codes for the person. */
+  async countUnused(dbContext, personId) {
+    const rows = await SelectBuilder.create().from("person_backup_code").select(new Literal("count(*)::text as count")).where({ person_id: personId }).where((expr) => expr.isNull("used_at")).getResult(dbContext.client);
+    return Number(rows[0]?.count ?? "0");
+  }
+  /** Strips formatting (hyphens/whitespace) and lowercases — display formatting must not affect verification. */
+  normalize(code) {
+    return code.replace(/[\s-]/g, "").toLowerCase();
+  }
+  hash(normalizedCode) {
+    return computeTokenHash(normalizedCode);
+  }
+  async generateCode() {
+    const bytes = await this.providers.randomBytes(BACKUP_CODE_LENGTH);
+    let raw = "";
+    for (let i = 0; i < BACKUP_CODE_LENGTH; i++) {
+      raw += ALPHABET[bytes[i] % ALPHABET.length];
+    }
+    const mid = Math.floor(BACKUP_CODE_LENGTH / 2);
+    return `${raw.slice(0, mid)}-${raw.slice(mid)}`;
+  }
+}
+export {
+  BackupCodeManager
+};
+//# sourceMappingURL=BackupCodeManager.js.map

package/dist/production/src/model/service/BackupCodeManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackupCodeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/BackupCodeManager.ts"],"sourcesContent":["import { Literal, SelectBuilder } from '@contember/database'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { ConsumeBackupCodeCommand, CreateBackupCodeCommand, DeleteBackupCodesCommand } from '../commands/index.js'\nimport { computeTokenHash } from '../utils/token.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonRow } from '../queries/index.js'\n\n/** Number of backup codes issued per generation. */\nconst BACKUP_CODE_COUNT = 10\n/** Number of significant characters per backup code (before formatting). */\nconst BACKUP_CODE_LENGTH = 10\n/**\n * Unambiguous lowercase alphabet, without the easily confused characters\n * 0/1/l/o. 32 symbols (base32-style).\n */\nconst ALPHABET = 'abcdefghijkmnpqrstuvwxyz23456789'\n\n/**\n * Manages MFA backup/recovery codes (the `person_backup_code` table).\n *\n * Codes only exist for a person who has enrolled TOTP. Behavior for everyone\n * else is unchanged. Plaintext codes are shown exactly once (on generation);\n * only their sha256 hashes are stored.\n */\nexport class BackupCodeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly providers: Pick<Providers, 'uuid' | 'now' | 'randomBytes'>,\n\t) {}\n\n\t/**\n\t * Replaces the whole set: deletes any existing codes for the person, issues\n\t * {@link BACKUP_CODE_COUNT} fresh ones, stores their hashes and returns the\n\t * formatted plaintext codes (to be shown once).\n\t */\n\tasync generate(dbContext: DatabaseContext, personId: string): Promise<string[]> {\n\t\tconst codes: string[] = []\n\t\tfor (let i = 0; i < BACKUP_CODE_COUNT; i++) {\n\t\t\tcodes.push(await this.generateCode())\n\t\t}\n\t\t// Replace the whole set atomically: a mid-flow failure must never leave the\n\t\t// person with a partial set that doesn't match the plaintext codes returned\n\t\t// to (and shown once to) the caller.\n\t\tawait dbContext.transaction(async tx => {\n\t\t\tawait tx.commandBus.execute(new DeleteBackupCodesCommand(personId))\n\t\t\tfor (const code of codes) {\n\t\t\t\t// Hash the normalized form so verification (which normalizes its input) matches.\n\t\t\t\tawait tx.commandBus.execute(new CreateBackupCodeCommand(personId, this.hash(this.normalize(code))))\n\t\t\t}\n\t\t})\n\t\treturn codes\n\t}\n\n\t/**\n\t * Normalizes the supplied code, then atomically consumes a single unused\n\t * matching code. Returns whether a code was actually consumed. Safe against\n\t * double-spend (see {@link ConsumeBackupCodeCommand}).\n\t */\n\tasync verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean> {\n\t\tconst normalized = this.normalize(code)\n\t\tif (normalized.length === 0) {\n\t\t\treturn false\n\t\t}\n\t\tconst consumed = await dbContext.commandBus.execute(new ConsumeBackupCodeCommand(person.id, this.hash(normalized)))\n\t\tif (consumed && (await this.countUnused(dbContext, person.id)) === 0) {\n\t\t\t// Best-effort: notify the person they have no backup codes left. A failed\n\t\t\t// email must never block or fail sign-in, so swallow any error.