npm - @contember/engine-tenant-api - Versions diffs - 2.2.0-alpha.1 → 2.2.0-alpha.10 - Mend

@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2014) hide show

package/dist/types/model/service/idp/IDPManager.d.ts CHANGED Viewed

@@ -3,15 +3,45 @@ import { AddIdpErrorCode, DisableIdpErrorCode, EnableIdpErrorCode, UpdateIdpErro
 import { DatabaseContext } from '../../utils/index.js';
 import { IdentityProviderData } from '../../type/index.js';
 import { IDPHandlerRegistry } from './IDPHandlerRegistry.js';
+import { ProjectSchemaResolver } from '../../type/index.js';
 import { UpdateIdpData } from '../../commands/idp/UpdateIdpCommand.js';
 import { IdentityProviderDto } from '../../queries/idp/types.js';
 export declare class IDPManager {
     private readonly idpRegistry;
-    constructor(idpRegistry: IDPHandlerRegistry);
+    private readonly projectSchemaResolver;
+    constructor(idpRegistry: IDPHandlerRegistry, projectSchemaResolver: ProjectSchemaResolver);
     addIDP(db: DatabaseContext, idp: IdentityProviderData): Promise<RegisterIDPResponse>;
     disableIDP(db: DatabaseContext, slug: string): Promise<DisableIDPResponse>;
     enableIDP(db: DatabaseContext, slug: string): Promise<EnableIDPResponse>;
     updateIDP(db: DatabaseContext, slug: string, data: UpdateIdpData, mergeConfiguration: boolean): Promise<UpdateIDPResponse>;
+    /**
+     * Reject top-level `configuration` keys the provider does not recognise.
+     *
+     * Every provider configuration is parsed with `Typesafe.partial`, which silently DROPS unknown
+     * properties. Without this check `addIDP` / `updateIDP` answer `ok` to a configuration the
+     * provider will never act on — a typo like `fetchUserinfo` (lowercase i) reads as a successfully
+     * applied setting while the option stays off, and an option that a given engine version does not
+     * support yet looks indistinguishable from one that works.
+     *
+     * The parsed result carries exactly the keys the provider understood, so the difference against
+     * the submitted object is the set of ignored keys. All of them are reported at once (rather than
+     * the first, as `Typesafe.noExtraProps` would) so a configuration with several typos takes one
+     * round trip to fix, matching {@link findRemovedRuleKeys}.
+     *
+     * Only the top level is checked: nested shapes that need strictness validate themselves
+     * (`claimMapping` via {@link parseClaimMapping}). Reading a stored configuration is deliberately
+     * left untouched — this runs at write time only, so a row written before this check keeps
+     * authenticating instead of locking its users out.
+     */
+    private assertNoUnknownConfigurationKeys;
+    /**
+     * Validate the optional A09 `claimMapping` embedded in an IdP `configuration`: reject a removed
+     * `grantRoles` (global-role mapping was dropped — see {@link parseClaimMapping}), reject a
+     * malformed shape, and validate each granted membership's role against the target project's ACL
+     * schema (mirroring the direct add-member path). Throws {@link InvalidIDPConfigurationError},
+     * surfaced as `INVALID_CONFIGURATION`.
+     */
+    private assertValidClaimMapping;
     listIDP(db: DatabaseContext): Promise<IdentityProviderDto[]>;
 }
 export type RegisterIDPResponse = Response<null, AddIdpErrorCode>;

package/dist/types/model/service/idp/IDPManager.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"IDPManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACvH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAG1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAK5D,OAAO,EAAoB,aAAa,EAAE,MAAM,wCAAwC,CAAA;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,WAAW;~~gBAAX~~,WAAW,EAAE,kBAAkB;~~IAIpC~~,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;~~IAwBpF~~,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;~~IAa1E~~,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;~~IAaxE~~,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;~~IAmD1H~~,OAAO,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;~~CAWzE~~;~~AAED~~,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;AACjE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;AACpE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;AAClE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA"}
1	+ {"version":3,"file":"IDPManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IDPManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AACvH,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAG1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAK5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAG3D,OAAO,EAAoB,aAAa,EAAE,MAAM,wCAAwC,CAAA;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,qBAAqB;IAFvC,YACkB,WAAW,EAAE,kBAAkB,EAC/B,qBAAqB,EAAE,qBAAqB,EAE7D;IAEY,MAAM,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAuBhG;IAEY,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAWtF;IAEY,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAWpF;IAEY,SAAS,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,kBAAkB,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkCtI;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,gCAAgC;IAWxC;;;;;;OAMG;YACW,uBAAuB;IA8CxB,OAAO,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAUxE;CACD;AAkCD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC,CAAA;AACjE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAA;AACpE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA;AAClE,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAA"}

package/dist/types/model/service/idp/IdentityProviderHandler.d.ts CHANGED Viewed

@@ -48,6 +48,13 @@ export type RevalidationResult = {
     status: 'valid';
     /** Fresh claims, if the revalidation method returned any (e.g. userinfo). */
     claims?: Record<string, unknown>;
+    /**
+     * Whether `claims` represent the IdP's COMPLETE claim surface — the same one sign-in sees — so a
+     * claim-mapping reconciliation may safely remove memberships under `unmatched: "remove"`. A partial
+     * surface (a userinfo-only probe, or a refresh whose userinfo fetch failed) leaves this false, and the
+     * caller keeps refresh-time sync additive-only to avoid stripping a grant the IdP still asserts.
+     */
+    claimsComplete?: boolean;
     /** Updated session state to persist (e.g. a rotated refresh token). */
     idpSession?: IDPSessionState;
 } | {

package/dist/types/model/service/idp/IdentityProviderHandler.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"IdentityProviderHandler.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdentityProviderHandler.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,OAAO,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,uEAAuE;IACvE,SAAS,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACzB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC9B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAC9B,CAAA;AAED,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,GAAG;IAC/B,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,oGAAoG;IACpG,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,oEAAoE;AACpE,MAAM,MAAM,kBAAkB,GAC3B;IACD,MAAM,EAAE,OAAO,CAAA;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,uEAAuE;IACvE,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GACC;IACD,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAEF,MAAM,WAAW,uBAAuB,CAAC,aAAa,SAAS,EAAE;IAChE,QAAQ,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAErF,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAE9F,qBAAqB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,aAAa,CAAA;IAEzD,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;IAE1E;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAEpG;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAEpG;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACvG"}
1	+ {"version":3,"file":"IdentityProviderHandler.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdentityProviderHandler.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,OAAO,CAAA;CACpB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG;IAC7B,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC,uEAAuE;IACvE,SAAS,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACzB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,2FAA2F;IAC3F,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB;;;;OAIG;IACH,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,8EAA8E;AAC9E,MAAM,MAAM,gBAAgB,GAAG;IAC9B,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAA;CAC9B,CAAA;AAED,+FAA+F;AAC/F,MAAM,MAAM,iBAAiB,GAAG;IAC/B,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,oGAAoG;IACpG,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,oEAAoE;AACpE,MAAM,MAAM,kBAAkB,GAC3B;IACD,MAAM,EAAE,OAAO,CAAA;IACf,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAChC;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,uEAAuE;IACvE,UAAU,CAAC,EAAE,eAAe,CAAA;CAC5B,GACC;IACD,MAAM,EAAE,SAAS,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;CACd,CAAA;AAEF,MAAM,WAAW,uBAAuB,CAAC,aAAa,SAAS,EAAE;IAChE,QAAQ,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAErF,eAAe,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAAA;IAE9F,qBAAqB,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,aAAa,CAAA;IAEzD,sBAAsB,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;IAE1E;;;;OAIG;IACH,UAAU,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAEpG;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IAEpG;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACvG"}

