@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/development/src/model/service/AuthPolicyResolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthPolicyResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyResolver.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { AllProjectRolesByIdentityQuery, AuthPoliciesQuery } from '../queries/index.js'\nimport { AuthPolicyRow, EffectivePolicy } from '../type/index.js'\nimport { IPostgresInterval } from 'postgres-interval'\nimport { intervalToSeconds } from '../utils/interval.js'\n\n/**\n * Resolves the effective auth policy for an identity by aggregating all matching\n * `auth_policy` rows across the identity's entire role set (global roles + every\n * project-membership role across all projects).\n *\n * Shared by A06 (consumes `mfaRequired`) and A19 (consumes the session fields).\n *\n * Aggregation:\n * - `mfaRequired` = OR of every matched row's `mfa_required` (NULL = no opinion).\n * - session fields = strictest wins: the shortest `tokenExpiration` / `idleTimeout`\n *   and the logical AND of `rememberMeAllowed` (any matched `false` wins).\n *\n * When nothing matches, the result is the inert baseline\n * (`mfaRequired=false`, session fields null) — i.e. today's behavior.\n */\nexport class AuthPolicyResolver {\n\tasync resolveForIdentity(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<EffectivePolicy> {\n\t\tconst policies = await db.queryHandler.fetch(new AuthPoliciesQuery())\n\t\t// Fast path: with no policies configured, enforcement is inert and we skip\n\t\t// the cross-project role query entirely (preserves today's query shape).\n\t\tif (policies.length === 0) {\n\t\t\treturn { mfaRequired: false, tokenExpiration: null, idleTimeout: null, graceDuration: null, rememberMeAllowed: null }\n\t\t}\n\t\tconst projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId))\n\n\t\t// Map of project_id -> set of roles held in that project.\n\t\tconst rolesByProject = new Map<string, Set<string>>()\n\t\tfor (const { projectId, role } of projectRoles) {\n\t\t\tlet set = rolesByProject.get(projectId)\n\t\t\tif (!set) {\n\t\t\t\tset = new Set<string>()\n\t\t\t\trolesByProject.set(projectId, set)\n\t\t\t}\n\t\t\tset.add(role)\n\t\t}\n\n\t\tconst globalRoleSet = new Set(globalRoles)\n\n\t\tconst matched = policies.filter(policy => this.matches(policy, globalRoleSet, rolesByProject))\n\n\t\treturn this.aggregate(matched)\n\t}\n\n\tprivate matches(policy: AuthPolicyRow, globalRoles: Set<string>, rolesByProject: Map<string, Set<string>>): boolean {\n\t\tif (policy.scope === 'global') {\n\t\t\treturn policy.roles.some(role => globalRoles.has(role))\n\t\t}\n\t\tif (policy.scope === 'project') {\n\t\t\tif (policy.project_id === null) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst projectRoles = rolesByProject.get(policy.project_id)\n\t\t\tif (!projectRoles) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\treturn policy.roles.some(role => projectRoles.has(role))\n\t\t}\n\t\treturn false\n\t}\n\n\tprivate aggregate(policies: readonly AuthPolicyRow[]): EffectivePolicy {\n\t\tlet mfaRequired = false\n\t\tlet tokenExpiration: IPostgresInterval | null = null\n\t\tlet idleTimeout: IPostgresInterval | null = null\n\t\tlet graceDuration: IPostgresInterval | null = null\n\t\tlet rememberMeAllowed: boolean | null = null\n\n\t\tfor (const policy of policies) {\n\t\t\tif (policy.mfa_required === true) {\n\t\t\t\tmfaRequired = true\n\t\t\t}\n\t\t\ttokenExpiration = this.shortest(tokenExpiration, policy.token_expiration)\n\t\t\tidleTimeout = this.shortest(idleTimeout, policy.idle_timeout)\n\t\t\tgraceDuration = this.shortest(graceDuration, policy.grace_duration)\n\t\t\tif (policy.remember_me_allowed === false) {\n\t\t\t\trememberMeAllowed = false\n\t\t\t} else if (policy.remember_me_allowed === true && rememberMeAllowed === null) {\n\t\t\t\trememberMeAllowed = true\n\t\t\t}\n\t\t}\n\n\t\treturn { mfaRequired, tokenExpiration, idleTimeout, graceDuration, rememberMeAllowed }\n\t}\n\n\t/** Strictest wins: returns the shorter of two intervals (NULL = unconstrained). */\n\tprivate shortest(current: IPostgresInterval | null, candidate: IPostgresInterval | null): IPostgresInterval | null {\n\t\tif (candidate === null) {\n\t\t\treturn current\n\t\t}\n\t\tif (current === null) {\n\t\t\treturn candidate\n\t\t}\n\t\treturn intervalToSeconds(candidate) < intervalToSeconds(current) ? candidate : current\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;AAqBO,MAAM,mBAAmB;AAAA,EAC/B,MAAM,mBAAmB,IAAqB,YAAoB,aAA0D;AAC3H,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAI,mBAAmB;AAGpE,QAAI,SAAS,WAAW,GAAG;AAC1B,aAAO,EAAE,aAAa,OAAO,iBAAiB,MAAM,aAAa,MAAM,eAAe,MAAM,mBAAmB,KAAA;AAAA,IAChH;AACA,UAAM,eAAe,MAAM,GAAG,aAAa,MAAM,IAAI,+BAA+B,UAAU,CAAC;AAG/F,UAAM,qCAAqB,IAAA;AAC3B,eAAW,EAAE,WAAW,KAAA,KAAU,cAAc;AAC/C,UAAI,MAAM,eAAe,IAAI,SAAS;AACtC,UAAI,CAAC,KAAK;AACT,kCAAU,IAAA;AACV,uBAAe,IAAI,WAAW,GAAG;AAAA,MAClC;AACA,UAAI,IAAI,IAAI;AAAA,IACb;AAEA,UAAM,gBAAgB,IAAI,IAAI,WAAW;AAEzC,UAAM,UAAU,SAAS,OAAO,CAAA,WAAU,KAAK,QAAQ,QAAQ,eAAe,cAAc,CAAC;AAE7F,WAAO,KAAK,UAAU,OAAO;AAAA,EAC9B;AAAA,EAEQ,QAAQ,QAAuB,aAA0B,gBAAmD;AACnH,QAAI,OAAO,UAAU,UAAU;AAC9B,aAAO,OAAO,MAAM,KAAK,UAAQ,YAAY,IAAI,IAAI,CAAC;AAAA,IACvD;AACA,QAAI,OAAO,UAAU,WAAW;AAC/B,UAAI,OAAO,eAAe,MAAM;AAC/B,eAAO;AAAA,MACR;AACA,YAAM,eAAe,eAAe,IAAI,OAAO,UAAU;AACzD,UAAI,CAAC,cAAc;AAClB,eAAO;AAAA,MACR;AACA,aAAO,OAAO,MAAM,KAAK,UAAQ,aAAa,IAAI,IAAI,CAAC;AAAA,IACxD;AACA,WAAO;AAAA,EACR;AAAA,EAEQ,UAAU,UAAqD;AACtE,QAAI,cAAc;AAClB,QAAI,kBAA4C;AAChD,QAAI,cAAwC;AAC5C,QAAI,gBAA0C;AAC9C,QAAI,oBAAoC;AAExC,eAAW,UAAU,UAAU;AAC9B,UAAI,OAAO,iBAAiB,MAAM;AACjC,sBAAc;AAAA,MACf;AACA,wBAAkB,KAAK,SAAS,iBAAiB,OAAO,gBAAgB;AACxE,oBAAc,KAAK,SAAS,aAAa,OAAO,YAAY;AAC5D,sBAAgB,KAAK,SAAS,eAAe,OAAO,cAAc;AAClE,UAAI,OAAO,wBAAwB,OAAO;AACzC,4BAAoB;AAAA,MACrB,WAAW,OAAO,wBAAwB,QAAQ,sBAAsB,MAAM;AAC7E,4BAAoB;AAAA,MACrB;AAAA,IACD;AAEA,WAAO,EAAE,aAAa,iBAAiB,aAAa,eAAe,kBAAA;AAAA,EACpE;AAAA;AAAA,EAGQ,SAAS,SAAmC,WAA+D;AAClH,QAAI,cAAc,MAAM;AACvB,aAAO;AAAA,IACR;AACA,QAAI,YAAY,MAAM;AACrB,aAAO;AAAA,IACR;AACA,WAAO,kBAAkB,SAAS,IAAI,kBAAkB,OAAO,IAAI,YAAY;AAAA,EAChF;AACD;"}