\n\t\t\ttry {\n\t\t\t\tawait this.mailer.sendBackupCodesExhaustedEmail(dbContext, { email: person.email ?? '' }, { projectId: null, variant: '' })\n\t\t\t} catch {\n\t\t\t\t// ignore\n\t\t\t}\n\t\t}\n\t\treturn consumed\n\t}\n\n\tasync deleteForPerson(dbContext: DatabaseContext, personId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DeleteBackupCodesCommand(personId))\n\t}\n\n\t/** Number of still-usable backup codes for the person. */\n\tasync countUnused(dbContext: DatabaseContext, personId: string): Promise<number> {\n\t\tconst rows = await SelectBuilder.create<{ count: string }>()\n\t\t\t.from('person_backup_code')\n\t\t\t.select(new Literal('count(*)::text as count'))\n\t\t\t.where({ person_id: personId })\n\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t.getResult(dbContext.client)\n\t\treturn Number(rows[0]?.count ?? '0')\n\t}\n\n\t/** Strips formatting (hyphens/whitespace) and lowercases — display formatting must not affect verification. */\n\tprivate normalize(code: string): string {\n\t\treturn code.replace(/[\\s-]/g, '').toLowerCase()\n\t}\n\n\tprivate hash(normalizedCode: string): string {\n\t\treturn computeTokenHash(normalizedCode)\n\t}\n\n\tprivate async generateCode(): Promise<string> {\n\t\tconst bytes = await this.providers.randomBytes(BACKUP_CODE_LENGTH)\n\t\tlet raw = ''\n\t\tfor (let i = 0; i < BACKUP_CODE_LENGTH; i++) {\n\t\t\traw += ALPHABET[bytes[i] % ALPHABET.length]\n\t\t}\n\t\t// Single hyphen in the middle for readability, e.g. \"abcde-fghij\".\n\t\tconst mid = Math.floor(BACKUP_CODE_LENGTH / 2)\n\t\treturn `${raw.slice(0, mid)}-${raw.slice(mid)}`\n\t}\n}\n"],"names":[],"mappings":";;;;;;AASA,MAAM,oBAAoB;AAE1B,MAAM,qBAAqB;AAK3B,MAAM,WAAW;AASV,MAAM,kBAAkB;AAAA,EAC9B,YACkB,QACA,WAChB;AAFgB,SAAA,SAAA;AACA,SAAA,YAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOH,MAAM,SAAS,WAA4B,UAAqC;AAC/E,UAAM,QAAkB,CAAA;AACxB,aAAS,IAAI,GAAG,IAAI,mBAAmB,KAAK;AAC3C,YAAM,KAAK,MAAM,KAAK,aAAA,CAAc;AAAA,IACrC;AAIA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,YAAM,GAAG,WAAW,QAAQ,IAAI,yBAAyB,QAAQ,CAAC;AAClE,iBAAW,QAAQ,OAAO;AAEzB,cAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,UAAU,KAAK,KAAK,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC;AAAA,MACnG;AAAA,IACD,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBAAiB,WAA4B,QAAmB,MAAgC;AACrG,UAAM,aAAa,KAAK,UAAU,IAAI;AACtC,QAAI,WAAW,WAAW,GAAG;AAC5B,aAAO;AAAA,IACR;AACA,UAAM,WAAW,MAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,OAAO,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC;AAClH,QAAI,YAAa,MAAM,KAAK,YAAY,WAAW,OAAO,EAAE,MAAO,GAAG;AAGrE,UAAI;AACH,cAAM,KAAK,OAAO,8BAA8B,WAAW,EAAE,OAAO,OAAO,SAAS,GAAA,GAAM,EAAE,WAAW,MAAM,SAAS,IAAI;AAAA,MAC3H,QAAQ;AAAA,MAER;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,gBAAgB,WAA4B,UAAiC;AAClF,UAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,QAAQ,CAAC;AAAA,EAC1E;AAAA;AAAA,EAGA,MAAM,YAAY,WAA4B,UAAmC;AAChF,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,KAAK,oBAAoB,EACzB,OAAO,IAAI,QAAQ,yBAAyB,CAAC,EAC7C,MAAM,EAAE,WAAW,SAAA,CAAU,EAC7B,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,UAAU,UAAU,MAAM;AAC5B,WAAO,OAAO,KAAK,CAAC,GAAG,SAAS,GAAG;AAAA,EACpC;AAAA;AAAA,EAGQ,UAAU,MAAsB;AACvC,WAAO,KAAK,QAAQ,UAAU,EAAE,EAAE,YAAA;AAAA,EACnC;AAAA,EAEQ,KAAK,gBAAgC;AAC5C,WAAO,iBAAiB,cAAc;AAAA,EACvC;AAAA,EAEA,MAAc,eAAgC;AAC7C,UAAM,QAAQ,MAAM,KAAK,UAAU,YAAY,kBAAkB;AACjE,QAAI,MAAM;AACV,aAAS,IAAI,GAAG,IAAI,oBAAoB,KAAK;AAC5C,aAAO,SAAS,MAAM,CAAC,IAAI,SAAS,MAAM;AAAA,IAC3C;AAEA,UAAM,MAAM,KAAK,MAAM,qBAAqB,CAAC;AAC7C,WAAO,GAAG,IAAI,MAAM,GAAG,GAAG,CAAC,IAAI,IAAI,MAAM,GAAG,CAAC;AAAA,EAC9C;AACD;"}