package/dist/types/model/service/idp/IdpSessionRevalidator.d.ts CHANGED Viewed

@@ -2,6 +2,8 @@ import { DatabaseContext } from '../../utils/index.js';
 import { ApiKeyRequestInfo } from '../../commands/index.js';
 import { ApiKeyRow } from '../../queries/apiKey/ApiKeyQuery.js';
 import { IDPHandlerRegistry } from './IDPHandlerRegistry.js';
+import { IDPClaimSyncService } from './IDPClaimSyncService.js';
+import { Logger } from '@contember/logger';
 export type RevalidationOutcome = 'valid' | 'revoked';
 /**
  * Re-validates IdP-backed sessions against their identity provider on the verify hot path
@@ -18,7 +20,9 @@ export type RevalidationOutcome = 'valid' | 'revoked';
  */
 export declare class IdpSessionRevalidator {
     private readonly idpRegistry;
-    constructor(idpRegistry: IDPHandlerRegistry);
+    private readonly claimSyncService;
+    private readonly logger;
+    constructor(idpRegistry: IDPHandlerRegistry, claimSyncService: IDPClaimSyncService, logger: Logger);
     revalidate(dbContext: DatabaseContext, readDbContext: DatabaseContext, apiKeyRow: ApiKeyRow, requestInfo?: ApiKeyRequestInfo): Promise<RevalidationOutcome>;
     /**
      * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in
@@ -26,6 +30,16 @@ export declare class IdpSessionRevalidator {
      */
     private decide;
     private runRevalidation;
+    /**
+     * Re-apply the claim mapping on a successful refresh. Runs in its own transaction (atomic apply of
+     * the membership changes) and never throws: the IdP has already vouched for the session, so a
+     * malformed mapping or a transient apply error must not revoke or fail it. A real membership change
+     * is audited as `idp_role_mapped`; a failure is audited as `idp_role_mapping_failed` (fail-open
+     * marker), mirroring the sign-in path. `claimsComplete` carries whether the refresh rebuilt sign-in's
+     * full claim surface (so removal reconciliation is safe) — see `allowRemoval` below.
+     */
+    private syncClaims;
+    private logRoleMapping;
     private logRevalidated;
     /**
      * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is

package/dist/types/model/service/idp/IdpSessionRevalidator.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"IdpSessionRevalidator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdpSessionRevalidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;~~AAQ5D~~,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,CAAA;AAgBrD;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAqB;IAEhC,OAAO,CAAC,QAAQ,CAAC,WAAW;~~gBAAX~~,WAAW,EAAE,kBAAkB;~~IAI3C~~,UAAU,CACf,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,eAAe,EAC9B,SAAS,EAAE,SAAS,EACpB,WAAW,CAAC,EAAE,iBAAiB,GAC7B,OAAO,CAAC,mBAAmB,CAAC;~~IAyD/B~~;;;OAGG;IACH,OAAO,CAAC,MAAM;YAqBA,eAAe;~~YAwDf~~,cAAc;IAe5B;;;;;;OAMG;YACW,qBAAqB;~~YA4BrB~~,MAAM;~~IA2BpB~~,OAAO,CAAC,aAAa;CAarB"}
1	+ {"version":3,"file":"IdpSessionRevalidator.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/IdpSessionRevalidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,qCAAqC,CAAA;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAO5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAI1C,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,CAAA;AAgBrD;;;;;;;;;;;;GAYG;AACH,qBAAa,qBAAqB;IAEhC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM;IAHxB,YACkB,WAAW,EAAE,kBAAkB,EAC/B,gBAAgB,EAAE,mBAAmB,EACrC,MAAM,EAAE,MAAM,EAE/B;IAEK,UAAU,CACf,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE,eAAe,EAC9B,SAAS,EAAE,SAAS,EACpB,WAAW,CAAC,EAAE,iBAAiB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CA0D9B;IAED;;;OAGG;IACH,OAAO,CAAC,MAAM;YAqBA,eAAe;IAoE7B;;;;;;;OAOG;YACW,UAAU;YAuCV,cAAc;YA+Bd,cAAc;IAe5B;;;;;;OAMG;YACW,qBAAqB;YA6BrB,MAAM;IAgCpB,OAAO,CAAC,aAAa;CAarB"}

package/dist/types/model/service/idp/PersonIdentityProviderManager.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PersonIdentityProviderManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/PersonIdentityProviderManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAsB,yBAAyB,EAAgC,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAI/H;;;;;;;;;;GAUG;AACH,qBAAa,6BAA6B;IAC5B,2BAA2B,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;~~IAIxG~~,0BAA0B,CAAC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;~~CAwBrI~~;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAA"}
1	+ {"version":3,"file":"PersonIdentityProviderManager.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/PersonIdentityProviderManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,yBAAyB,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAsB,yBAAyB,EAAgC,SAAS,EAAE,MAAM,wBAAwB,CAAA;AAI/H;;;;;;;;;;GAUG;AACH,qBAAa,6BAA6B;IAC5B,2BAA2B,CAAC,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAEpH;IAEY,0BAA0B,CAAC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CA+BpI;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAA"}

package/dist/types/model/service/idp/index.d.ts CHANGED Viewed

@@ -6,6 +6,10 @@ export * from './BackchannelLogoutManager.js';
 export * from './IDPRevalidation.js';
 export * from './IDPManager.js';
 export * from './PersonIdentityProviderManager.js';
+export * from './ClaimMapping.js';
+export * from './ClaimMappingEvaluator.js';
+export * from './ClaimMappingValidation.js';
+export * from './IDPClaimSyncService.js';
 export * from './IDPResponseError.js';
 export * from './IDPValidationError.js';
 export * from './InvalidIDPConfigurationError.js';

package/dist/types/model/service/idp/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,yBAAyB,CAAA;AACvC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oCAAoC,CAAA;AAClD,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mCAAmC,CAAA;AACjD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,iCAAiC,CAAA"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/service/idp/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oCAAoC,CAAA;AAClD,cAAc,yBAAyB,CAAA;AACvC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,+BAA+B,CAAA;AAC7C,cAAc,sBAAsB,CAAA;AACpC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oCAAoC,CAAA;AAClD,cAAc,mBAAmB,CAAA;AACjC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,yBAAyB,CAAA;AACvC,cAAc,mCAAmC,CAAA;AACjD,cAAc,8BAA8B,CAAA;AAC5C,cAAc,6BAA6B,CAAA;AAC3C,cAAc,iCAAiC,CAAA"}

package/dist/types/model/service/idp/providers/AppleProvider.d.ts CHANGED Viewed

@@ -23,7 +23,7 @@ export declare const AppleConfiguration: Typesafe.Type<{
         readonly mode?: "auto" | "blocking" | undefined;
         readonly onFailure?: "revoke" | undefined;
     } & {
-        readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
     }) | undefined;
     readonly claimMapping?: {
         readonly externalIdentifier?: string | undefined;
@@ -59,7 +59,7 @@ export declare class AppleProvider implements IdentityProviderHandler<AppleConfi
             readonly mode?: "auto" | "blocking" | undefined;
             readonly onFailure?: "revoke" | undefined;
         } & {
-            readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
         }) | undefined;
         readonly claimMapping?: {
             readonly externalIdentifier?: string | undefined;

package/dist/types/model/service/idp/providers/AppleProvider.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AppleProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/AppleProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AASvG,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAED,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAI/D,qBAAa,aAAc,YAAW,uBAAuB,CAAC,kBAAkB,CAAC;IAChF,OAAO,CAAC,MAAM,CAA4B;IAE1C,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAkE;IAE1E,QAAQ,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;~~IAStF~~,eAAe,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;~~IAMpG~~,sBAAsB,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;~~YAIpF~~,gBAAgB;CAyB9B"}
1	+ {"version":3,"file":"AppleProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/AppleProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AASvG,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAED,KAAK,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAI/D,qBAAa,aAAc,YAAW,uBAAuB,CAAC,kBAAkB,CAAC;IAChF,OAAO,CAAC,MAAM,CAA4B;IAE1C,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAkE;IAE1E,QAAQ,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAOlG;IAEY,eAAe,CAAC,aAAa,EAAE,kBAAkB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAInG;IAED,sBAAsB,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAEjG;YAEa,gBAAgB;CAyB9B"}

package/dist/types/model/service/idp/providers/FacebookProvider.d.ts CHANGED Viewed

