@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/development/src/model/queries/person/PersonQueryBuilderFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryBuilderFactory.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAA,SAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;;"}
+{"version":3,"file":"PersonQueryBuilderFactory.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t// MFA grace gate on the DB clock (against now()), so app/DB skew can't\n\t\t\t// extend the window. See SignInManager.enforceMfaEnrollment / CLAUDE.md.\n\t\t\t.select(expr => expr.raw('\"person\".\"mfa_grace_until\" is not null and \"person\".\"mfa_grace_until\" > now()'), 'is_in_grace')\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,CAAA,SAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,CAAA,SAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EAGpC,OAAO,UAAQ,KAAK,IAAI,+EAA+E,GAAG,aAAa,EACvH,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,UAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,CAAA,SAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;;"}

package/dist/development/src/model/queries/person/PersonQueryBuilderFactory.js

@@ -6,10 +6,10 @@ class PersonQueryBuilderFactory {
    * and the `identity` join that the full builder needs only for `roles`.
    */
   static createPersonListQueryBuilder() {
-    return SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
+    return SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).select(["person", "disabled_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
   }
   static createPersonQueryBuilder() {
-    return SelectBuilder.create().select(["person", "id"]).select(["person", "password_hash"]).select(["person_mfa", "totp_secret"], "otp_secret").select(["person_mfa", "totp_secret_version"], "otp_secret_version").select(["person_mfa", "totp_activated_at"], "otp_activated_at").select(["person_mfa", "totp_pending_secret"], "otp_pending_secret").select(["person_mfa", "totp_pending_version"], "otp_pending_version").select(["person_mfa", "totp_pending_created_at"], "otp_pending_created_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person", "disabled_at"]).select(["person", "passwordless_enabled"]).select(["person", "mfa_grace_until"]).select(["person", "email_verified_at"]).select(["person", "email_verification_required"]).select(["identity", "roles"]).from("person").join("identity", "identity", (expr) => expr.columnsEq(["identity", "id"], ["person", "identity_id"])).leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
+    return SelectBuilder.create().select(["person", "id"]).select(["person", "password_hash"]).select(["person_mfa", "totp_secret"], "otp_secret").select(["person_mfa", "totp_secret_version"], "otp_secret_version").select(["person_mfa", "totp_activated_at"], "otp_activated_at").select(["person_mfa", "totp_pending_secret"], "otp_pending_secret").select(["person_mfa", "totp_pending_version"], "otp_pending_version").select(["person_mfa", "totp_pending_created_at"], "otp_pending_created_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person", "disabled_at"]).select(["person", "passwordless_enabled"]).select(["person", "mfa_grace_until"]).select((expr) => expr.raw('"person"."mfa_grace_until" is not null and "person"."mfa_grace_until" > now()'), "is_in_grace").select(["person", "email_verified_at"]).select(["person", "email_verification_required"]).select(["identity", "roles"]).from("person").join("identity", "identity", (expr) => expr.columnsEq(["identity", "id"], ["person", "identity_id"])).leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
   }
 }
 export {

package/dist/development/src/model/queries/person/PersonQueryBuilderFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryBuilderFactory.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAA,SAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;"}
+{"version":3,"file":"PersonQueryBuilderFactory.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t// MFA grace gate on the DB clock (against now()), so app/DB skew can't\n\t\t\t// extend the window. See SignInManager.enforceMfaEnrollment / CLAUDE.md.\n\t\t\t.select(expr => expr.raw('\"person\".\"mfa_grace_until\" is not null and \"person\".\"mfa_grace_until\" > now()'), 'is_in_grace')\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,CAAA,SAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,CAAA,SAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EAGpC,OAAO,UAAQ,KAAK,IAAI,+EAA+E,GAAG,aAAa,EACvH,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,UAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,CAAA,SAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;"}

package/dist/development/src/model/queries/personToken/PersonTokenQuery.cjs

@@ -23,7 +23,7 @@ class PersonTokenQuery extends Database.DatabaseQuery {
     return new PersonTokenQuery("person_id", personId, type, true);
   }
   async fetch({ db }) {
-    let qb = Database.SelectBuilder.create().from("person_token").select(new Database.Literal("*")).where({
+    let qb = Database.SelectBuilder.create().from("person_token").select(new Database.Literal("*")).select(new Database.Literal('"expires_at" <= now()'), "is_expired").where({
       [this.identifierType]: this.identifier,
       type: this.type
     });

package/dist/development/src/model/queries/personToken/PersonTokenQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonTokenQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/personToken/PersonTokenQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { PersonToken } from '../../type/index.js'\nimport { computeTokenHash } from '../../utils/index.js'\n\nexport class PersonTokenQuery extends DatabaseQuery<PersonToken.Row | null> {\n\tprivate constructor(\n\t\tprivate readonly identifierType: 'id' | 'token_hash' | 'person_id',\n\t\tprivate readonly identifier: string,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly latestUnusedOnly: boolean = false,\n\t) {\n\t\tsuper()\n\t}\n\n\tpublic static byId(id: string, type: PersonToken.Type): PersonTokenQuery {\n\t\treturn new PersonTokenQuery('id', id, type)\n\t}\n\n\tpublic static byToken(token: string, type: PersonToken.Type): PersonTokenQuery {\n\t\tconst tokenHash = computeTokenHash(token)\n\t\treturn new PersonTokenQuery('token_hash', tokenHash, type)\n\t}\n\n\t/** Latest still-unused token of the given type for a person (e.g. the most recent email OTP code). */\n\tpublic static latestUnusedByPerson(personId: string, type: PersonToken.Type): PersonTokenQuery {\n\t\treturn new PersonTokenQuery('person_id', personId, type, true)\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonToken.Row | null> {\n\t\tlet qb = SelectBuilder.create<PersonToken.Row>()\n\t\t\t.from('person_token')\n\t\t\t.select(new Literal('*'))\n\t\t\t.where({\n\t\t\t\t[this.identifierType]: this.identifier,\n\t\t\t\ttype: this.type,\n\t\t\t})\n\t\tif (this.latestUnusedOnly) {\n\t\t\tqb = qb\n\t\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t\t.orderBy('created_at', 'desc')\n\t\t\t\t.limit(1)\n\t\t}\n\t\tconst result = await qb.getResult(db)\n\t\treturn this.fetchOneOrNull(result)\n\t}\n}\n"],"names":["DatabaseQuery","token","computeTokenHash","SelectBuilder","Literal"],"mappings":";;;;;AAIO,MAAM,yBAAyBA,SAAAA,cAAsC;AAAA,EACnE,YACU,gBACA,YACA,MACA,mBAA4B,OAC5C;AACD,UAAA;AALiB,SAAA,iBAAA;AACA,SAAA,aAAA;AACA,SAAA,OAAA;AACA,SAAA,mBAAA;AAAA,EAGlB;AAAA,EAEA,OAAc,KAAK,IAAY,MAA0C;AACxE,WAAO,IAAI,iBAAiB,MAAM,IAAI,IAAI;AAAA,EAC3C;AAAA,EAEA,OAAc,QAAQC,SAAe,MAA0C;AAC9E,UAAM,YAAYC,MAAAA,iBAAiBD,OAAK;AACxC,WAAO,IAAI,iBAAiB,cAAc,WAAW,IAAI;AAAA,EAC1D;AAAA;AAAA,EAGA,OAAc,qBAAqB,UAAkB,MAA0C;AAC9F,WAAO,IAAI,iBAAiB,aAAa,UAAU,MAAM,IAAI;AAAA,EAC9D;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0D;AACvE,QAAI,KAAKE,SAAAA,cAAc,OAAA,EACrB,KAAK,cAAc,EACnB,OAAO,IAAIC,SAAAA,QAAQ,GAAG,CAAC,EACvB,MAAM;AAAA,MACN,CAAC,KAAK,cAAc,GAAG,KAAK;AAAA,MAC5B,MAAM,KAAK;AAAA,IAAA,CACX;AACF,QAAI,KAAK,kBAAkB;AAC1B,WAAK,GACH,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,QAAQ,cAAc,MAAM,EAC5B,MAAM,CAAC;AAAA,IACV;AACA,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,WAAO,KAAK,eAAe,MAAM;AAAA,EAClC;AACD;;"}
+{"version":3,"file":"PersonTokenQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/personToken/PersonTokenQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { PersonToken } from '../../type/index.js'\nimport { computeTokenHash } from '../../utils/index.js'\n\nexport class PersonTokenQuery extends DatabaseQuery<PersonToken.Row | null> {\n\tprivate constructor(\n\t\tprivate readonly identifierType: 'id' | 'token_hash' | 'person_id',\n\t\tprivate readonly identifier: string,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly latestUnusedOnly: boolean = false,\n\t) {\n\t\tsuper()\n\t}\n\n\tpublic static byId(id: string, type: PersonToken.Type): PersonTokenQuery {\n\t\treturn new PersonTokenQuery('id', id, type)\n\t}\n\n\tpublic static byToken(token: string, type: PersonToken.Type): PersonTokenQuery {\n\t\tconst tokenHash = computeTokenHash(token)\n\t\treturn new PersonTokenQuery('token_hash', tokenHash, type)\n\t}\n\n\t/** Latest still-unused token of the given type for a person (e.g. the most recent email OTP code). */\n\tpublic static latestUnusedByPerson(personId: string, type: PersonToken.Type): PersonTokenQuery {\n\t\treturn new PersonTokenQuery('person_id', personId, type, true)\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonToken.Row | null> {\n\t\tlet qb = SelectBuilder.create<PersonToken.Row>()\n\t\t\t.from('person_token')\n\t\t\t.select(new Literal('*'))\n\t\t\t// Evaluate expiry on the DATABASE clock so the gate (validateToken's\n\t\t\t// `is_expired` check) cannot be weakened by app/DB clock skew. The\n\t\t\t// `expires_at` column itself is written on the DB clock too. See CLAUDE.md.\n\t\t\t.select(new Literal('\"expires_at\" <= now()'), 'is_expired')\n\t\t\t.where({\n\t\t\t\t[this.identifierType]: this.identifier,\n\t\t\t\ttype: this.type,\n\t\t\t})\n\t\tif (this.latestUnusedOnly) {\n\t\t\tqb = qb\n\t\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t\t.orderBy('created_at', 'desc')\n\t\t\t\t.limit(1)\n\t\t}\n\t\tconst result = await qb.getResult(db)\n\t\treturn this.fetchOneOrNull(result)\n\t}\n}\n"],"names":["DatabaseQuery","token","computeTokenHash","SelectBuilder","Literal"],"mappings":";;;;;AAIO,MAAM,yBAAyBA,SAAAA,cAAsC;AAAA,EACnE,YACU,gBACA,YACA,MACA,mBAA4B,OAC5C;AACD,UAAA;AALiB,SAAA,iBAAA;AACA,SAAA,aAAA;AACA,SAAA,OAAA;AACA,SAAA,mBAAA;AAAA,EAGlB;AAAA,EAEA,OAAc,KAAK,IAAY,MAA0C;AACxE,WAAO,IAAI,iBAAiB,MAAM,IAAI,IAAI;AAAA,EAC3C;AAAA,EAEA,OAAc,QAAQC,SAAe,MAA0C;AAC9E,UAAM,YAAYC,MAAAA,iBAAiBD,OAAK;AACxC,WAAO,IAAI,iBAAiB,cAAc,WAAW,IAAI;AAAA,EAC1D;AAAA;AAAA,EAGA,OAAc,qBAAqB,UAAkB,MAA0C;AAC9F,WAAO,IAAI,iBAAiB,aAAa,UAAU,MAAM,IAAI;AAAA,EAC9D;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0D;AACvE,QAAI,KAAKE,SAAAA,cAAc,OAAA,EACrB,KAAK,cAAc,EACnB,OAAO,IAAIC,SAAAA,QAAQ,GAAG,CAAC,EAIvB,OAAO,IAAIA,SAAAA,QAAQ,uBAAuB,GAAG,YAAY,EACzD,MAAM;AAAA,MACN,CAAC,KAAK,cAAc,GAAG,KAAK;AAAA,MAC5B,MAAM,KAAK;AAAA,IAAA,CACX;AACF,QAAI,KAAK,kBAAkB;AAC1B,WAAK,GACH,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,QAAQ,cAAc,MAAM,EAC5B,MAAM,CAAC;AAAA,IACV;AACA,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,WAAO,KAAK,eAAe,MAAM;AAAA,EAClC;AACD;;"}