package/dist/production/src/model/service/ConfigurationManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ConfigurationManager.ts"],"sourcesContent":["import { ConfigInput, ConfigureErrorCode } from '../../schema'\nimport { Response, ResponseOk } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\nimport { UpdateConfigurationCommand } from '../commands'\n\nexport class ConfigurationManager {\n\tpublic async updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>> {\n\t\t// todo: validate configuration\n\n\t\tawait db.commandBus.execute(new UpdateConfigurationCommand(configuration))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\n"],"names":["UpdateConfigurationCommand","ResponseOk"],"mappings":";;;;;;;AAKO,MAAM,qBAAqB;AAAA,EACjC,MAAa,oBAAoB,IAAqB,eAAyE;AAG9H,UAAM,GAAG,WAAW,QAAQ,IAAIA,2BAAAA,2BAA2B,aAAa,CAAC;AAEzE,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}
+{"version":3,"file":"ConfigurationManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ConfigurationManager.ts"],"sourcesContent":["import { ConfigInput, ConfigureErrorCode } from '../../schema/index.js'\nimport { Response, ResponseOk } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { UpdateConfigurationCommand } from '../commands/index.js'\n\nexport class ConfigurationManager {\n\tpublic async updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>> {\n\t\t// todo: validate configuration\n\n\t\tawait db.commandBus.execute(new UpdateConfigurationCommand(configuration))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\n"],"names":["UpdateConfigurationCommand","ResponseOk"],"mappings":";;;;;;;AAKO,MAAM,qBAAqB;AAAA,EACjC,MAAa,oBAAoB,IAAqB,eAAyE;AAG9H,UAAM,GAAG,WAAW,QAAQ,IAAIA,2BAAAA,2BAA2B,aAAa,CAAC;AAEzE,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}

package/dist/production/src/model/service/ConfigurationManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ConfigurationManager.ts"],"sourcesContent":["import { ConfigInput, ConfigureErrorCode } from '../../schema'\nimport { Response, ResponseOk } from '../utils/Response'\nimport { DatabaseContext } from '../utils'\nimport { UpdateConfigurationCommand } from '../commands'\n\nexport class ConfigurationManager {\n\tpublic async updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>> {\n\t\t// todo: validate configuration\n\n\t\tawait db.commandBus.execute(new UpdateConfigurationCommand(configuration))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\n"],"names":[],"mappings":";;;;;AAKO,MAAM,qBAAqB;AAAA,EACjC,MAAa,oBAAoB,IAAqB,eAAyE;AAG9H,UAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,aAAa,CAAC;AAEzE,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}
+{"version":3,"file":"ConfigurationManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ConfigurationManager.ts"],"sourcesContent":["import { ConfigInput, ConfigureErrorCode } from '../../schema/index.js'\nimport { Response, ResponseOk } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { UpdateConfigurationCommand } from '../commands/index.js'\n\nexport class ConfigurationManager {\n\tpublic async updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>> {\n\t\t// todo: validate configuration\n\n\t\tawait db.commandBus.execute(new UpdateConfigurationCommand(configuration))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\n"],"names":[],"mappings":";;;;;AAKO,MAAM,qBAAqB;AAAA,EACjC,MAAa,oBAAoB,IAAqB,eAAyE;AAG9H,UAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,aAAa,CAAC;AAEzE,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}

package/dist/production/src/model/service/CustomRoleManager.cjs

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+const Response = require("../utils/Response.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("../type/ApiKey.cjs");
+const CustomRolesQuery = require("../queries/customRole/CustomRolesQuery.cjs");
+const IdentitiesHoldingRoleCountQuery = require("../queries/identity/IdentitiesHoldingRoleCountQuery.cjs");
+const ProjectsQuery = require("../queries/project/ProjectsQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+const Roles = require("../authorization/Roles.cjs");
+const CustomRolePermissions = require("../authorization/CustomRolePermissions.cjs");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
+const CreateCustomRoleCommand = require("../commands/customRole/CreateCustomRoleCommand.cjs");
+const DeleteCustomRoleCommand = require("../commands/customRole/DeleteCustomRoleCommand.cjs");