@@ -22,7 +22,7 @@ declare const FacebookConfiguration: Typesafe.Type<{
         readonly mode?: "auto" | "blocking" | undefined;
         readonly onFailure?: "revoke" | undefined;
     } & {
-        readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
     }) | undefined;
     readonly claimMapping?: {
         readonly externalIdentifier?: string | undefined;
@@ -57,7 +57,7 @@ export declare class FacebookProvider implements IdentityProviderHandler<Faceboo
             readonly mode?: "auto" | "blocking" | undefined;
             readonly onFailure?: "revoke" | undefined;
         } & {
-            readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
         }) | undefined;
         readonly claimMapping?: {
             readonly externalIdentifier?: string | undefined;

package/dist/types/model/service/idp/providers/FacebookProvider.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"FacebookProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/FacebookProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AASvG,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAwB,CAAA;AACnD,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAkBrE,qBAAa,gBAAiB,YAAW,uBAAuB,CAAC,qBAAqB,CAAC;IAGtF,OAAO,CAAC,cAAc,CAsCpB;IAEF,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAqE;IAE7E,QAAQ,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;~~IASzF~~,eAAe,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;~~IA8BvG~~,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;~~YAI5F~~,gBAAgB;CAa9B"}
1	+ {"version":3,"file":"FacebookProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/FacebookProvider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AASvG,QAAA,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAwB,CAAA;AACnD,KAAK,qBAAqB,GAAG,UAAU,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAkBrE,qBAAa,gBAAiB,YAAW,uBAAuB,CAAC,qBAAqB,CAAC;IAGtF,OAAO,CAAC,cAAc,CAsCpB;IAEF,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAqE;IAE7E,QAAQ,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAOrG;IAEY,eAAe,CAAC,aAAa,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CA4BtG;IAED,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAEzG;YAEa,gBAAgB;CAa9B"}

package/dist/types/model/service/idp/providers/OIDCHelpers.d.ts CHANGED Viewed

@@ -23,6 +23,15 @@ export type HandleOIDCResponseOptions = {
     captureSession?: boolean;
     claimMapping?: OIDCClaimMapping;
 };
+/**
+ * Lift a configured nested attributes object (`attributesKey`, notably Apereo CAS's `attributes`) to the
+ * top level so providers that nest their claims map without a code change. The nested attributes are
+ * UNSIGNED, so they are spread UNDER `source` — a signed top-level claim keeps precedence over an
+ * attributes-level value. Shared by the sign-in response handler ({@link handleOIDCResponse}) and the
+ * session-refresh path ({@link revalidateOIDC}) so BOTH see the same claim surface; without this, an
+ * `attributesKey` provider's A09 claim mapping would resolve at sign-in but silently not on refresh.
+ */
+export declare const liftNestedClaims: (source: Record<string, unknown>, attributesKey: string | undefined) => Record<string, unknown>;
 export declare const handleOIDCResponse: (client: Client, { sessionData, redirectUrl, ...otherData }: OIDCResponseData, { fetchUserInfo, returnOIDCResult, captureSession, claimMapping }?: HandleOIDCResponseOptions) => Promise<IDPResponse>;
 /**
  * Re-validate a stored OIDC session against the IdP. Returns `revoked` only for definitive
@@ -30,7 +39,10 @@ export declare const handleOIDCResponse: (client: Client, { sessionData, redirec
  * (network, IdP down) re-throw so the caller can fail-open and keep the session — IdP
  * downtime must not log everyone out.
  */
-export declare const revalidateOIDC: (client: Client, method: "refresh" | "userinfo" | "introspection", session: IDPSessionState) => Promise<RevalidationResult>;
+export declare const revalidateOIDC: (client: Client, method: 'refresh' | 'userinfo' | 'introspection', session: IDPSessionState, options?: {
+    claimMapping?: OIDCClaimMapping;
+    fetchUserInfo?: boolean;
+}) => Promise<RevalidationResult>;
 /**
  * Build an RP-initiated (front-channel) logout URL (OIDC RP-Initiated Logout 1.0). Returns null
  * when the IdP advertises no `end_session_endpoint` — the caller then degrades to a local-only

package/dist/types/model/service/idp/providers/OIDCHelpers.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"OIDCHelpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCHelpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA8B,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAEpF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGnE,OAAO,EACN,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,MAAM,+BAA+B,CAAA;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,~~GAAI~~,~~UAAU,~~QAAQ,~~EAAE~~,~~YAAY,~~MAAM,~~EAAE~~,~~aAAa,~~MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,eAYrH,CAAA;AAED,eAAO,MAAM,YAAY,~~GACxB~~,~~QAAQ,~~MAAM,~~EACd,sCAAsC~~;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KAClG,OAAO,CAAC,iBAAiB,CAe3B,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACvC,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAA;CAC/B,CAAA;~~AASD~~,eAAO,MAAM,~~kBAAkB~~,~~GAC9B~~,~~QAAQ~~,MAAM,~~EACd~~,~~4CAA4C~~,~~gBAAgB~~,~~EAC5D~~,~~oEAAmE~~,~~yBAA8B~~,~~KAC/F~~,OAAO,CAAC,WAAW,~~CAgFrB~~,CAAA;AAKD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,~~GAC1B~~,~~QAAQ,~~MAAM,~~EACd~~,~~QAAQ,~~SAAS,GAAG,UAAU,GAAG,eAAe,~~EAChD~~,~~SAAS,~~eAAe,~~KACtB~~,OAAO,CAAC,kBAAkB,~~CA0D5B~~,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,~~GAAI~~,~~QAAQ,~~MAAM,~~EAAE~~,~~oCAAoC,~~gBAAgB,KAAG,MAAM,GAAG,IAQlH,CAAA;AAmCD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,~~GAAU~~,~~QAAQ,~~MAAM,~~EAAE~~,~~QAAQ,~~MAAM,CAAC,MAAM,CAAC,~~EAAE~~,~~aAAa,~~MAAM,KAAG,OAAO,CAAC,iBAAiB,CAqDpI,CAAA"}
1	+ {"version":3,"file":"OIDCHelpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCHelpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA8B,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAEpF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGnE,OAAO,EACN,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,MAAM,+BAA+B,CAAA;AAEtC;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,aAAc,QAAQ,cAAc,MAAM,eAAe,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,eAYrH,CAAA;AAED,eAAO,MAAM,YAAY,WAChB,MAAM,wCACwB;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,KAClG,OAAO,CAAC,iBAAiB,CAe3B,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACvC,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,YAAY,CAAC,EAAE,gBAAgB,CAAA;CAC/B,CAAA;AAiBD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,WAAY,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,iBAAiB,MAAM,GAAG,SAAS,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAS3H,CAAA;AAkGD,eAAO,MAAM,kBAAkB,WACtB,MAAM,8CAC8B,gBAAgB,sEACO,yBAAyB,KAC1F,OAAO,CAAC,WAAW,CAqCrB,CAAA;AAKD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,WAClB,MAAM,UACN,SAAS,GAAG,UAAU,GAAG,eAAe,WACvC,eAAe,YACf;IAAE,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAAC,aAAa,CAAC,EAAE,OAAO,CAAA;CAAE,KACnE,OAAO,CAAC,kBAAkB,CAqF5B,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,WAAY,MAAM,sCAAsC,gBAAgB,KAAG,MAAM,GAAG,IAQlH,CAAA;AAmCD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,WAAkB,MAAM,UAAU,MAAM,CAAC,MAAM,CAAC,eAAe,MAAM,KAAG,OAAO,CAAC,iBAAiB,CAqDpI,CAAA"}