package/dist/development/src/model/queries/personToken/PersonTokenQuery.js

@@ -21,7 +21,7 @@ class PersonTokenQuery extends DatabaseQuery {
     return new PersonTokenQuery("person_id", personId, type, true);
   }
   async fetch({ db }) {
-    let qb = SelectBuilder.create().from("person_token").select(new Literal("*")).where({
+    let qb = SelectBuilder.create().from("person_token").select(new Literal("*")).select(new Literal('"expires_at" <= now()'), "is_expired").where({
       [this.identifierType]: this.identifier,
       type: this.type
     });

package/dist/development/src/model/queries/personToken/PersonTokenQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonTokenQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/personToken/PersonTokenQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { PersonToken } from '../../type/index.js'\nimport { computeTokenHash } from '../../utils/index.js'\n\nexport class PersonTokenQuery extends DatabaseQuery<PersonToken.Row | null> {\n\tprivate constructor(\n\t\tprivate readonly identifierType: 'id' | 'token_hash' | 'person_id',\n\t\tprivate readonly identifier: string,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly latestUnusedOnly: boolean = false,\n\t) {\n\t\tsuper()\n\t}\n\n\tpublic static byId(id: string, type: PersonToken.Type): PersonTokenQuery {\n\t\treturn new PersonTokenQuery('id', id, type)\n\t}\n\n\tpublic static byToken(token: string, type: PersonToken.Type): PersonTokenQuery {\n\t\tconst tokenHash = computeTokenHash(token)\n\t\treturn new PersonTokenQuery('token_hash', tokenHash, type)\n\t}\n\n\t/** Latest still-unused token of the given type for a person (e.g. the most recent email OTP code). */\n\tpublic static latestUnusedByPerson(personId: string, type: PersonToken.Type): PersonTokenQuery {\n\t\treturn new PersonTokenQuery('person_id', personId, type, true)\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonToken.Row | null> {\n\t\tlet qb = SelectBuilder.create<PersonToken.Row>()\n\t\t\t.from('person_token')\n\t\t\t.select(new Literal('*'))\n\t\t\t.where({\n\t\t\t\t[this.identifierType]: this.identifier,\n\t\t\t\ttype: this.type,\n\t\t\t})\n\t\tif (this.latestUnusedOnly) {\n\t\t\tqb = qb\n\t\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t\t.orderBy('created_at', 'desc')\n\t\t\t\t.limit(1)\n\t\t}\n\t\tconst result = await qb.getResult(db)\n\t\treturn this.fetchOneOrNull(result)\n\t}\n}\n"],"names":[],"mappings":";;;AAIO,MAAM,yBAAyB,cAAsC;AAAA,EACnE,YACU,gBACA,YACA,MACA,mBAA4B,OAC5C;AACD,UAAA;AALiB,SAAA,iBAAA;AACA,SAAA,aAAA;AACA,SAAA,OAAA;AACA,SAAA,mBAAA;AAAA,EAGlB;AAAA,EAEA,OAAc,KAAK,IAAY,MAA0C;AACxE,WAAO,IAAI,iBAAiB,MAAM,IAAI,IAAI;AAAA,EAC3C;AAAA,EAEA,OAAc,QAAQ,OAAe,MAA0C;AAC9E,UAAM,YAAY,iBAAiB,KAAK;AACxC,WAAO,IAAI,iBAAiB,cAAc,WAAW,IAAI;AAAA,EAC1D;AAAA;AAAA,EAGA,OAAc,qBAAqB,UAAkB,MAA0C;AAC9F,WAAO,IAAI,iBAAiB,aAAa,UAAU,MAAM,IAAI;AAAA,EAC9D;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0D;AACvE,QAAI,KAAK,cAAc,OAAA,EACrB,KAAK,cAAc,EACnB,OAAO,IAAI,QAAQ,GAAG,CAAC,EACvB,MAAM;AAAA,MACN,CAAC,KAAK,cAAc,GAAG,KAAK;AAAA,MAC5B,MAAM,KAAK;AAAA,IAAA,CACX;AACF,QAAI,KAAK,kBAAkB;AAC1B,WAAK,GACH,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,QAAQ,cAAc,MAAM,EAC5B,MAAM,CAAC;AAAA,IACV;AACA,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,WAAO,KAAK,eAAe,MAAM;AAAA,EAClC;AACD;"}
+{"version":3,"file":"PersonTokenQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/personToken/PersonTokenQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { PersonToken } from '../../type/index.js'\nimport { computeTokenHash } from '../../utils/index.js'\n\nexport class PersonTokenQuery extends DatabaseQuery<PersonToken.Row | null> {\n\tprivate constructor(\n\t\tprivate readonly identifierType: 'id' | 'token_hash' | 'person_id',\n\t\tprivate readonly identifier: string,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly latestUnusedOnly: boolean = false,\n\t) {\n\t\tsuper()\n\t}\n\n\tpublic static byId(id: string, type: PersonToken.Type): PersonTokenQuery {\n\t\treturn new PersonTokenQuery('id', id, type)\n\t}\n\n\tpublic static byToken(token: string, type: PersonToken.Type): PersonTokenQuery {\n\t\tconst tokenHash = computeTokenHash(token)\n\t\treturn new PersonTokenQuery('token_hash', tokenHash, type)\n\t}\n\n\t/** Latest still-unused token of the given type for a person (e.g. the most recent email OTP code). */\n\tpublic static latestUnusedByPerson(personId: string, type: PersonToken.Type): PersonTokenQuery {\n\t\treturn new PersonTokenQuery('person_id', personId, type, true)\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonToken.Row | null> {\n\t\tlet qb = SelectBuilder.create<PersonToken.Row>()\n\t\t\t.from('person_token')\n\t\t\t.select(new Literal('*'))\n\t\t\t// Evaluate expiry on the DATABASE clock so the gate (validateToken's\n\t\t\t// `is_expired` check) cannot be weakened by app/DB clock skew. The\n\t\t\t// `expires_at` column itself is written on the DB clock too. See CLAUDE.md.\n\t\t\t.select(new Literal('\"expires_at\" <= now()'), 'is_expired')\n\t\t\t.where({\n\t\t\t\t[this.identifierType]: this.identifier,\n\t\t\t\ttype: this.type,\n\t\t\t})\n\t\tif (this.latestUnusedOnly) {\n\t\t\tqb = qb\n\t\t\t\t.where(expr => expr.isNull('used_at'))\n\t\t\t\t.orderBy('created_at', 'desc')\n\t\t\t\t.limit(1)\n\t\t}\n\t\tconst result = await qb.getResult(db)\n\t\treturn this.fetchOneOrNull(result)\n\t}\n}\n"],"names":[],"mappings":";;;AAIO,MAAM,yBAAyB,cAAsC;AAAA,EACnE,YACU,gBACA,YACA,MACA,mBAA4B,OAC5C;AACD,UAAA;AALiB,SAAA,iBAAA;AACA,SAAA,aAAA;AACA,SAAA,OAAA;AACA,SAAA,mBAAA;AAAA,EAGlB;AAAA,EAEA,OAAc,KAAK,IAAY,MAA0C;AACxE,WAAO,IAAI,iBAAiB,MAAM,IAAI,IAAI;AAAA,EAC3C;AAAA,EAEA,OAAc,QAAQ,OAAe,MAA0C;AAC9E,UAAM,YAAY,iBAAiB,KAAK;AACxC,WAAO,IAAI,iBAAiB,cAAc,WAAW,IAAI;AAAA,EAC1D;AAAA;AAAA,EAGA,OAAc,qBAAqB,UAAkB,MAA0C;AAC9F,WAAO,IAAI,iBAAiB,aAAa,UAAU,MAAM,IAAI;AAAA,EAC9D;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0D;AACvE,QAAI,KAAK,cAAc,OAAA,EACrB,KAAK,cAAc,EACnB,OAAO,IAAI,QAAQ,GAAG,CAAC,EAIvB,OAAO,IAAI,QAAQ,uBAAuB,GAAG,YAAY,EACzD,MAAM;AAAA,MACN,CAAC,KAAK,cAAc,GAAG,KAAK;AAAA,MAC5B,MAAM,KAAK;AAAA,IAAA,CACX;AACF,QAAI,KAAK,kBAAkB;AAC1B,WAAK,GACH,MAAM,CAAA,SAAQ,KAAK,OAAO,SAAS,CAAC,EACpC,QAAQ,cAAc,MAAM,EAC5B,MAAM,CAAC;AAAA,IACV;AACA,UAAM,SAAS,MAAM,GAAG,UAAU,EAAE;AACpC,WAAO,KAAK,eAAe,MAAM;AAAA,EAClC;AACD;"}

package/dist/development/src/model/queries/project/ProjectsByIdentityQuery.cjs

@@ -4,8 +4,11 @@ const Database = require("@contember/database");
 const ProjectsQuery = require("./ProjectsQuery.cjs");
 const PermissionActions = require("../../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../apiKey/ApiKeyQuery.cjs");
+require("../../type/ApiKey.cjs");
+require("../../authorization/CustomRolePermissions.cjs");
 require("../../authorization/PermissionContext.cjs");
-require("../../authorization/PermissionsFactory.cjs");
+require("../../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 class ProjectsByIdentityQuery extends Database.DatabaseQuery {
   constructor(identityId, permissionContext) {

