@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/development/src/model/mailing/UserMailer.cjs

@@ -18,8 +18,9 @@ require("../type/ApiKey.cjs");
 const MailTemplateQuery = require("../queries/mailTemplate/MailTemplateQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 const Layout_mustache = require("./templates/Layout.mustache.cjs");
 class UserMailer {

package/dist/development/src/model/mailing/UserMailer.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UserMailer.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils/index.js'\nimport NewUserInvited from './templates/NewUserInvited.mustache.js'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache.js'\nimport PasswordReset from './templates/PasswordReset.mustache.js'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache.js'\nimport EmailOtp from './templates/EmailOtp.mustache.js'\nimport ForcedSignOut from './templates/ForcedSignOut.mustache.js'\nimport BackupCodesExhausted from './templates/BackupCodesExhausted.mustache.js'\nimport EmailVerification from './templates/EmailVerification.mustache.js'\nimport EmailChangeVerify from './templates/EmailChangeVerify.mustache.js'\nimport EmailChangeNotify from './templates/EmailChangeNotify.mustache.js'\nimport UnusualLogin from './templates/UnusualLogin.mustache.js'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type.js'\nimport { MailTemplateQuery } from '../queries/index.js'\nimport Layout from './templates/Layout.mustache.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) {}\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: {\n\t\t\temail: string\n\t\t\tpassword: string | null\n\t\t\ttoken: string | null\n\t\t\tproject: string\n\t\t\tprojectSlug: string\n\t\t\tmemberships: readonly Acl.Membership[]\n\t\t},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendForcedSignOutEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; reason: string | null },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.forcedSignOut, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your sessions have been signed out',\n\t\t\tcontent: ForcedSignOut,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailVerificationEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailVerification, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Verify your e-mail address',\n\t\t\tcontent: EmailVerification,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailChangeVerifyEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailChangeVerify, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Confirm your new e-mail address',\n\t\t\tcontent: EmailChangeVerify,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailChangeNotifyEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; newEmail: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailChangeNotify, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your e-mail address was changed',\n\t\t\tcontent: EmailChangeNotify,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string; requestId: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailOtpEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; code: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailOtp, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your verification code',\n\t\t\tcontent: EmailOtp,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendBackupCodesExhaustedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.backupCodesExhausted, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have no MFA backup codes left',\n\t\t\tcontent: BackupCodesExhausted,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendUnusualLoginEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; geoCountry: string | null; ipAddress: string | null },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.unusualLogin, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Unusual sign-in to your account',\n\t\t\tcontent: UnusualLogin,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo\n\t\t\t\t? {\n\t\t\t\t\treplyTo: template.replyTo,\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'> | null> {\n\t\tconst customTemplate = (await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":["MailType","NewUserInvited","ExistingUserInvited","PasswordReset","ForcedSignOut","EmailVerification","EmailChangeVerify","EmailChangeNotify","PasswordlessSignIn","EmailOtp","BackupCodesExhausted","UnusualLogin","MailTemplateQuery","Layout"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAkBO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,WACA,eAQA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMA,KAAAA,SAAS,gBAAgB,GAAG,kBAAA;AACvD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASC;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMD,KAAAA,SAAS,qBAAqB,GAAG,kBAAA;AAC5D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASE;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMF,KAAAA,SAAS,eAAe,GAAG,kBAAA;AACtD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASG;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMH,KAAAA,SAAS,eAAe,GAAG,kBAAA;AACtD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASI;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMJ,KAAAA,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASK;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAML,KAAAA,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASM;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMN,KAAAA,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASO;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMP,KAAAA,SAAS,oBAAoB,GAAG,kBAAA;AAC3D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASQ;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,kBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMR,KAAAA,SAAS,UAAU,GAAG,kBAAA;AACjD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASS;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,8BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMT,KAAAA,SAAS,sBAAsB,GAAG,kBAAA;AAC7D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASU;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMV,KAAAA,SAAS,cAAc,GAAG,kBAAA;AACrD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASW;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAC3E,UAAM,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UACV;AAAA,QACD,SAAS,SAAS;AAAA,MAAA,IAEjB,CAAA;AAAA,IAAC,CACJ;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,WACA,YAC4E;AAC5E,UAAM,iBAAkB,MAAM,UAAU,aAAa,MAAM,IAAIC,kBAAAA,kBAAkB,UAAU,CAAC,KACvF,MAAM,UAAU,aAAa,MAAM,IAAIA,oCAAkB,EAAE,GAAG,YAAY,WAAW,KAAA,CAAM,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACpB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,eAAe,YAAYC,gBAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAA;AAAA,EAC5E;AACD;;"}
+{"version":3,"file":"UserMailer.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils/index.js'\nimport NewUserInvited from './templates/NewUserInvited.mustache.js'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache.js'\nimport PasswordReset from './templates/PasswordReset.mustache.js'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache.js'\nimport EmailOtp from './templates/EmailOtp.mustache.js'\nimport ForcedSignOut from './templates/ForcedSignOut.mustache.js'\nimport BackupCodesExhausted from './templates/BackupCodesExhausted.mustache.js'\nimport EmailVerification from './templates/EmailVerification.mustache.js'\nimport EmailChangeVerify from './templates/EmailChangeVerify.mustache.js'\nimport EmailChangeNotify from './templates/EmailChangeNotify.mustache.js'\nimport UnusualLogin from './templates/UnusualLogin.mustache.js'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type.js'\nimport { MailTemplateQuery } from '../queries/index.js'\nimport Layout from './templates/Layout.mustache.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) {}\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: {\n\t\t\temail: string\n\t\t\tpassword: string | null\n\t\t\ttoken: string | null\n\t\t\tproject: string\n\t\t\tprojectSlug: string\n\t\t\tmemberships: readonly Acl.Membership[]\n\t\t},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendForcedSignOutEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; reason: string | null },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.forcedSignOut, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your sessions have been signed out',\n\t\t\tcontent: ForcedSignOut,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailVerificationEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailVerification, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Verify your e-mail address',\n\t\t\tcontent: EmailVerification,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailChangeVerifyEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailChangeVerify, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Confirm your new e-mail address',\n\t\t\tcontent: EmailChangeVerify,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailChangeNotifyEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; newEmail: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailChangeNotify, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your e-mail address was changed',\n\t\t\tcontent: EmailChangeNotify,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string; requestId: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailOtpEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; code: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailOtp, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your verification code',\n\t\t\tcontent: EmailOtp,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendBackupCodesExhaustedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.backupCodesExhausted, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have no MFA backup codes left',\n\t\t\tcontent: BackupCodesExhausted,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendUnusualLoginEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; geoCountry: string | null; ipAddress: string | null },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.unusualLogin, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Unusual sign-in to your account',\n\t\t\tcontent: UnusualLogin,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo\n\t\t\t\t? {\n\t\t\t\t\treplyTo: template.replyTo,\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'> | null> {\n\t\tconst customTemplate = (await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":["MailType","NewUserInvited","ExistingUserInvited","PasswordReset","ForcedSignOut","EmailVerification","EmailChangeVerify","EmailChangeNotify","PasswordlessSignIn","EmailOtp","BackupCodesExhausted","UnusualLogin","MailTemplateQuery","Layout"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAkBO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,WACA,eAQA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMA,KAAAA,SAAS,gBAAgB,GAAG,kBAAA;AACvD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASC;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMD,KAAAA,SAAS,qBAAqB,GAAG,kBAAA;AAC5D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASE;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMF,KAAAA,SAAS,eAAe,GAAG,kBAAA;AACtD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASG;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMH,KAAAA,SAAS,eAAe,GAAG,kBAAA;AACtD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASI;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMJ,KAAAA,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASK;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAML,KAAAA,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASM;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMN,KAAAA,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASO;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMP,KAAAA,SAAS,oBAAoB,GAAG,kBAAA;AAC3D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASQ;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,kBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMR,KAAAA,SAAS,UAAU,GAAG,kBAAA;AACjD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASS;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,8BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMT,KAAAA,SAAS,sBAAsB,GAAG,kBAAA;AAC7D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASU;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAMV,KAAAA,SAAS,cAAc,GAAG,kBAAA;AACrD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAASW;AAAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAC3E,UAAM,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UACV;AAAA,QACD,SAAS,SAAS;AAAA,MAAA,IAEjB,CAAA;AAAA,IAAC,CACJ;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,WACA,YAC4E;AAC5E,UAAM,iBAAkB,MAAM,UAAU,aAAa,MAAM,IAAIC,kBAAAA,kBAAkB,UAAU,CAAC,KACvF,MAAM,UAAU,aAAa,MAAM,IAAIA,oCAAkB,EAAE,GAAG,YAAY,WAAW,KAAA,CAAM,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACpB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,eAAe,YAAYC,gBAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAA;AAAA,EAC5E;AACD;;"}

package/dist/development/src/model/mailing/UserMailer.js

@@ -16,8 +16,9 @@ import "../type/ApiKey.js";
 import { MailTemplateQuery } from "../queries/mailTemplate/MailTemplateQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 import Layout from "./templates/Layout.mustache.js";
 class UserMailer {

