@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/tests/cases/unit/idp/oidcRevalidate.test.ts

@@ -24,13 +24,70 @@ describe('revalidateOIDC — refresh', () => {
 
 		expect(result.status).toBe('valid')
 		if (result.status === 'valid') {
-			expect(result.claims).toEqual({ sub: 'user-1', email: 'a@b.cz' })
+			// claims are normalized the SAME way sign-in normalizes them (identity fields mapped on top of the
+			// raw claims), so an `always` mapping reconciles against an identical surface on refresh.
+			expect(result.claims).toEqual({ sub: 'user-1', email: 'a@b.cz', externalIdentifier: 'user-1', emailVerified: false })
+			// id_token present + surface rebuilt → complete, so the caller may run `unmatched: "remove"` here too.
+			expect(result.claimsComplete).toBe(true)
 			expect(result.idpSession?.tokens?.refresh_token).toBe('refresh-new')
 			expect(result.idpSession?.sessionId).toBe('sid-1')
 			expect(result.idpSession?.expiresAt).toEqual(new Date(1_900_000_000 * 1000))
 		}
 	})
 
+	test('fetchUserInfo: merges userinfo into the refresh surface (same as sign-in)', async () => {
+		// At sign-in, `fetchUserInfo` merges userinfo over the id-token claims; the refresh path does the SAME,
+		// so a rule keyed on a userinfo-only claim (e.g. `groups`) resolves on refresh too.
+		const client = {
+			refresh: async () => ({
+				refresh_token: 'refresh-new',
+				access_token: 'access-new',
+				id_token: 'id-new',
+				claims: () => ({ sub: 'user-1', email: 'a@b.cz' }),
+			}),
+			userinfo: async (token: any) => {
+				expect(token.access_token).toBe('access-new')
+				return { sub: 'user-1', groups: ['IT-Admins'] }
+			},
+		} as any
+
+		const result = await revalidateOIDC(client, 'refresh', session({ refresh_token: 'refresh-old' }), { fetchUserInfo: true })
+
+		expect(result.status).toBe('valid')
+		if (result.status === 'valid') {
+			expect((result.claims as any)?.groups).toEqual(['IT-Admins'])
+			expect((result.claims as any)?.email).toBe('a@b.cz')
+			expect(result.claimsComplete).toBe(true)
+		}
+	})
+
+	test('fetchUserInfo failure → keep session, skip the sync (no claims, surface not complete)', async () => {
+		// The IdP already vouched for the session via the successful refresh; a failed userinfo fetch must not
+		// fail revalidation. Drop the claims so the sync is skipped (and removal can never run off a half-built
+		// surface) and retry on a later refresh.
+		const client = {
+			refresh: async () => ({
+				refresh_token: 'refresh-new',
+				access_token: 'access-new',
+				id_token: 'id-new',
+				claims: () => ({ sub: 'user-1' }),
+			}),
+			userinfo: async () => {
+				throw new Error('userinfo unreachable')
+			},
+		} as any
+
+		const result = await revalidateOIDC(client, 'refresh', session({ refresh_token: 'refresh-old' }), { fetchUserInfo: true })
+
+		expect(result.status).toBe('valid')
+		if (result.status === 'valid') {
+			expect(result.claims).toBeUndefined()
+			expect(result.claimsComplete).toBe(false)
+			// the session is still kept (rotated token persisted)
+			expect(result.idpSession?.tokens?.refresh_token).toBe('refresh-new')
+		}
+	})
+
 	test('non-rotating IdP: refresh omits the refresh token → keep the stored one (no spurious revoke)', async () => {
 		// RFC 6749 §6 — a refresh response MAY omit refresh_token; the client keeps the old one.
 		const client = {
@@ -78,6 +135,28 @@ describe('revalidateOIDC — refresh', () => {
 		} as any
 		await expect(revalidateOIDC(client, 'refresh', session({ refresh_token: 'x' }))).rejects.toThrow('ECONNREFUSED')
 	})
+
+	test('attributesKey: nested claims are lifted to the top level on the refresh path (same as sign-in)', async () => {
+		// A09 (SEC-2): an `attributesKey` provider (e.g. Apereo CAS) nests its claims under `attributes`; the
+		// `claimMapping` option wires that lift into `revalidateOIDC` so its mapping resolves identically on refresh.
+		const client = {
+			refresh: async () => ({
+				refresh_token: 'refresh-new',
+				id_token: 'id-new',
+				claims: () => ({ sub: 'signed', attributes: { groups: ['IT-Admins'], sub: 'spoofed' } }),
+			}),
+		} as any
+
+		const result = await revalidateOIDC(client, 'refresh', session({ refresh_token: 'refresh-old' }), { claimMapping: { attributesKey: 'attributes' } })
+
+		expect(result.status).toBe('valid')
+		if (result.status === 'valid') {
+			// the nested `groups` is surfaced top-level for rule matching…
+			expect((result.claims as any)?.groups).toEqual(['IT-Admins'])
+			// …while a signed top-level claim keeps precedence over an attributes-level value of the same name
+			expect((result.claims as any)?.sub).toBe('signed')
+		}
+	})
 })
 