package/dist/development/src/model/queries/project/ProjectsByIdentityQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectsByIdentityQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsByIdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { ProjectsQuery } from './ProjectsQuery.js'\nimport { PermissionActions, PermissionContext } from '../../authorization/index.js'\nimport { Project } from '../../type/index.js'\n\nexport class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {\n\tconstructor(private readonly identityId: string, private readonly permissionContext: PermissionContext) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<Project[]> {\n\t\tconst canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({\n\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t})\n\n\t\tif (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {\n\t\t\treturn await new ProjectsQuery().fetch(queryable)\n\t\t}\n\n\t\tconst qb = SelectBuilder.create<Project>()\n\t\t\t.select(['project', 'id'])\n\t\t\t.select(['project', 'name'])\n\t\t\t.select(['project', 'slug'])\n\t\t\t.select(['project', 'config'])\n\t\t\t.from('project')\n\t\t\t.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create() //\n\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t.select('project_id')\n\t\t\t\t\t\t.where({\n\t\t\t\t\t\t\tidentity_id: this.identityId,\n\t\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\tconst qbWithIdentityPermissions = canAuthorizedEntityViewAll\n\t\t\t? qb\n\t\t\t: qb.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create().from('project_membership').select('project_id').where({\n\t\t\t\t\t\tidentity_id: this.permissionContext.identity.id,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\treturn await qbWithIdentityPermissions.getResult(queryable.db)\n\t}\n}\n"],"names":["DatabaseQuery","PermissionActions","ProjectsQuery","SelectBuilder"],"mappings":";;;;;;;;;AAKO,MAAM,gCAAgCA,SAAAA,cAAyB;AAAA,EACrE,YAA6B,YAAqC,mBAAsC;AACvG,UAAA;AAD4B,SAAA,aAAA;AAAqC,SAAA,oBAAA;AAAA,EAElE;AAAA,EAEA,MAAM,MAAM,WAAkD;AAC7D,UAAM,6BAA6B,MAAM,KAAK,kBAAkB,UAAU;AAAA,MACzE,QAAQC,kBAAAA,kBAAkB;AAAA,IAAA,CAC1B;AAED,QAAI,KAAK,eAAe,KAAK,kBAAkB,SAAS,MAAM,4BAA4B;AACzF,aAAO,MAAM,IAAIC,cAAAA,gBAAgB,MAAM,SAAS;AAAA,IACjD;AAEA,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,QAAQ,CAAC,EAC5B,KAAK,SAAS,EACd;AAAA,MAAM,WACN,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChBA,uBAAc,SACZ,KAAK,oBAAoB,EACzB,OAAO,YAAY,EACnB,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MAAA;AAAA,IACH;AAGF,UAAM,4BAA4B,6BAC/B,KACA,GAAG;AAAA,MAAM,WACV,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChBA,uBAAc,SAAS,KAAK,oBAAoB,EAAE,OAAO,YAAY,EAAE,MAAM;AAAA,UAC5E,aAAa,KAAK,kBAAkB,SAAS;AAAA,QAAA,CAC7C;AAAA,MAAA;AAAA,IACF;AAGF,WAAO,MAAM,0BAA0B,UAAU,UAAU,EAAE;AAAA,EAC9D;AACD;;"}
+{"version":3,"file":"ProjectsByIdentityQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsByIdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { ProjectsQuery } from './ProjectsQuery.js'\nimport { PermissionActions, PermissionContext } from '../../authorization/index.js'\nimport { Project } from '../../type/index.js'\n\nexport class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {\n\tconstructor(private readonly identityId: string, private readonly permissionContext: PermissionContext) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<Project[]> {\n\t\tconst canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({\n\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t})\n\n\t\tif (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {\n\t\t\treturn await new ProjectsQuery().fetch(queryable)\n\t\t}\n\n\t\tconst qb = SelectBuilder.create<Project>()\n\t\t\t.select(['project', 'id'])\n\t\t\t.select(['project', 'name'])\n\t\t\t.select(['project', 'slug'])\n\t\t\t.select(['project', 'config'])\n\t\t\t.from('project')\n\t\t\t.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create() //\n\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t.select('project_id')\n\t\t\t\t\t\t.where({\n\t\t\t\t\t\t\tidentity_id: this.identityId,\n\t\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\tconst qbWithIdentityPermissions = canAuthorizedEntityViewAll\n\t\t\t? qb\n\t\t\t: qb.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create().from('project_membership').select('project_id').where({\n\t\t\t\t\t\tidentity_id: this.permissionContext.identity.id,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\treturn await qbWithIdentityPermissions.getResult(queryable.db)\n\t}\n}\n"],"names":["DatabaseQuery","PermissionActions","ProjectsQuery","SelectBuilder"],"mappings":";;;;;;;;;;;;AAKO,MAAM,gCAAgCA,SAAAA,cAAyB;AAAA,EACrE,YAA6B,YAAqC,mBAAsC;AACvG,UAAA;AAD4B,SAAA,aAAA;AAAqC,SAAA,oBAAA;AAAA,EAElE;AAAA,EAEA,MAAM,MAAM,WAAkD;AAC7D,UAAM,6BAA6B,MAAM,KAAK,kBAAkB,UAAU;AAAA,MACzE,QAAQC,kBAAAA,kBAAkB;AAAA,IAAA,CAC1B;AAED,QAAI,KAAK,eAAe,KAAK,kBAAkB,SAAS,MAAM,4BAA4B;AACzF,aAAO,MAAM,IAAIC,cAAAA,gBAAgB,MAAM,SAAS;AAAA,IACjD;AAEA,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,QAAQ,CAAC,EAC5B,KAAK,SAAS,EACd;AAAA,MAAM,WACN,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChBA,uBAAc,SACZ,KAAK,oBAAoB,EACzB,OAAO,YAAY,EACnB,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MAAA;AAAA,IACH;AAGF,UAAM,4BAA4B,6BAC/B,KACA,GAAG;AAAA,MAAM,WACV,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChBA,uBAAc,SAAS,KAAK,oBAAoB,EAAE,OAAO,YAAY,EAAE,MAAM;AAAA,UAC5E,aAAa,KAAK,kBAAkB,SAAS;AAAA,QAAA,CAC7C;AAAA,MAAA;AAAA,IACF;AAGF,WAAO,MAAM,0BAA0B,UAAU,UAAU,EAAE;AAAA,EAC9D;AACD;;"}

package/dist/development/src/model/queries/project/ProjectsByIdentityQuery.js

@@ -2,8 +2,11 @@ import { DatabaseQuery, SelectBuilder } from "@contember/database";
 import { ProjectsQuery } from "./ProjectsQuery.js";
 import { PermissionActions } from "../../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../apiKey/ApiKeyQuery.js";
+import "../../type/ApiKey.js";
+import "../../authorization/CustomRolePermissions.js";
 import "../../authorization/PermissionContext.js";
-import "../../authorization/PermissionsFactory.js";
+import "../../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 class ProjectsByIdentityQuery extends DatabaseQuery {
   constructor(identityId, permissionContext) {

package/dist/development/src/model/queries/project/ProjectsByIdentityQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectsByIdentityQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsByIdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { ProjectsQuery } from './ProjectsQuery.js'\nimport { PermissionActions, PermissionContext } from '../../authorization/index.js'\nimport { Project } from '../../type/index.js'\n\nexport class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {\n\tconstructor(private readonly identityId: string, private readonly permissionContext: PermissionContext) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<Project[]> {\n\t\tconst canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({\n\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t})\n\n\t\tif (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {\n\t\t\treturn await new ProjectsQuery().fetch(queryable)\n\t\t}\n\n\t\tconst qb = SelectBuilder.create<Project>()\n\t\t\t.select(['project', 'id'])\n\t\t\t.select(['project', 'name'])\n\t\t\t.select(['project', 'slug'])\n\t\t\t.select(['project', 'config'])\n\t\t\t.from('project')\n\t\t\t.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create() //\n\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t.select('project_id')\n\t\t\t\t\t\t.where({\n\t\t\t\t\t\t\tidentity_id: this.identityId,\n\t\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\tconst qbWithIdentityPermissions = canAuthorizedEntityViewAll\n\t\t\t? qb\n\t\t\t: qb.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create().from('project_membership').select('project_id').where({\n\t\t\t\t\t\tidentity_id: this.permissionContext.identity.id,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\treturn await qbWithIdentityPermissions.getResult(queryable.db)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;AAKO,MAAM,gCAAgC,cAAyB;AAAA,EACrE,YAA6B,YAAqC,mBAAsC;AACvG,UAAA;AAD4B,SAAA,aAAA;AAAqC,SAAA,oBAAA;AAAA,EAElE;AAAA,EAEA,MAAM,MAAM,WAAkD;AAC7D,UAAM,6BAA6B,MAAM,KAAK,kBAAkB,UAAU;AAAA,MACzE,QAAQ,kBAAkB;AAAA,IAAA,CAC1B;AAED,QAAI,KAAK,eAAe,KAAK,kBAAkB,SAAS,MAAM,4BAA4B;AACzF,aAAO,MAAM,IAAI,gBAAgB,MAAM,SAAS;AAAA,IACjD;AAEA,UAAM,KAAK,cAAc,OAAA,EACvB,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,QAAQ,CAAC,EAC5B,KAAK,SAAS,EACd;AAAA,MAAM,WACN,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChB,cAAc,SACZ,KAAK,oBAAoB,EACzB,OAAO,YAAY,EACnB,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MAAA;AAAA,IACH;AAGF,UAAM,4BAA4B,6BAC/B,KACA,GAAG;AAAA,MAAM,WACV,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChB,cAAc,SAAS,KAAK,oBAAoB,EAAE,OAAO,YAAY,EAAE,MAAM;AAAA,UAC5E,aAAa,KAAK,kBAAkB,SAAS;AAAA,QAAA,CAC7C;AAAA,MAAA;AAAA,IACF;AAGF,WAAO,MAAM,0BAA0B,UAAU,UAAU,EAAE;AAAA,EAC9D;AACD;"}
+{"version":3,"file":"ProjectsByIdentityQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/project/ProjectsByIdentityQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { ProjectsQuery } from './ProjectsQuery.js'\nimport { PermissionActions, PermissionContext } from '../../authorization/index.js'\nimport { Project } from '../../type/index.js'\n\nexport class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {\n\tconstructor(private readonly identityId: string, private readonly permissionContext: PermissionContext) {\n\t\tsuper()\n\t}\n\n\tasync fetch(queryable: DatabaseQueryable): Promise<Project[]> {\n\t\tconst canAuthorizedEntityViewAll = await this.permissionContext.isAllowed({\n\t\t\taction: PermissionActions.PROJECT_VIEW,\n\t\t})\n\n\t\tif (this.identityId === this.permissionContext.identity.id && canAuthorizedEntityViewAll) {\n\t\t\treturn await new ProjectsQuery().fetch(queryable)\n\t\t}\n\n\t\tconst qb = SelectBuilder.create<Project>()\n\t\t\t.select(['project', 'id'])\n\t\t\t.select(['project', 'name'])\n\t\t\t.select(['project', 'slug'])\n\t\t\t.select(['project', 'config'])\n\t\t\t.from('project')\n\t\t\t.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create() //\n\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t.select('project_id')\n\t\t\t\t\t\t.where({\n\t\t\t\t\t\t\tidentity_id: this.identityId,\n\t\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\tconst qbWithIdentityPermissions = canAuthorizedEntityViewAll\n\t\t\t? qb\n\t\t\t: qb.where(where =>\n\t\t\t\twhere.in(\n\t\t\t\t\t['project', 'id'],\n\t\t\t\t\tSelectBuilder.create().from('project_membership').select('project_id').where({\n\t\t\t\t\t\tidentity_id: this.permissionContext.identity.id,\n\t\t\t\t\t}),\n\t\t\t\t)\n\t\t\t)\n\n\t\treturn await qbWithIdentityPermissions.getResult(queryable.db)\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;AAKO,MAAM,gCAAgC,cAAyB;AAAA,EACrE,YAA6B,YAAqC,mBAAsC;AACvG,UAAA;AAD4B,SAAA,aAAA;AAAqC,SAAA,oBAAA;AAAA,EAElE;AAAA,EAEA,MAAM,MAAM,WAAkD;AAC7D,UAAM,6BAA6B,MAAM,KAAK,kBAAkB,UAAU;AAAA,MACzE,QAAQ,kBAAkB;AAAA,IAAA,CAC1B;AAED,QAAI,KAAK,eAAe,KAAK,kBAAkB,SAAS,MAAM,4BAA4B;AACzF,aAAO,MAAM,IAAI,gBAAgB,MAAM,SAAS;AAAA,IACjD;AAEA,UAAM,KAAK,cAAc,OAAA,EACvB,OAAO,CAAC,WAAW,IAAI,CAAC,EACxB,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,MAAM,CAAC,EAC1B,OAAO,CAAC,WAAW,QAAQ,CAAC,EAC5B,KAAK,SAAS,EACd;AAAA,MAAM,WACN,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChB,cAAc,SACZ,KAAK,oBAAoB,EACzB,OAAO,YAAY,EACnB,MAAM;AAAA,UACN,aAAa,KAAK;AAAA,QAAA,CAClB;AAAA,MAAA;AAAA,IACH;AAGF,UAAM,4BAA4B,6BAC/B,KACA,GAAG;AAAA,MAAM,WACV,MAAM;AAAA,QACL,CAAC,WAAW,IAAI;AAAA,QAChB,cAAc,SAAS,KAAK,oBAAoB,EAAE,OAAO,YAAY,EAAE,MAAM;AAAA,UAC5E,aAAa,KAAK,kBAAkB,SAAS;AAAA,QAAA,CAC7C;AAAA,MAAA;AAAA,IACF;AAGF,WAAO,MAAM,0BAA0B,UAAU,UAAU,EAAE;AAAA,EAC9D;AACD;"}