+const RemoveCustomRoleAssignmentsCommand = require("../commands/customRole/RemoveCustomRoleAssignmentsCommand.cjs");
+const UpdateCustomRoleCommand = require("../commands/customRole/UpdateCustomRoleCommand.cjs");
+const GlobalRoleValidator = require("./GlobalRoleValidator.cjs");
+const SLUG_MAX_LENGTH = 64;
+class CustomRoleManager {
+  constructor(globalRoleValidator = new GlobalRoleValidator.GlobalRoleValidator()) {
+    this.globalRoleValidator = globalRoleValidator;
+  }
+  async listRoles(db) {
+    const rows = await db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery());
+    return rows.map((row) => this.toState(row));
+  }
+  async createRole(db, input) {
+    if (!Roles.ROLE_SLUG_PATTERN.test(input.slug) || input.slug.length > SLUG_MAX_LENGTH) {
+      return new Response.ResponseError("INVALID_SLUG", `Slug must match ${Roles.ROLE_SLUG_PATTERN} and be at most ${SLUG_MAX_LENGTH} characters long`);
+    }
+    if (CustomRolePermissions.BUILTIN_TENANT_ROLES.has(input.slug)) {
+      return new Response.ResponseError("INVALID_SLUG", `Slug ${input.slug} collides with a built-in role`);
+    }
+    const parsed = this.parseGrants(input.grants);
+    if (parsed instanceof Response.ResponseError) {
+      return parsed;
+    }
+    const referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, /* @__PURE__ */ new Set([input.slug]));
+    if (referenceError !== null) {
+      return referenceError;
+    }
+    const existing = await db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery({ slugs: [input.slug] }));
+    if (existing.length > 0) {
+      return new Response.ResponseError("SLUG_ALREADY_EXISTS", `Custom role ${input.slug} already exists`);
+    }
+    const holders = await db.queryHandler.fetch(new IdentitiesHoldingRoleCountQuery.IdentitiesHoldingRoleCountQuery(input.slug));
+    if (holders > 0) {
+      return new Response.ResponseError(
+        "SLUG_ALREADY_ASSIGNED",
+        `Role string ${input.slug} is already held by ${holders} identities; remove it from them before defining the role`
+      );
+    }
+    const id = await db.commandBus.execute(
+      new CreateCustomRoleCommand.CreateCustomRoleCommand({
+        slug: input.slug,
+        description: input.description,
+        grants: parsed.grants
+      })
+    );
+    return new Response.ResponseOk({
+      id,
+      role: {
+        slug: input.slug,
+        description: input.description,
+        grants: parsed.grants
+      }
+    });
+  }
+  /** Maps the racing-insert failure the transaction could not report itself. */
+  static isSlugConflict(error) {
+    return error instanceof Database.UniqueViolationError;
+  }
+  async updateRole(db, slug, input) {
+    const [current] = await db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery({ slugs: [slug], lock: Database.LockType.forUpdate }));
+    if (current === void 0) {
+      return new Response.ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    let canonicalGrants;
+    if (input.grants !== void 0) {
+      const parsed = this.parseGrants(input.grants);
+      if (parsed instanceof Response.ResponseError) {
+        return parsed;
+      }
+      const referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, /* @__PURE__ */ new Set([slug]));
+      if (referenceError !== null) {
+        return referenceError;
+      }
+      canonicalGrants = parsed.grants;
+    }
+    const before = this.toState(current);
+    const updated = await db.commandBus.execute(
+      new UpdateCustomRoleCommand.UpdateCustomRoleCommand(slug, {
+        description: input.description,
+        grants: canonicalGrants
+      })
+    );
+    if (!updated) {
+      return new Response.ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    return new Response.ResponseOk({
+      before,
+      after: {
+        slug,
+        description: input.description === void 0 ? before.description : input.description,
+        grants: canonicalGrants ?? before.grants
+      }
+    });
+  }
+  async deleteRole(db, slug) {
+    const [current] = await db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery({ slugs: [slug], lock: Database.LockType.forUpdate }));