 describe('revalidateOIDC — userinfo', () => {
@@ -91,7 +170,20 @@ describe('revalidateOIDC — userinfo', () => {
 		const result = await revalidateOIDC(client, 'userinfo', session({ access_token: 'access-1' }))
 		expect(result.status).toBe('valid')
 		if (result.status === 'valid') {
-			expect(result.claims).toEqual({ sub: 'user-1', groups: ['admins'] })
+			expect(result.claims).toEqual({ sub: 'user-1', groups: ['admins'], externalIdentifier: 'user-1', emailVerified: false })
+			// userinfo carries no id-token claims → narrower than sign-in's surface → additive-only on refresh.
+			expect(result.claimsComplete).toBe(false)
+		}
+	})
+
+	test('attributesKey: userinfo nested claims are lifted to the top level', async () => {
+		const client = {
+			userinfo: async () => ({ sub: 'user-1', attributes: { groups: ['admins'] } }),
+		} as any
+		const result = await revalidateOIDC(client, 'userinfo', session({ access_token: 'access-1' }), { claimMapping: { attributesKey: 'attributes' } })
+		expect(result.status).toBe('valid')
+		if (result.status === 'valid') {
+			expect((result.claims as any)?.groups).toEqual(['admins'])
 		}
 	})
 

package/tests/cases/unit/otpManager.test.ts

@@ -62,6 +62,7 @@ const basePerson: PersonRow = {
 	disabled_at: null,
 	passwordless_enabled: null,
 	mfa_grace_until: null,
+	is_in_grace: false,
 	email_verified_at: null,
 	email_verification_required: false,
 }

package/tests/cases/unit/panelAccessResolver.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, test } from 'bun:test'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { DatabaseContext, PanelAccessResolver, Providers } from '../../../src/index.js'
+import { getConfigSql } from '../integration/mocked/sql/getConfigSql.js'
+
+const identityId = '123e4567-e89b-12d3-a456-000000000001'
+
+const providers: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => new Date('2026-08-06T12:00:00.000Z'),
+	randomBytes: length => Promise.resolve(Buffer.alloc(length)),
+	uuid: () => 'uuid',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	hash: value => Buffer.from(value.toString()),
+}
+
+const resolve = async (queries: ExpectedQuery[], globalRoles: readonly string[]) => {
+	const connection = createConnectionMock(queries)
+	const db = new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers)
+	const result = await new PanelAccessResolver(providers).isAllowed(db, identityId, globalRoles)
+	expect(queries).toHaveLength(0)
+	return result
+}
+
+const projectRolesSql = (roles: string[]): ExpectedQuery => ({
+	sql: 'select "project_id", "role" from "tenant"."project_membership" where "identity_id" = ?',
+	parameters: [identityId],
+	response: { rows: roles.map((role, index) => ({ project_id: `project-${index}`, role })) },
+})
+
+describe('PanelAccessResolver', () => {
+	test('allows project_admin through the default global policy without reading memberships', async () => {
+		expect(await resolve([getConfigSql()], ['project_admin'])).toBe(true)
+	})
+
+	test('allows a configured custom global role', async () => {
+		expect(await resolve([getConfigSql({ panel_global_roles: ['project_creator'], panel_project_roles: [] })], ['project_creator'])).toBe(true)
+	})
+
+	test('denies everyone when both policy lists are empty', async () => {
+		expect(await resolve([getConfigSql({ panel_global_roles: [], panel_project_roles: [] })], ['super_admin'])).toBe(false)
+	})
+
+	test('allows a matching project role and denies a non-matching role', async () => {
+		expect(await resolve([getConfigSql({ panel_global_roles: [], panel_project_roles: ['admin'] }), projectRolesSql(['editor', 'admin'])], [])).toBe(
+			true,
+		)
+		expect(await resolve([getConfigSql({ panel_global_roles: [], panel_project_roles: ['admin'] }), projectRolesSql(['editor'])], [])).toBe(false)
+	})
+})