+{"version":3,"file":"AuthPolicyResolver.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthPolicyResolver.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { AllProjectRolesByIdentityQuery, AuthPoliciesQuery } from '../queries/index.js'\nimport { AuthPolicyRow, EffectivePolicy } from '../type/index.js'\nimport { IPostgresInterval } from 'postgres-interval'\nimport { intervalToSeconds } from '../utils/interval.js'\n\n/**\n * Resolves the effective auth policy for an identity by aggregating all matching\n * `auth_policy` rows across the identity's entire role set (global roles + every\n * project-membership role across all projects).\n *\n * Shared by A06 (consumes `mfaRequired`) and A19 (consumes the session fields).\n *\n * Aggregation:\n * - `mfaRequired` = OR of every matched row's `mfa_required` (NULL = no opinion).\n * - session fields = strictest wins: the shortest `tokenExpiration` / `idleTimeout`\n *   and the logical AND of `rememberMeAllowed` (any matched `false` wins).\n *\n * When nothing matches, the result is the inert baseline\n * (`mfaRequired=false`, session fields null) — i.e. today's behavior.\n */\nexport class AuthPolicyResolver {\n\tasync resolveForIdentity(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<EffectivePolicy> {\n\t\tconst policies = await db.queryHandler.fetch(new AuthPoliciesQuery())\n\t\t// Fast path: with no policies configured, enforcement is inert and we skip\n\t\t// the cross-project role query entirely (preserves today's query shape).\n\t\tif (policies.length === 0) {\n\t\t\treturn { mfaRequired: false, tokenExpiration: null, idleTimeout: null, graceDuration: null, rememberMeAllowed: null }\n\t\t}\n\t\tconst projectRoles = await db.queryHandler.fetch(new AllProjectRolesByIdentityQuery(identityId))\n\n\t\t// Map of project_id -> set of roles held in that project.\n\t\tconst rolesByProject = new Map<string, Set<string>>()\n\t\tfor (const { projectId, role } of projectRoles) {\n\t\t\tlet set = rolesByProject.get(projectId)\n\t\t\tif (!set) {\n\t\t\t\tset = new Set<string>()\n\t\t\t\trolesByProject.set(projectId, set)\n\t\t\t}\n\t\t\tset.add(role)\n\t\t}\n\n\t\tconst globalRoleSet = new Set(globalRoles)\n\n\t\tconst matched = policies.filter(policy => this.matches(policy, globalRoleSet, rolesByProject))\n\n\t\treturn this.aggregate(matched)\n\t}\n\n\tprivate matches(policy: AuthPolicyRow, globalRoles: Set<string>, rolesByProject: Map<string, Set<string>>): boolean {\n\t\tif (policy.scope === 'global') {\n\t\t\treturn policy.roles.some(role => globalRoles.has(role))\n\t\t}\n\t\tif (policy.scope === 'project') {\n\t\t\tif (policy.project_id === null) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\tconst projectRoles = rolesByProject.get(policy.project_id)\n\t\t\tif (!projectRoles) {\n\t\t\t\treturn false\n\t\t\t}\n\t\t\treturn policy.roles.some(role => projectRoles.has(role))\n\t\t}\n\t\treturn false\n\t}\n\n\tprivate aggregate(policies: readonly AuthPolicyRow[]): EffectivePolicy {\n\t\tlet mfaRequired = false\n\t\tlet tokenExpiration: IPostgresInterval | null = null\n\t\tlet idleTimeout: IPostgresInterval | null = null\n\t\tlet graceDuration: IPostgresInterval | null = null\n\t\tlet rememberMeAllowed: boolean | null = null\n\n\t\tfor (const policy of policies) {\n\t\t\tif (policy.mfa_required === true) {\n\t\t\t\tmfaRequired = true\n\t\t\t}\n\t\t\ttokenExpiration = this.shortest(tokenExpiration, policy.token_expiration)\n\t\t\tidleTimeout = this.shortest(idleTimeout, policy.idle_timeout)\n\t\t\tgraceDuration = this.shortest(graceDuration, policy.grace_duration)\n\t\t\tif (policy.remember_me_allowed === false) {\n\t\t\t\trememberMeAllowed = false\n\t\t\t} else if (policy.remember_me_allowed === true && rememberMeAllowed === null) {\n\t\t\t\trememberMeAllowed = true\n\t\t\t}\n\t\t}\n\n\t\treturn { mfaRequired, tokenExpiration, idleTimeout, graceDuration, rememberMeAllowed }\n\t}\n\n\t/** Strictest wins: returns the shorter of two intervals (NULL = unconstrained). */\n\tprivate shortest(current: IPostgresInterval | null, candidate: IPostgresInterval | null): IPostgresInterval | null {\n\t\tif (candidate === null) {\n\t\t\treturn current\n\t\t}\n\t\tif (current === null) {\n\t\t\treturn candidate\n\t\t}\n\t\treturn intervalToSeconds(candidate) < intervalToSeconds(current) ? candidate : current\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAqBO,MAAM,mBAAmB;AAAA,EAC/B,MAAM,mBAAmB,IAAqB,YAAoB,aAA0D;AAC3H,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAI,mBAAmB;AAGpE,QAAI,SAAS,WAAW,GAAG;AAC1B,aAAO,EAAE,aAAa,OAAO,iBAAiB,MAAM,aAAa,MAAM,eAAe,MAAM,mBAAmB,KAAA;AAAA,IAChH;AACA,UAAM,eAAe,MAAM,GAAG,aAAa,MAAM,IAAI,+BAA+B,UAAU,CAAC;AAG/F,UAAM,qCAAqB,IAAA;AAC3B,eAAW,EAAE,WAAW,KAAA,KAAU,cAAc;AAC/C,UAAI,MAAM,eAAe,IAAI,SAAS;AACtC,UAAI,CAAC,KAAK;AACT,kCAAU,IAAA;AACV,uBAAe,IAAI,WAAW,GAAG;AAAA,MAClC;AACA,UAAI,IAAI,IAAI;AAAA,IACb;AAEA,UAAM,gBAAgB,IAAI,IAAI,WAAW;AAEzC,UAAM,UAAU,SAAS,OAAO,CAAA,WAAU,KAAK,QAAQ,QAAQ,eAAe,cAAc,CAAC;AAE7F,WAAO,KAAK,UAAU,OAAO;AAAA,EAC9B;AAAA,EAEQ,QAAQ,QAAuB,aAA0B,gBAAmD;AACnH,QAAI,OAAO,UAAU,UAAU;AAC9B,aAAO,OAAO,MAAM,KAAK,UAAQ,YAAY,IAAI,IAAI,CAAC;AAAA,IACvD;AACA,QAAI,OAAO,UAAU,WAAW;AAC/B,UAAI,OAAO,eAAe,MAAM;AAC/B,eAAO;AAAA,MACR;AACA,YAAM,eAAe,eAAe,IAAI,OAAO,UAAU;AACzD,UAAI,CAAC,cAAc;AAClB,eAAO;AAAA,MACR;AACA,aAAO,OAAO,MAAM,KAAK,UAAQ,aAAa,IAAI,IAAI,CAAC;AAAA,IACxD;AACA,WAAO;AAAA,EACR;AAAA,EAEQ,UAAU,UAAqD;AACtE,QAAI,cAAc;AAClB,QAAI,kBAA4C;AAChD,QAAI,cAAwC;AAC5C,QAAI,gBAA0C;AAC9C,QAAI,oBAAoC;AAExC,eAAW,UAAU,UAAU;AAC9B,UAAI,OAAO,iBAAiB,MAAM;AACjC,sBAAc;AAAA,MACf;AACA,wBAAkB,KAAK,SAAS,iBAAiB,OAAO,gBAAgB;AACxE,oBAAc,KAAK,SAAS,aAAa,OAAO,YAAY;AAC5D,sBAAgB,KAAK,SAAS,eAAe,OAAO,cAAc;AAClE,UAAI,OAAO,wBAAwB,OAAO;AACzC,4BAAoB;AAAA,MACrB,WAAW,OAAO,wBAAwB,QAAQ,sBAAsB,MAAM;AAC7E,4BAAoB;AAAA,MACrB;AAAA,IACD;AAEA,WAAO,EAAE,aAAa,iBAAiB,aAAa,eAAe,kBAAA;AAAA,EACpE;AAAA;AAAA,EAGQ,SAAS,SAAmC,WAA+D;AAClH,QAAI,cAAc,MAAM;AACvB,aAAO;AAAA,IACR;AACA,QAAI,YAAY,MAAM;AACrB,aAAO;AAAA,IACR;AACA,WAAO,kBAAkB,SAAS,IAAI,kBAAkB,OAAO,IAAI,YAAY;AAAA,EAChF;AACD;"}

package/dist/development/src/model/service/CustomRoleManager.cjs

@@ -0,0 +1,170 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+const Response = require("../utils/Response.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("../type/ApiKey.cjs");
+const CustomRolesQuery = require("../queries/customRole/CustomRolesQuery.cjs");
+const IdentitiesHoldingRoleCountQuery = require("../queries/identity/IdentitiesHoldingRoleCountQuery.cjs");