package/dist/development/src/model/queries/rateLimit/RateLimitCountQuery.cjs

@@ -2,14 +2,14 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
 class RateLimitCountQuery extends Database.DatabaseQuery {
-  constructor(scope, keyHash, windowStart) {
+  constructor(scope, keyHash, windowSeconds) {
     super();
     this.scope = scope;
     this.keyHash = keyHash;
-    this.windowStart = windowStart;
+    this.windowSeconds = windowSeconds;
   }
   async fetch({ db }) {
-    const rows = await Database.SelectBuilder.create().from("rate_limit_event").select(new Database.Literal("count(*)::text as count")).where({ scope: this.scope, key_hash: this.keyHash }).where((expr) => expr.compare("occurred_at", ">=", this.windowStart)).getResult(db);
+    const rows = await Database.SelectBuilder.create().from("rate_limit_event").select(new Database.Literal("count(*)::text as count")).where({ scope: this.scope, key_hash: this.keyHash }).where(new Database.Literal("occurred_at >= NOW() - make_interval(secs => ?)", [this.windowSeconds])).getResult(db);
     return Number(rows[0]?.count ?? "0");
   }
 }

package/dist/development/src/model/queries/rateLimit/RateLimitCountQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"RateLimitCountQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/rateLimit/RateLimitCountQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RateLimitCountQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t\tprivate readonly windowStart: Date,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\tconst rows = await SelectBuilder.create<{ count: string }>()\n\t\t\t.from('rate_limit_event')\n\t\t\t.select(new Literal('count(*)::text as count'))\n\t\t\t.where({ scope: this.scope, key_hash: this.keyHash })\n\t\t\t.where(expr => expr.compare('occurred_at', '>=', this.windowStart))\n\t\t\t.getResult(db)\n\t\treturn Number(rows[0]?.count ?? '0')\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal"],"mappings":";;;AAGO,MAAM,4BAA4BA,SAAAA,cAAsB;AAAA,EAC9D,YACkB,OACA,SACA,aAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,UAAA;AACA,SAAA,cAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,KAAK,kBAAkB,EACvB,OAAO,IAAIC,SAAAA,QAAQ,yBAAyB,CAAC,EAC7C,MAAM,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,QAAA,CAAS,EACnD,MAAM,CAAA,SAAQ,KAAK,QAAQ,eAAe,MAAM,KAAK,WAAW,CAAC,EACjE,UAAU,EAAE;AACd,WAAO,OAAO,KAAK,CAAC,GAAG,SAAS,GAAG;AAAA,EACpC;AACD;;"}
+{"version":3,"file":"RateLimitCountQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/rateLimit/RateLimitCountQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RateLimitCountQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t\tprivate readonly windowSeconds: number,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\t// The window start is computed against the database clock (NOW()), not the\n\t\t// application clock, so the limiter cannot be weakened by app/DB clock skew\n\t\t// or by clock divergence between engine instances. See NextLoginAttemptQuery.\n\t\tconst rows = await SelectBuilder.create<{ count: string }>()\n\t\t\t.from('rate_limit_event')\n\t\t\t.select(new Literal('count(*)::text as count'))\n\t\t\t.where({ scope: this.scope, key_hash: this.keyHash })\n\t\t\t.where(new Literal('occurred_at >= NOW() - make_interval(secs => ?)', [this.windowSeconds]))\n\t\t\t.getResult(db)\n\t\treturn Number(rows[0]?.count ?? '0')\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal"],"mappings":";;;AAGO,MAAM,4BAA4BA,SAAAA,cAAsB;AAAA,EAC9D,YACkB,OACA,SACA,eAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,UAAA;AACA,SAAA,gBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AAIvD,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,KAAK,kBAAkB,EACvB,OAAO,IAAIC,SAAAA,QAAQ,yBAAyB,CAAC,EAC7C,MAAM,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,QAAA,CAAS,EACnD,MAAM,IAAIA,SAAAA,QAAQ,mDAAmD,CAAC,KAAK,aAAa,CAAC,CAAC,EAC1F,UAAU,EAAE;AACd,WAAO,OAAO,KAAK,CAAC,GAAG,SAAS,GAAG;AAAA,EACpC;AACD;;"}

package/dist/development/src/model/queries/rateLimit/RateLimitCountQuery.js

@@ -1,13 +1,13 @@
 import { DatabaseQuery, SelectBuilder, Literal } from "@contember/database";
 class RateLimitCountQuery extends DatabaseQuery {
-  constructor(scope, keyHash, windowStart) {
+  constructor(scope, keyHash, windowSeconds) {
     super();
     this.scope = scope;
     this.keyHash = keyHash;
-    this.windowStart = windowStart;
+    this.windowSeconds = windowSeconds;
   }
   async fetch({ db }) {
-    const rows = await SelectBuilder.create().from("rate_limit_event").select(new Literal("count(*)::text as count")).where({ scope: this.scope, key_hash: this.keyHash }).where((expr) => expr.compare("occurred_at", ">=", this.windowStart)).getResult(db);
+    const rows = await SelectBuilder.create().from("rate_limit_event").select(new Literal("count(*)::text as count")).where({ scope: this.scope, key_hash: this.keyHash }).where(new Literal("occurred_at >= NOW() - make_interval(secs => ?)", [this.windowSeconds])).getResult(db);
     return Number(rows[0]?.count ?? "0");
   }
 }

package/dist/development/src/model/queries/rateLimit/RateLimitCountQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"RateLimitCountQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/rateLimit/RateLimitCountQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RateLimitCountQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t\tprivate readonly windowStart: Date,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\tconst rows = await SelectBuilder.create<{ count: string }>()\n\t\t\t.from('rate_limit_event')\n\t\t\t.select(new Literal('count(*)::text as count'))\n\t\t\t.where({ scope: this.scope, key_hash: this.keyHash })\n\t\t\t.where(expr => expr.compare('occurred_at', '>=', this.windowStart))\n\t\t\t.getResult(db)\n\t\treturn Number(rows[0]?.count ?? '0')\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,4BAA4B,cAAsB;AAAA,EAC9D,YACkB,OACA,SACA,aAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,UAAA;AACA,SAAA,cAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,KAAK,kBAAkB,EACvB,OAAO,IAAI,QAAQ,yBAAyB,CAAC,EAC7C,MAAM,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,QAAA,CAAS,EACnD,MAAM,CAAA,SAAQ,KAAK,QAAQ,eAAe,MAAM,KAAK,WAAW,CAAC,EACjE,UAAU,EAAE;AACd,WAAO,OAAO,KAAK,CAAC,GAAG,SAAS,GAAG;AAAA,EACpC;AACD;"}
+{"version":3,"file":"RateLimitCountQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/rateLimit/RateLimitCountQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RateLimitCountQuery extends DatabaseQuery<number> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t\tprivate readonly windowSeconds: number,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<number> {\n\t\t// The window start is computed against the database clock (NOW()), not the\n\t\t// application clock, so the limiter cannot be weakened by app/DB clock skew\n\t\t// or by clock divergence between engine instances. See NextLoginAttemptQuery.\n\t\tconst rows = await SelectBuilder.create<{ count: string }>()\n\t\t\t.from('rate_limit_event')\n\t\t\t.select(new Literal('count(*)::text as count'))\n\t\t\t.where({ scope: this.scope, key_hash: this.keyHash })\n\t\t\t.where(new Literal('occurred_at >= NOW() - make_interval(secs => ?)', [this.windowSeconds]))\n\t\t\t.getResult(db)\n\t\treturn Number(rows[0]?.count ?? '0')\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,4BAA4B,cAAsB;AAAA,EAC9D,YACkB,OACA,SACA,eAChB;AACD,UAAA;AAJiB,SAAA,QAAA;AACA,SAAA,UAAA;AACA,SAAA,gBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AAIvD,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,KAAK,kBAAkB,EACvB,OAAO,IAAI,QAAQ,yBAAyB,CAAC,EAC7C,MAAM,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,QAAA,CAAS,EACnD,MAAM,IAAI,QAAQ,mDAAmD,CAAC,KAAK,aAAa,CAAC,CAAC,EAC1F,UAAU,EAAE;AACd,WAAO,OAAO,KAAK,CAAC,GAAG,SAAS,GAAG;AAAA,EACpC;AACD;"}

package/dist/development/src/model/service/AuthLogService.cjs

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const CreateAuthLogEntryCommand = require("../commands/authLog/CreateAuthLogEntryCommand.cjs");
+const UnpersistedApiKeyManager = require("./apiKey/UnpersistedApiKeyManager.cjs");
+const invokedBy = (identityId) => UnpersistedApiKeyManager.isUnpersistedIdentityId(identityId) ? { metadata: { invokedByUnpersistedIdentityId: identityId } } : { invokedById: identityId };
 class AuthLogService {
   async logAuthAction(db, ctx, data) {
     const dataContainer = data.response.ok ? data.response.result ?? {} : data.response.metadata ?? {};
@@ -13,12 +15,14 @@ class AuthLogService {
     if (ctx.forwarderUserAgent !== void 0) {
       metadata.forwarderUserAgent = ctx.forwarderUserAgent;
     }
+    const invoker = invokedBy(ctx.identityId);
+    Object.assign(metadata, invoker.metadata);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
         success: data.response.ok,
         personInputIdentifier: data.personInput ?? authData?.data?.personInput,
         personId: data.personId ?? authData?.data?.personId,
-        invokedById: ctx.identityId,
+        invokedById: invoker.invokedById,
         type: data.type,
         identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
         errorCode: data.response.ok ? null : data.response.error,
@@ -40,10 +44,12 @@ class AuthLogService {
    * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
    */
   async logSessionEvent(db, entry) {
+    const invoker = invokedBy(entry.identityId);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
         type: entry.type,
-        invokedById: entry.identityId,
+        invokedById: invoker.invokedById,
+        metadata: invoker.metadata,
         personId: entry.personId ?? void 0,
         success: entry.success,
         ipAddress: entry.ipAddress,

package/dist/development/src/model/service/AuthLogService.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: ctx.identityId,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: entry.identityId,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["CreateAuthLogEntryCommand","AuthLogService"],"mappings":";;;AAMA,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AAEA,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,IAAI;AAAA,QACjB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUC,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;;"}
+{"version":3,"file":"AuthLogService.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\nimport { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'\n\n/**\n * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a\n * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort\n * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is\n * still recorded, just not as a reference.\n */\nconst invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>\n\tisUnpersistedIdentityId(identityId)\n\t\t? { metadata: { invokedByUnpersistedIdentityId: identityId } }\n\t\t: { invokedById: identityId }\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\t\tconst invoker = invokedBy(ctx.identityId)\n\t\tObject.assign(metadata, invoker.metadata)\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tconst invoker = invokedBy(entry.identityId)\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\tmetadata: invoker.metadata,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["isUnpersistedIdentityId","CreateAuthLogEntryCommand","AuthLogService"],"mappings":";;;;AAaA,MAAM,YAAY,CAAC,eAClBA,iDAAwB,UAAU,IAC/B,EAAE,UAAU,EAAE,gCAAgC,WAAA,EAAW,IACzD,EAAE,aAAa,WAAA;AAEnB,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AACA,UAAM,UAAU,UAAU,IAAI,UAAU;AACxC,WAAO,OAAO,UAAU,QAAQ,QAAQ;AAExC,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIC,oDAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,QAAQ;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,UAAU,UAAU,MAAM,UAAU;AAC1C,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,UAAU,QAAQ;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUC,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;;"}