package/dist/development/src/model/mailing/UserMailer.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserMailer.js","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils/index.js'\nimport NewUserInvited from './templates/NewUserInvited.mustache.js'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache.js'\nimport PasswordReset from './templates/PasswordReset.mustache.js'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache.js'\nimport EmailOtp from './templates/EmailOtp.mustache.js'\nimport ForcedSignOut from './templates/ForcedSignOut.mustache.js'\nimport BackupCodesExhausted from './templates/BackupCodesExhausted.mustache.js'\nimport EmailVerification from './templates/EmailVerification.mustache.js'\nimport EmailChangeVerify from './templates/EmailChangeVerify.mustache.js'\nimport EmailChangeNotify from './templates/EmailChangeNotify.mustache.js'\nimport UnusualLogin from './templates/UnusualLogin.mustache.js'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type.js'\nimport { MailTemplateQuery } from '../queries/index.js'\nimport Layout from './templates/Layout.mustache.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) {}\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: {\n\t\t\temail: string\n\t\t\tpassword: string | null\n\t\t\ttoken: string | null\n\t\t\tproject: string\n\t\t\tprojectSlug: string\n\t\t\tmemberships: readonly Acl.Membership[]\n\t\t},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendForcedSignOutEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; reason: string | null },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.forcedSignOut, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your sessions have been signed out',\n\t\t\tcontent: ForcedSignOut,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailVerificationEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailVerification, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Verify your e-mail address',\n\t\t\tcontent: EmailVerification,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailChangeVerifyEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailChangeVerify, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Confirm your new e-mail address',\n\t\t\tcontent: EmailChangeVerify,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailChangeNotifyEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; newEmail: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailChangeNotify, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your e-mail address was changed',\n\t\t\tcontent: EmailChangeNotify,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string; requestId: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailOtpEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; code: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailOtp, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your verification code',\n\t\t\tcontent: EmailOtp,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendBackupCodesExhaustedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.backupCodesExhausted, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have no MFA backup codes left',\n\t\t\tcontent: BackupCodesExhausted,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendUnusualLoginEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; geoCountry: string | null; ipAddress: string | null },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.unusualLogin, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Unusual sign-in to your account',\n\t\t\tcontent: UnusualLogin,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo\n\t\t\t\t? {\n\t\t\t\t\treplyTo: template.replyTo,\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'> | null> {\n\t\tconst customTemplate = (await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkBO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,WACA,eAQA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,gBAAgB,GAAG,kBAAA;AACvD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,qBAAqB,GAAG,kBAAA;AAC5D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,eAAe,GAAG,kBAAA;AACtD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,eAAe,GAAG,kBAAA;AACtD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,oBAAoB,GAAG,kBAAA;AAC3D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,kBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,UAAU,GAAG,kBAAA;AACjD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,8BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,sBAAsB,GAAG,kBAAA;AAC7D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,cAAc,GAAG,kBAAA;AACrD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAC3E,UAAM,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UACV;AAAA,QACD,SAAS,SAAS;AAAA,MAAA,IAEjB,CAAA;AAAA,IAAC,CACJ;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,WACA,YAC4E;AAC5E,UAAM,iBAAkB,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,UAAU,CAAC,KACvF,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,EAAE,GAAG,YAAY,WAAW,KAAA,CAAM,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACpB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,eAAe,YAAY,OAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAA;AAAA,EAC5E;AACD;"}
+{"version":3,"file":"UserMailer.js","sources":["../../../../../../packages/engine-tenant-api/src/model/mailing/UserMailer.ts"],"sourcesContent":["import { Mailer, TemplateRenderer } from '../../utils/index.js'\nimport NewUserInvited from './templates/NewUserInvited.mustache.js'\nimport ExistingUserInvited from './templates/ExistingUserInvited.mustache.js'\nimport PasswordReset from './templates/PasswordReset.mustache.js'\nimport PasswordlessSignIn from './templates/PasswordlessSignIn.mustache.js'\nimport EmailOtp from './templates/EmailOtp.mustache.js'\nimport ForcedSignOut from './templates/ForcedSignOut.mustache.js'\nimport BackupCodesExhausted from './templates/BackupCodesExhausted.mustache.js'\nimport EmailVerification from './templates/EmailVerification.mustache.js'\nimport EmailChangeVerify from './templates/EmailChangeVerify.mustache.js'\nimport EmailChangeNotify from './templates/EmailChangeNotify.mustache.js'\nimport UnusualLogin from './templates/UnusualLogin.mustache.js'\nimport { MailTemplateData, MailTemplateIdentifier, MailType } from './type.js'\nimport { MailTemplateQuery } from '../queries/index.js'\nimport Layout from './templates/Layout.mustache.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Acl } from '@contember/schema'\n\nexport class UserMailer {\n\tconstructor(\n\t\tprivate readonly mailer: Mailer,\n\t\tprivate readonly templateRenderer: TemplateRenderer,\n\t) {}\n\n\tasync sendNewUserInvitedMail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: {\n\t\t\temail: string\n\t\t\tpassword: string | null\n\t\t\ttoken: string | null\n\t\t\tproject: string\n\t\t\tprojectSlug: string\n\t\t\tmemberships: readonly Acl.Membership[]\n\t\t},\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.newUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: NewUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendExistingUserInvitedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; project: string; projectSlug: string; memberships: readonly Acl.Membership[] },\n\t\tcustomMailOptions: { projectId: string; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.existingUserInvited, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have been invited to {{project}}',\n\t\t\tcontent: ExistingUserInvited,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordResetEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordReset, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Password reset',\n\t\t\tcontent: PasswordReset,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendForcedSignOutEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; reason: string | null },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.forcedSignOut, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your sessions have been signed out',\n\t\t\tcontent: ForcedSignOut,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailVerificationEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailVerification, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Verify your e-mail address',\n\t\t\tcontent: EmailVerification,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailChangeVerifyEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailChangeVerify, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Confirm your new e-mail address',\n\t\t\tcontent: EmailChangeVerify,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailChangeNotifyEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; newEmail: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailChangeNotify, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your e-mail address was changed',\n\t\t\tcontent: EmailChangeNotify,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendPasswordlessEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; token: string; project?: string; projectSlug?: string; url?: string; requestId: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.passwordlessSignIn, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Sign in here',\n\t\t\tcontent: PasswordlessSignIn,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendEmailOtpEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; code: string; project?: string; projectSlug?: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.emailOtp, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Your verification code',\n\t\t\tcontent: EmailOtp,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendBackupCodesExhaustedEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.backupCodesExhausted, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'You have no MFA backup codes left',\n\t\t\tcontent: BackupCodesExhausted,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tasync sendUnusualLoginEmail(\n\t\tdbContext: DatabaseContext,\n\t\tmailArguments: { email: string; geoCountry: string | null; ipAddress: string | null },\n\t\tcustomMailOptions: { projectId: string | null; variant: string },\n\t): Promise<void> {\n\t\tconst templateId = { type: MailType.unusualLogin, ...customMailOptions }\n\t\tconst template = (await this.getCustomTemplate(dbContext, templateId)) || {\n\t\t\tsubject: 'Unusual sign-in to your account',\n\t\t\tcontent: UnusualLogin,\n\t\t\treplyTo: null,\n\t\t}\n\t\tawait this.sendMail(templateId, template, mailArguments)\n\t}\n\n\tprivate async sendMail(\n\t\ttemplateId: MailTemplateIdentifier,\n\t\ttemplate: Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'>,\n\t\tvariables: Record<string, any>,\n\t) {\n\t\tconst html = await this.templateRenderer.render(template.content, variables)\n\t\tawait this.mailer.send({\n\t\t\tto: variables.email,\n\t\t\tsubject: await this.templateRenderer.render(template.subject, variables),\n\t\t\thtml,\n\t\t\tvariables,\n\t\t\ttemplate: templateId,\n\t\t\t...(template.replyTo\n\t\t\t\t? {\n\t\t\t\t\treplyTo: template.replyTo,\n\t\t\t\t}\n\t\t\t\t: {}),\n\t\t})\n\t}\n\n\tprivate async getCustomTemplate(\n\t\tdbContext: DatabaseContext,\n\t\tidentifier: MailTemplateIdentifier,\n\t): Promise<Pick<MailTemplateData, 'subject' | 'content' | 'replyTo'> | null> {\n\t\tconst customTemplate = (await dbContext.queryHandler.fetch(new MailTemplateQuery(identifier)))\n\t\t\t?? (await dbContext.queryHandler.fetch(new MailTemplateQuery({ ...identifier, projectId: null })))\n\n\t\tif (!customTemplate) {\n\t\t\treturn null\n\t\t}\n\t\tconst content = customTemplate.useLayout ? Layout(customTemplate.content) : customTemplate.content\n\t\treturn { content, subject: customTemplate.subject, replyTo: customTemplate.replyTo }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkBO,MAAM,WAAW;AAAA,EACvB,YACkB,QACA,kBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,uBACL,WACA,eAQA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,gBAAgB,GAAG,kBAAA;AACvD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,6BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,qBAAqB,GAAG,kBAAA;AAC5D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,eAAe,GAAG,kBAAA;AACtD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,uBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,eAAe,GAAG,kBAAA;AACtD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,2BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,mBAAmB,GAAG,kBAAA;AAC1D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,oBAAoB,GAAG,kBAAA;AAC3D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,kBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,UAAU,GAAG,kBAAA;AACjD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,8BACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,sBAAsB,GAAG,kBAAA;AAC7D,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAM,sBACL,WACA,eACA,mBACgB;AAChB,UAAM,aAAa,EAAE,MAAM,SAAS,cAAc,GAAG,kBAAA;AACrD,UAAM,WAAY,MAAM,KAAK,kBAAkB,WAAW,UAAU,KAAM;AAAA,MACzE,SAAS;AAAA,MACT,SAAS;AAAA,MACT,SAAS;AAAA,IAAA;AAEV,UAAM,KAAK,SAAS,YAAY,UAAU,aAAa;AAAA,EACxD;AAAA,EAEA,MAAc,SACb,YACA,UACA,WACC;AACD,UAAM,OAAO,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAC3E,UAAM,KAAK,OAAO,KAAK;AAAA,MACtB,IAAI,UAAU;AAAA,MACd,SAAS,MAAM,KAAK,iBAAiB,OAAO,SAAS,SAAS,SAAS;AAAA,MACvE;AAAA,MACA;AAAA,MACA,UAAU;AAAA,MACV,GAAI,SAAS,UACV;AAAA,QACD,SAAS,SAAS;AAAA,MAAA,IAEjB,CAAA;AAAA,IAAC,CACJ;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,WACA,YAC4E;AAC5E,UAAM,iBAAkB,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,UAAU,CAAC,KACvF,MAAM,UAAU,aAAa,MAAM,IAAI,kBAAkB,EAAE,GAAG,YAAY,WAAW,KAAA,CAAM,CAAC;AAEjG,QAAI,CAAC,gBAAgB;AACpB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,eAAe,YAAY,OAAO,eAAe,OAAO,IAAI,eAAe;AAC3F,WAAO,EAAE,SAAS,SAAS,eAAe,SAAS,SAAS,eAAe,QAAA;AAAA,EAC5E;AACD;"}

package/dist/development/src/model/queries/apiKey/ApiKeyQuery.cjs

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
 require("../../type/ApiKey.cjs");
+const ProlongApiKeyCommand = require("../../commands/apiKey/ProlongApiKeyCommand.cjs");
 const token = require("../../utils/token.cjs");
 class ApiKeyByIdQuery extends Database.DatabaseQuery {
   constructor(apiKeyId) {
@@ -26,7 +27,13 @@ class ApiKeyByTokenQuery extends Database.DatabaseQuery {
     return this.fetchOneOrNull(rows);
   }
 }
-const apiKeyBaseQuery = Database.SelectBuilder.create().select(["api_key", "id"]).select(["api_key", "type"]).select(["api_key", "identity_id"]).select(["api_key", "disabled_at"]).select(["api_key", "expires_at"]).select(["identity", "roles"]).select(["api_key", "expiration"]).select(["person", "id"], "person_id").select(["api_key", "last_ip"]).select(["api_key", "last_user_agent"]).select(["api_key", "last_used_at"]).select(["api_key", "trust_forwarded_info"]).select(["api_key", "issued_at"]).select(["api_key", "idle_timeout"]).select(["api_key", "max_expires_at"]).from("api_key").join("identity", "identity", (joinClause) => joinClause.compareColumns(["api_key", "identity_id"], Database.Operator.eq, ["identity", "id"])).leftJoin(
+const apiKeyBaseQuery = Database.SelectBuilder.create().select(["api_key", "id"]).select(["api_key", "type"]).select(["api_key", "identity_id"]).select(["api_key", "disabled_at"]).select(["api_key", "expires_at"]).select(["identity", "roles"]).select(["api_key", "expiration"]).select(["person", "id"], "person_id").select(["api_key", "last_ip"]).select(["api_key", "last_user_agent"]).select(["api_key", "last_used_at"]).select(["api_key", "trust_forwarded_info"]).select(["api_key", "issued_at"]).select(["api_key", "idle_timeout"]).select(["api_key", "max_expires_at"]).select(new Database.Literal('"api_key"."expires_at" is not null and "api_key"."expires_at" <= now()'), "is_expired").select(new Database.Literal('"api_key"."max_expires_at" is not null and "api_key"."max_expires_at" <= now()'), "is_max_expired").select(
+  new Database.Literal(
+    '"api_key"."idle_timeout" is not null and "api_key"."last_used_at" is not null and "api_key"."last_used_at" < now() - "api_key"."idle_timeout" - make_interval(secs => ?)',
+    [ProlongApiKeyCommand.PROLONG_THROTTLE_MS / 1e3]
+  ),
+  "is_idle_expired"
+).from("api_key").join("identity", "identity", (joinClause) => joinClause.compareColumns(["api_key", "identity_id"], Database.Operator.eq, ["identity", "id"])).leftJoin(
   "person",
   "person",
   (on) => on.compareColumns(