+    if (current === void 0) {
+      return new Response.ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    const referencedBy = (await db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery())).filter((row) => row.slug !== slug && CustomRolePermissions.parsePersistedCustomRoleReferences(row.grants).includes(slug)).map((row) => row.slug);
+    if (referencedBy.length > 0) {
+      return new Response.ResponseError(
+        "ROLE_IN_USE",
+        `Custom role ${slug} is referenced by the grant configuration of ${referencedBy.join(", ")}`
+      );
+    }
+    const deleted = await db.commandBus.execute(new DeleteCustomRoleCommand.DeleteCustomRoleCommand(slug));
+    if (!deleted) {
+      return new Response.ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    const removedAssignmentIdentityIds = await db.commandBus.execute(new RemoveCustomRoleAssignmentsCommand.RemoveCustomRoleAssignmentsCommand(slug));
+    return new Response.ResponseOk({
+      before: this.toState(current),
+      removedAssignments: removedAssignmentIdentityIds.length,
+      removedAssignmentIdentityIds
+    });
+  }
+  parseGrants(grants) {
+    try {
+      return CustomRolePermissions.parseCustomRoleGrants(grants);
+    } catch (error) {
+      if (error instanceof CustomRolePermissions.CustomRoleGrantValidationError) {
+        return new Response.ResponseError(error.code, error.message);
+      }
+      throw error;
+    }
+  }
+  async validateReferences(db, roles, projects, additionallyActiveRoles) {
+    const invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles, additionallyActiveRoles);
+    if (invalidRole !== null) {
+      return new Response.ResponseError("INVALID_PERMISSION_CONFIGURATION", `Referenced role ${invalidRole} does not exist or is not globally assignable`);
+    }
+    if (projects.length > 0) {
+      const existingProjects = new Set((await db.queryHandler.fetch(new ProjectsQuery.ProjectsQuery())).map((project) => project.slug));
+      const missingProject = projects.find((project) => !existingProjects.has(project));
+      if (missingProject !== void 0) {
+        return new Response.ResponseError("INVALID_PERMISSION_CONFIGURATION", `Referenced project ${missingProject} does not exist`);
+      }
+    }
+    return null;
+  }
+  toState(row) {
+    return {
+      slug: row.slug,
+      description: row.description,
+      grants: CustomRolePermissions.parsePersistedCustomRoleGrants(row.grants)
+    };
+  }
+}
+exports.CustomRoleManager = CustomRoleManager;
+//# sourceMappingURL=CustomRoleManager.cjs.map

package/dist/production/src/model/service/CustomRoleManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/CustomRoleManager.ts"],"sourcesContent":["import { LockType, UniqueViolationError } from '@contember/database'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { CustomRolesQuery, IdentitiesHoldingRoleCountQuery, ProjectsQuery } from '../queries/index.js'\nimport { CreateCustomRoleCommand, DeleteCustomRoleCommand, RemoveCustomRoleAssignmentsCommand, UpdateCustomRoleCommand } from '../commands/index.js'\nimport { CustomRoleRow } from '../type/index.js'\nimport {\n\tBUILTIN_TENANT_ROLES,\n\tCanonicalCustomRoleGrant,\n\tCustomRoleGrantValidationError,\n\tparseCustomRoleGrants,\n\tparsePersistedCustomRoleGrants,\n\tparsePersistedCustomRoleReferences,\n} from '../authorization/CustomRolePermissions.js'\nimport { ROLE_SLUG_PATTERN } from '../authorization/Roles.js'\nimport { CreateCustomRoleErrorCode, DeleteCustomRoleErrorCode, UpdateCustomRoleErrorCode } from '../../schema/index.js'\nimport { GlobalRoleValidator } from './GlobalRoleValidator.js'\n\nconst SLUG_MAX_LENGTH = 64\n\nexport type CustomRoleState = {\n\treadonly slug: string\n\treadonly description: string | null\n\treadonly grants: readonly CanonicalCustomRoleGrant[]\n}\n\ntype CreateResult = {\n\treadonly id: string\n\treadonly role: CustomRoleState\n}\n\ntype UpdateResult = {\n\treadonly before: CustomRoleState\n\treadonly after: CustomRoleState\n}\n\ntype DeleteResult = {\n\treadonly before: CustomRoleState\n\treadonly