package/dist/development/src/model/service/AuthLogService.js

@@ -1,4 +1,6 @@
 import { CreateAuthLogEntryCommand } from "../commands/authLog/CreateAuthLogEntryCommand.js";
+import { isUnpersistedIdentityId } from "./apiKey/UnpersistedApiKeyManager.js";
+const invokedBy = (identityId) => isUnpersistedIdentityId(identityId) ? { metadata: { invokedByUnpersistedIdentityId: identityId } } : { invokedById: identityId };
 class AuthLogService {
   async logAuthAction(db, ctx, data) {
     const dataContainer = data.response.ok ? data.response.result ?? {} : data.response.metadata ?? {};
@@ -11,12 +13,14 @@ class AuthLogService {
     if (ctx.forwarderUserAgent !== void 0) {
       metadata.forwarderUserAgent = ctx.forwarderUserAgent;
     }
+    const invoker = invokedBy(ctx.identityId);
+    Object.assign(metadata, invoker.metadata);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand({
         success: data.response.ok,
         personInputIdentifier: data.personInput ?? authData?.data?.personInput,
         personId: data.personId ?? authData?.data?.personId,
-        invokedById: ctx.identityId,
+        invokedById: invoker.invokedById,
         type: data.type,
         identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
         errorCode: data.response.ok ? null : data.response.error,
@@ -38,10 +42,12 @@ class AuthLogService {
    * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
    */
   async logSessionEvent(db, entry) {
+    const invoker = invokedBy(entry.identityId);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand({
         type: entry.type,
-        invokedById: entry.identityId,
+        invokedById: invoker.invokedById,
+        metadata: invoker.metadata,
         personId: entry.personId ?? void 0,
         success: entry.success,
         ipAddress: entry.ipAddress,

package/dist/development/src/model/service/AuthLogService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: ctx.identityId,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: entry.identityId,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["AuthLogService"],"mappings":";AAMA,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AAEA,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,IAAI;AAAA,QACjB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUA,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;"}
+{"version":3,"file":"AuthLogService.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\nimport { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'\n\n/**\n * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a\n * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort\n * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is\n * still recorded, just not as a reference.\n */\nconst invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>\n\tisUnpersistedIdentityId(identityId)\n\t\t? { metadata: { invokedByUnpersistedIdentityId: identityId } }\n\t\t: { invokedById: identityId }\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\t\tconst invoker = invokedBy(ctx.identityId)\n\t\tObject.assign(metadata, invoker.metadata)\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tconst invoker = invokedBy(entry.identityId)\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\tmetadata: invoker.metadata,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["AuthLogService"],"mappings":";;AAaA,MAAM,YAAY,CAAC,eAClB,wBAAwB,UAAU,IAC/B,EAAE,UAAU,EAAE,gCAAgC,WAAA,EAAW,IACzD,EAAE,aAAa,WAAA;AAEnB,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AACA,UAAM,UAAU,UAAU,IAAI,UAAU;AACxC,WAAO,OAAO,UAAU,QAAQ,QAAQ;AAExC,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,QAAQ;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,UAAU,UAAU,MAAM,UAAU;AAC1C,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,UAAU,QAAQ;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUA,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;"}

package/dist/development/src/model/service/AuthPolicyManager.cjs

@@ -7,8 +7,9 @@ require("../type/ApiKey.cjs");
 const AuthPoliciesQuery = require("../queries/authPolicy/AuthPoliciesQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 require("node:crypto");
 const CreateAuthPolicyCommand = require("../commands/authPolicy/CreateAuthPolicyCommand.cjs");

package/dist/development/src/model/service/AuthPolicyManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { AuthPoliciesQuery } from '../queries/index.js'\nimport { CreateAuthPolicyCommand, DeleteAuthPolicyCommand, UpdateAuthPolicyCommand } from '../commands/index.js'\nimport { AuthPolicyRow, AuthPolicyScope } from '../type/index.js'\nimport { CreateAuthPolicyErrorCode, DeleteAuthPolicyErrorCode, UpdateAuthPolicyErrorCode } from '../../schema/index.js'\n\nexport type AuthPolicyInputValues = {\n\tscope: AuthPolicyScope\n\t/** Project slug; resolved to project_id. Required for scope='project', forbidden for scope='global'. */\n\tproject?: string | null\n\troles: string[]\n\tmfaRequired?: boolean | null\n\ttokenExpiration?: string | null\n\tidleTimeout?: string | null\n\tgraceDuration?: string | null\n\trememberMeAllowed?: boolean | null\n}\n\n/**\n * CRUD over the `auth_policy` table (shared infra reused by A19). Project is\n * always addressed by slug in the API and resolved to project_id here.\n */\nexport class AuthPolicyManager {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync listPolicies(db: DatabaseContext): Promise<AuthPolicyRow[]> {\n\t\treturn db.queryHandler.fetch(new AuthPoliciesQuery())\n\t}\n\n\tasync createPolicy(db: DatabaseContext, input: AuthPolicyInputValues): Promise<Response<{ id: string }, CreateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst id = await db.commandBus.execute(\n\t\t\tnew CreateAuthPolicyCommand({\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\treturn new ResponseOk({ id })\n\t}\n\n\tasync updatePolicy(db: DatabaseContext, id: string, input: AuthPolicyInputValues): Promise<Response<null, UpdateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst updated = await db.commandBus.execute(\n\t\t\tnew UpdateAuthPolicyCommand(id, {\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\tif (!updated) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync deletePolicy(db: DatabaseContext, id: string): Promise<Response<null, DeleteAuthPolicyErrorCode>> {\n\t\tconst deleted = await db.commandBus.execute(new DeleteAuthPolicyCommand(id))\n\t\tif (!deleted) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\t/**\n\t * Validates scope/project consistency and resolves a slug to project_id.\n\t * `scope='project'` requires a project (which must exist); `scope='global'`\n\t * forbids one.\n\t */\n\tprivate async resolveProjectId(\n\t\tdb: DatabaseContext,\n\t\tscope: AuthPolicyScope,\n\t\tprojectSlug: string | null,\n\t): Promise<\n\t\t{ ok: true; projectId: string | null } | {\n\t\t\tok: false\n\t\t\terror: 'PROJECT_REQUIRED' | 'PROJECT_NOT_ALLOWED' | 'PROJECT_NOT_FOUND'\n\t\t\terrorMessage: string\n\t\t}\n\t> {\n\t\tif (scope === 'global') {\n\t\t\tif (projectSlug !== null) {\n\t\t\t\treturn { ok: false, error: 'PROJECT_NOT_ALLOWED', errorMessage: 'A global auth policy must not reference a project' }\n\t\t\t}\n\t\t\treturn { ok: true, projectId: null }\n\t\t}\n\t\t// scope === 'project'\n\t\tif (projectSlug === null) {\n\t\t\treturn { ok: false, error: 'PROJECT_REQUIRED', errorMessage: 'A project-scoped auth policy requires a project' }\n\t\t}\n\t\tconst project = await this.projectManager.getProjectBySlug(db, projectSlug)\n\t\tif (!project) {\n\t\t\treturn { ok: false, error: 'PROJECT_NOT_FOUND', errorMessage: `Project ${projectSlug} not found` }\n\t\t}\n\t\treturn { ok: true, projectId: project.id }\n\t}\n}\n"],"names":["AuthPoliciesQuery","ResponseError","CreateAuthPolicyCommand","ResponseOk","UpdateAuthPolicyCommand","DeleteAuthPolicyCommand"],"mappings":";;;;;;;;;;;;;;;;AAwBO,MAAM,kBAAkB;AAAA,EAC9B,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,IAA+C;AACjE,WAAO,GAAG,aAAa,MAAM,IAAIA,kBAAAA,mBAAmB;AAAA,EACrD;AAAA,EAEA,MAAM,aAAa,IAAqB,OAA4F;AACnI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAIC,SAAAA,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,KAAK,MAAM,GAAG,WAAW;AAAA,MAC9B,IAAIC,gDAAwB;AAAA,QAC3B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,WAAO,IAAIC,SAAAA,WAAW,EAAE,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAY,OAAkF;AACrI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAIF,SAAAA,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,UAAU,MAAM,GAAG,WAAW;AAAA,MACnC,IAAIG,wBAAAA,wBAAwB,IAAI;AAAA,QAC/B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,QAAI,CAAC,SAAS;AACb,aAAO,IAAIH,SAAAA,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAIE,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAgE;AACvG,UAAM,UAAU,MAAM,GAAG,WAAW,QAAQ,IAAIE,wBAAAA,wBAAwB,EAAE,CAAC;AAC3E,QAAI,CAAC,SAAS;AACb,aAAO,IAAIJ,SAAAA,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAIE,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,iBACb,IACA,OACA,aAOC;AACD,QAAI,UAAU,UAAU;AACvB,UAAI,gBAAgB,MAAM;AACzB,eAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB,cAAc,oDAAA;AAAA,MACjE;AACA,aAAO,EAAE,IAAI,MAAM,WAAW,KAAA;AAAA,IAC/B;AAEA,QAAI,gBAAgB,MAAM;AACzB,aAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,cAAc,kDAAA;AAAA,IAC9D;AACA,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,IAAI,WAAW;AAC1E,QAAI,CAAC,SAAS;AACb,aAAO,EAAE,IAAI,OAAO,OAAO,qBAAqB,cAAc,WAAW,WAAW,aAAA;AAAA,IACrF;AACA,WAAO,EAAE,IAAI,MAAM,WAAW,QAAQ,GAAA;AAAA,EACvC;AACD;;"}
+{"version":3,"file":"AuthPolicyManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { AuthPoliciesQuery } from '../queries/index.js'\nimport { CreateAuthPolicyCommand, DeleteAuthPolicyCommand, UpdateAuthPolicyCommand } from '../commands/index.js'\nimport { AuthPolicyRow, AuthPolicyScope } from '../type/index.js'\nimport { CreateAuthPolicyErrorCode, DeleteAuthPolicyErrorCode, UpdateAuthPolicyErrorCode } from '../../schema/index.js'\n\nexport type AuthPolicyInputValues = {\n\tscope: AuthPolicyScope\n\t/** Project slug; resolved to project_id. Required for scope='project', forbidden for scope='global'. */\n\tproject?: string | null\n\troles: string[]\n\tmfaRequired?: boolean | null\n\ttokenExpiration?: string | null\n\tidleTimeout?: string | null\n\tgraceDuration?: string | null\n\trememberMeAllowed?: boolean | null\n}\n\n/**\n * CRUD over the `auth_policy` table (shared infra reused by A19). Project is\n * always addressed by slug in the API and resolved to project_id here.\n */\nexport class AuthPolicyManager {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync listPolicies(db: DatabaseContext): Promise<AuthPolicyRow[]> {\n\t\treturn db.queryHandler.fetch(new AuthPoliciesQuery())\n\t}\n\n\tasync createPolicy(db: DatabaseContext, input: AuthPolicyInputValues): Promise<Response<{ id: string }, CreateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst id = await db.commandBus.execute(\n\t\t\tnew CreateAuthPolicyCommand({\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\treturn new ResponseOk({ id })\n\t}\n\n\tasync updatePolicy(db: DatabaseContext, id: string, input: AuthPolicyInputValues): Promise<Response<null, UpdateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst updated = await db.commandBus.execute(\n\t\t\tnew UpdateAuthPolicyCommand(id, {\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\tif (!updated) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync deletePolicy(db: DatabaseContext, id: string): Promise<Response<null, DeleteAuthPolicyErrorCode>> {\n\t\tconst deleted = await db.commandBus.execute(new DeleteAuthPolicyCommand(id))\n\t\tif (!deleted) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\t/**\n\t * Validates scope/project consistency and resolves a slug to project_id.\n\t * `scope='project'` requires a project (which must exist); `scope='global'`\n\t * forbids one.\n\t */\n\tprivate async resolveProjectId(\n\t\tdb: DatabaseContext,\n\t\tscope: AuthPolicyScope,\n\t\tprojectSlug: string | null,\n\t): Promise<\n\t\t{ ok: true; projectId: string | null } | {\n\t\t\tok: false\n\t\t\terror: 'PROJECT_REQUIRED' | 'PROJECT_NOT_ALLOWED' | 'PROJECT_NOT_FOUND'\n\t\t\terrorMessage: string\n\t\t}\n\t> {\n\t\tif (scope === 'global') {\n\t\t\tif (projectSlug !== null) {\n\t\t\t\treturn { ok: false, error: 'PROJECT_NOT_ALLOWED', errorMessage: 'A global auth policy must not reference a project' }\n\t\t\t}\n\t\t\treturn { ok: true, projectId: null }\n\t\t}\n\t\t// scope === 'project'\n\t\tif (projectSlug === null) {\n\t\t\treturn { ok: false, error: 'PROJECT_REQUIRED', errorMessage: 'A project-scoped auth policy requires a project' }\n\t\t}\n\t\tconst project = await this.projectManager.getProjectBySlug(db, projectSlug)\n\t\tif (!project) {\n\t\t\treturn { ok: false, error: 'PROJECT_NOT_FOUND', errorMessage: `Project ${projectSlug} not found` }\n\t\t}\n\t\treturn { ok: true, projectId: project.id }\n\t}\n}\n"],"names":["AuthPoliciesQuery","ResponseError","CreateAuthPolicyCommand","ResponseOk","UpdateAuthPolicyCommand","DeleteAuthPolicyCommand"],"mappings":";;;;;;;;;;;;;;;;;AAwBO,MAAM,kBAAkB;AAAA,EAC9B,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,IAA+C;AACjE,WAAO,GAAG,aAAa,MAAM,IAAIA,kBAAAA,mBAAmB;AAAA,EACrD;AAAA,EAEA,MAAM,aAAa,IAAqB,OAA4F;AACnI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAIC,SAAAA,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,KAAK,MAAM,GAAG,WAAW;AAAA,MAC9B,IAAIC,gDAAwB;AAAA,QAC3B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,WAAO,IAAIC,SAAAA,WAAW,EAAE,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAY,OAAkF;AACrI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAIF,SAAAA,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,UAAU,MAAM,GAAG,WAAW;AAAA,MACnC,IAAIG,wBAAAA,wBAAwB,IAAI;AAAA,QAC/B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,QAAI,CAAC,SAAS;AACb,aAAO,IAAIH,SAAAA,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAIE,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAgE;AACvG,UAAM,UAAU,MAAM,GAAG,WAAW,QAAQ,IAAIE,wBAAAA,wBAAwB,EAAE,CAAC;AAC3E,QAAI,CAAC,SAAS;AACb,aAAO,IAAIJ,SAAAA,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAIE,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,iBACb,IACA,OACA,aAOC;AACD,QAAI,UAAU,UAAU;AACvB,UAAI,gBAAgB,MAAM;AACzB,eAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB,cAAc,oDAAA;AAAA,MACjE;AACA,aAAO,EAAE,IAAI,MAAM,WAAW,KAAA;AAAA,IAC/B;AAEA,QAAI,gBAAgB,MAAM;AACzB,aAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,cAAc,kDAAA;AAAA,IAC9D;AACA,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,IAAI,WAAW;AAC1E,QAAI,CAAC,SAAS;AACb,aAAO,EAAE,IAAI,OAAO,OAAO,qBAAqB,cAAc,WAAW,WAAW,aAAA;AAAA,IACrF;AACA,WAAO,EAAE,IAAI,MAAM,WAAW,QAAQ,GAAA;AAAA,EACvC;AACD;;"}