package/dist/development/src/model/queries/apiKey/ApiKeyQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/apiKey/ApiKeyQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'\nimport { ApiKey } from '../../type/index.js'\nimport { computeTokenHash } from '../../utils/index.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class ApiKeyByIdQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly apiKeyId: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where(\n\t\t\t\twhere => where.compare(['api_key', 'id'], Operator.eq, this.apiKeyId),\n\t\t\t)\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport class ApiKeyByTokenQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly token: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst tokenHash = computeTokenHash(this.token)\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where({ token_hash: tokenHash })\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport type ApiKeyRow = {\n\treadonly id: string\n\treadonly type: ApiKey.Type\n\treadonly identity_id: string\n\treadonly disabled_at: Date | null\n\treadonly expires_at: Date | null\n\treadonly expiration: number | null\n\treadonly roles: string[]\n\treadonly person_id: string | null\n\treadonly last_ip: string | null\n\treadonly last_user_agent: string | null\n\treadonly last_used_at: Date | null\n\treadonly trust_forwarded_info: boolean\n\treadonly issued_at: Date | null\n\treadonly idle_timeout: IPostgresInterval | null\n\treadonly max_expires_at: Date | null\n}\n\nconst apiKeyBaseQuery = SelectBuilder.create<null | ApiKeyRow>()\n\t.select(['api_key', 'id'])\n\t.select(['api_key', 'type'])\n\t.select(['api_key', 'identity_id'])\n\t.select(['api_key', 'disabled_at'])\n\t.select(['api_key', 'expires_at'])\n\t.select(['identity', 'roles'])\n\t.select(['api_key', 'expiration'])\n\t.select(['person', 'id'], 'person_id')\n\t.select(['api_key', 'last_ip'])\n\t.select(['api_key', 'last_user_agent'])\n\t.select(['api_key', 'last_used_at'])\n\t.select(['api_key', 'trust_forwarded_info'])\n\t.select(['api_key', 'issued_at'])\n\t.select(['api_key', 'idle_timeout'])\n\t.select(['api_key', 'max_expires_at'])\n\t.from('api_key')\n\t.join('identity', 'identity', joinClause => joinClause.compareColumns(['api_key', 'identity_id'], Operator.eq, ['identity', 'id']))\n\t.leftJoin(\n\t\t'person',\n\t\t'person',\n\t\ton =>\n\t\t\ton.compareColumns(\n\t\t\t\t['person', 'identity_id'],\n\t\t\t\tOperator.eq,\n\t\t\t\t['identity', 'id'],\n\t\t\t),\n\t)\n"],"names":["DatabaseQuery","Operator","token","computeTokenHash","SelectBuilder"],"mappings":";;;;;AAKO,MAAM,wBAAwBA,SAAAA,cAAgC;AAAA,EACpE,YAA6B,UAAkB;AAC9C,UAAA;AAD4B,SAAA,WAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAAoD;AACjE,UAAM,OAAO,MAAM,gBACjB;AAAA,MACA,CAAA,UAAS,MAAM,QAAQ,CAAC,WAAW,IAAI,GAAGC,SAAAA,SAAS,IAAI,KAAK,QAAQ;AAAA,IAAA,EAEpE,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;AAEO,MAAM,2BAA2BD,SAAAA,cAAgC;AAAA,EACvE,YAA6BE,QAAe;AAC3C,UAAA;AAD4B,SAAA,QAAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAAoD;AACjE,UAAM,YAAYC,MAAAA,iBAAiB,KAAK,KAAK;AAC7C,UAAM,OAAO,MAAM,gBACjB,MAAM,EAAE,YAAY,UAAA,CAAW,EAC/B,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;AAoBA,MAAM,kBAAkBC,SAAAA,cAAc,OAAA,EACpC,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,UAAU,IAAI,GAAG,WAAW,EACpC,OAAO,CAAC,WAAW,SAAS,CAAC,EAC7B,OAAO,CAAC,WAAW,iBAAiB,CAAC,EACrC,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,sBAAsB,CAAC,EAC1C,OAAO,CAAC,WAAW,WAAW,CAAC,EAC/B,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,gBAAgB,CAAC,EACpC,KAAK,SAAS,EACd,KAAK,YAAY,YAAY,CAAA,eAAc,WAAW,eAAe,CAAC,WAAW,aAAa,GAAGH,SAAAA,SAAS,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,EACjI;AAAA,EACA;AAAA,EACA;AAAA,EACA,QACC,GAAG;AAAA,IACF,CAAC,UAAU,aAAa;AAAA,IACxBA,SAAAA,SAAS;AAAA,IACT,CAAC,YAAY,IAAI;AAAA,EAAA;AAEpB;;;"}
+{"version":3,"file":"ApiKeyQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/apiKey/ApiKeyQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, Operator, SelectBuilder } from '@contember/database'\nimport { ApiKey } from '../../type/index.js'\nimport { computeTokenHash } from '../../utils/index.js'\nimport { IPostgresInterval } from 'postgres-interval'\nimport { PROLONG_THROTTLE_MS } from '../../commands/apiKey/ProlongApiKeyCommand.js'\n\nexport class ApiKeyByIdQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly apiKeyId: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where(\n\t\t\t\twhere => where.compare(['api_key', 'id'], Operator.eq, this.apiKeyId),\n\t\t\t)\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport class ApiKeyByTokenQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly token: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst tokenHash = computeTokenHash(this.token)\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where({ token_hash: tokenHash })\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport type ApiKeyRow = {\n\treadonly id: string\n\treadonly type: ApiKey.Type\n\treadonly identity_id: string\n\treadonly disabled_at: Date | null\n\treadonly expires_at: Date | null\n\treadonly expiration: number | null\n\treadonly roles: string[]\n\treadonly person_id: string | null\n\treadonly last_ip: string | null\n\treadonly last_user_agent: string | null\n\treadonly last_used_at: Date | null\n\treadonly trust_forwarded_info: boolean\n\treadonly issued_at: Date | null\n\treadonly idle_timeout: IPostgresInterval | null\n\treadonly max_expires_at: Date | null\n\t/** Time gates computed on the DB clock (against NOW()) so app/DB skew can't weaken them. */\n\treadonly is_expired: boolean\n\treadonly is_max_expired: boolean\n\treadonly is_idle_expired: boolean\n}\n\nconst apiKeyBaseQuery = SelectBuilder.create<null | ApiKeyRow>()\n\t.select(['api_key', 'id'])\n\t.select(['api_key', 'type'])\n\t.select(['api_key', 'identity_id'])\n\t.select(['api_key', 'disabled_at'])\n\t.select(['api_key', 'expires_at'])\n\t.select(['identity', 'roles'])\n\t.select(['api_key', 'expiration'])\n\t.select(['person', 'id'], 'person_id')\n\t.select(['api_key', 'last_ip'])\n\t.select(['api_key', 'last_user_agent'])\n\t.select(['api_key', 'last_used_at'])\n\t.select(['api_key', 'trust_forwarded_info'])\n\t.select(['api_key', 'issued_at'])\n\t.select(['api_key', 'idle_timeout'])\n\t.select(['api_key', 'max_expires_at'])\n\t// A19 time gates on the DB clock — see ApiKeyManager.verifyAndProlong / CLAUDE.md.\n\t.select(new Literal('\"api_key\".\"expires_at\" is not null and \"api_key\".\"expires_at\" <= now()'), 'is_expired')\n\t.select(new Literal('\"api_key\".\"max_expires_at\" is not null and \"api_key\".\"max_expires_at\" <= now()'), 'is_max_expired')\n\t.select(\n\t\tnew Literal(\n\t\t\t'\"api_key\".\"idle_timeout\" is not null and \"api_key\".\"last_used_at\" is not null'\n\t\t\t\t+ ' and \"api_key\".\"last_used_at\" < now() - \"api_key\".\"idle_timeout\" - make_interval(secs => ?)',\n\t\t\t[PROLONG_THROTTLE_MS / 1000],\n\t\t),\n\t\t'is_idle_expired',\n\t)\n\t.from('api_key')\n\t.join('identity', 'identity', joinClause => joinClause.compareColumns(['api_key', 'identity_id'], Operator.eq, ['identity', 'id']))\n\t.leftJoin(\n\t\t'person',\n\t\t'person',\n\t\ton =>\n\t\t\ton.compareColumns(\n\t\t\t\t['person', 'identity_id'],\n\t\t\t\tOperator.eq,\n\t\t\t\t['identity', 'id'],\n\t\t\t),\n\t)\n"],"names":["DatabaseQuery","Operator","token","computeTokenHash","SelectBuilder","Literal","PROLONG_THROTTLE_MS"],"mappings":";;;;;;AAMO,MAAM,wBAAwBA,SAAAA,cAAgC;AAAA,EACpE,YAA6B,UAAkB;AAC9C,UAAA;AAD4B,SAAA,WAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAAoD;AACjE,UAAM,OAAO,MAAM,gBACjB;AAAA,MACA,CAAA,UAAS,MAAM,QAAQ,CAAC,WAAW,IAAI,GAAGC,SAAAA,SAAS,IAAI,KAAK,QAAQ;AAAA,IAAA,EAEpE,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;AAEO,MAAM,2BAA2BD,SAAAA,cAAgC;AAAA,EACvE,YAA6BE,QAAe;AAC3C,UAAA;AAD4B,SAAA,QAAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAAoD;AACjE,UAAM,YAAYC,MAAAA,iBAAiB,KAAK,KAAK;AAC7C,UAAM,OAAO,MAAM,gBACjB,MAAM,EAAE,YAAY,UAAA,CAAW,EAC/B,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;AAwBA,MAAM,kBAAkBC,SAAAA,cAAc,SACpC,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,UAAU,IAAI,GAAG,WAAW,EACpC,OAAO,CAAC,WAAW,SAAS,CAAC,EAC7B,OAAO,CAAC,WAAW,iBAAiB,CAAC,EACrC,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,sBAAsB,CAAC,EAC1C,OAAO,CAAC,WAAW,WAAW,CAAC,EAC/B,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,gBAAgB,CAAC,EAEpC,OAAO,IAAIC,SAAAA,QAAQ,wEAAwE,GAAG,YAAY,EAC1G,OAAO,IAAIA,SAAAA,QAAQ,gFAAgF,GAAG,gBAAgB,EACtH;AAAA,EACA,IAAIA,SAAAA;AAAAA,IACH;AAAA,IAEA,CAACC,qBAAAA,sBAAsB,GAAI;AAAA,EAAA;AAAA,EAE5B;AACD,EACC,KAAK,SAAS,EACd,KAAK,YAAY,YAAY,CAAA,eAAc,WAAW,eAAe,CAAC,WAAW,aAAa,GAAGL,kBAAS,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,EACjI;AAAA,EACA;AAAA,EACA;AAAA,EACA,QACC,GAAG;AAAA,IACF,CAAC,UAAU,aAAa;AAAA,IACxBA,SAAAA,SAAS;AAAA,IACT,CAAC,YAAY,IAAI;AAAA,EAAA;AAEpB;;;"}