+const ProjectsQuery = require("../queries/project/ProjectsQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+const Roles = require("../authorization/Roles.cjs");
+const CustomRolePermissions = require("../authorization/CustomRolePermissions.cjs");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+require("node:crypto");
+const CreateCustomRoleCommand = require("../commands/customRole/CreateCustomRoleCommand.cjs");
+const DeleteCustomRoleCommand = require("../commands/customRole/DeleteCustomRoleCommand.cjs");
+const RemoveCustomRoleAssignmentsCommand = require("../commands/customRole/RemoveCustomRoleAssignmentsCommand.cjs");
+const UpdateCustomRoleCommand = require("../commands/customRole/UpdateCustomRoleCommand.cjs");
+const GlobalRoleValidator = require("./GlobalRoleValidator.cjs");
+const SLUG_MAX_LENGTH = 64;
+class CustomRoleManager {
+  constructor(globalRoleValidator = new GlobalRoleValidator.GlobalRoleValidator()) {
+    this.globalRoleValidator = globalRoleValidator;
+  }
+  async listRoles(db) {
+    const rows = await db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery());
+    return rows.map((row) => this.toState(row));
+  }
+  async createRole(db, input) {
+    if (!Roles.ROLE_SLUG_PATTERN.test(input.slug) || input.slug.length > SLUG_MAX_LENGTH) {
+      return new Response.ResponseError("INVALID_SLUG", `Slug must match ${Roles.ROLE_SLUG_PATTERN} and be at most ${SLUG_MAX_LENGTH} characters long`);
+    }
+    if (CustomRolePermissions.BUILTIN_TENANT_ROLES.has(input.slug)) {
+      return new Response.ResponseError("INVALID_SLUG", `Slug ${input.slug} collides with a built-in role`);
+    }
+    const parsed = this.parseGrants(input.grants);
+    if (parsed instanceof Response.ResponseError) {
+      return parsed;
+    }
+    const referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, /* @__PURE__ */ new Set([input.slug]));
+    if (referenceError !== null) {
+      return referenceError;
+    }
+    const existing = await db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery({ slugs: [input.slug] }));
+    if (existing.length > 0) {
+      return new Response.ResponseError("SLUG_ALREADY_EXISTS", `Custom role ${input.slug} already exists`);
+    }
+    const holders = await db.queryHandler.fetch(new IdentitiesHoldingRoleCountQuery.IdentitiesHoldingRoleCountQuery(input.slug));
+    if (holders > 0) {
+      return new Response.ResponseError(
+        "SLUG_ALREADY_ASSIGNED",
+        `Role string ${input.slug} is already held by ${holders} identities; remove it from them before defining the role`
+      );
+    }
+    const id = await db.commandBus.execute(
+      new CreateCustomRoleCommand.CreateCustomRoleCommand({
+        slug: input.slug,
+        description: input.description,
+        grants: parsed.grants
+      })
+    );
+    return new Response.ResponseOk({
+      id,
+      role: {
+        slug: input.slug,
+        description: input.description,
+        grants: parsed.grants
+      }
+    });
+  }
+  /** Maps the racing-insert failure the transaction could not report itself. */
+  static isSlugConflict(error) {
+    return error instanceof Database.UniqueViolationError;
+  }