package/dist/development/src/model/service/AuthPolicyManager.js

@@ -5,8 +5,9 @@ import "../type/ApiKey.js";
 import { AuthPoliciesQuery } from "../queries/authPolicy/AuthPoliciesQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 import "node:crypto";
 import { CreateAuthPolicyCommand } from "../commands/authPolicy/CreateAuthPolicyCommand.js";

package/dist/development/src/model/service/AuthPolicyManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { AuthPoliciesQuery } from '../queries/index.js'\nimport { CreateAuthPolicyCommand, DeleteAuthPolicyCommand, UpdateAuthPolicyCommand } from '../commands/index.js'\nimport { AuthPolicyRow, AuthPolicyScope } from '../type/index.js'\nimport { CreateAuthPolicyErrorCode, DeleteAuthPolicyErrorCode, UpdateAuthPolicyErrorCode } from '../../schema/index.js'\n\nexport type AuthPolicyInputValues = {\n\tscope: AuthPolicyScope\n\t/** Project slug; resolved to project_id. Required for scope='project', forbidden for scope='global'. */\n\tproject?: string | null\n\troles: string[]\n\tmfaRequired?: boolean | null\n\ttokenExpiration?: string | null\n\tidleTimeout?: string | null\n\tgraceDuration?: string | null\n\trememberMeAllowed?: boolean | null\n}\n\n/**\n * CRUD over the `auth_policy` table (shared infra reused by A19). Project is\n * always addressed by slug in the API and resolved to project_id here.\n */\nexport class AuthPolicyManager {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync listPolicies(db: DatabaseContext): Promise<AuthPolicyRow[]> {\n\t\treturn db.queryHandler.fetch(new AuthPoliciesQuery())\n\t}\n\n\tasync createPolicy(db: DatabaseContext, input: AuthPolicyInputValues): Promise<Response<{ id: string }, CreateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst id = await db.commandBus.execute(\n\t\t\tnew CreateAuthPolicyCommand({\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\treturn new ResponseOk({ id })\n\t}\n\n\tasync updatePolicy(db: DatabaseContext, id: string, input: AuthPolicyInputValues): Promise<Response<null, UpdateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst updated = await db.commandBus.execute(\n\t\t\tnew UpdateAuthPolicyCommand(id, {\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\tif (!updated) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync deletePolicy(db: DatabaseContext, id: string): Promise<Response<null, DeleteAuthPolicyErrorCode>> {\n\t\tconst deleted = await db.commandBus.execute(new DeleteAuthPolicyCommand(id))\n\t\tif (!deleted) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\t/**\n\t * Validates scope/project consistency and resolves a slug to project_id.\n\t * `scope='project'` requires a project (which must exist); `scope='global'`\n\t * forbids one.\n\t */\n\tprivate async resolveProjectId(\n\t\tdb: DatabaseContext,\n\t\tscope: AuthPolicyScope,\n\t\tprojectSlug: string | null,\n\t): Promise<\n\t\t{ ok: true; projectId: string | null } | {\n\t\t\tok: false\n\t\t\terror: 'PROJECT_REQUIRED' | 'PROJECT_NOT_ALLOWED' | 'PROJECT_NOT_FOUND'\n\t\t\terrorMessage: string\n\t\t}\n\t> {\n\t\tif (scope === 'global') {\n\t\t\tif (projectSlug !== null) {\n\t\t\t\treturn { ok: false, error: 'PROJECT_NOT_ALLOWED', errorMessage: 'A global auth policy must not reference a project' }\n\t\t\t}\n\t\t\treturn { ok: true, projectId: null }\n\t\t}\n\t\t// scope === 'project'\n\t\tif (projectSlug === null) {\n\t\t\treturn { ok: false, error: 'PROJECT_REQUIRED', errorMessage: 'A project-scoped auth policy requires a project' }\n\t\t}\n\t\tconst project = await this.projectManager.getProjectBySlug(db, projectSlug)\n\t\tif (!project) {\n\t\t\treturn { ok: false, error: 'PROJECT_NOT_FOUND', errorMessage: `Project ${projectSlug} not found` }\n\t\t}\n\t\treturn { ok: true, projectId: project.id }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAwBO,MAAM,kBAAkB;AAAA,EAC9B,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,IAA+C;AACjE,WAAO,GAAG,aAAa,MAAM,IAAI,mBAAmB;AAAA,EACrD;AAAA,EAEA,MAAM,aAAa,IAAqB,OAA4F;AACnI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAI,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,KAAK,MAAM,GAAG,WAAW;AAAA,MAC9B,IAAI,wBAAwB;AAAA,QAC3B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,WAAO,IAAI,WAAW,EAAE,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAY,OAAkF;AACrI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAI,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,UAAU,MAAM,GAAG,WAAW;AAAA,MACnC,IAAI,wBAAwB,IAAI;AAAA,QAC/B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,QAAI,CAAC,SAAS;AACb,aAAO,IAAI,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAgE;AACvG,UAAM,UAAU,MAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,EAAE,CAAC;AAC3E,QAAI,CAAC,SAAS;AACb,aAAO,IAAI,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,iBACb,IACA,OACA,aAOC;AACD,QAAI,UAAU,UAAU;AACvB,UAAI,gBAAgB,MAAM;AACzB,eAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB,cAAc,oDAAA;AAAA,MACjE;AACA,aAAO,EAAE,IAAI,MAAM,WAAW,KAAA;AAAA,IAC/B;AAEA,QAAI,gBAAgB,MAAM;AACzB,aAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,cAAc,kDAAA;AAAA,IAC9D;AACA,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,IAAI,WAAW;AAC1E,QAAI,CAAC,SAAS;AACb,aAAO,EAAE,IAAI,OAAO,OAAO,qBAAqB,cAAc,WAAW,WAAW,aAAA;AAAA,IACrF;AACA,WAAO,EAAE,IAAI,MAAM,WAAW,QAAQ,GAAA;AAAA,EACvC;AACD;"}
+{"version":3,"file":"AuthPolicyManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { AuthPoliciesQuery } from '../queries/index.js'\nimport { CreateAuthPolicyCommand, DeleteAuthPolicyCommand, UpdateAuthPolicyCommand } from '../commands/index.js'\nimport { AuthPolicyRow, AuthPolicyScope } from '../type/index.js'\nimport { CreateAuthPolicyErrorCode, DeleteAuthPolicyErrorCode, UpdateAuthPolicyErrorCode } from '../../schema/index.js'\n\nexport type AuthPolicyInputValues = {\n\tscope: AuthPolicyScope\n\t/** Project slug; resolved to project_id. Required for scope='project', forbidden for scope='global'. */\n\tproject?: string | null\n\troles: string[]\n\tmfaRequired?: boolean | null\n\ttokenExpiration?: string | null\n\tidleTimeout?: string | null\n\tgraceDuration?: string | null\n\trememberMeAllowed?: boolean | null\n}\n\n/**\n * CRUD over the `auth_policy` table (shared infra reused by A19). Project is\n * always addressed by slug in the API and resolved to project_id here.\n */\nexport class AuthPolicyManager {\n\tconstructor(\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\tasync listPolicies(db: DatabaseContext): Promise<AuthPolicyRow[]> {\n\t\treturn db.queryHandler.fetch(new AuthPoliciesQuery())\n\t}\n\n\tasync createPolicy(db: DatabaseContext, input: AuthPolicyInputValues): Promise<Response<{ id: string }, CreateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst id = await db.commandBus.execute(\n\t\t\tnew CreateAuthPolicyCommand({\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\treturn new ResponseOk({ id })\n\t}\n\n\tasync updatePolicy(db: DatabaseContext, id: string, input: AuthPolicyInputValues): Promise<Response<null, UpdateAuthPolicyErrorCode>> {\n\t\tconst projectResult = await this.resolveProjectId(db, input.scope, input.project ?? null)\n\t\tif (!projectResult.ok) {\n\t\t\treturn new ResponseError(projectResult.error, projectResult.errorMessage)\n\t\t}\n\t\tconst updated = await db.commandBus.execute(\n\t\t\tnew UpdateAuthPolicyCommand(id, {\n\t\t\t\tscope: input.scope,\n\t\t\t\tprojectId: projectResult.projectId,\n\t\t\t\troles: input.roles,\n\t\t\t\tmfaRequired: input.mfaRequired ?? null,\n\t\t\t\ttokenExpiration: input.tokenExpiration ?? null,\n\t\t\t\tidleTimeout: input.idleTimeout ?? null,\n\t\t\t\tgraceDuration: input.graceDuration ?? null,\n\t\t\t\trememberMeAllowed: input.rememberMeAllowed ?? null,\n\t\t\t}),\n\t\t)\n\t\tif (!updated) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\tasync deletePolicy(db: DatabaseContext, id: string): Promise<Response<null, DeleteAuthPolicyErrorCode>> {\n\t\tconst deleted = await db.commandBus.execute(new DeleteAuthPolicyCommand(id))\n\t\tif (!deleted) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Auth policy ${id} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n\n\t/**\n\t * Validates scope/project consistency and resolves a slug to project_id.\n\t * `scope='project'` requires a project (which must exist); `scope='global'`\n\t * forbids one.\n\t */\n\tprivate async resolveProjectId(\n\t\tdb: DatabaseContext,\n\t\tscope: AuthPolicyScope,\n\t\tprojectSlug: string | null,\n\t): Promise<\n\t\t{ ok: true; projectId: string | null } | {\n\t\t\tok: false\n\t\t\terror: 'PROJECT_REQUIRED' | 'PROJECT_NOT_ALLOWED' | 'PROJECT_NOT_FOUND'\n\t\t\terrorMessage: string\n\t\t}\n\t> {\n\t\tif (scope === 'global') {\n\t\t\tif (projectSlug !== null) {\n\t\t\t\treturn { ok: false, error: 'PROJECT_NOT_ALLOWED', errorMessage: 'A global auth policy must not reference a project' }\n\t\t\t}\n\t\t\treturn { ok: true, projectId: null }\n\t\t}\n\t\t// scope === 'project'\n\t\tif (projectSlug === null) {\n\t\t\treturn { ok: false, error: 'PROJECT_REQUIRED', errorMessage: 'A project-scoped auth policy requires a project' }\n\t\t}\n\t\tconst project = await this.projectManager.getProjectBySlug(db, projectSlug)\n\t\tif (!project) {\n\t\t\treturn { ok: false, error: 'PROJECT_NOT_FOUND', errorMessage: `Project ${projectSlug} not found` }\n\t\t}\n\t\treturn { ok: true, projectId: project.id }\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;AAwBO,MAAM,kBAAkB;AAAA,EAC9B,YACkB,gBAChB;AADgB,SAAA,iBAAA;AAAA,EACf;AAAA,EAEH,MAAM,aAAa,IAA+C;AACjE,WAAO,GAAG,aAAa,MAAM,IAAI,mBAAmB;AAAA,EACrD;AAAA,EAEA,MAAM,aAAa,IAAqB,OAA4F;AACnI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAI,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,KAAK,MAAM,GAAG,WAAW;AAAA,MAC9B,IAAI,wBAAwB;AAAA,QAC3B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,WAAO,IAAI,WAAW,EAAE,IAAI;AAAA,EAC7B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAY,OAAkF;AACrI,UAAM,gBAAgB,MAAM,KAAK,iBAAiB,IAAI,MAAM,OAAO,MAAM,WAAW,IAAI;AACxF,QAAI,CAAC,cAAc,IAAI;AACtB,aAAO,IAAI,cAAc,cAAc,OAAO,cAAc,YAAY;AAAA,IACzE;AACA,UAAM,UAAU,MAAM,GAAG,WAAW;AAAA,MACnC,IAAI,wBAAwB,IAAI;AAAA,QAC/B,OAAO,MAAM;AAAA,QACb,WAAW,cAAc;AAAA,QACzB,OAAO,MAAM;AAAA,QACb,aAAa,MAAM,eAAe;AAAA,QAClC,iBAAiB,MAAM,mBAAmB;AAAA,QAC1C,aAAa,MAAM,eAAe;AAAA,QAClC,eAAe,MAAM,iBAAiB;AAAA,QACtC,mBAAmB,MAAM,qBAAqB;AAAA,MAAA,CAC9C;AAAA,IAAA;AAEF,QAAI,CAAC,SAAS;AACb,aAAO,IAAI,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAM,aAAa,IAAqB,IAAgE;AACvG,UAAM,UAAU,MAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,EAAE,CAAC;AAC3E,QAAI,CAAC,SAAS;AACb,aAAO,IAAI,cAAc,aAAa,eAAe,EAAE,YAAY;AAAA,IACpE;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,iBACb,IACA,OACA,aAOC;AACD,QAAI,UAAU,UAAU;AACvB,UAAI,gBAAgB,MAAM;AACzB,eAAO,EAAE,IAAI,OAAO,OAAO,uBAAuB,cAAc,oDAAA;AAAA,MACjE;AACA,aAAO,EAAE,IAAI,MAAM,WAAW,KAAA;AAAA,IAC/B;AAEA,QAAI,gBAAgB,MAAM;AACzB,aAAO,EAAE,IAAI,OAAO,OAAO,oBAAoB,cAAc,kDAAA;AAAA,IAC9D;AACA,UAAM,UAAU,MAAM,KAAK,eAAe,iBAAiB,IAAI,WAAW;AAC1E,QAAI,CAAC,SAAS;AACb,aAAO,EAAE,IAAI,OAAO,OAAO,qBAAqB,cAAc,WAAW,WAAW,aAAA;AAAA,IACrF;AACA,WAAO,EAAE,IAAI,MAAM,WAAW,QAAQ,GAAA;AAAA,EACvC;AACD;"}