package/tests/cases/unit/rateLimiter.test.ts

@@ -34,8 +34,8 @@ const configWith = (limit: number, window = '01:00:00'): Config =>
 	}) as unknown as Config
 
 const COUNT_SQL = `select count(*)::text as count from "tenant"."rate_limit_event"
-	where "scope" = ? and "key_hash" = ? and "occurred_at" >= ?`
-const INSERT_SQL = `insert into "tenant"."rate_limit_event" ("id", "scope", "key_hash", "occurred_at") values (?, ?, ?, ?)`
+	where "scope" = ? and "key_hash" = ? and occurred_at >= NOW() - make_interval(secs => ?)`
+const INSERT_SQL = `insert into "tenant"."rate_limit_event" ("id", "scope", "key_hash") values (?, ?, ?)`
 
 const expectedHash = Buffer.from('sha256:1.2.3.4')
 
@@ -75,7 +75,7 @@ describe('RateLimiter', () => {
 			queries: [
 				{
 					sql: INSERT_SQL,
-					parameters: ['rate-limit-event-id', 'sign_up_per_ip', expectedHash, NOW],
+					parameters: ['rate-limit-event-id', 'sign_up_per_ip', expectedHash],
 					response: { rowCount: 1 },
 				},
 			],
@@ -90,12 +90,12 @@ describe('RateLimiter', () => {
 				{
 					sql: COUNT_SQL,
 					// window of 1h → occurred_at >= NOW - 3600s
-					parameters: ['sign_up_per_ip', expectedHash, new Date('2026-05-20T11:00:00.000Z')],
+					parameters: ['sign_up_per_ip', expectedHash, 3600],
 					response: { rows: [{ count: '2' }] },
 				},
 				{
 					sql: INSERT_SQL,
-					parameters: ['rate-limit-event-id', 'sign_up_per_ip', expectedHash, NOW],
+					parameters: ['rate-limit-event-id', 'sign_up_per_ip', expectedHash],
 					response: { rowCount: 1 },
 				},
 			],
@@ -109,7 +109,7 @@ describe('RateLimiter', () => {
 			queries: [
 				{
 					sql: COUNT_SQL,
-					parameters: ['sign_up_per_ip', expectedHash, new Date('2026-05-20T11:00:00.000Z')],
+					parameters: ['sign_up_per_ip', expectedHash, 3600],
 					response: { rows: [{ count: '3' }] },
 				},
 				// no INSERT — a denied attempt must not extend the window
@@ -124,7 +124,7 @@ describe('RateLimiter', () => {
 			queries: [
 				{
 					sql: COUNT_SQL,
-					parameters: ['sign_up_per_ip', expectedHash, new Date('2026-05-20T11:00:00.000Z')],
+					parameters: ['sign_up_per_ip', expectedHash, 3600],
 					response: { rows: [{ count: '9' }] },
 				},
 			],