package/dist/development/src/model/queries/apiKey/ApiKeyQuery.js

@@ -1,5 +1,6 @@
-import { SelectBuilder, Operator, DatabaseQuery } from "@contember/database";
+import { SelectBuilder, Literal, Operator, DatabaseQuery } from "@contember/database";
 import "../../type/ApiKey.js";
+import { PROLONG_THROTTLE_MS } from "../../commands/apiKey/ProlongApiKeyCommand.js";
 import { computeTokenHash } from "../../utils/token.js";
 class ApiKeyByIdQuery extends DatabaseQuery {
   constructor(apiKeyId) {
@@ -24,7 +25,13 @@ class ApiKeyByTokenQuery extends DatabaseQuery {
     return this.fetchOneOrNull(rows);
   }
 }
-const apiKeyBaseQuery = SelectBuilder.create().select(["api_key", "id"]).select(["api_key", "type"]).select(["api_key", "identity_id"]).select(["api_key", "disabled_at"]).select(["api_key", "expires_at"]).select(["identity", "roles"]).select(["api_key", "expiration"]).select(["person", "id"], "person_id").select(["api_key", "last_ip"]).select(["api_key", "last_user_agent"]).select(["api_key", "last_used_at"]).select(["api_key", "trust_forwarded_info"]).select(["api_key", "issued_at"]).select(["api_key", "idle_timeout"]).select(["api_key", "max_expires_at"]).from("api_key").join("identity", "identity", (joinClause) => joinClause.compareColumns(["api_key", "identity_id"], Operator.eq, ["identity", "id"])).leftJoin(
+const apiKeyBaseQuery = SelectBuilder.create().select(["api_key", "id"]).select(["api_key", "type"]).select(["api_key", "identity_id"]).select(["api_key", "disabled_at"]).select(["api_key", "expires_at"]).select(["identity", "roles"]).select(["api_key", "expiration"]).select(["person", "id"], "person_id").select(["api_key", "last_ip"]).select(["api_key", "last_user_agent"]).select(["api_key", "last_used_at"]).select(["api_key", "trust_forwarded_info"]).select(["api_key", "issued_at"]).select(["api_key", "idle_timeout"]).select(["api_key", "max_expires_at"]).select(new Literal('"api_key"."expires_at" is not null and "api_key"."expires_at" <= now()'), "is_expired").select(new Literal('"api_key"."max_expires_at" is not null and "api_key"."max_expires_at" <= now()'), "is_max_expired").select(
+  new Literal(
+    '"api_key"."idle_timeout" is not null and "api_key"."last_used_at" is not null and "api_key"."last_used_at" < now() - "api_key"."idle_timeout" - make_interval(secs => ?)',
+    [PROLONG_THROTTLE_MS / 1e3]
+  ),
+  "is_idle_expired"
+).from("api_key").join("identity", "identity", (joinClause) => joinClause.compareColumns(["api_key", "identity_id"], Operator.eq, ["identity", "id"])).leftJoin(
   "person",
   "person",
   (on) => on.compareColumns(

package/dist/development/src/model/queries/apiKey/ApiKeyQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/apiKey/ApiKeyQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'\nimport { ApiKey } from '../../type/index.js'\nimport { computeTokenHash } from '../../utils/index.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class ApiKeyByIdQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly apiKeyId: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where(\n\t\t\t\twhere => where.compare(['api_key', 'id'], Operator.eq, this.apiKeyId),\n\t\t\t)\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport class ApiKeyByTokenQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly token: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst tokenHash = computeTokenHash(this.token)\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where({ token_hash: tokenHash })\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport type ApiKeyRow = {\n\treadonly id: string\n\treadonly type: ApiKey.Type\n\treadonly identity_id: string\n\treadonly disabled_at: Date | null\n\treadonly expires_at: Date | null\n\treadonly expiration: number | null\n\treadonly roles: string[]\n\treadonly person_id: string | null\n\treadonly last_ip: string | null\n\treadonly last_user_agent: string | null\n\treadonly last_used_at: Date | null\n\treadonly trust_forwarded_info: boolean\n\treadonly issued_at: Date | null\n\treadonly idle_timeout: IPostgresInterval | null\n\treadonly max_expires_at: Date | null\n}\n\nconst apiKeyBaseQuery = SelectBuilder.create<null | ApiKeyRow>()\n\t.select(['api_key', 'id'])\n\t.select(['api_key', 'type'])\n\t.select(['api_key', 'identity_id'])\n\t.select(['api_key', 'disabled_at'])\n\t.select(['api_key', 'expires_at'])\n\t.select(['identity', 'roles'])\n\t.select(['api_key', 'expiration'])\n\t.select(['person', 'id'], 'person_id')\n\t.select(['api_key', 'last_ip'])\n\t.select(['api_key', 'last_user_agent'])\n\t.select(['api_key', 'last_used_at'])\n\t.select(['api_key', 'trust_forwarded_info'])\n\t.select(['api_key', 'issued_at'])\n\t.select(['api_key', 'idle_timeout'])\n\t.select(['api_key', 'max_expires_at'])\n\t.from('api_key')\n\t.join('identity', 'identity', joinClause => joinClause.compareColumns(['api_key', 'identity_id'], Operator.eq, ['identity', 'id']))\n\t.leftJoin(\n\t\t'person',\n\t\t'person',\n\t\ton =>\n\t\t\ton.compareColumns(\n\t\t\t\t['person', 'identity_id'],\n\t\t\t\tOperator.eq,\n\t\t\t\t['identity', 'id'],\n\t\t\t),\n\t)\n"],"names":[],"mappings":";;;AAKO,MAAM,wBAAwB,cAAgC;AAAA,EACpE,YAA6B,UAAkB;AAC9C,UAAA;AAD4B,SAAA,WAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAAoD;AACjE,UAAM,OAAO,MAAM,gBACjB;AAAA,MACA,CAAA,UAAS,MAAM,QAAQ,CAAC,WAAW,IAAI,GAAG,SAAS,IAAI,KAAK,QAAQ;AAAA,IAAA,EAEpE,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;AAEO,MAAM,2BAA2B,cAAgC;AAAA,EACvE,YAA6B,OAAe;AAC3C,UAAA;AAD4B,SAAA,QAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAAoD;AACjE,UAAM,YAAY,iBAAiB,KAAK,KAAK;AAC7C,UAAM,OAAO,MAAM,gBACjB,MAAM,EAAE,YAAY,UAAA,CAAW,EAC/B,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;AAoBA,MAAM,kBAAkB,cAAc,OAAA,EACpC,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,UAAU,IAAI,GAAG,WAAW,EACpC,OAAO,CAAC,WAAW,SAAS,CAAC,EAC7B,OAAO,CAAC,WAAW,iBAAiB,CAAC,EACrC,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,sBAAsB,CAAC,EAC1C,OAAO,CAAC,WAAW,WAAW,CAAC,EAC/B,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,gBAAgB,CAAC,EACpC,KAAK,SAAS,EACd,KAAK,YAAY,YAAY,CAAA,eAAc,WAAW,eAAe,CAAC,WAAW,aAAa,GAAG,SAAS,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,EACjI;AAAA,EACA;AAAA,EACA;AAAA,EACA,QACC,GAAG;AAAA,IACF,CAAC,UAAU,aAAa;AAAA,IACxB,SAAS;AAAA,IACT,CAAC,YAAY,IAAI;AAAA,EAAA;AAEpB;"}
+{"version":3,"file":"ApiKeyQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/apiKey/ApiKeyQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, Operator, SelectBuilder } from '@contember/database'\nimport { ApiKey } from '../../type/index.js'\nimport { computeTokenHash } from '../../utils/index.js'\nimport { IPostgresInterval } from 'postgres-interval'\nimport { PROLONG_THROTTLE_MS } from '../../commands/apiKey/ProlongApiKeyCommand.js'\n\nexport class ApiKeyByIdQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly apiKeyId: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where(\n\t\t\t\twhere => where.compare(['api_key', 'id'], Operator.eq, this.apiKeyId),\n\t\t\t)\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport class ApiKeyByTokenQuery extends DatabaseQuery<null | ApiKeyRow> {\n\tconstructor(private readonly token: string) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<null | ApiKeyRow> {\n\t\tconst tokenHash = computeTokenHash(this.token)\n\t\tconst rows = await apiKeyBaseQuery\n\t\t\t.where({ token_hash: tokenHash })\n\t\t\t.getResult(db)\n\n\t\treturn this.fetchOneOrNull(rows)\n\t}\n}\n\nexport type ApiKeyRow = {\n\treadonly id: string\n\treadonly type: ApiKey.Type\n\treadonly identity_id: string\n\treadonly disabled_at: Date | null\n\treadonly expires_at: Date | null\n\treadonly expiration: number | null\n\treadonly roles: string[]\n\treadonly person_id: string | null\n\treadonly last_ip: string | null\n\treadonly last_user_agent: string | null\n\treadonly last_used_at: Date | null\n\treadonly trust_forwarded_info: boolean\n\treadonly issued_at: Date | null\n\treadonly idle_timeout: IPostgresInterval | null\n\treadonly max_expires_at: Date | null\n\t/** Time gates computed on the DB clock (against NOW()) so app/DB skew can't weaken them. */\n\treadonly is_expired: boolean\n\treadonly is_max_expired: boolean\n\treadonly is_idle_expired: boolean\n}\n\nconst apiKeyBaseQuery = SelectBuilder.create<null | ApiKeyRow>()\n\t.select(['api_key', 'id'])\n\t.select(['api_key', 'type'])\n\t.select(['api_key', 'identity_id'])\n\t.select(['api_key', 'disabled_at'])\n\t.select(['api_key', 'expires_at'])\n\t.select(['identity', 'roles'])\n\t.select(['api_key', 'expiration'])\n\t.select(['person', 'id'], 'person_id')\n\t.select(['api_key', 'last_ip'])\n\t.select(['api_key', 'last_user_agent'])\n\t.select(['api_key', 'last_used_at'])\n\t.select(['api_key', 'trust_forwarded_info'])\n\t.select(['api_key', 'issued_at'])\n\t.select(['api_key', 'idle_timeout'])\n\t.select(['api_key', 'max_expires_at'])\n\t// A19 time gates on the DB clock — see ApiKeyManager.verifyAndProlong / CLAUDE.md.\n\t.select(new Literal('\"api_key\".\"expires_at\" is not null and \"api_key\".\"expires_at\" <= now()'), 'is_expired')\n\t.select(new Literal('\"api_key\".\"max_expires_at\" is not null and \"api_key\".\"max_expires_at\" <= now()'), 'is_max_expired')\n\t.select(\n\t\tnew Literal(\n\t\t\t'\"api_key\".\"idle_timeout\" is not null and \"api_key\".\"last_used_at\" is not null'\n\t\t\t\t+ ' and \"api_key\".\"last_used_at\" < now() - \"api_key\".\"idle_timeout\" - make_interval(secs => ?)',\n\t\t\t[PROLONG_THROTTLE_MS / 1000],\n\t\t),\n\t\t'is_idle_expired',\n\t)\n\t.from('api_key')\n\t.join('identity', 'identity', joinClause => joinClause.compareColumns(['api_key', 'identity_id'], Operator.eq, ['identity', 'id']))\n\t.leftJoin(\n\t\t'person',\n\t\t'person',\n\t\ton =>\n\t\t\ton.compareColumns(\n\t\t\t\t['person', 'identity_id'],\n\t\t\t\tOperator.eq,\n\t\t\t\t['identity', 'id'],\n\t\t\t),\n\t)\n"],"names":[],"mappings":";;;;AAMO,MAAM,wBAAwB,cAAgC;AAAA,EACpE,YAA6B,UAAkB;AAC9C,UAAA;AAD4B,SAAA,WAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAAoD;AACjE,UAAM,OAAO,MAAM,gBACjB;AAAA,MACA,CAAA,UAAS,MAAM,QAAQ,CAAC,WAAW,IAAI,GAAG,SAAS,IAAI,KAAK,QAAQ;AAAA,IAAA,EAEpE,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;AAEO,MAAM,2BAA2B,cAAgC;AAAA,EACvE,YAA6B,OAAe;AAC3C,UAAA;AAD4B,SAAA,QAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAAoD;AACjE,UAAM,YAAY,iBAAiB,KAAK,KAAK;AAC7C,UAAM,OAAO,MAAM,gBACjB,MAAM,EAAE,YAAY,UAAA,CAAW,EAC/B,UAAU,EAAE;AAEd,WAAO,KAAK,eAAe,IAAI;AAAA,EAChC;AACD;AAwBA,MAAM,kBAAkB,cAAc,SACpC,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,aAAa,CAAC,EACjC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,UAAU,IAAI,GAAG,WAAW,EACpC,OAAO,CAAC,WAAW,SAAS,CAAC,EAC7B,OAAO,CAAC,WAAW,iBAAiB,CAAC,EACrC,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,sBAAsB,CAAC,EAC1C,OAAO,CAAC,WAAW,WAAW,CAAC,EAC/B,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,gBAAgB,CAAC,EAEpC,OAAO,IAAI,QAAQ,wEAAwE,GAAG,YAAY,EAC1G,OAAO,IAAI,QAAQ,gFAAgF,GAAG,gBAAgB,EACtH;AAAA,EACA,IAAI;AAAA,IACH;AAAA,IAEA,CAAC,sBAAsB,GAAI;AAAA,EAAA;AAAA,EAE5B;AACD,EACC,KAAK,SAAS,EACd,KAAK,YAAY,YAAY,CAAA,eAAc,WAAW,eAAe,CAAC,WAAW,aAAa,GAAG,SAAS,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,EACjI;AAAA,EACA;AAAA,EACA;AAAA,EACA,QACC,GAAG;AAAA,IACF,CAAC,UAAU,aAAa;AAAA,IACxB,SAAS;AAAA,IACT,CAAC,YAAY,IAAI;AAAA,EAAA;AAEpB;"}