package/dist/development/src/model/service/AuthPolicyResolver.cjs

@@ -7,8 +7,9 @@ const AuthPoliciesQuery = require("../queries/authPolicy/AuthPoliciesQuery.cjs")
 const AllProjectRolesByIdentityQuery = require("../queries/membership/AllProjectRolesByIdentityQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 const interval = require("../utils/interval.cjs");
 class AuthPolicyResolver {

package/dist/development/src/model/service/AuthPolicyResolver.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyResolver.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { AllProjectRolesByIdentityQuery, AuthPoliciesQuery } from '../queries/index.js'\nimport { AuthPolicyRow, EffectivePolicy } from '../type/index.js'\nimport { IPostgresInterval } from 'postgres-interval'\nimport { intervalToSeconds } from '../utils/interval.js'\n\n/**\n * Resolves the effective auth policy for an identity by aggregating all matching\n * `auth_policy` rows across the identity's entire role set (global roles + every\n * project-membership role across all projects).\n *\n * Shared by A06 (consumes `mfaRequired`) and A19 (consumes the session fields).\n *\n * Aggregation:\n * - `mfaRequired` = OR of every matched row's `mfa_required` (NULL = no opinion).\n * - session fields = strictest wins: the shortest `tokenExpiration` / `idleTimeout`\n *   and the logical AND of `rememberMeAllowed` (any matched `false` wins).\n *\n * When nothing matches, the result is the inert baseline\n * (`mfaRequired=false`, session fields null) — i.e. today's behavior.\n */\nexport class AuthPolicyResolver {\n\tasync resolveForIdentity(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<EffectivePolicy> {\n\t\tconst policies = await db.queryHandler.fetch(new AuthPoliciesQuery())\n\t\t// Fast path: with no policies configured, enforcement is inert and we skip\n\t\t// the cross-project role query entirely (preserves today's query shape).\n\t\tif (policies.length === 0) {\n\t\t\treturn { mfaRequired: false, tokenExpiration: null, idleTimeout: null, graceDuration: null, rememberMeAllowed: null }\n\t\t}\n\t\tconst projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId))\n\n\t\t// Map of project_id -> set of roles held in that project.\n\t\tconst rolesByProject = new Map<string, Set<string>>()\n\t\tfor (const { projectId, role } of projectRoles) {\n\t\t\tlet set = rolesByProject.get(projectId)\n\t\t\tif (!set) {\n\t\t\t\tset = new Set<string>()\n\t\t\t\trolesByProject.set(projectId, set)\n\t\t\t}\n\t\t\tset.add(role)\n\t\t}\n\n\t\tconst globalRoleSet = new Set(globalRoles)\n\n\t\tconst matched = policies.filter(policy => this.matches(policy, globalRoleSet, rolesByProject))\n\n\t\treturn this.aggregate(matched)\n\t}\n\n\tprivate matches(policy: AuthPolicyRow, globalRoles: Set<string>, rolesByProject: Map<string, Set<string>>): boolean {\n\t\tif (policy.scope === 'global') {\n\t\t\treturn policy.roles.some(role => globalRoles.has(role))\n\t\t}\n\t\tif (policy.scope === 'project') {\n\t\t\tif (policy.project_id === null) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst projectRoles = rolesByProject.get(policy.project_id)\n\t\t\tif (!projectRoles) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\treturn policy.roles.some(role => projectRoles.has(role))\n\t\t}\n\t\treturn false\n\t}\n\n\tprivate aggregate(policies: readonly AuthPolicyRow[]): EffectivePolicy {\n\t\tlet mfaRequired = false\n\t\tlet tokenExpiration: IPostgresInterval | null = null\n\t\tlet idleTimeout: IPostgresInterval | null = null\n\t\tlet graceDuration: IPostgresInterval | null = null\n\t\tlet rememberMeAllowed: boolean | null = null\n\n\t\tfor (const policy of policies) {\n\t\t\tif (policy.mfa_required === true) {\n\t\t\t\tmfaRequired = true\n\t\t\t}\n\t\t\ttokenExpiration = this.shortest(tokenExpiration, policy.token_expiration)\n\t\t\tidleTimeout = this.shortest(idleTimeout, policy.idle_timeout)\n\t\t\tgraceDuration = this.shortest(graceDuration, policy.grace_duration)\n\t\t\tif (policy.remember_me_allowed === false) {\n\t\t\t\trememberMeAllowed = false\n\t\t\t} else if (policy.remember_me_allowed === true && rememberMeAllowed === null) {\n\t\t\t\trememberMeAllowed = true\n\t\t\t}\n\t\t}\n\n\t\treturn { mfaRequired, tokenExpiration, idleTimeout, graceDuration, rememberMeAllowed }\n\t}\n\n\t/** Strictest wins: returns the shorter of two intervals (NULL = unconstrained). */\n\tprivate shortest(current: IPostgresInterval | null, candidate: IPostgresInterval | null): IPostgresInterval | null {\n\t\tif (candidate === null) {\n\t\t\treturn current\n\t\t}\n\t\tif (current === null) {\n\t\t\treturn candidate\n\t\t}\n\t\treturn intervalToSeconds(candidate) < intervalToSeconds(current) ? candidate : current\n\t}\n}\n"],"names":["AuthPoliciesQuery","AllProjectRolesByIdentityQuery","intervalToSeconds"],"mappings":";;;;;;;;;;;;;AAqBO,MAAM,mBAAmB;AAAA,EAC/B,MAAM,mBAAmB,IAAqB,YAAoB,aAA0D;AAC3H,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIA,kBAAAA,mBAAmB;AAGpE,QAAI,SAAS,WAAW,GAAG;AAC1B,aAAO,EAAE,aAAa,OAAO,iBAAiB,MAAM,aAAa,MAAM,eAAe,MAAM,mBAAmB,KAAA;AAAA,IAChH;AACA,UAAM,eAAe,MAAM,GAAG,aAAa,MAAM,IAAIC,+BAAAA,+BAA+B,UAAU,CAAC;AAG/F,UAAM,qCAAqB,IAAA;AAC3B,eAAW,EAAE,WAAW,KAAA,KAAU,cAAc;AAC/C,UAAI,MAAM,eAAe,IAAI,SAAS;AACtC,UAAI,CAAC,KAAK;AACT,kCAAU,IAAA;AACV,uBAAe,IAAI,WAAW,GAAG;AAAA,MAClC;AACA,UAAI,IAAI,IAAI;AAAA,IACb;AAEA,UAAM,gBAAgB,IAAI,IAAI,WAAW;AAEzC,UAAM,UAAU,SAAS,OAAO,CAAA,WAAU,KAAK,QAAQ,QAAQ,eAAe,cAAc,CAAC;AAE7F,WAAO,KAAK,UAAU,OAAO;AAAA,EAC9B;AAAA,EAEQ,QAAQ,QAAuB,aAA0B,gBAAmD;AACnH,QAAI,OAAO,UAAU,UAAU;AAC9B,aAAO,OAAO,MAAM,KAAK,UAAQ,YAAY,IAAI,IAAI,CAAC;AAAA,IACvD;AACA,QAAI,OAAO,UAAU,WAAW;AAC/B,UAAI,OAAO,eAAe,MAAM;AAC/B,eAAO;AAAA,MACR;AACA,YAAM,eAAe,eAAe,IAAI,OAAO,UAAU;AACzD,UAAI,CAAC,cAAc;AAClB,eAAO;AAAA,MACR;AACA,aAAO,OAAO,MAAM,KAAK,UAAQ,aAAa,IAAI,IAAI,CAAC;AAAA,IACxD;AACA,WAAO;AAAA,EACR;AAAA,EAEQ,UAAU,UAAqD;AACtE,QAAI,cAAc;AAClB,QAAI,kBAA4C;AAChD,QAAI,cAAwC;AAC5C,QAAI,gBAA0C;AAC9C,QAAI,oBAAoC;AAExC,eAAW,UAAU,UAAU;AAC9B,UAAI,OAAO,iBAAiB,MAAM;AACjC,sBAAc;AAAA,MACf;AACA,wBAAkB,KAAK,SAAS,iBAAiB,OAAO,gBAAgB;AACxE,oBAAc,KAAK,SAAS,aAAa,OAAO,YAAY;AAC5D,sBAAgB,KAAK,SAAS,eAAe,OAAO,cAAc;AAClE,UAAI,OAAO,wBAAwB,OAAO;AACzC,4BAAoB;AAAA,MACrB,WAAW,OAAO,wBAAwB,QAAQ,sBAAsB,MAAM;AAC7E,4BAAoB;AAAA,MACrB;AAAA,IACD;AAEA,WAAO,EAAE,aAAa,iBAAiB,aAAa,eAAe,kBAAA;AAAA,EACpE;AAAA;AAAA,EAGQ,SAAS,SAAmC,WAA+D;AAClH,QAAI,cAAc,MAAM;AACvB,aAAO;AAAA,IACR;AACA,QAAI,YAAY,MAAM;AACrB,aAAO;AAAA,IACR;AACA,WAAOC,SAAAA,kBAAkB,SAAS,IAAIA,SAAAA,kBAAkB,OAAO,IAAI,YAAY;AAAA,EAChF;AACD;;"}