package/tests/cases/unit/savePersonTokenCommand.test.ts

@@ -0,0 +1,40 @@
+import { expect, test } from 'bun:test'
+import { createConnectionMock, ExpectedQuery } from '@contember/database-tester'
+import { computeTokenHash, DatabaseContext, Providers, SavePersonTokenCommand } from '../../../src/index.js'
+
+const APP_NOW = new Date('2026-07-14T10:00:00Z')
+const DB_EXPIRES_AT = new Date('2026-07-14T09:15:00Z')
+const TOKEN_HASH = computeTokenHash('token')
+
+const providers: Providers = {
+	bcrypt: () => Promise.resolve('x'),
+	bcryptCompare: () => Promise.resolve(true),
+	now: () => APP_NOW,
+	randomBytes: () => Promise.resolve(Buffer.alloc(0)),
+	uuid: () => 'token-id',
+	decrypt: () => {
+		throw new Error('not supported')
+	},
+	encrypt: () => {
+		throw new Error('not supported')
+	},
+	encryptionEnabled: false,
+	hash: () => Buffer.alloc(0),
+}
+
+test('returns the database-clock expiration', async () => {
+	const queries: ExpectedQuery[] = [{
+		sql:
+			`insert into "tenant"."person_token" ("id", "token_hash", "person_id", "expires_at", "created_at", "used_at", "type", "meta") values (?, ?, ?, now() + make_interval(secs => ?), ?, ?, ?, ?) returning "expires_at"`,
+		parameters: ['token-id', TOKEN_HASH, 'person-id', 900, APP_NOW, null, 'passwordless', null],
+		response: { rows: [{ expires_at: DB_EXPIRES_AT }] },
+	}]
+	const connection = createConnectionMock(queries)
+	const client = connection.createClient('tenant', { module: 'tenant' })
+	const db = new DatabaseContext(client, providers)
+
+	const result = await db.commandBus.execute(new SavePersonTokenCommand('person-id', TOKEN_HASH, 'passwordless', 15))
+
+	expect(result).toEqual({ id: 'token-id', expiresAt: DB_EXPIRES_AT })
+	expect(queries).toHaveLength(0)
+})

package/tests/cases/unit/updateConfigurationCommand.test.ts

@@ -0,0 +1,63 @@
+import { expect, test } from 'bun:test'
+import { createConnectionMock, type ExpectedQuery } from '@contember/database-tester'
+import { DatabaseContext, type Providers, Schema, UpdateConfigurationCommand } from '../../../src/index.js'
+
+const createProviders = (encrypt: Providers['encrypt'] = async value => ({ value, version: 1 })): Providers => ({
+	bcrypt: async value => value,
+	bcryptCompare: async () => true,
+	now: () => new Date('2026-08-11T00:00:00Z'),
+	randomBytes: async length => Buffer.alloc(length),
+	uuid: () => '00000000-0000-0000-0000-000000000000',
+	decrypt: async value => ({ value, needsReEncrypt: false }),
+	encrypt,
+	encryptionEnabled: true,
+	hash: value => Buffer.from(value.toString()),
+})
+
+const execute = async (
+	configuration: Schema.ConfigInput,
+	expectedQuery: ExpectedQuery,
+	providers: Providers = createProviders(),
+): Promise<void> => {
+	const expectedQueries = [expectedQuery]
+	const connection = createConnectionMock(expectedQueries)
+	const client = connection.createClient('tenant', { module: 'tenant' })
+	const db = new DatabaseContext(client, providers)
+
+	await db.commandBus.execute(new UpdateConfigurationCommand(configuration))
+
+	expect(expectedQueries).toHaveLength(0)
+}
+
+test('captcha secret null preserves the stored secret and version while provider null disables captcha', async () => {
+	let encryptCalls = 0
+	const providers = createProviders(async value => {
+		encryptCalls++
+		return { value, version: 99 }
+	})
+
+	await execute({ captcha: { provider: null, secret: null } }, {
+		sql: 'update "tenant"."config" set "captcha_provider" = ? where "id" = ?',
+		parameters: [null, 'singleton'],
+		response: { rowCount: 1 },
+	}, providers)
+
+	// The partial UPDATE omits both stored columns, so their existing bytes/version survive.
+	expect(encryptCalls).toBe(0)
+})
+
+test('omitting captcha secret preserves the stored secret and version', async () => {
+	await execute({ captcha: { threshold: null } }, {
+		sql: 'update "tenant"."config" set "captcha_threshold" = ? where "id" = ?',
+		parameters: [null, 'singleton'],
+		response: { rowCount: 1 },
+	})
+})
+
+test('an empty captcha secret explicitly clears both stored secret columns', async () => {
+	await execute({ captcha: { secret: '' } }, {
+		sql: 'update "tenant"."config" set "captcha_secret" = ?, "captcha_secret_version" = ? where "id" = ?',
+		parameters: [null, null, 'singleton'],
+		response: { rowCount: 1 },
+	})
+})