package/dist/development/src/model/queries/apiKey/ApiKeySessionsQuery.cjs

@@ -3,15 +3,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
 const ApiKey = require("../../type/ApiKey.cjs");
 class ApiKeySessionsByIdentityQuery extends Database.DatabaseQuery {
-  constructor(identityId, options) {
+  constructor(identityId) {
     super();
     this.identityId = identityId;
-    this.options = options;
   }
   async fetch({ db }) {
     const rows = await Database.SelectBuilder.create().select(["api_key", "id"]).select(["api_key", "created_at"]).select(["api_key", "expires_at"]).select(["api_key", "last_used_at"]).select(["api_key", "last_ip"]).select(["api_key", "last_user_agent"]).select(["api_key", "created_ip"]).select(["api_key", "created_user_agent"]).select(["api_key", "trust_forwarded_info"]).from("api_key").where((it) => it.compare(["api_key", "identity_id"], Database.Operator.eq, this.identityId)).where((it) => it.compare(["api_key", "type"], Database.Operator.eq, ApiKey.ApiKey.Type.SESSION)).where((it) => it.isNull(["api_key", "disabled_at"])).where(
       (it) => it.or(
-        (or) => or.isNull(["api_key", "expires_at"]).compare(["api_key", "expires_at"], Database.Operator.gt, this.options.now)
+        (or) => or.isNull(["api_key", "expires_at"]).raw('"api_key"."expires_at" > now()')
       )
     ).orderBy(["api_key", "created_at"], "desc").getResult(db);
     return rows;

package/dist/development/src/model/queries/apiKey/ApiKeySessionsQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeySessionsQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/apiKey/ApiKeySessionsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'\nimport { ApiKey } from '../../type/index.js'\n\nexport type ApiKeySessionRow = {\n\treadonly id: string\n\treadonly created_at: Date\n\treadonly expires_at: Date | null\n\treadonly last_used_at: Date | null\n\treadonly last_ip: string | null\n\treadonly last_user_agent: string | null\n\treadonly created_ip: string | null\n\treadonly created_user_agent: string | null\n\treadonly trust_forwarded_info: boolean\n}\n\nexport class ApiKeySessionsByIdentityQuery extends DatabaseQuery<readonly ApiKeySessionRow[]> {\n\tconstructor(\n\t\tprivate readonly identityId: string,\n\t\tprivate readonly options: { now: Date },\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<readonly ApiKeySessionRow[]> {\n\t\tconst rows = await SelectBuilder.create<ApiKeySessionRow>()\n\t\t\t.select(['api_key', 'id'])\n\t\t\t.select(['api_key', 'created_at'])\n\t\t\t.select(['api_key', 'expires_at'])\n\t\t\t.select(['api_key', 'last_used_at'])\n\t\t\t.select(['api_key', 'last_ip'])\n\t\t\t.select(['api_key', 'last_user_agent'])\n\t\t\t.select(['api_key', 'created_ip'])\n\t\t\t.select(['api_key', 'created_user_agent'])\n\t\t\t.select(['api_key', 'trust_forwarded_info'])\n\t\t\t.from('api_key')\n\t\t\t.where(it => it.compare(['api_key', 'identity_id'], Operator.eq, this.identityId))\n\t\t\t.where(it => it.compare(['api_key', 'type'], Operator.eq, ApiKey.Type.SESSION))\n\t\t\t.where(it => it.isNull(['api_key', 'disabled_at']))\n\t\t\t.where(it =>\n\t\t\t\tit.or(or =>\n\t\t\t\t\tor.isNull(['api_key', 'expires_at'])\n\t\t\t\t\t\t.compare(['api_key', 'expires_at'], Operator.gt, this.options.now)\n\t\t\t\t)\n\t\t\t)\n\t\t\t.orderBy(['api_key', 'created_at'], 'desc')\n\t\t\t.getResult(db)\n\n\t\treturn rows\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Operator","ApiKey"],"mappings":";;;;AAeO,MAAM,sCAAsCA,SAAAA,cAA2C;AAAA,EAC7F,YACkB,YACA,SAChB;AACD,UAAA;AAHiB,SAAA,aAAA;AACA,SAAA,UAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,SAAS,CAAC,EAC7B,OAAO,CAAC,WAAW,iBAAiB,CAAC,EACrC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,oBAAoB,CAAC,EACxC,OAAO,CAAC,WAAW,sBAAsB,CAAC,EAC1C,KAAK,SAAS,EACd,MAAM,QAAM,GAAG,QAAQ,CAAC,WAAW,aAAa,GAAGC,kBAAS,IAAI,KAAK,UAAU,CAAC,EAChF,MAAM,CAAA,OAAM,GAAG,QAAQ,CAAC,WAAW,MAAM,GAAGA,SAAAA,SAAS,IAAIC,cAAO,KAAK,OAAO,CAAC,EAC7E,MAAM,QAAM,GAAG,OAAO,CAAC,WAAW,aAAa,CAAC,CAAC,EACjD;AAAA,MAAM,QACN,GAAG;AAAA,QAAG,QACL,GAAG,OAAO,CAAC,WAAW,YAAY,CAAC,EACjC,QAAQ,CAAC,WAAW,YAAY,GAAGD,SAAAA,SAAS,IAAI,KAAK,QAAQ,GAAG;AAAA,MAAA;AAAA,IACnE,EAEA,QAAQ,CAAC,WAAW,YAAY,GAAG,MAAM,EACzC,UAAU,EAAE;AAEd,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"ApiKeySessionsQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/apiKey/ApiKeySessionsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'\nimport { ApiKey } from '../../type/index.js'\n\nexport type ApiKeySessionRow = {\n\treadonly id: string\n\treadonly created_at: Date\n\treadonly expires_at: Date | null\n\treadonly last_used_at: Date | null\n\treadonly last_ip: string | null\n\treadonly last_user_agent: string | null\n\treadonly created_ip: string | null\n\treadonly created_user_agent: string | null\n\treadonly trust_forwarded_info: boolean\n}\n\nexport class ApiKeySessionsByIdentityQuery extends DatabaseQuery<readonly ApiKeySessionRow[]> {\n\tconstructor(\n\t\tprivate readonly identityId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<readonly ApiKeySessionRow[]> {\n\t\tconst rows = await SelectBuilder.create<ApiKeySessionRow>()\n\t\t\t.select(['api_key', 'id'])\n\t\t\t.select(['api_key', 'created_at'])\n\t\t\t.select(['api_key', 'expires_at'])\n\t\t\t.select(['api_key', 'last_used_at'])\n\t\t\t.select(['api_key', 'last_ip'])\n\t\t\t.select(['api_key', 'last_user_agent'])\n\t\t\t.select(['api_key', 'created_ip'])\n\t\t\t.select(['api_key', 'created_user_agent'])\n\t\t\t.select(['api_key', 'trust_forwarded_info'])\n\t\t\t.from('api_key')\n\t\t\t.where(it => it.compare(['api_key', 'identity_id'], Operator.eq, this.identityId))\n\t\t\t.where(it => it.compare(['api_key', 'type'], Operator.eq, ApiKey.Type.SESSION))\n\t\t\t.where(it => it.isNull(['api_key', 'disabled_at']))\n\t\t\t// expires_at compared on the DB clock (NOW()) — see CLAUDE.md.\n\t\t\t.where(it =>\n\t\t\t\tit.or(or =>\n\t\t\t\t\tor.isNull(['api_key', 'expires_at'])\n\t\t\t\t\t\t.raw('\"api_key\".\"expires_at\" > now()')\n\t\t\t\t)\n\t\t\t)\n\t\t\t.orderBy(['api_key', 'created_at'], 'desc')\n\t\t\t.getResult(db)\n\n\t\treturn rows\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Operator","ApiKey"],"mappings":";;;;AAeO,MAAM,sCAAsCA,SAAAA,cAA2C;AAAA,EAC7F,YACkB,YAChB;AACD,UAAA;AAFiB,SAAA,aAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,SAAS,CAAC,EAC7B,OAAO,CAAC,WAAW,iBAAiB,CAAC,EACrC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,oBAAoB,CAAC,EACxC,OAAO,CAAC,WAAW,sBAAsB,CAAC,EAC1C,KAAK,SAAS,EACd,MAAM,QAAM,GAAG,QAAQ,CAAC,WAAW,aAAa,GAAGC,kBAAS,IAAI,KAAK,UAAU,CAAC,EAChF,MAAM,CAAA,OAAM,GAAG,QAAQ,CAAC,WAAW,MAAM,GAAGA,SAAAA,SAAS,IAAIC,cAAO,KAAK,OAAO,CAAC,EAC7E,MAAM,QAAM,GAAG,OAAO,CAAC,WAAW,aAAa,CAAC,CAAC,EAEjD;AAAA,MAAM,QACN,GAAG;AAAA,QAAG,CAAA,OACL,GAAG,OAAO,CAAC,WAAW,YAAY,CAAC,EACjC,IAAI,gCAAgC;AAAA,MAAA;AAAA,IACvC,EAEA,QAAQ,CAAC,WAAW,YAAY,GAAG,MAAM,EACzC,UAAU,EAAE;AAEd,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/queries/apiKey/ApiKeySessionsQuery.js