+{"version":3,"file":"AuthPolicyResolver.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyResolver.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { AllProjectRolesByIdentityQuery, AuthPoliciesQuery } from '../queries/index.js'\nimport { AuthPolicyRow, EffectivePolicy } from '../type/index.js'\nimport { IPostgresInterval } from 'postgres-interval'\nimport { intervalToSeconds } from '../utils/interval.js'\n\n/**\n * Resolves the effective auth policy for an identity by aggregating all matching\n * `auth_policy` rows across the identity's entire role set (global roles + every\n * project-membership role across all projects).\n *\n * Shared by A06 (consumes `mfaRequired`) and A19 (consumes the session fields).\n *\n * Aggregation:\n * - `mfaRequired` = OR of every matched row's `mfa_required` (NULL = no opinion).\n * - session fields = strictest wins: the shortest `tokenExpiration` / `idleTimeout`\n *   and the logical AND of `rememberMeAllowed` (any matched `false` wins).\n *\n * When nothing matches, the result is the inert baseline\n * (`mfaRequired=false`, session fields null) — i.e. today's behavior.\n */\nexport class AuthPolicyResolver {\n\tasync resolveForIdentity(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<EffectivePolicy> {\n\t\tconst policies = await db.queryHandler.fetch(new AuthPoliciesQuery())\n\t\t// Fast path: with no policies configured, enforcement is inert and we skip\n\t\t// the cross-project role query entirely (preserves today's query shape).\n\t\tif (policies.length === 0) {\n\t\t\treturn { mfaRequired: false, tokenExpiration: null, idleTimeout: null, graceDuration: null, rememberMeAllowed: null }\n\t\t}\n\t\tconst projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId))\n\n\t\t// Map of project_id -> set of roles held in that project.\n\t\tconst rolesByProject = new Map<string, Set<string>>()\n\t\tfor (const { projectId, role } of projectRoles) {\n\t\t\tlet set = rolesByProject.get(projectId)\n\t\t\tif (!set) {\n\t\t\t\tset = new Set<string>()\n\t\t\t\trolesByProject.set(projectId, set)\n\t\t\t}\n\t\t\tset.add(role)\n\t\t}\n\n\t\tconst globalRoleSet = new Set(globalRoles)\n\n\t\tconst matched = policies.filter(policy => this.matches(policy, globalRoleSet, rolesByProject))\n\n\t\treturn this.aggregate(matched)\n\t}\n\n\tprivate matches(policy: AuthPolicyRow, globalRoles: Set<string>, rolesByProject: Map<string, Set<string>>): boolean {\n\t\tif (policy.scope === 'global') {\n\t\t\treturn policy.roles.some(role => globalRoles.has(role))\n\t\t}\n\t\tif (policy.scope === 'project') {\n\t\t\tif (policy.project_id === null) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst projectRoles = rolesByProject.get(policy.project_id)\n\t\t\tif (!projectRoles) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\treturn policy.roles.some(role => projectRoles.has(role))\n\t\t}\n\t\treturn false\n\t}\n\n\tprivate aggregate(policies: readonly AuthPolicyRow[]): EffectivePolicy {\n\t\tlet mfaRequired = false\n\t\tlet tokenExpiration: IPostgresInterval | null = null\n\t\tlet idleTimeout: IPostgresInterval | null = null\n\t\tlet graceDuration: IPostgresInterval | null = null\n\t\tlet rememberMeAllowed: boolean | null = null\n\n\t\tfor (const policy of policies) {\n\t\t\tif (policy.mfa_required === true) {\n\t\t\t\tmfaRequired = true\n\t\t\t}\n\t\t\ttokenExpiration = this.shortest(tokenExpiration, policy.token_expiration)\n\t\t\tidleTimeout = this.shortest(idleTimeout, policy.idle_timeout)\n\t\t\tgraceDuration = this.shortest(graceDuration, policy.grace_duration)\n\t\t\tif (policy.remember_me_allowed === false) {\n\t\t\t\trememberMeAllowed = false\n\t\t\t} else if (policy.remember_me_allowed === true && rememberMeAllowed === null) {\n\t\t\t\trememberMeAllowed = true\n\t\t\t}\n\t\t}\n\n\t\treturn { mfaRequired, tokenExpiration, idleTimeout, graceDuration, rememberMeAllowed }\n\t}\n\n\t/** Strictest wins: returns the shorter of two intervals (NULL = unconstrained). */\n\tprivate shortest(current: IPostgresInterval | null, candidate: IPostgresInterval | null): IPostgresInterval | null {\n\t\tif (candidate === null) {\n\t\t\treturn current\n\t\t}\n\t\tif (current === null) {\n\t\t\treturn candidate\n\t\t}\n\t\treturn intervalToSeconds(candidate) < intervalToSeconds(current) ? candidate : current\n\t}\n}\n"],"names":["AuthPoliciesQuery","AllProjectRolesByIdentityQuery","intervalToSeconds"],"mappings":";;;;;;;;;;;;;;AAqBO,MAAM,mBAAmB;AAAA,EAC/B,MAAM,mBAAmB,IAAqB,YAAoB,aAA0D;AAC3H,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIA,kBAAAA,mBAAmB;AAGpE,QAAI,SAAS,WAAW,GAAG;AAC1B,aAAO,EAAE,aAAa,OAAO,iBAAiB,MAAM,aAAa,MAAM,eAAe,MAAM,mBAAmB,KAAA;AAAA,IAChH;AACA,UAAM,eAAe,MAAM,GAAG,aAAa,MAAM,IAAIC,+BAAAA,+BAA+B,UAAU,CAAC;AAG/F,UAAM,qCAAqB,IAAA;AAC3B,eAAW,EAAE,WAAW,KAAA,KAAU,cAAc;AAC/C,UAAI,MAAM,eAAe,IAAI,SAAS;AACtC,UAAI,CAAC,KAAK;AACT,kCAAU,IAAA;AACV,uBAAe,IAAI,WAAW,GAAG;AAAA,MAClC;AACA,UAAI,IAAI,IAAI;AAAA,IACb;AAEA,UAAM,gBAAgB,IAAI,IAAI,WAAW;AAEzC,UAAM,UAAU,SAAS,OAAO,CAAA,WAAU,KAAK,QAAQ,QAAQ,eAAe,cAAc,CAAC;AAE7F,WAAO,KAAK,UAAU,OAAO;AAAA,EAC9B;AAAA,EAEQ,QAAQ,QAAuB,aAA0B,gBAAmD;AACnH,QAAI,OAAO,UAAU,UAAU;AAC9B,aAAO,OAAO,MAAM,KAAK,UAAQ,YAAY,IAAI,IAAI,CAAC;AAAA,IACvD;AACA,QAAI,OAAO,UAAU,WAAW;AAC/B,UAAI,OAAO,eAAe,MAAM;AAC/B,eAAO;AAAA,MACR;AACA,YAAM,eAAe,eAAe,IAAI,OAAO,UAAU;AACzD,UAAI,CAAC,cAAc;AAClB,eAAO;AAAA,MACR;AACA,aAAO,OAAO,MAAM,KAAK,UAAQ,aAAa,IAAI,IAAI,CAAC;AAAA,IACxD;AACA,WAAO;AAAA,EACR;AAAA,EAEQ,UAAU,UAAqD;AACtE,QAAI,cAAc;AAClB,QAAI,kBAA4C;AAChD,QAAI,cAAwC;AAC5C,QAAI,gBAA0C;AAC9C,QAAI,oBAAoC;AAExC,eAAW,UAAU,UAAU;AAC9B,UAAI,OAAO,iBAAiB,MAAM;AACjC,sBAAc;AAAA,MACf;AACA,wBAAkB,KAAK,SAAS,iBAAiB,OAAO,gBAAgB;AACxE,oBAAc,KAAK,SAAS,aAAa,OAAO,YAAY;AAC5D,sBAAgB,KAAK,SAAS,eAAe,OAAO,cAAc;AAClE,UAAI,OAAO,wBAAwB,OAAO;AACzC,4BAAoB;AAAA,MACrB,WAAW,OAAO,wBAAwB,QAAQ,sBAAsB,MAAM;AAC7E,4BAAoB;AAAA,MACrB;AAAA,IACD;AAEA,WAAO,EAAE,aAAa,iBAAiB,aAAa,eAAe,kBAAA;AAAA,EACpE;AAAA;AAAA,EAGQ,SAAS,SAAmC,WAA+D;AAClH,QAAI,cAAc,MAAM;AACvB,aAAO;AAAA,IACR;AACA,QAAI,YAAY,MAAM;AACrB,aAAO;AAAA,IACR;AACA,WAAOC,SAAAA,kBAAkB,SAAS,IAAIA,SAAAA,kBAAkB,OAAO,IAAI,YAAY;AAAA,EAChF;AACD;;"}

package/dist/development/src/model/service/AuthPolicyResolver.js

@@ -5,8 +5,9 @@ import { AuthPoliciesQuery } from "../queries/authPolicy/AuthPoliciesQuery.js";
 import { AllProjectRolesByIdentityQuery } from "../queries/membership/AllProjectRolesByIdentityQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 import { intervalToSeconds } from "../utils/interval.js";
 class AuthPolicyResolver {