+  async updateRole(db, slug, input) {
+    const [current] = await db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery({ slugs: [slug], lock: Database.LockType.forUpdate }));
+    if (current === void 0) {
+      return new Response.ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    let canonicalGrants;
+    if (input.grants !== void 0) {
+      const parsed = this.parseGrants(input.grants);
+      if (parsed instanceof Response.ResponseError) {
+        return parsed;
+      }
+      const referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, /* @__PURE__ */ new Set([slug]));
+      if (referenceError !== null) {
+        return referenceError;
+      }
+      canonicalGrants = parsed.grants;
+    }
+    const before = this.toState(current);
+    const updated = await db.commandBus.execute(
+      new UpdateCustomRoleCommand.UpdateCustomRoleCommand(slug, {
+        description: input.description,
+        grants: canonicalGrants
+      })
+    );
+    if (!updated) {
+      return new Response.ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    return new Response.ResponseOk({
+      before,
+      after: {
+        slug,
+        description: input.description === void 0 ? before.description : input.description,
+        grants: canonicalGrants ?? before.grants
+      }
+    });
+  }
+  async deleteRole(db, slug) {
+    const [current] = await db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery({ slugs: [slug], lock: Database.LockType.forUpdate }));
+    if (current === void 0) {
+      return new Response.ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    const referencedBy = (await db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery())).filter((row) => row.slug !== slug && CustomRolePermissions.parsePersistedCustomRoleReferences(row.grants).includes(slug)).map((row) => row.slug);
+    if (referencedBy.length > 0) {
+      return new Response.ResponseError(
+        "ROLE_IN_USE",
+        `Custom role ${slug} is referenced by the grant configuration of ${referencedBy.join(", ")}`
+      );
+    }
+    const deleted = await db.commandBus.execute(new DeleteCustomRoleCommand.DeleteCustomRoleCommand(slug));
+    if (!deleted) {
+      return new Response.ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    const removedAssignmentIdentityIds = await db.commandBus.execute(new RemoveCustomRoleAssignmentsCommand.RemoveCustomRoleAssignmentsCommand(slug));
+    return new Response.ResponseOk({
+      before: this.toState(current),
+      removedAssignments: removedAssignmentIdentityIds.length,
+      removedAssignmentIdentityIds
+    });
+  }
+  parseGrants(grants) {
+    try {
+      return CustomRolePermissions.parseCustomRoleGrants(grants);
+    } catch (error) {
+      if (error instanceof CustomRolePermissions.CustomRoleGrantValidationError) {
+        return new Response.ResponseError(error.code, error.message);
+      }
+      throw error;
+    }
+  }
+  async validateReferences(db, roles, projects, additionallyActiveRoles) {
+    const invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles, additionallyActiveRoles);
+    if (invalidRole !== null) {