@@ -1,15 +1,14 @@
 import { DatabaseQuery, SelectBuilder, Operator } from "@contember/database";
 import { ApiKey } from "../../type/ApiKey.js";
 class ApiKeySessionsByIdentityQuery extends DatabaseQuery {
-  constructor(identityId, options) {
+  constructor(identityId) {
     super();
     this.identityId = identityId;
-    this.options = options;
   }
   async fetch({ db }) {
     const rows = await SelectBuilder.create().select(["api_key", "id"]).select(["api_key", "created_at"]).select(["api_key", "expires_at"]).select(["api_key", "last_used_at"]).select(["api_key", "last_ip"]).select(["api_key", "last_user_agent"]).select(["api_key", "created_ip"]).select(["api_key", "created_user_agent"]).select(["api_key", "trust_forwarded_info"]).from("api_key").where((it) => it.compare(["api_key", "identity_id"], Operator.eq, this.identityId)).where((it) => it.compare(["api_key", "type"], Operator.eq, ApiKey.Type.SESSION)).where((it) => it.isNull(["api_key", "disabled_at"])).where(
       (it) => it.or(
-        (or) => or.isNull(["api_key", "expires_at"]).compare(["api_key", "expires_at"], Operator.gt, this.options.now)
+        (or) => or.isNull(["api_key", "expires_at"]).raw('"api_key"."expires_at" > now()')
       )
     ).orderBy(["api_key", "created_at"], "desc").getResult(db);
     return rows;

package/dist/development/src/model/queries/apiKey/ApiKeySessionsQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeySessionsQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/apiKey/ApiKeySessionsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'\nimport { ApiKey } from '../../type/index.js'\n\nexport type ApiKeySessionRow = {\n\treadonly id: string\n\treadonly created_at: Date\n\treadonly expires_at: Date | null\n\treadonly last_used_at: Date | null\n\treadonly last_ip: string | null\n\treadonly last_user_agent: string | null\n\treadonly created_ip: string | null\n\treadonly created_user_agent: string | null\n\treadonly trust_forwarded_info: boolean\n}\n\nexport class ApiKeySessionsByIdentityQuery extends DatabaseQuery<readonly ApiKeySessionRow[]> {\n\tconstructor(\n\t\tprivate readonly identityId: string,\n\t\tprivate readonly options: { now: Date },\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<readonly ApiKeySessionRow[]> {\n\t\tconst rows = await SelectBuilder.create<ApiKeySessionRow>()\n\t\t\t.select(['api_key', 'id'])\n\t\t\t.select(['api_key', 'created_at'])\n\t\t\t.select(['api_key', 'expires_at'])\n\t\t\t.select(['api_key', 'last_used_at'])\n\t\t\t.select(['api_key', 'last_ip'])\n\t\t\t.select(['api_key', 'last_user_agent'])\n\t\t\t.select(['api_key', 'created_ip'])\n\t\t\t.select(['api_key', 'created_user_agent'])\n\t\t\t.select(['api_key', 'trust_forwarded_info'])\n\t\t\t.from('api_key')\n\t\t\t.where(it => it.compare(['api_key', 'identity_id'], Operator.eq, this.identityId))\n\t\t\t.where(it => it.compare(['api_key', 'type'], Operator.eq, ApiKey.Type.SESSION))\n\t\t\t.where(it => it.isNull(['api_key', 'disabled_at']))\n\t\t\t.where(it =>\n\t\t\t\tit.or(or =>\n\t\t\t\t\tor.isNull(['api_key', 'expires_at'])\n\t\t\t\t\t\t.compare(['api_key', 'expires_at'], Operator.gt, this.options.now)\n\t\t\t\t)\n\t\t\t)\n\t\t\t.orderBy(['api_key', 'created_at'], 'desc')\n\t\t\t.getResult(db)\n\n\t\treturn rows\n\t}\n}\n"],"names":[],"mappings":";;AAeO,MAAM,sCAAsC,cAA2C;AAAA,EAC7F,YACkB,YACA,SAChB;AACD,UAAA;AAHiB,SAAA,aAAA;AACA,SAAA,UAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,SAAS,CAAC,EAC7B,OAAO,CAAC,WAAW,iBAAiB,CAAC,EACrC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,oBAAoB,CAAC,EACxC,OAAO,CAAC,WAAW,sBAAsB,CAAC,EAC1C,KAAK,SAAS,EACd,MAAM,QAAM,GAAG,QAAQ,CAAC,WAAW,aAAa,GAAG,SAAS,IAAI,KAAK,UAAU,CAAC,EAChF,MAAM,CAAA,OAAM,GAAG,QAAQ,CAAC,WAAW,MAAM,GAAG,SAAS,IAAI,OAAO,KAAK,OAAO,CAAC,EAC7E,MAAM,QAAM,GAAG,OAAO,CAAC,WAAW,aAAa,CAAC,CAAC,EACjD;AAAA,MAAM,QACN,GAAG;AAAA,QAAG,QACL,GAAG,OAAO,CAAC,WAAW,YAAY,CAAC,EACjC,QAAQ,CAAC,WAAW,YAAY,GAAG,SAAS,IAAI,KAAK,QAAQ,GAAG;AAAA,MAAA;AAAA,IACnE,EAEA,QAAQ,CAAC,WAAW,YAAY,GAAG,MAAM,EACzC,UAAU,EAAE;AAEd,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"ApiKeySessionsQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/apiKey/ApiKeySessionsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'\nimport { ApiKey } from '../../type/index.js'\n\nexport type ApiKeySessionRow = {\n\treadonly id: string\n\treadonly created_at: Date\n\treadonly expires_at: Date | null\n\treadonly last_used_at: Date | null\n\treadonly last_ip: string | null\n\treadonly last_user_agent: string | null\n\treadonly created_ip: string | null\n\treadonly created_user_agent: string | null\n\treadonly trust_forwarded_info: boolean\n}\n\nexport class ApiKeySessionsByIdentityQuery extends DatabaseQuery<readonly ApiKeySessionRow[]> {\n\tconstructor(\n\t\tprivate readonly identityId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<readonly ApiKeySessionRow[]> {\n\t\tconst rows = await SelectBuilder.create<ApiKeySessionRow>()\n\t\t\t.select(['api_key', 'id'])\n\t\t\t.select(['api_key', 'created_at'])\n\t\t\t.select(['api_key', 'expires_at'])\n\t\t\t.select(['api_key', 'last_used_at'])\n\t\t\t.select(['api_key', 'last_ip'])\n\t\t\t.select(['api_key', 'last_user_agent'])\n\t\t\t.select(['api_key', 'created_ip'])\n\t\t\t.select(['api_key', 'created_user_agent'])\n\t\t\t.select(['api_key', 'trust_forwarded_info'])\n\t\t\t.from('api_key')\n\t\t\t.where(it => it.compare(['api_key', 'identity_id'], Operator.eq, this.identityId))\n\t\t\t.where(it => it.compare(['api_key', 'type'], Operator.eq, ApiKey.Type.SESSION))\n\t\t\t.where(it => it.isNull(['api_key', 'disabled_at']))\n\t\t\t// expires_at compared on the DB clock (NOW()) — see CLAUDE.md.\n\t\t\t.where(it =>\n\t\t\t\tit.or(or =>\n\t\t\t\t\tor.isNull(['api_key', 'expires_at'])\n\t\t\t\t\t\t.raw('\"api_key\".\"expires_at\" > now()')\n\t\t\t\t)\n\t\t\t)\n\t\t\t.orderBy(['api_key', 'created_at'], 'desc')\n\t\t\t.getResult(db)\n\n\t\treturn rows\n\t}\n}\n"],"names":[],"mappings":";;AAeO,MAAM,sCAAsC,cAA2C;AAAA,EAC7F,YACkB,YAChB;AACD,UAAA;AAFiB,SAAA,aAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,cAAc,CAAC,EAClC,OAAO,CAAC,WAAW,SAAS,CAAC,EAC7B,OAAO,CAAC,WAAW,iBAAiB,CAAC,EACrC,OAAO,CAAC,WAAW,YAAY,CAAC,EAChC,OAAO,CAAC,WAAW,oBAAoB,CAAC,EACxC,OAAO,CAAC,WAAW,sBAAsB,CAAC,EAC1C,KAAK,SAAS,EACd,MAAM,QAAM,GAAG,QAAQ,CAAC,WAAW,aAAa,GAAG,SAAS,IAAI,KAAK,UAAU,CAAC,EAChF,MAAM,CAAA,OAAM,GAAG,QAAQ,CAAC,WAAW,MAAM,GAAG,SAAS,IAAI,OAAO,KAAK,OAAO,CAAC,EAC7E,MAAM,QAAM,GAAG,OAAO,CAAC,WAAW,aAAa,CAAC,CAAC,EAEjD;AAAA,MAAM,QACN,GAAG;AAAA,QAAG,CAAA,OACL,GAAG,OAAO,CAAC,WAAW,YAAY,CAAC,EACjC,IAAI,gCAAgC;AAAA,MAAA;AAAA,IACvC,EAEA,QAAQ,CAAC,WAAW,YAAY,GAAG,MAAM,EACzC,UAAU,EAAE;AAEd,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/queries/authLog/NextLoginAttemptQuery.cjs

@@ -14,7 +14,7 @@ class NextLoginAttemptQuery extends Database.DatabaseQuery {
     })).with("window_start", (it) => it.select(
       new Database.Literal(`
 					GREATEST(
-						COALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window), 
+						COALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window),
 						NOW() - cfg.login_attempt_window
 					)`),
       "start_time"
@@ -24,19 +24,21 @@ class NextLoginAttemptQuery extends Database.DatabaseQuery {
       success: false
     }).where(new Database.Literal("person_auth_log.created_at >= window_start.start_time"))).select(
       new Database.Literal(`
-				CASE WHEN failed_logins.fails = 0 
-				THEN NOW() 
-				ELSE LEAST(
-					failed_logins.last_fail + cfg.login_max_backoff, 
-					failed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))
-				) END`),
-      "next_allowed_login"
+				CASE WHEN failed_logins.fails = 0
+				THEN 0
+				ELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (
+					LEAST(
+						failed_logins.last_fail + cfg.login_max_backoff,
+						failed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))
+					) - NOW()
+				)))) END`),
+      "retry_after_seconds"
     ).from("failed_logins").from("cfg");
     const result = await qb.getResult(db);
     if (result.length === 0) {
-      return /* @__PURE__ */ new Date();
+      return 0;
     }
-    return result[0].next_allowed_login;
+    return Number(result[0].retry_after_seconds);
   }
 }
 exports.NextLoginAttemptQuery = NextLoginAttemptQuery;