removedAssignments: number\n\t/** Which identities lost the role — a count alone cannot answer \"who lost what\" after the fact. */\n\treadonly removedAssignmentIdentityIds: readonly string[]\n}\n\nexport class CustomRoleManager {\n\tconstructor(\n\t\tprivate readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),\n\t) {\n\t}\n\n\tasync listRoles(db: DatabaseContext): Promise<CustomRoleState[]> {\n\t\tconst rows = await db.queryHandler.fetch(new CustomRolesQuery())\n\t\treturn rows.map(row => this.toState(row))\n\t}\n\n\tasync createRole(\n\t\tdb: DatabaseContext,\n\t\tinput: { slug: string; description: string | null; grants: unknown },\n\t): Promise<Response<CreateResult, CreateCustomRoleErrorCode>> {\n\t\tif (!ROLE_SLUG_PATTERN.test(input.slug) || input.slug.length > SLUG_MAX_LENGTH) {\n\t\t\treturn new ResponseError('INVALID_SLUG', `Slug must match ${ROLE_SLUG_PATTERN} and be at most ${SLUG_MAX_LENGTH} characters long`)\n\t\t}\n\t\tif (BUILTIN_TENANT_ROLES.has(input.slug)) {\n\t\t\treturn new ResponseError('INVALID_SLUG', `Slug ${input.slug} collides with a built-in role`)\n\t\t}\n\t\tconst parsed = this.parseGrants(input.grants)\n\t\tif (parsed instanceof ResponseError) {\n\t\t\treturn parsed\n\t\t}\n\t\tconst referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, new Set([input.slug]))\n\t\tif (referenceError !== null) {\n\t\t\treturn referenceError\n\t\t}\n\t\tconst existing = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [input.slug] }))\n\t\tif (existing.length > 0) {\n\t\t\treturn new ResponseError('SLUG_ALREADY_EXISTS', `Custom role ${input.slug} already exists`)\n\t\t}\n\t\t// Only legacy rows can match: every assignment path rejects a slug with no custom_role row,\n\t\t// so no concurrent writer can add one before this insert commits.\n\t\tconst holders = await db.queryHandler.fetch(new IdentitiesHoldingRoleCountQuery(input.slug))\n\t\tif (holders > 0) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'SLUG_ALREADY_ASSIGNED',\n\t\t\t\t`Role string ${input.slug} is already held by ${holders} identities; remove it from them before defining the role`,\n\t\t\t)\n\t\t}\n\t\t// A racing INSERT aborts the transaction, so UniqueViolationError cannot be mapped\n\t\t// here — the caller catches it outside, once the transaction has rolled back.\n\t\tconst id = await db.commandBus.execute(\n\t\t\tnew CreateCustomRoleCommand({\n\t\t\t\tslug: input.slug,\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: parsed.grants,\n\t\t\t}),\n\t\t)\n\t\treturn new ResponseOk({\n\t\t\tid,\n\t\t\trole: {\n\t\t\t\tslug: input.slug,\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: parsed.grants,\n\t\t\t},\n\t\t})\n\t}\n\n\t/** Maps the racing-insert failure the transaction could not report itself. */\n\tstatic isSlugConflict(error: unknown): boolean {\n\t\treturn error instanceof UniqueViolationError\n\t}\n\n\tasync updateRole(\n\t\tdb: DatabaseContext,\n\t\tslug: string,\n\t\tinput: { description?: string | null; grants?: unknown },\n\t): Promise<Response<UpdateResult, UpdateCustomRoleErrorCode>> {\n\t\tconst [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }))\n\t\tif (current === undefined) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\tlet canonicalGrants: readonly CanonicalCustomRoleGrant[] | undefined\n\t\tif (input.grants !== undefined) {\n\t\t\tconst parsed = this.parseGrants(input.grants)\n\t\t\tif (parsed instanceof ResponseError) {\n\t\t\t\treturn parsed\n\t\t\t}\n\t\t\tconst referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, new Set([slug]))\n\t\t\tif (referenceError !