package/tests/src/IdPMock.ts

@@ -13,6 +13,12 @@ export class IdPMock implements IdentityProviderHandler<any> {
 			externalIdentifier: configuration.externalIdentifier,
 			email: configuration.email,
 			emailVerified: configuration.emailVerified,
+			// Surface any extra claims configured on the mock (e.g. `groups`, `department`) verbatim,
+			// mirroring how real providers spread raw OIDC claims into the IDPResponse — lets tests
+			// drive claim-mapping (A09). `claimMapping` itself lives on the IdP config, not here.
+			...(configuration.claims ?? {}),
+			// Lets tests drive the federated-session branch of sign-in (re-validation state).
+			...(configuration.idpSession ? { idpSession: configuration.idpSession } : {}),
 		})
 	}
 

package/tests/src/testTenant.ts

@@ -38,13 +38,25 @@ export interface Test {
 	httpInfo?: { ip?: string; userAgent?: string; geoCountry?: string }
 	/** Override individual providers (e.g. a working `decrypt` to enable captcha). */
 	providers?: Partial<Providers>
-	/** Tenant roles of the authenticated identity (default: none). */
+	/**
+	 * Tenant roles of the authenticated identity (default: none). Setting this switches the
+	 * context to the REAL authorization stack — the static permission map plus
+	 * `CustomRoleAuthorizator` — instead of the allow-everything default, so the test
+	 * actually exercises what these roles may do. Custom-role slugs listed here trigger the
+	 * request-scoped `custom_role` lookup, which must appear in `executes`.
+	 */
 	identityRoles?: string[]
 	/**
-	 * Override the authorizator. The default allows every action; pass a custom one
-	 * to exercise forbidden / partially-allowed (e.g. per-role) ACL branches.
+	 * Override the authorizator. Without this and without `identityRoles`, every action is
+	 * allowed; pass a custom one to exercise forbidden / partially-allowed ACL branches.
 	 */
 	authorizator?: Authorizator<Identity>
+	/**
+	 * Override the project schema resolver (default: a fixed schema defining roles `editor` / `reviewer`).
+	 * Pass `{ getSchema: () => Promise.resolve(undefined) }` to exercise the unresolvable-schema branch of
+	 * the A09 apply-time backstop.
+	 */
+	projectSchemaResolver?: ProjectSchemaResolver
 }
 
 export const createUuidGenerator = () => {
@@ -65,13 +77,37 @@ const schema: Schema = {
 						type: Acl.VariableType.entity,
 						entityName: 'Language',
 					},
+					// A condition variable for the claim-mapping config-validation tests. It carries a `fallback`
+					// so it is OPTIONAL — a membership that doesn't set it (e.g. createApiKey's editor grant)
+					// stays valid instead of failing with VARIABLE_EMPTY.
+					siteFilter: {
+						type: Acl.VariableType.condition,
+						fallback: { never: true },
+					},
+					// An entity variable used by the claim-mapping apply tests (a claim mapped to locale ids).
+					// Carries a `fallback` so it stays OPTIONAL on the direct add-member path, while A09's
+					// apply-time backstop now drops a grant naming a role/variable absent from the live ACL — so
+					// the variable must exist here for the happy-path apply tests to validate and be applied.
+					locale: {
+						type: Acl.VariableType.entity,
+						entityName: 'Locale',
+						fallback: { never: true },
+					},
 				},
 			},
+			// A second project role for the claim-mapping reconciliation tests (unmatched: remove grants and
+			// strips both `editor` and `reviewer`). Must exist in the live ACL or A09's apply-time backstop
+			// drops the grant for it.
+			reviewer: {
+				stages: '*',
+				entities: {},
+				variables: {},
+			},
 		},
 	},
 }
 