package/dist/types/model/service/idp/providers/OIDCProvider.d.ts CHANGED Viewed

@@ -24,7 +24,7 @@ export declare class OIDCProvider implements IdentityProviderHandler<OIDCConfigu
             readonly mode?: "auto" | "blocking" | undefined;
             readonly onFailure?: "revoke" | undefined;
         } & {
-            readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
         }) | undefined;
         readonly claimMapping?: {
             readonly externalIdentifier?: string | undefined;

package/dist/types/model/service/idp/providers/OIDCProvider.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"OIDCProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCProvider.ts"],"names":[],"mappings":"AACA,OAAO,EACN,uBAAuB,EACvB,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EAAE,iBAAiB,EAAkC,MAAM,gBAAgB,CAAA;AAOlF,qBAAa,YAAa,YAAW,uBAAuB,CAAC,iBAAiB,CAAC;IAC9E,OAAO,CAAC,WAAW,CAAqC;IAExD,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAiE;IAEzE,QAAQ,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC;~~IASrF~~,eAAe,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;~~IAetF~~,UAAU,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;~~IAKnG~~,cAAc,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;~~IAKnG~~,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;~~IAKnH~~;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;~~YAIpF~~,gBAAgB;CAqB9B"}
1	+ {"version":3,"file":"OIDCProvider.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/OIDCProvider.ts"],"names":[],"mappings":"AACA,OAAO,EACN,uBAAuB,EACvB,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EAAE,iBAAiB,EAAkC,MAAM,gBAAgB,CAAA;AAOlF,qBAAa,YAAa,YAAW,uBAAuB,CAAC,iBAAiB,CAAC;IAC9E,OAAO,CAAC,WAAW,CAAqC;IAExD,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAAiE;IAEzE,QAAQ,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAOjG;IAEY,eAAe,CAAC,aAAa,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAalG;IAEY,UAAU,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAM/G;IAEY,cAAc,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAG/G;IAEY,mBAAmB,CAAC,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAGlH;IAED;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB,sBAAsB,CAAC,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAEjG;YAEa,gBAAgB;CAqB9B"}

package/dist/types/model/service/idp/providers/OIDCTypes.d.ts CHANGED Viewed

@@ -13,7 +13,7 @@ export declare const OIDCRevalidationConfig: Typesafe.Type<{
     readonly mode?: "auto" | "blocking" | undefined;
     readonly onFailure?: "revoke" | undefined;
 } & {
-    readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+    readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
 }>;
 export type OIDCRevalidationConfig = ReturnType<typeof OIDCRevalidationConfig>;
 /**
@@ -67,7 +67,7 @@ export declare const OIDCConfigurationOptions: {
             readonly mode?: "auto" | "blocking" | undefined;
             readonly onFailure?: "revoke" | undefined;
         } & {
-            readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
         }) | undefined;
         readonly claimMapping?: {
             readonly externalIdentifier?: string | undefined;
@@ -100,7 +100,7 @@ export declare const OIDCConfigurationOptions: {
             readonly mode?: "auto" | "blocking" | undefined;
             readonly onFailure?: "revoke" | undefined;
         } & {
-            readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+            readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
         }>;
         claimMapping: {
             (input: unknown, path?: PropertyKey[]): {
@@ -158,7 +158,7 @@ export declare const BaseOIDCConfiguration: Typesafe.Type<{
         readonly mode?: "auto" | "blocking" | undefined;
         readonly onFailure?: "revoke" | undefined;
     } & {
-        readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
     }) | undefined;
     readonly claimMapping?: {
         readonly externalIdentifier?: string | undefined;
@@ -190,7 +190,7 @@ export declare const OIDCConfiguration: Typesafe.Type<{
         readonly mode?: "auto" | "blocking" | undefined;
         readonly onFailure?: "revoke" | undefined;
     } & {
-        readonly method?: "refresh" | "userinfo" | "introspection" | undefined;
+        readonly method?: "introspection" | "refresh" | "userinfo" | undefined;
     }) | undefined;
     readonly claimMapping?: {
         readonly externalIdentifier?: string | undefined;

package/dist/types/model/service/idp/providers/helpers.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,eAAO,MAAM,aAAa,GACxB,CAAC,SAAS,QAAQ,CAAC,IAAI,~~EAAE~~,~~MAAM,~~QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,~~EAAE,kBAAkB~~;IAAE,KAAI,OAAO,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,~~MAAM~~,OAAO,~~OAAO,~~KAAG,CASzH,CAAA"}
1	+ {"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../../src/model/service/idp/providers/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,qBAAqB,CAAA;AAE/C,eAAO,MAAM,aAAa,GACxB,CAAC,SAAS,QAAQ,CAAC,IAAI,QAAQ,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB;IAAE,KAAI,OAAO,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,aAAa,OAAO,KAAG,CASzH,CAAA"}

package/dist/types/model/service/index.d.ts CHANGED Viewed

@@ -3,6 +3,8 @@ export * from './captcha/index.js';
 export * from './idp/index.js';
 export * from './AuthLogService.js';
 export * from './AuthPolicyManager.js';
+export * from './CustomRoleManager.js';
+export * from './GlobalRoleValidator.js';
 export * from './AuthPolicyResolver.js';
 export * from './BackupCodeManager.js';
 export * from './EmailChangeManager.js';
@@ -16,6 +18,7 @@ export * from './MailTemplateManager.js';
 export * from './MembershipValidator.js';
 export * from './OtpAuthenticator.js';
 export * from './OtpManager.js';
+export * from './PanelAccessResolver.js';
 export * from './PasswordChangeManager.js';
 export * from './PasswordResetManager.js';
 export * from './PersonAccessManager.js';

package/dist/types/model/service/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/service/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAE9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,4BAA4B,CAAA;AAC1C,cAAc,2BAA2B,CAAA;AACzC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,2BAA2B,CAAA;AACzC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/service/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA;AAClC,cAAc,gBAAgB,CAAA;AAE9B,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,yBAAyB,CAAA;AACvC,cAAc,wBAAwB,CAAA;AACtC,cAAc,yBAAyB,CAAA;AACvC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,+BAA+B,CAAA;AAC7C,cAAc,uBAAuB,CAAA;AACrC,cAAc,oBAAoB,CAAA;AAClC,cAAc,wBAAwB,CAAA;AACtC,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,2BAA2B,CAAA;AACzC,cAAc,0BAA0B,CAAA;AACxC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,2BAA2B,CAAA;AACzC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA"}