package/dist/development/src/model/queries/authLog/NextLoginAttemptQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"NextLoginAttemptQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextLoginAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\n\nexport class NextLoginAttemptQuery extends DatabaseQuery<Date> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Date> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_successful_reset', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: 'password_reset',\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\tGREATEST(\n\t\t\t\t\t\tCOALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window), \n\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_successful_reset'))\n\t\t\t.with('failed_logins', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'fails')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_fail')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: 'login',\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\tCASE WHEN failed_logins.fails = 0 \n\t\t\t\tTHEN NOW() \n\t\t\t\tELSE LEAST(\n\t\t\t\t\tfailed_logins.last_fail + cfg.login_max_backoff, \n\t\t\t\t\tfailed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))\n\t\t\t\t) END`),\n\t\t\t\t'next_allowed_login',\n\t\t\t)\n\t\t\t.from('failed_logins')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new Date()\n\t\t}\n\t\treturn result[0].next_allowed_login\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal","it"],"mappings":";;;AAEO,MAAM,8BAA8BA,SAAAA,cAAoB;AAAA,EAC9D,YACkB,OAChB;AACD,UAAA;AAFiB,SAAA,QAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAAwC;AACrD,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,yBAAyB,CAAA,OAC9B,GACE,OAAO,IAAIC,iBAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAC,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAID,iBAAQ;AAAA;AAAA;AAAA;AAAA,OAIX;AAAA,MACD;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,uBAAuB,CAAC,EAC/B,KAAK,iBAAiB,CAAA,OACtB,GACE,OAAO,IAAIA,SAAAA,QAAQ,UAAU,GAAG,OAAO,EACvC,OAAO,IAAIA,SAAAA,QAAQ,iCAAiC,GAAG,WAAW,EAClE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM;AAAA,MACN,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAIA,SAAAA,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAIA,iBAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMN;AAAA,MACN;AAAA,IAAA,EAEA,KAAK,eAAe,EACpB,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,iCAAW,KAAA;AAAA,IACZ;AACA,WAAO,OAAO,CAAC,EAAE;AAAA,EAClB;AACD;;"}
+{"version":3,"file":"NextLoginAttemptQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextLoginAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\n\nexport class NextLoginAttemptQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_successful_reset', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: 'password_reset',\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\tGREATEST(\n\t\t\t\t\t\tCOALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window),\n\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_successful_reset'))\n\t\t\t.with('failed_logins', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'fails')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_fail')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: 'login',\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\tCASE WHEN failed_logins.fails = 0\n\t\t\t\tTHEN 0\n\t\t\t\tELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (\n\t\t\t\t\tLEAST(\n\t\t\t\t\t\tfailed_logins.last_fail + cfg.login_max_backoff,\n\t\t\t\t\t\tfailed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))\n\t\t\t\t\t) - NOW()\n\t\t\t\t)))) END`),\n\t\t\t\t'retry_after_seconds',\n\t\t\t)\n\t\t\t.from('failed_logins')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn 0\n\t\t}\n\t\treturn Number(result[0].retry_after_seconds)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal","it"],"mappings":";;;AAEO,MAAM,8BAA8BA,SAAAA,cAAsB;AAAA,EAChE,YACkB,OAChB;AACD,UAAA;AAFiB,SAAA,QAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,yBAAyB,CAAA,OAC9B,GACE,OAAO,IAAIC,iBAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAC,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAID,iBAAQ;AAAA;AAAA;AAAA;AAAA,OAIX;AAAA,MACD;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,uBAAuB,CAAC,EAC/B,KAAK,iBAAiB,CAAA,OACtB,GACE,OAAO,IAAIA,SAAAA,QAAQ,UAAU,GAAG,OAAO,EACvC,OAAO,IAAIA,SAAAA,QAAQ,iCAAiC,GAAG,WAAW,EAClE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM;AAAA,MACN,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAIA,SAAAA,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAIA,iBAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAQH;AAAA,MACT;AAAA,IAAA,EAEA,KAAK,eAAe,EACpB,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,OAAO,OAAO,CAAC,EAAE,mBAAmB;AAAA,EAC5C;AACD;;"}

package/dist/development/src/model/queries/authLog/NextLoginAttemptQuery.js

@@ -12,7 +12,7 @@ class NextLoginAttemptQuery extends DatabaseQuery {
     })).with("window_start", (it) => it.select(
       new Literal(`
 					GREATEST(
-						COALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window), 
+						COALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window),
 						NOW() - cfg.login_attempt_window
 					)`),
       "start_time"
@@ -22,19 +22,21 @@ class NextLoginAttemptQuery extends DatabaseQuery {
       success: false
     }).where(new Literal("person_auth_log.created_at >= window_start.start_time"))).select(
       new Literal(`
-				CASE WHEN failed_logins.fails = 0 
-				THEN NOW() 
-				ELSE LEAST(
-					failed_logins.last_fail + cfg.login_max_backoff, 
-					failed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))
-				) END`),
-      "next_allowed_login"
+				CASE WHEN failed_logins.fails = 0
+				THEN 0
+				ELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (
+					LEAST(
+						failed_logins.last_fail + cfg.login_max_backoff,
+						failed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))
+					) - NOW()
+				)))) END`),
+      "retry_after_seconds"
     ).from("failed_logins").from("cfg");
     const result = await qb.getResult(db);
     if (result.length === 0) {
-      return /* @__PURE__ */ new Date();
+      return 0;
     }
-    return result[0].next_allowed_login;
+    return Number(result[0].retry_after_seconds);
   }
 }
 export {

package/dist/development/src/model/queries/authLog/NextLoginAttemptQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"NextLoginAttemptQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextLoginAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\n\nexport class NextLoginAttemptQuery extends DatabaseQuery<Date> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Date> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_successful_reset', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: 'password_reset',\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\tGREATEST(\n\t\t\t\t\t\tCOALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window), \n\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_successful_reset'))\n\t\t\t.with('failed_logins', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'fails')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_fail')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: 'login',\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\tCASE WHEN failed_logins.fails = 0 \n\t\t\t\tTHEN NOW() \n\t\t\t\tELSE LEAST(\n\t\t\t\t\tfailed_logins.last_fail + cfg.login_max_backoff, \n\t\t\t\t\tfailed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))\n\t\t\t\t) END`),\n\t\t\t\t'next_allowed_login',\n\t\t\t)\n\t\t\t.from('failed_logins')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new Date()\n\t\t}\n\t\treturn result[0].next_allowed_login\n\t}\n}\n"],"names":["it"],"mappings":";AAEO,MAAM,8BAA8B,cAAoB;AAAA,EAC9D,YACkB,OAChB;AACD,UAAA;AAFiB,SAAA,QAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAAwC;AACrD,UAAM,KAAK,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,yBAAyB,CAAA,OAC9B,GACE,OAAO,IAAI,QAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAA,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA,OAIX;AAAA,MACD;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,uBAAuB,CAAC,EAC/B,KAAK,iBAAiB,CAAA,OACtB,GACE,OAAO,IAAI,QAAQ,UAAU,GAAG,OAAO,EACvC,OAAO,IAAI,QAAQ,iCAAiC,GAAG,WAAW,EAClE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM;AAAA,MACN,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAI,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAMN;AAAA,MACN;AAAA,IAAA,EAEA,KAAK,eAAe,EACpB,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,iCAAW,KAAA;AAAA,IACZ;AACA,WAAO,OAAO,CAAC,EAAE;AAAA,EAClB;AACD;"}
+{"version":3,"file":"NextLoginAttemptQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextLoginAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\n\nexport class NextLoginAttemptQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_successful_reset', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: 'password_reset',\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\tGREATEST(\n\t\t\t\t\t\tCOALESCE(last_successful_reset.created_at, NOW() - cfg.login_attempt_window),\n\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_successful_reset'))\n\t\t\t.with('failed_logins', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'fails')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_fail')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: 'login',\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\tCASE WHEN failed_logins.fails = 0\n\t\t\t\tTHEN 0\n\t\t\t\tELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (\n\t\t\t\t\tLEAST(\n\t\t\t\t\t\tfailed_logins.last_fail + cfg.login_max_backoff,\n\t\t\t\t\t\tfailed_logins.last_fail + cfg.login_base_backoff * (POWER(2, failed_logins.fails - 1))\n\t\t\t\t\t) - NOW()\n\t\t\t\t)))) END`),\n\t\t\t\t'retry_after_seconds',\n\t\t\t)\n\t\t\t.from('failed_logins')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn 0\n\t\t}\n\t\treturn Number(result[0].retry_after_seconds)\n\t}\n}\n"],"names":["it"],"mappings":";AAEO,MAAM,8BAA8B,cAAsB;AAAA,EAChE,YACkB,OAChB;AACD,UAAA;AAFiB,SAAA,QAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,KAAK,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,yBAAyB,CAAA,OAC9B,GACE,OAAO,IAAI,QAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAA,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA,OAIX;AAAA,MACD;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,uBAAuB,CAAC,EAC/B,KAAK,iBAAiB,CAAA,OACtB,GACE,OAAO,IAAI,QAAQ,UAAU,GAAG,OAAO,EACvC,OAAO,IAAI,QAAQ,iCAAiC,GAAG,WAAW,EAClE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM;AAAA,MACN,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAI,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,aAQH;AAAA,MACT;AAAA,IAAA,EAEA,KAAK,eAAe,EACpB,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,OAAO,OAAO,CAAC,EAAE,mBAAmB;AAAA,EAC5C;AACD;"}

package/dist/development/src/model/queries/authLog/NextMailAttemptQuery.cjs

@@ -27,18 +27,20 @@ class NextMailAttemptQuery extends Database.DatabaseQuery {
     }).where(new Database.Literal("person_auth_log.created_at >= window_start.start_time"))).select(
       new Database.Literal(`
 					CASE WHEN attempts.attempts = 0
-					THEN NOW()
-					ELSE LEAST(
-						attempts.last_attempt + cfg.login_max_backoff,
-						attempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))
-					) END`),
-      "next_allowed_attempt"
+					THEN 0
+					ELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (
+						LEAST(
+							attempts.last_attempt + cfg.login_max_backoff,
+							attempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))
+						) - NOW()
+					)))) END`),
+      "retry_after_seconds"
     ).from("attempts").from("cfg");
     const result = await qb.getResult(db);
     if (result.length === 0) {
-      return /* @__PURE__ */ new Date();
+      return 0;
     }
-    return result[0].next_allowed_attempt;
+    return Number(result[0].retry_after_seconds);
   }
 }
 exports.NextMailAttemptQuery = NextMailAttemptQuery;

package/dist/development/src/model/queries/authLog/NextMailAttemptQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"NextMailAttemptQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextMailAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { AuthActionType } from '../../type/AuthLog.js'\n\n/**\n * Per-email exponential backoff for mail-sending init flows (password reset,\n * passwordless sign-in). Mirrors {@link NextLoginAttemptQuery} but counts\n * *successful* init events (= mails actually sent) against the same email, and\n * treats a successful completion (`completionType`) as the cutoff that resets\n * the backoff to zero.\n *\n * Reuses the existing `login_base_backoff` / `login_max_backoff` /\n * `login_attempt_window` knobs — see ConfigRateLimits docstring for the\n * rationale.\n */\nexport class NextMailAttemptQuery extends DatabaseQuery<Date> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t\tprivate readonly initType: AuthActionType,\n\t\tprivate readonly completionType: AuthActionType,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Date> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_completion', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: this.completionType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\t\tGREATEST(\n\t\t\t\t\t\t\tCOALESCE(last_completion.created_at, NOW() - cfg.login_attempt_window),\n\t\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_completion'))\n\t\t\t.with('attempts', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'attempts')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_attempt')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: this.initType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\t\tCASE WHEN attempts.attempts = 0\n\t\t\t\t\tTHEN NOW()\n\t\t\t\t\tELSE LEAST(\n\t\t\t\t\t\tattempts.last_attempt + cfg.login_max_backoff,\n\t\t\t\t\t\tattempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))\n\t\t\t\t\t) END`),\n\t\t\t\t'next_allowed_attempt',\n\t\t\t)\n\t\t\t.from('attempts')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new Date()\n\t\t}\n\t\treturn result[0].next_allowed_attempt\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal","it"],"mappings":";;;AAcO,MAAM,6BAA6BA,SAAAA,cAAoB;AAAA,EAC7D,YACkB,OACA,UACA,gBAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,WAAA;AACA,SAAA,iBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAAwC;AACrD,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,mBAAmB,CAAA,OACxB,GACE,OAAO,IAAIC,iBAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAC,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAID,iBAAQ;AAAA;AAAA;AAAA;AAAA,QAIV;AAAA,MACF;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,iBAAiB,CAAC,EACzB,KAAK,YAAY,CAAA,OACjB,GACE,OAAO,IAAIA,SAAAA,QAAQ,UAAU,GAAG,UAAU,EAC1C,OAAO,IAAIA,SAAAA,QAAQ,iCAAiC,GAAG,cAAc,EACrE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAIA,SAAAA,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAIA,iBAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAML;AAAA,MACP;AAAA,IAAA,EAEA,KAAK,UAAU,EACf,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,iCAAW,KAAA;AAAA,IACZ;AACA,WAAO,OAAO,CAAC,EAAE;AAAA,EAClB;AACD;;"}
+{"version":3,"file":"NextMailAttemptQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextMailAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { AuthActionType } from '../../type/AuthLog.js'\n\n/**\n * Per-email exponential backoff for mail-sending init flows (password reset,\n * passwordless sign-in). Mirrors {@link NextLoginAttemptQuery} but counts\n * *successful* init events (= mails actually sent) against the same email, and\n * treats a successful completion (`completionType`) as the cutoff that resets\n * the backoff to zero.\n *\n * Reuses the existing `login_base_backoff` / `login_max_backoff` /\n * `login_attempt_window` knobs — see ConfigRateLimits docstring for the\n * rationale.\n */\nexport class NextMailAttemptQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t\tprivate readonly initType: AuthActionType,\n\t\tprivate readonly completionType: AuthActionType,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_completion', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: this.completionType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\t\tGREATEST(\n\t\t\t\t\t\t\tCOALESCE(last_completion.created_at, NOW() - cfg.login_attempt_window),\n\t\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_completion'))\n\t\t\t.with('attempts', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'attempts')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_attempt')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: this.initType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\t\tCASE WHEN attempts.attempts = 0\n\t\t\t\t\tTHEN 0\n\t\t\t\t\tELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (\n\t\t\t\t\t\tLEAST(\n\t\t\t\t\t\t\tattempts.last_attempt + cfg.login_max_backoff,\n\t\t\t\t\t\t\tattempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))\n\t\t\t\t\t\t) - NOW()\n\t\t\t\t\t)))) END`),\n\t\t\t\t'retry_after_seconds',\n\t\t\t)\n\t\t\t.from('attempts')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn 0\n\t\t}\n\t\treturn Number(result[0].retry_after_seconds)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal","it"],"mappings":";;;AAcO,MAAM,6BAA6BA,SAAAA,cAAsB;AAAA,EAC/D,YACkB,OACA,UACA,gBAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,WAAA;AACA,SAAA,iBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,mBAAmB,CAAA,OACxB,GACE,OAAO,IAAIC,iBAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAC,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAID,iBAAQ;AAAA;AAAA;AAAA;AAAA,QAIV;AAAA,MACF;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,iBAAiB,CAAC,EACzB,KAAK,YAAY,CAAA,OACjB,GACE,OAAO,IAAIA,SAAAA,QAAQ,UAAU,GAAG,UAAU,EAC1C,OAAO,IAAIA,SAAAA,QAAQ,iCAAiC,GAAG,cAAc,EACrE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAIA,SAAAA,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAIA,iBAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAQF;AAAA,MACV;AAAA,IAAA,EAEA,KAAK,UAAU,EACf,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,OAAO,OAAO,CAAC,EAAE,mBAAmB;AAAA,EAC5C;AACD;;"}