-const projectSchemaResolver: ProjectSchemaResolver = {
+const defaultProjectSchemaResolver: ProjectSchemaResolver = {
 	getSchema: project => Promise.resolve(schema),
 }
 
@@ -80,6 +116,7 @@ export const authenticatedApiKeyId = testUuid(998)
 
 export const executeTenantTest = async (test: Test) => {
 	const mailer = createMockedMailer()
+	const projectSchemaResolver = test.projectSchemaResolver ?? defaultProjectSchemaResolver
 	const providers: Providers = {
 		bcrypt: (value: string) => Promise.resolve('BCRYPTED-' + value),
 		bcryptCompare: (data: string, hash: string) => Promise.resolve('BCRYPTED-' + data === hash),
@@ -112,6 +149,7 @@ export const executeTenantTest = async (test: Test) => {
 			connection,
 			readConnection: connection,
 			cryptoProviders: providers,
+			logger: createLogger(new JsonStreamLoggerHandler(process.stderr)),
 		})
 		.replaceService('mailer', () => mailer)
 		.setupService('idpRegistry', reg => {
@@ -126,16 +164,26 @@ export const executeTenantTest = async (test: Test) => {
 		: [test.expectedAuthLog]
 
 	const databaseContext = tenantContainer.databaseContext
+	// `identityRoles` means "evaluate what these roles really may do", so it routes through
+	// the container's PermissionContextFactory — the static map plus CustomRoleAuthorizator.
+	// Without it (and without an explicit authorizator) the default stays allow-everything,
+	// which is what the bulk of these tests want.
+	const permissionContext = test.authorizator === undefined && test.identityRoles !== undefined
+		? await tenantContainer.permissionContextFactory.createPreloaded(databaseContext, {
+			id: authenticatedIdentityId,
+			roles: test.identityRoles,
+		})
+		: new PermissionContext(
+			new StaticIdentity(authenticatedIdentityId, test.identityRoles ?? []),
+			test.authorizator ?? {
+				isAllowed: () => Promise.resolve(true),
+			},
+			new ProjectScopeFactory(new AclSchemaAccessNodeFactory()),
+			projectSchemaResolver,
+		)
 	const context: TenantResolverContext = {
 		...createResolverContext(
-			new PermissionContext(
-				new StaticIdentity(authenticatedIdentityId, test.identityRoles ?? []),
-				test.authorizator ?? {
-					isAllowed: () => Promise.resolve(true),
-				},
-				new ProjectScopeFactory(new AclSchemaAccessNodeFactory()),
-				projectSchemaResolver,
-			),
+			permissionContext,
 			authenticatedApiKeyId,
 			test.callerTrustForwardedInfo ?? false,
 		),

package/dist/development/src/model/commands/membership/RemoveProjectMembershipsCommand.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/membership/RemoveProjectMembershipsCommand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAM,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/commands/membership/RemoveProjectMembershipsCommand.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/production/src/model/commands/membership/RemoveProjectMembershipsCommand.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAM,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/types/model/commands/membership/RemoveProjectMembershipsCommand.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RemoveProjectMembershipsCommand.d.ts","sourceRoot":"","sources":["../../../../../src/model/commands/membership/RemoveProjectMembershipsCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAA;AAGvC,qBAAa,8BAA+B,YAAW,OAAO,CAAC,IAAI,CAAC;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAU,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAA7E,SAAS,EAAE,MAAM,EAAmB,UAAU,EAAE,MAAM,EAAmB,IAAI,EAAE,MAAM;IAE5G,OAAO,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAUlE"}