package/dist/types/model/service/membershipUtils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../../src/model/service/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAuB,MAAM,sBAAsB,CAAA;AAClG,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,eAAO,MAAM,4BAA4B,~~GAAI~~,~~aAAa,~~SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKpG,CAAA;AACD,eAAO,MAAM,+BAA+B,~~GAAI~~,~~aAAa,~~SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKvG,CAAA;AAED,eAAO,MAAM,4BAA4B,~~GACxC~~,~~gBAAgB,~~SAAS,GAAG,CAAC,UAAU,EAAE,~~EACzC~~,~~gBAAgB,~~SAAS,GAAG,CAAC,UAAU,EAAE,KACvC,qBAAqB,EA8BvB,CAAA"}
1	+ {"version":3,"file":"membershipUtils.d.ts","sourceRoot":"","sources":["../../../../src/model/service/membershipUtils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAuB,MAAM,sBAAsB,CAAA;AAClG,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,eAAO,MAAM,4BAA4B,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKpG,CAAA;AACD,eAAO,MAAM,+BAA+B,gBAAiB,SAAS,GAAG,CAAC,UAAU,EAAE,KAAG,eAAe,EAKvG,CAAA;AAED,eAAO,MAAM,4BAA4B,mBACxB,SAAS,GAAG,CAAC,UAAU,EAAE,kBACzB,SAAS,GAAG,CAAC,UAAU,EAAE,KACvC,qBAAqB,EA8BvB,CAAA"}

package/dist/types/model/type/AuthLog.d.ts CHANGED Viewed

@@ -1,2 +1,2 @@
-export type AuthActionType = 'login' | 'create_session_token' | 'idp_login' | 'password_reset_init' | 'password_reset' | 'password_change' | 'email_change' | 'email_verify_init' | 'email_verify_complete' | 'email_change_init' | 'email_change_complete' | '2fa_disable' | '2fa_enable' | 'passwordless_login_init' | 'passwordless_login_exchange' | 'passwordless_login' | 'person_disable' | 'session_revoked_by_user' | 'forced_sign_out' | 'global_role_grant' | 'global_role_revoke' | 'project_membership_create' | 'project_membership_update' | 'project_membership_remove' | 'api_key_create' | 'api_key_disable' | 'idp_create' | 'idp_update' | 'idp_disable' | 'idp_enable' | 'idp_session_revalidated' | 'idp_session_revoked' | 'idp_session_revalidation_failed' | 'idp_logout_initiated' | 'idp_backchannel_logout' | 'idp_disconnect' | 'project_create' | 'project_update' | 'project_secret_change' | 'mail_template_change' | 'tenant_config_change' | 'person_invite' | 'backup_code_generated' | 'backup_code_used' | 'backup_code_regenerated' | 'email_otp_sent' | 'mfa_enrollment_required' | 'mfa_reset' | 'session_expired_idle' | 'session_policy_applied' | 'auth_policy_change' | 'unusual_login_detected' | 'step_up_required';
+export type AuthActionType = 'login' | 'create_session_token' | 'idp_login' | 'password_reset_init' | 'password_reset' | 'password_change' | 'email_change' | 'email_verify_init' | 'email_verify_complete' | 'email_change_init' | 'email_change_complete' | '2fa_disable' | '2fa_enable' | 'passwordless_login_init' | 'passwordless_login_exchange' | 'passwordless_login' | 'person_disable' | 'person_enable' | 'session_revoked_by_user' | 'forced_sign_out' | 'global_role_grant' | 'global_role_revoke' | 'project_membership_create' | 'project_membership_update' | 'project_membership_remove' | 'api_key_create' | 'api_key_disable' | 'idp_create' | 'idp_update' | 'idp_disable' | 'idp_enable' | 'idp_session_revalidated' | 'idp_session_revoked' | 'idp_session_revalidation_failed' | 'idp_logout_initiated' | 'idp_backchannel_logout' | 'idp_disconnect' | 'idp_role_mapped' | 'idp_role_mapping_failed' | 'project_create' | 'project_update' | 'project_secret_change' | 'mail_template_change' | 'tenant_config_change' | 'person_invite' | 'backup_code_generated' | 'backup_code_used' | 'backup_code_regenerated' | 'email_otp_sent' | 'mfa_enrollment_required' | 'mfa_reset' | 'session_expired_idle' | 'session_policy_applied' | 'auth_policy_change' | 'custom_role_change' | 'unusual_login_detected' | 'step_up_required';
 //# sourceMappingURL=AuthLog.d.ts.map

package/dist/types/model/type/AuthLog.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AuthLog.d.ts","sourceRoot":"","sources":["../../../../src/model/type/AuthLog.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GACvB,OAAO,GACP,sBAAsB,GACtB,WAAW,GACX,qBAAqB,GACrB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,uBAAuB,GACvB,mBAAmB,GACnB,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,6BAA6B,GAC7B,oBAAoB,GACpB,gBAAgB,GAChB,yBAAyB,GACzB,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,qBAAqB,GACrB,iCAAiC,GACjC,sBAAsB,GACtB,wBAAwB,GACxB,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,GACtB,sBAAsB,GACtB,eAAe,GACf,uBAAuB,GACvB,kBAAkB,GAClB,yBAAyB,GACzB,gBAAgB,GAChB,yBAAyB,GACzB,WAAW,GACX,sBAAsB,GACtB,wBAAwB,GACxB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,CAAA"}
1	+ {"version":3,"file":"AuthLog.d.ts","sourceRoot":"","sources":["../../../../src/model/type/AuthLog.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GACvB,OAAO,GACP,sBAAsB,GACtB,WAAW,GACX,qBAAqB,GACrB,gBAAgB,GAChB,iBAAiB,GACjB,cAAc,GACd,mBAAmB,GACnB,uBAAuB,GACvB,mBAAmB,GACnB,uBAAuB,GACvB,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,6BAA6B,GAC7B,oBAAoB,GACpB,gBAAgB,GAChB,eAAe,GACf,yBAAyB,GACzB,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,2BAA2B,GAC3B,2BAA2B,GAC3B,2BAA2B,GAC3B,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,YAAY,GACZ,yBAAyB,GACzB,qBAAqB,GACrB,iCAAiC,GACjC,sBAAsB,GACtB,wBAAwB,GACxB,gBAAgB,GAChB,iBAAiB,GACjB,yBAAyB,GACzB,gBAAgB,GAChB,gBAAgB,GAChB,uBAAuB,GACvB,sBAAsB,GACtB,sBAAsB,GACtB,eAAe,GACf,uBAAuB,GACvB,kBAAkB,GAClB,yBAAyB,GACzB,gBAAgB,GAChB,yBAAyB,GACzB,WAAW,GACX,sBAAsB,GACtB,wBAAwB,GACxB,oBAAoB,GACpB,oBAAoB,GACpB,wBAAwB,GACxB,kBAAkB,CAAA"}

package/dist/types/model/type/Config.d.ts CHANGED Viewed

@@ -48,6 +48,8 @@ export type ConfigRow = {
     rate_limit_email_otp_per_person_window: IPostgresInterval;
     rate_limit_email_verification_per_ip_limit: number;
     rate_limit_email_verification_per_ip_window: IPostgresInterval;
+    panel_global_roles: readonly string[];
+    panel_project_roles: readonly string[];
 };
 export type Config = Omit<{
     [K in keyof ConfigSchema]: {