package/dist/development/src/model/queries/authLog/NextMailAttemptQuery.js

@@ -25,18 +25,20 @@ class NextMailAttemptQuery extends DatabaseQuery {
     }).where(new Literal("person_auth_log.created_at >= window_start.start_time"))).select(
       new Literal(`
 					CASE WHEN attempts.attempts = 0
-					THEN NOW()
-					ELSE LEAST(
-						attempts.last_attempt + cfg.login_max_backoff,
-						attempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))
-					) END`),
-      "next_allowed_attempt"
+					THEN 0
+					ELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (
+						LEAST(
+							attempts.last_attempt + cfg.login_max_backoff,
+							attempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))
+						) - NOW()
+					)))) END`),
+      "retry_after_seconds"
     ).from("attempts").from("cfg");
     const result = await qb.getResult(db);
     if (result.length === 0) {
-      return /* @__PURE__ */ new Date();
+      return 0;
     }
-    return result[0].next_allowed_attempt;
+    return Number(result[0].retry_after_seconds);
   }
 }
 export {

package/dist/development/src/model/queries/authLog/NextMailAttemptQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"NextMailAttemptQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextMailAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { AuthActionType } from '../../type/AuthLog.js'\n\n/**\n * Per-email exponential backoff for mail-sending init flows (password reset,\n * passwordless sign-in). Mirrors {@link NextLoginAttemptQuery} but counts\n * *successful* init events (= mails actually sent) against the same email, and\n * treats a successful completion (`completionType`) as the cutoff that resets\n * the backoff to zero.\n *\n * Reuses the existing `login_base_backoff` / `login_max_backoff` /\n * `login_attempt_window` knobs — see ConfigRateLimits docstring for the\n * rationale.\n */\nexport class NextMailAttemptQuery extends DatabaseQuery<Date> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t\tprivate readonly initType: AuthActionType,\n\t\tprivate readonly completionType: AuthActionType,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Date> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_completion', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: this.completionType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\t\tGREATEST(\n\t\t\t\t\t\t\tCOALESCE(last_completion.created_at, NOW() - cfg.login_attempt_window),\n\t\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_completion'))\n\t\t\t.with('attempts', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'attempts')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_attempt')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: this.initType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\t\tCASE WHEN attempts.attempts = 0\n\t\t\t\t\tTHEN NOW()\n\t\t\t\t\tELSE LEAST(\n\t\t\t\t\t\tattempts.last_attempt + cfg.login_max_backoff,\n\t\t\t\t\t\tattempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))\n\t\t\t\t\t) END`),\n\t\t\t\t'next_allowed_attempt',\n\t\t\t)\n\t\t\t.from('attempts')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new Date()\n\t\t}\n\t\treturn result[0].next_allowed_attempt\n\t}\n}\n"],"names":["it"],"mappings":";AAcO,MAAM,6BAA6B,cAAoB;AAAA,EAC7D,YACkB,OACA,UACA,gBAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,WAAA;AACA,SAAA,iBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAAwC;AACrD,UAAM,KAAK,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,mBAAmB,CAAA,OACxB,GACE,OAAO,IAAI,QAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAA,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA,QAIV;AAAA,MACF;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,iBAAiB,CAAC,EACzB,KAAK,YAAY,CAAA,OACjB,GACE,OAAO,IAAI,QAAQ,UAAU,GAAG,UAAU,EAC1C,OAAO,IAAI,QAAQ,iCAAiC,GAAG,cAAc,EACrE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAI,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAML;AAAA,MACP;AAAA,IAAA,EAEA,KAAK,UAAU,EACf,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,iCAAW,KAAA;AAAA,IACZ;AACA,WAAO,OAAO,CAAC,EAAE;AAAA,EAClB;AACD;"}
+{"version":3,"file":"NextMailAttemptQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/authLog/NextMailAttemptQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { AuthActionType } from '../../type/AuthLog.js'\n\n/**\n * Per-email exponential backoff for mail-sending init flows (password reset,\n * passwordless sign-in). Mirrors {@link NextLoginAttemptQuery} but counts\n * *successful* init events (= mails actually sent) against the same email, and\n * treats a successful completion (`completionType`) as the cutoff that resets\n * the backoff to zero.\n *\n * Reuses the existing `login_base_backoff` / `login_max_backoff` /\n * `login_attempt_window` knobs — see ConfigRateLimits docstring for the\n * rationale.\n */\nexport class NextMailAttemptQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly email: string,\n\t\tprivate readonly initType: AuthActionType,\n\t\tprivate readonly completionType: AuthActionType,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\tconst qb = SelectBuilder.create()\n\t\t\t.with('cfg', it => it.from('config'))\n\t\t\t.with('last_completion', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'created_at')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.join('person', 'person', it => it.columnsEq(['person', 'id'], ['person_auth_log', 'person_id']))\n\t\t\t\t\t.where({\n\t\t\t\t\t\ttype: this.completionType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\temail: this.email,\n\t\t\t\t\t}))\n\t\t\t.with('window_start', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(\n\t\t\t\t\t\tnew Literal(`\n\t\t\t\t\t\tGREATEST(\n\t\t\t\t\t\t\tCOALESCE(last_completion.created_at, NOW() - cfg.login_attempt_window),\n\t\t\t\t\t\t\tNOW() - cfg.login_attempt_window\n\t\t\t\t\t\t)`),\n\t\t\t\t\t\t'start_time',\n\t\t\t\t\t)\n\t\t\t\t\t.from('cfg')\n\t\t\t\t\t.from('last_completion'))\n\t\t\t.with('attempts', it =>\n\t\t\t\tit\n\t\t\t\t\t.select(new Literal('COUNT(*)'), 'attempts')\n\t\t\t\t\t.select(new Literal('MAX(person_auth_log.created_at)'), 'last_attempt')\n\t\t\t\t\t.from('person_auth_log')\n\t\t\t\t\t.from('window_start')\n\t\t\t\t\t.where({\n\t\t\t\t\t\tperson_input_identifier: this.email,\n\t\t\t\t\t\ttype: this.initType,\n\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t})\n\t\t\t\t\t.where(new Literal('person_auth_log.created_at >= window_start.start_time')))\n\t\t\t.select(\n\t\t\t\tnew Literal(`\n\t\t\t\t\tCASE WHEN attempts.attempts = 0\n\t\t\t\t\tTHEN 0\n\t\t\t\t\tELSE GREATEST(0, CEIL(EXTRACT(EPOCH FROM (\n\t\t\t\t\t\tLEAST(\n\t\t\t\t\t\t\tattempts.last_attempt + cfg.login_max_backoff,\n\t\t\t\t\t\t\tattempts.last_attempt + cfg.login_base_backoff * (POWER(2, attempts.attempts - 1))\n\t\t\t\t\t\t) - NOW()\n\t\t\t\t\t)))) END`),\n\t\t\t\t'retry_after_seconds',\n\t\t\t)\n\t\t\t.from('attempts')\n\t\t\t.from('cfg')\n\n\t\tconst result = await qb.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn 0\n\t\t}\n\t\treturn Number(result[0].retry_after_seconds)\n\t}\n}\n"],"names":["it"],"mappings":";AAcO,MAAM,6BAA6B,cAAsB;AAAA,EAC/D,YACkB,OACA,UACA,gBAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,WAAA;AACA,SAAA,iBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,KAAK,cAAc,OAAA,EACvB,KAAK,OAAO,QAAM,GAAG,KAAK,QAAQ,CAAC,EACnC,KAAK,mBAAmB,CAAA,OACxB,GACE,OAAO,IAAI,QAAQ,iCAAiC,GAAG,YAAY,EACnE,KAAK,iBAAiB,EACtB,KAAK,UAAU,UAAU,CAAAA,QAAMA,IAAG,UAAU,CAAC,UAAU,IAAI,GAAG,CAAC,mBAAmB,WAAW,CAAC,CAAC,EAC/F,MAAM;AAAA,MACN,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,MACT,OAAO,KAAK;AAAA,IAAA,CACZ,CAAC,EACH,KAAK,gBAAgB,QACrB,GACE;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA,QAIV;AAAA,MACF;AAAA,IAAA,EAEA,KAAK,KAAK,EACV,KAAK,iBAAiB,CAAC,EACzB,KAAK,YAAY,CAAA,OACjB,GACE,OAAO,IAAI,QAAQ,UAAU,GAAG,UAAU,EAC1C,OAAO,IAAI,QAAQ,iCAAiC,GAAG,cAAc,EACrE,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,MAAM;AAAA,MACN,yBAAyB,KAAK;AAAA,MAC9B,MAAM,KAAK;AAAA,MACX,SAAS;AAAA,IAAA,CACT,EACA,MAAM,IAAI,QAAQ,uDAAuD,CAAC,CAAC,EAC7E;AAAA,MACA,IAAI,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAQF;AAAA,MACV;AAAA,IAAA,EAEA,KAAK,UAAU,EACf,KAAK,KAAK;AAEZ,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,OAAO,OAAO,CAAC,EAAE,mBAAmB;AAAA,EAC5C;AACD;"}