== null) {\n\t\t\t\treturn referenceError\n\t\t\t}\n\t\t\tcanonicalGrants = parsed.grants\n\t\t}\n\t\tconst before = this.toState(current)\n\t\tconst updated = await db.commandBus.execute(\n\t\t\tnew UpdateCustomRoleCommand(slug, {\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: canonicalGrants,\n\t\t\t}),\n\t\t)\n\t\tif (!updated) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\treturn new ResponseOk({\n\t\t\tbefore,\n\t\t\tafter: {\n\t\t\t\tslug,\n\t\t\t\tdescription: input.description === undefined ? before.description : input.description,\n\t\t\t\tgrants: canonicalGrants ?? before.grants,\n\t\t\t},\n\t\t})\n\t}\n\n\tasync deleteRole(db: DatabaseContext, slug: string): Promise<Response<DeleteResult, DeleteCustomRoleErrorCode>> {\n\t\tconst [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }))\n\t\tif (current === undefined) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\t// References live inside an opaque jsonb blob — no FK can catch this. Read the other rows\n\t\t// unlocked: a concurrent create/update naming this slug holds FOR SHARE on the row we\n\t\t// already hold FOR UPDATE, so the two serialize without a second lock (and without the\n\t\t// deadlock a reversed acquisition order would invite).\n\t\tconst referencedBy = (await db.queryHandler.fetch(new CustomRolesQuery()))\n\t\t\t.filter(row => row.slug !== slug && parsePersistedCustomRoleReferences(row.grants).includes(slug))\n\t\t\t.map(row => row.slug)\n\t\tif (referencedBy.length > 0) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'ROLE_IN_USE',\n\t\t\t\t`Custom role ${slug} is referenced by the grant configuration of ${referencedBy.join(', ')}`,\n\t\t\t)\n\t\t}\n\t\tconst deleted = await db.commandBus.execute(new DeleteCustomRoleCommand(slug))\n\t\tif (!deleted) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\tconst removedAssignmentIdentityIds = await db.commandBus.execute(new RemoveCustomRoleAssignmentsCommand(slug))\n\t\treturn new ResponseOk({\n\t\t\tbefore: this.toState(current),\n\t\t\tremovedAssignments: removedAssignmentIdentityIds.length,\n\t\t\tremovedAssignmentIdentityIds,\n\t\t})\n\t}\n\n\tprivate parseGrants(\n\t\tgrants: unknown,\n\t): ReturnType<typeof parseCustomRoleGrants> | ResponseError<'UNKNOWN_PERMISSION' | 'DUPLICATE_PERMISSION' | 'INVALID_PERMISSION_CONFIGURATION'> {\n\t\ttry {\n\t\t\treturn parseCustomRoleGrants(grants)\n\t\t} catch (error) {\n\t\t\tif (error instanceof CustomRoleGrantValidationError) {\n\t\t\t\treturn new ResponseError(error.code, error.message)\n\t\t\t}\n\t\t\tthrow error\n\t\t}\n\t}\n\n\tprivate async validateReferences(\n\t\tdb: DatabaseContext,\n\t\troles: readonly string[],\n\t\tprojects: readonly string[],\n\t\tadditionallyActiveRoles: ReadonlySet<string>,\n\t): Promise<ResponseError<'INVALID_PERMISSION_CONFIGURATION'> | null> {\n\t\tconst invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles, additionallyActiveRoles)\n\t\tif (invalidRole !== null) {\n\t\t\treturn new ResponseError('INVALID_PERMISSION_CONFIGURATION', `Referenced role ${invalidRole} does not exist or is not globally assignable`)\n\t\t}\n\t\tif (projects.length > 0) {\n\t\t\tconst existingProjects = new Set((await db.queryHandler.fetch(new ProjectsQuery())).map(project => project.slug))\n\t\t\tconst missingProject = projects.find(project => !existingProjects.has(project))\n\t\t\tif (missingProject !== undefined) {\n\t\t\t\treturn new ResponseError('INVALID_PERMISSION_CONFIGURATION', `Referenced project ${missingProject} does not exist`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n\n\tprivate toState(row: CustomRoleRow): CustomRoleState {\n\t\treturn {\n\t\t\tslug: row.slug,\n\t\t\tdescription: row.description,\n\t\t\tgrants: parsePersistedCustomRoleGrants(row.grants),\n\t\t}\n\t}\n}\n"],"names":["GlobalRoleValidator","CustomRolesQuery","ROLE_SLUG_PATTERN","ResponseError","BUILTIN_TENANT_ROLES","IdentitiesHoldingRoleCountQuery","CreateCustomRoleCommand","ResponseOk","UniqueViolationError","LockType","UpdateCustomRoleCommand","parsePersistedCustomRoleReferences","DeleteCustomRoleCommand","RemoveCustomRoleAssignmentsCommand","parseCustomRoleGrants","CustomRoleGrantValidationError","ProjectsQuery","parsePersistedCustomRoleGrants"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAM,kBAAkB;AAyBjB,MAAM,kBAAkB;AAAA,EAC9B,YACkB,sBAA2C,IAAIA,oBAAAA,uBAC/D;AADgB,SAAA,sBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,IAAiD;AAChE,UAAM,OAAO,MAAM,GAAG,aAAa,MAAM,IAAIC,iBAAAA,kBAAkB;AAC/D,WAAO,KAAK,IAAI,CAAA,QAAO,KAAK,QAAQ,GAAG,CAAC;AAAA,EACzC;AAAA,EAEA,MAAM,WACL,IACA,OAC6D;AAC7D,QAAI,CAACC,MAAAA,kBAAkB,KAAK,MAAM,IAAI,KAAK,MAAM,KAAK,SAAS,iBAAiB;AAC/E,aAAO,IAAIC,SAAAA,cAAc,gBAAgB,mBAAmBD,MAAAA,iBAAiB,mBAAmB,eAAe,kBAAkB;AAAA,IAClI;AACA,QAAIE,2CAAqB,IAAI,MAAM,IAAI,GAAG;AACzC,aAAO,IAAID,SAAAA,cAAc,gBAAgB,QAAQ,MAAM,IAAI,gCAAgC;AAAA,IAC5F;AACA,UAAM,SAAS,KAAK,YAAY,MAAM,MAAM;AAC5C,QAAI,kBAAkBA,SAAAA,eAAe;AACpC,aAAO;AAAA,IACR;AACA,UAAM,iBAAiB,MAAM,KAAK,mBAAmB,IAAI,OAAO,iBAAiB,OAAO,wCAAwB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;AACjI,QAAI,mBAAmB,MAAM;AAC5B,aAAO;AAAA,IACR;AACA,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIF,kCAAiB,EAAE,OAAO,CAAC,MAAM,IAAI,EAAA,CAAG,CAAC;AAC1F,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO,IAAIE,SAAAA,cAAc,uBAAuB,eAAe,MAAM,IAAI,iBAAiB;AAAA,IAC3F;AAGA,UAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIE,gCAAAA,gCAAgC,MAAM,IAAI,CAAC;AAC3F,QAAI,UAAU,GAAG;AAChB,aAAO,IAAIF,SAAAA;AAAAA,QACV;AAAA,QACA,eAAe,MAAM,IAAI,uBAAuB,OAAO;AAAA,MAAA;AAAA,IAEzD;AAGA,UAAM,KAAK,MAAM,GAAG,WAAW;AAAA,MAC9B,IAAIG,gDAAwB;AAAA,QAC3B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,QAAQ,OAAO;AAAA,MAAA,CACf;AAAA,IAAA;AAEF,WAAO,IAAIC,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,MAAM;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,QAAQ,OAAO;AAAA,MAAA;AAAA,IAChB,CACA;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,eAAe,OAAyB;AAC9C,WAAO,iBAAiBC,SAAAA;AAAAA,EACzB;AAAA,EAEA,MAAM,WACL,IACA,MACA,OAC6D;AAC7D,UAAM,CAAC,OAAO,IAAI,MAAM,GAAG,aAAa,MAAM,IAAIP,iBAAAA,iBAAiB,EAAE,OAAO,CAAC,IAAI,GAAG,MAAMQ,SAAAA,SAAS,UAAA,CAAW,CAAC;AAC/G,QAAI,YAAY,QAAW;AAC1B,aAAO,IAAIN,SAAAA,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,QAAI;AACJ,QAAI,MAAM,WAAW,QAAW;AAC/B,YAAM,SAAS,KAAK,YAAY,MAAM,MAAM;AAC5C,UAAI,kBAAkBA,SAAAA,eAAe;AACpC,eAAO;AAAA,MACR;AACA,YAAM,iBAAiB,MAAM,KAAK,mBAAmB,IAAI,OAAO,iBAAiB,OAAO,oBAAoB,oBAAI,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3H,UAAI,mBAAmB,MAAM;AAC5B,eAAO;AAAA,MACR;AACA,wBAAkB,OAAO;AAAA,IAC1B;AACA,UAAM,SAAS,KAAK,QAAQ,OAAO;AACnC,UAAM,UAAU,MAAM,GAAG,WAAW;AAAA,MACnC,IAAIO,wBAAAA,wBAAwB,MAAM;AAAA,QACjC,aAAa,MAAM;AAAA,QACnB,QAAQ;AAAA,MAAA,CACR;AAAA,IAAA;AAEF,QAAI,CAAC,SAAS;AACb,aAAO,IAAIP,SAAAA,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,WAAO,IAAII,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,QACN;AAAA,QACA,aAAa,MAAM,gBAAgB,SAAY,OAAO,cAAc,MAAM;AAAA,QAC1E,QAAQ,mBAAmB,OAAO;AAAA,MAAA;AAAA,IACnC,CACA;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,IAAqB,MAA0E;AAC/G,UAAM,CAAC,OAAO,IAAI,MAAM,GAAG,aAAa,MAAM,IAAIN,iBAAAA,iBAAiB,EAAE,OAAO,CAAC,IAAI,GAAG,MAAMQ,SAAAA,SAAS,UAAA,CAAW,CAAC;AAC/G,QAAI,YAAY,QAAW;AAC1B,aAAO,IAAIN,SAAAA,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AAKA,UAAM,gBAAgB,MAAM,GAAG,aAAa,MAAM,IAAIF,iBAAAA,iBAAA,CAAkB,GACtE,OAAO,CAAA,QAAO,IAAI,SAAS,QAAQU,yDAAmC,IAAI,MAAM,EAAE,SAAS,IAAI,CAAC,EAChG,IAAI,CAAA,QAAO,IAAI,IAAI;AACrB,QAAI,aAAa,SAAS,GAAG;AAC5B,aAAO,IAAIR,SAAAA;AAAAA,QACV;AAAA,QACA,eAAe,IAAI,gDAAgD,aAAa,KAAK,IAAI,CAAC;AAAA,MAAA;AAAA,IAE5F;AACA,UAAM,UAAU,MAAM,GAAG,WAAW,QAAQ,IAAIS,wBAAAA,wBAAwB,IAAI,CAAC;AAC7E,QAAI,CAAC,SAAS;AACb,aAAO,IAAIT,SAAAA,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,UAAM,+BAA+B,MAAM,GAAG,WAAW,QAAQ,IAAIU,mCAAAA,mCAAmC,IAAI,CAAC;AAC7G,WAAO,IAAIN,SAAAA,WAAW;AAAA,MACrB,QAAQ,KAAK,QAAQ,OAAO;AAAA,MAC5B,oBAAoB,6BAA6B;AAAA,MACjD;AAAA,IAAA,CACA;AAAA,EACF;AAAA,EAEQ,YACP,QAC+I;AAC/I,QAAI;AACH,aAAOO,sBAAAA,sBAAsB,MAAM;AAAA,IACpC,SAAS,OAAO;AACf,UAAI,iBAAiBC,sBAAAA,gCAAgC;AACpD,eAAO,IAAIZ,SAAAA,cAAc,MAAM,MAAM,MAAM,OAAO;AAAA,MACnD;AACA,YAAM;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAc,mBACb,IACA,OACA,UACA,yBACoE;AACpE,UAAM,cAAc,MAAM,KAAK,oBAAoB,gBAAgB,IAAI,OAAO,uBAAuB;AACrG,QAAI,gBAAgB,MAAM;AACzB,aAAO,IAAIA,SAAAA,cAAc,oCAAoC,mBAAmB,WAAW,+CAA+C;AAAA,IAC3I;AACA,QAAI,SAAS,SAAS,GAAG;AACxB,YAAM,mBAAmB,IAAI,KAAK,MAAM,GAAG,aAAa,MAAM,IAAIa,cAAAA,cAAA,CAAe,GAAG,IAAI,CAAA,YAAW,QAAQ,IAAI,CAAC;AAChH,YAAM,iBAAiB,SAAS,KAAK,CAAA,YAAW,CAAC,iBAAiB,IAAI,OAAO,CAAC;AAC9E,UAAI,mBAAmB,QAAW;AACjC,eAAO,IAAIb,SAAAA,cAAc,oCAAoC,sBAAsB,cAAc,iBAAiB;AAAA,MACnH;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEQ,QAAQ,KAAqC;AACpD,WAAO;AAAA,MACN,MAAM,IAAI;AAAA,MACV,aAAa,IAAI;AAAA,MACjB,QAAQc,sBAAAA,+BAA+B,IAAI,MAAM;AAAA,IAAA;AAAA,EAEnD;AACD;;"}