package/dist/types/model/type/Config.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../../../src/model/type/Config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,MAAM,MAAM,SAAS,GAAG;IACvB,iCAAiC,EAAE,OAAO,CAAA;IAC1C,iCAAiC,EAAE,OAAO,CAAA;IAC1C,oBAAoB,EAAE,YAAY,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,uBAAuB,EAAE,iBAAiB,CAAA;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,0BAA0B,EAAE,MAAM,CAAA;IAClC,0BAA0B,EAAE,MAAM,CAAA;IAClC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wBAAwB,EAAE,MAAM,CAAA;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,wBAAwB,EAAE,OAAO,CAAA;IACjC,mBAAmB,EAAE,OAAO,CAAA;IAC5B,kBAAkB,EAAE,iBAAiB,CAAA;IACrC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,oBAAoB,EAAE,iBAAiB,CAAA;IACvC,uBAAuB,EAAE,OAAO,CAAA;IAChC,yBAAyB,EAAE,OAAO,CAAA;IAClC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,0BAA0B,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACpD,wBAAwB,EAAE,iBAAiB,CAAA;IAC3C,+BAA+B,EAAE,OAAO,CAAA;IACxC,0BAA0B,EAAE,MAAM,CAAA;IAClC,6BAA6B,EAAE,MAAM,CAAA;IACrC,+BAA+B,EAAE,MAAM,CAAA;IACvC,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAA;IACxC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,uBAAuB,EAAE,OAAO,CAAA;IAChC,8BAA8B,EAAE,OAAO,CAAA;IACvC,iCAAiC,EAAE,OAAO,CAAA;IAC1C,kCAAkC,EAAE,OAAO,CAAA;IAC3C,+BAA+B,EAAE,MAAM,CAAA;IACvC,gCAAgC,EAAE,iBAAiB,CAAA;IACnD,6BAA6B,EAAE,MAAM,CAAA;IACrC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,sCAAsC,EAAE,MAAM,CAAA;IAC9C,uCAAuC,EAAE,iBAAiB,CAAA;IAC1D,yCAAyC,EAAE,MAAM,CAAA;IACjD,0CAA0C,EAAE,iBAAiB,CAAA;IAC7D,qCAAqC,EAAE,MAAM,CAAA;IAC7C,sCAAsC,EAAE,iBAAiB,CAAA;IACzD,0CAA0C,EAAE,MAAM,CAAA;IAClD,2CAA2C,EAAE,iBAAiB,CAAA;~~CAC9D~~,CAAA;AAED,MAAM,MAAM,MAAM,GACf,IAAI,CACL;KACE,CAAC,IAAI,MAAM,YAAY,GAAG;SACzB,EAAE,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;KACrE;CACD,EACD,YAAY,CACZ,GACC;IACD;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CACrC,CAAA"}
1	+ {"version":3,"file":"Config.d.ts","sourceRoot":"","sources":["../../../../src/model/type/Config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,KAAK,MAAM,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,MAAM,MAAM,SAAS,GAAG;IACvB,iCAAiC,EAAE,OAAO,CAAA;IAC1C,iCAAiC,EAAE,OAAO,CAAA;IAC1C,oBAAoB,EAAE,YAAY,CAAA;IAClC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,uBAAuB,EAAE,iBAAiB,CAAA;IAC1C,mBAAmB,EAAE,MAAM,CAAA;IAC3B,0BAA0B,EAAE,MAAM,CAAA;IAClC,0BAA0B,EAAE,MAAM,CAAA;IAClC,sBAAsB,EAAE,MAAM,CAAA;IAC9B,wBAAwB,EAAE,MAAM,CAAA;IAChC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,wBAAwB,EAAE,OAAO,CAAA;IACjC,mBAAmB,EAAE,OAAO,CAAA;IAC5B,kBAAkB,EAAE,iBAAiB,CAAA;IACrC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,oBAAoB,EAAE,iBAAiB,CAAA;IACvC,uBAAuB,EAAE,OAAO,CAAA;IAChC,yBAAyB,EAAE,OAAO,CAAA;IAClC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,0BAA0B,EAAE,iBAAiB,GAAG,IAAI,CAAA;IACpD,wBAAwB,EAAE,iBAAiB,CAAA;IAC3C,+BAA+B,EAAE,OAAO,CAAA;IACxC,0BAA0B,EAAE,MAAM,CAAA;IAClC,6BAA6B,EAAE,MAAM,CAAA;IACrC,+BAA+B,EAAE,MAAM,CAAA;IACvC,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAA;IACxC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,uBAAuB,EAAE,OAAO,CAAA;IAChC,8BAA8B,EAAE,OAAO,CAAA;IACvC,iCAAiC,EAAE,OAAO,CAAA;IAC1C,kCAAkC,EAAE,OAAO,CAAA;IAC3C,+BAA+B,EAAE,MAAM,CAAA;IACvC,gCAAgC,EAAE,iBAAiB,CAAA;IACnD,6BAA6B,EAAE,MAAM,CAAA;IACrC,8BAA8B,EAAE,iBAAiB,CAAA;IACjD,sCAAsC,EAAE,MAAM,CAAA;IAC9C,uCAAuC,EAAE,iBAAiB,CAAA;IAC1D,yCAAyC,EAAE,MAAM,CAAA;IACjD,0CAA0C,EAAE,iBAAiB,CAAA;IAC7D,qCAAqC,EAAE,MAAM,CAAA;IAC7C,sCAAsC,EAAE,iBAAiB,CAAA;IACzD,0CAA0C,EAAE,MAAM,CAAA;IAClD,2CAA2C,EAAE,iBAAiB,CAAA;IAE9D,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,MAAM,GACf,IAAI,CACL;KACE,CAAC,IAAI,MAAM,YAAY,GAAG;SACzB,EAAE,IAAI,MAAM,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;KACrE;CACD,EACD,YAAY,CACZ,GACC;IACD;;;OAGG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;CACrC,CAAA"}

package/dist/types/model/type/CustomRole.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+export type CustomRoleRow = {
+    readonly id: string;
+    readonly slug: string;
+    readonly description: string | null;
+    readonly grants: unknown;
+    readonly created_at: Date;
+    readonly updated_at: Date;
+};
+//# sourceMappingURL=CustomRole.d.ts.map

package/dist/types/model/type/CustomRole.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"CustomRole.d.ts","sourceRoot":"","sources":["../../../../src/model/type/CustomRole.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CACzB,CAAA"}

package/dist/types/model/type/IdentityProvider.d.ts CHANGED Viewed

@@ -10,5 +10,7 @@ export interface IdentityProviderOptions {
     initReturnsConfig: boolean;
     requireVerifiedEmail: boolean;
     assumeEmailVerified: boolean;
+    /** A person linked to this provider may authenticate only through it. */
+    disableLocalAuthentication: boolean;
 }
 //# sourceMappingURL=IdentityProvider.d.ts.map

package/dist/types/model/type/IdentityProvider.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../../src/model/type/IdentityProvider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,uBAAuB,CAAA;CAChC;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,mBAAmB,EAAE,OAAO,CAAA;~~CAC5B~~"}
1	+ {"version":3,"file":"IdentityProvider.d.ts","sourceRoot":"","sources":["../../../../src/model/type/IdentityProvider.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAClC,OAAO,EAAE,uBAAuB,CAAA;CAChC;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,yEAAyE;IACzE,0BAA0B,EAAE,OAAO,CAAA;CACnC"}

package/dist/types/model/type/PersonToken.d.ts CHANGED Viewed

@@ -15,6 +15,8 @@ export declare namespace PersonToken {
         token_hash: string;
         used_at: null | Date;
         expires_at: Date;
+        /** `expires_at <= now()` computed on the DB clock — the authoritative expiry gate. */
+        is_expired: boolean;
         person_id: string;
         otp_hash: string | null;
         otp_attempts: number;

package/dist/types/model/type/PersonToken.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"PersonToken.d.ts","sourceRoot":"","sources":["../../../../src/model/type/PersonToken.ts"],"names":[],"mappings":"AAAA,yBAAiB,WAAW,CAAC;IAC5B,KAAY,IAAI,GAAG,gBAAgB,GAAG,cAAc,GAAG,eAAe,GAAG,oBAAoB,GAAG,cAAc,CAAA;IAC9G,KAAY,cAAc,GAAG,OAAO,GAAG,KAAK,CAAA;IAE5C;;;;OAIG;IACH,UAAiB,SAAS;QACzB,KAAK,EAAE,MAAM,CAAA;KACb;IAED,UAAiB,GAAG;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,UAAU,EAAE,IAAI,CAAA;QAChB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAA;QACpB,UAAU,EAAE,IAAI,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KACtB;IAED,KAAY,oBAAoB,GAC7B,iBAAiB,GACjB,eAAe,GACf,YAAY,GACZ,eAAe,CAAA;CAClB"}
1	+ {"version":3,"file":"PersonToken.d.ts","sourceRoot":"","sources":["../../../../src/model/type/PersonToken.ts"],"names":[],"mappings":"AAAA,yBAAiB,WAAW,CAAC;IAC5B,KAAY,IAAI,GAAG,gBAAgB,GAAG,cAAc,GAAG,eAAe,GAAG,oBAAoB,GAAG,cAAc,CAAA;IAC9G,KAAY,cAAc,GAAG,OAAO,GAAG,KAAK,CAAA;IAE5C;;;;OAIG;IACH,UAAiB,SAAS;QACzB,KAAK,EAAE,MAAM,CAAA;KACb;IAED,UAAiB,GAAG;QACnB,EAAE,EAAE,MAAM,CAAA;QACV,UAAU,EAAE,IAAI,CAAA;QAChB,UAAU,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,IAAI,GAAG,IAAI,CAAA;QACpB,UAAU,EAAE,IAAI,CAAA;QAChB,sFAAsF;QACtF,UAAU,EAAE,OAAO,CAAA;QACnB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,SAAS,GAAG,IAAI,CAAA;KACtB;IAED,KAAY,oBAAoB,GAC7B,iBAAiB,GACjB,eAAe,GACf,YAAY,GACZ,eAAe,CAAA;CAClB"}

package/dist/types/model/type/RateLimit.d.ts CHANGED Viewed

@@ -1,10 +1,10 @@
 export declare const RateLimitScopes: {
-    readonly signUpPerIp: "sign_up_per_ip";
-    readonly loginPerIp: "login_per_ip";
-    readonly passwordResetPerIp: "password_reset_per_ip";
-    readonly passwordlessInitPerIp: "passwordless_init_per_ip";
-    readonly emailOtpPerPerson: "email_otp_per_person";
-    readonly emailVerificationPerIp: "email_verification_per_ip";
+    readonly signUpPerIp: 'sign_up_per_ip';
+    readonly loginPerIp: 'login_per_ip';
+    readonly passwordResetPerIp: 'password_reset_per_ip';
+    readonly passwordlessInitPerIp: 'passwordless_init_per_ip';
+    readonly emailOtpPerPerson: 'email_otp_per_person';
+    readonly emailVerificationPerIp: 'email_verification_per_ip';
 };
 export type RateLimitScope = typeof RateLimitScopes[keyof typeof RateLimitScopes];
 //# sourceMappingURL=RateLimit.d.ts.map

package/dist/types/model/type/RateLimit.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"RateLimit.d.ts","sourceRoot":"","sources":["../../../../src/model/type/RateLimit.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe~~;;;;;;;CAOlB~~,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA"}
1	+ {"version":3,"file":"RateLimit.d.ts","sourceRoot":"","sources":["../../../../src/model/type/RateLimit.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe;aAC3B,WAAW,EAAE,gBAAgB;aAC7B,UAAU,EAAE,cAAc;aAC1B,kBAAkB,EAAE,uBAAuB;aAC3C,qBAAqB,EAAE,0BAA0B;aACjD,iBAAiB,EAAE,sBAAsB;aACzC,sBAAsB,EAAE,2BAA2B;CAC1C,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA"}

package/dist/types/model/type/index.d.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 export * from './ApiKey.js';
 export * from './AuthPolicy.js';
 export * from './Config.js';
+export * from './CustomRole.js';
 export * from './IdentityProvider.js';
 export * from './Project.js';
 export * from './Variables.js';

package/dist/types/model/type/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/type/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/type/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,aAAa,CAAA;AAC3B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,cAAc,CAAA;AAC5B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA"}

package/dist/types/model/utils/DatabaseContext.d.ts CHANGED Viewed

@@ -1,7 +1,21 @@
 import { Client, Connection } from '@contember/database';
+import { Logger } from '@contember/logger';
 import { Providers } from '../providers.js';
 import { CommandBus } from '../commands/index.js';
 import { BatchLoaderArgs } from '../../utils/batchQuery.js';
+export interface TransactionOptions {
+    /**
+     * Repeat the transaction when postgres aborts it with a serialization failure (40001) — the standing cost of the
+     * repeatable-read level every transaction here runs at.
+     *
+     * Opt in only when the callback has no effect outside the transaction: several managers send a mail from inside
+     * one (InviteManager, EmailChangeManager, PasswordlessSignInManager) and a retry would send it twice.
+     */
+    retry?: {
+        logger: Logger;
+    };
+    readonly isolation?: 'repeatableRead' | 'readCommitted';
+}
 export declare class DatabaseContext<Conn extends Connection.ConnectionLike = Connection.ConnectionLike> {
     readonly client: Client<Conn>;
     readonly providers: Providers;
@@ -9,7 +23,7 @@ export declare class DatabaseContext<Conn extends Connection.ConnectionLike = Co
     constructor(client: Client<Conn>, providers: Providers);
     get commandBus(): CommandBus<Conn>;
     get queryHandler(): import("@contember/queryable").QueryHandler<import("@contember/database").DatabaseQueryable>;
-    transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>): Promise<T>;
+    transaction<T>(cb: (dbContext: DatabaseContext<Connection.TransactionLike>) => Promise<T>, options?: TransactionOptions): Promise<T>;
     scope<T>(cb: (dbContext: DatabaseContext<Connection.AcquiredConnectionLike>) => Promise<T>): Promise<T>;
     batchLoad<Arg, Result, Item>(loaderArgs: BatchLoaderArgs<Arg, Result, Item>, arg: Arg): Promise<Item>;
 }

package/dist/types/model/utils/DatabaseContext.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"DatabaseContext.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/DatabaseContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,~~EAAE~~,MAAM,qBAAqB,CAAA;~~AACxD~~,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,eAAe,EAA+B,MAAM,2BAA2B,CAAA;AAExF,qBAAa,eAAe,CAAC,IAAI,SAAS,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc;aAI7E,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;aACpB,SAAS,EAAE,SAAS;IAJrC,OAAO,CAAC,OAAO,CAAkE;~~gBAGhE~~,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EACpB,SAAS,EAAE,SAAS;~~IAIrC~~,IAAW,UAAU,qBAEpB;IAED,IAAW,YAAY,iGAEtB;IAEY,WAAW,CAAC,CAAC,~~EAAE~~,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,~~GAAG~~,OAAO,CAAC,CAAC,CAAC;~~IAOtG~~,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,sBAAsB,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;~~IAM7G~~,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;~~CAS5G~~"}
1	+ {"version":3,"file":"DatabaseContext.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/DatabaseContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAoB,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,eAAe,EAA+B,MAAM,2BAA2B,CAAA;AAExF,MAAM,WAAW,kBAAkB;IAClC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,GAAG,eAAe,CAAA;CACvD;AAED,qBAAa,eAAe,CAAC,IAAI,SAAS,UAAU,CAAC,cAAc,GAAG,UAAU,CAAC,cAAc;aAI7E,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC;aACpB,SAAS,EAAE,SAAS;IAJrC,OAAO,CAAC,OAAO,CAAkE;IAEjF,YACiB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EACpB,SAAS,EAAE,SAAS,EAEpC;IAED,IAAW,UAAU,qBAEpB;IAED,IAAW,YAAY,iGAEtB;IAEY,WAAW,CAAC,CAAC,EACzB,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAC1E,OAAO,GAAE,kBAAuB,GAC9B,OAAO,CAAC,CAAC,CAAC,CAaZ;IAEY,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,UAAU,CAAC,sBAAsB,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAInH;IAEM,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3G;CACD"}

package/dist/types/model/utils/Response.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"Response.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/Response.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS,IACjF,UAAU,CAAC,MAAM,CAAC,GAClB,CAAC,KAAK,SAAS,KAAK,GAAG,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAA;AAEtE,qBAAa,UAAU,CAAC,MAAM;aAGD,MAAM,EAAE,MAAM;IAF1C,SAAgB,EAAE,QAAO;~~gBAEG~~,MAAM,EAAE,MAAM;~~CAC1C~~;AAED,qBAAa,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS;aAIjE,KAAK,EAAE,KAAK;aACZ,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,QAAQ;IALpC,SAAgB,EAAE,SAAQ;~~gBAGT~~,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,QAAQ,YAAA;~~CAEpC~~"}
1	+ {"version":3,"file":"Response.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/Response.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,aAAa,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS,IACjF,UAAU,CAAC,MAAM,CAAC,GAClB,CAAC,KAAK,SAAS,KAAK,GAAG,KAAK,GAAG,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAA;AAEtE,qBAAa,UAAU,CAAC,MAAM;aAGD,MAAM,EAAE,MAAM;IAF1C,SAAgB,EAAE,QAAO;IAEzB,YAA4B,MAAM,EAAE,MAAM,EAAI;CAC9C;AAED,qBAAa,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,SAAS,EAAE,GAAG,SAAS,GAAG,SAAS;aAIjE,KAAK,EAAE,KAAK;aACZ,YAAY,EAAE,MAAM;aACpB,QAAQ,CAAC,EAAE,QAAQ;IALpC,SAAgB,EAAE,SAAQ;IAE1B,YACiB,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,QAAQ,YAAA,EAChC;CACJ"}

package/dist/types/model/utils/email.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/email.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,~~GAAI~~,~~OAAO,~~MAAM,WAE3C,CAAA;AAED,eAAO,MAAM,aAAa,~~GAAI~~,~~OAAO,~~MAAM,KAAG,OAI7C,CAAA"}
1	+ {"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/email.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,cAAc,UAAW,MAAM,WAE3C,CAAA;AAED,eAAO,MAAM,aAAa,UAAW,MAAM,KAAG,OAI7C,CAAA"}

package/dist/types/model/utils/hex.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"hex.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/hex.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,CAAC,MAAM,SAAS,MAAM,IAAI,MAAM,GAAG;IAAE,OAAO,EAAE,aAAa,MAAM,EAAE,CAAA;CAAE,CAAA;AAIrG,eAAO,MAAM,sBAAsB,GAAI,MAAM,SAAS,MAAM,~~EAAE~~,~~OAAO,~~MAAM,~~EAAE~~,~~QAAQ,~~MAAM,KAAG,KAAK,IAAI,oBAAoB,CAAC,MAAM,CAEjI,CAAA"}
1	+ {"version":3,"file":"hex.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/hex.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,CAAC,MAAM,SAAS,MAAM,IAAI,MAAM,GAAG;IAAE,OAAO,EAAE,aAAa,MAAM,EAAE,CAAA;CAAE,CAAA;AAIrG,eAAO,MAAM,sBAAsB,GAAI,MAAM,SAAS,MAAM,SAAS,MAAM,UAAU,MAAM,KAAG,KAAK,IAAI,oBAAoB,CAAC,MAAM,CAEjI,CAAA"}

package/dist/types/model/utils/interval.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"interval.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/interval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,~~GAAI~~,~~UAAU,~~iBAAiB,KAAG,MAKhE,CAAA;AAED,eAAO,MAAM,iBAAiB,~~GAAI~~,~~UAAU,~~iBAAiB,KAAG,MAW/D,CAAA"}
1	+ {"version":3,"file":"interval.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/interval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAAc,iBAAiB,KAAG,MAKhE,CAAA;AAED,eAAO,MAAM,iBAAiB,aAAc,iBAAiB,KAAG,MAW/D,CAAA"}

package/dist/types/model/utils/time.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/time.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,WAAW,~~GAAI~~,~~KAAK,~~IAAI,~~EAAE~~,MAAM,~~MAAM,~~SAA4C,CAAA"}
1	+ {"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/time.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,WAAW,QAAS,IAAI,QAAQ,MAAM,SAA4C,CAAA"}

package/dist/types/model/utils/token.d.ts CHANGED Viewed

@@ -14,10 +14,9 @@ export declare const MAX_OTP_ATTEMPTS = 3;
  * without leaking timing information about the matching prefix.
  */
 export declare const timingSafeCompareHash: (a: TokenHash, b: TokenHash) => boolean;
-export declare const validateToken: ({ entry, validationType, token, now }: {
+export declare const validateToken: ({ entry, validationType, token }: {
     entry: PersonToken.Row | null;
     validationType: PersonToken.ValidationType;
     token: string;
-    now: Date;
 }) => Response<PersonToken.Row, PersonToken.TokenValidationError>;
 //# sourceMappingURL=token.d.ts.map

package/dist/types/model/utils/token.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAA0B,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,OAAO,EAAE,QAAQ,EAA6B,MAAM,eAAe,CAAA;AAEnE,eAAO,MAAM,aAAa,~~GAAU,WAAW~~;IAC9C,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/C,KAAG,OAAO,CAAC,MAAM,CAEjB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;AAEhD,eAAO,MAAM,gBAAgB,~~GAAI~~,~~OAAO,~~MAAM,KAAG,SAKhD,CAAA;AAED,eAAO,MAAM,WAAW,~~GAAI~~,~~OAAO,~~MAAM,KAAG,KAAK,IAAI,SAA8C,CAAA;AAEnG,eAAO,MAAM,gBAAgB,IAAI,CAAA;AAEjC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,~~GAAI~~,~~GAAG,~~SAAS,~~EAAE~~,~~GAAG,~~SAAS,KAAG,OAOlE,CAAA;AAED,eAAO,MAAM,aAAa,~~GAAI,uCAAuC~~;~~IACpE~~,KAAK,EAAE,WAAW,CAAC,GAAG,GAAG,IAAI,CAAA;IAC7B,cAAc,EAAE,WAAW,CAAC,cAAc,CAAA;IAC1C,KAAK,EAAE,MAAM,CAAA;~~IACb~~,~~GAAG,EAAE,IAAI,CAAA;CACT,~~KAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,oBAAoB,CAkC7D,CAAA"}
1	+ {"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../../src/model/utils/token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAA0B,MAAM,UAAU,CAAA;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,OAAO,EAAE,QAAQ,EAA6B,MAAM,eAAe,CAAA;AAEnE,eAAO,MAAM,aAAa,cAAqB;IAC9C,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC/C,KAAG,OAAO,CAAC,MAAM,CAEjB,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAA;AAEhD,eAAO,MAAM,gBAAgB,UAAW,MAAM,KAAG,SAKhD,CAAA;AAED,eAAO,MAAM,WAAW,UAAW,MAAM,KAAG,KAAK,IAAI,SAA8C,CAAA;AAEnG,eAAO,MAAM,gBAAgB,IAAI,CAAA;AAEjC;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,MAAO,SAAS,KAAK,SAAS,KAAG,OAOlE,CAAA;AAED,eAAO,MAAM,aAAa,qCAAsC;IAC/D,KAAK,EAAE,WAAW,CAAC,GAAG,GAAG,IAAI,CAAA;IAC7B,cAAc,EAAE,WAAW,CAAC,cAAc,CAAA;IAC1C,KAAK,EAAE,MAAM,CAAA;CACb,KAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,oBAAoB,CAkC7D,CAAA"}