+      return new Response.ResponseError("INVALID_PERMISSION_CONFIGURATION", `Referenced role ${invalidRole} does not exist or is not globally assignable`);
+    }
+    if (projects.length > 0) {
+      const existingProjects = new Set((await db.queryHandler.fetch(new ProjectsQuery.ProjectsQuery())).map((project) => project.slug));
+      const missingProject = projects.find((project) => !existingProjects.has(project));
+      if (missingProject !== void 0) {
+        return new Response.ResponseError("INVALID_PERMISSION_CONFIGURATION", `Referenced project ${missingProject} does not exist`);
+      }
+    }
+    return null;
+  }
+  toState(row) {
+    return {
+      slug: row.slug,
+      description: row.description,
+      grants: CustomRolePermissions.parsePersistedCustomRoleGrants(row.grants)
+    };
+  }
+}
+exports.CustomRoleManager = CustomRoleManager;
+//# sourceMappingURL=CustomRoleManager.cjs.map

package/dist/development/src/model/service/CustomRoleManager.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/CustomRoleManager.ts"],"sourcesContent":["import { LockType, UniqueViolationError } from '@contember/database'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { CustomRolesQuery, IdentitiesHoldingRoleCountQuery, ProjectsQuery } from '../queries/index.js'\nimport { CreateCustomRoleCommand, DeleteCustomRoleCommand, RemoveCustomRoleAssignmentsCommand, UpdateCustomRoleCommand } from '../commands/index.js'\nimport { CustomRoleRow } from '../type/index.js'\nimport {\n\tBUILTIN_TENANT_ROLES,\n\tCanonicalCustomRoleGrant,\n\tCustomRoleGrantValidationError,\n\tparseCustomRoleGrants,\n\tparsePersistedCustomRoleGrants,\n\tparsePersistedCustomRoleReferences,\n} from '../authorization/CustomRolePermissions.js'\nimport { ROLE_SLUG_PATTERN } from '../authorization/Roles.js'\nimport { CreateCustomRoleErrorCode, DeleteCustomRoleErrorCode, UpdateCustomRoleErrorCode } from '../../schema/index.js'\nimport { GlobalRoleValidator } from './GlobalRoleValidator.js'\n\nconst SLUG_MAX_LENGTH = 64\n\nexport type CustomRoleState = {\n\treadonly slug: string\n\treadonly description: string | null\n\treadonly grants: readonly CanonicalCustomRoleGrant[]\n}\n\ntype CreateResult = {\n\treadonly id: string\n\treadonly role: CustomRoleState\n}\n\ntype UpdateResult = {\n\treadonly before: CustomRoleState\n\treadonly after: CustomRoleState\n}\n\ntype DeleteResult = {\n\treadonly before: CustomRoleState\n\treadonly removedAssignments: number\n\t/** Which identities lost the role — a count alone cannot answer \"who lost what\" after the fact. */\n\treadonly removedAssignmentIdentityIds: readonly string[]\n}\n\nexport class CustomRoleManager {\n\tconstructor(\n\t\tprivate readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),\n\t) {\n\t}\n\n\tasync listRoles(db: DatabaseContext): Promise<CustomRoleState[]> {\n\t\tconst rows = await db.queryHandler.fetch(new CustomRolesQuery())\n\t\treturn rows.map(row => this.toState(row))\n\t}\n\n\tasync createRole(\n\t\tdb: DatabaseContext,\n\t\tinput: { slug: string; description: string | null; grants: unknown },\n\t): Promise<Response<CreateResult, CreateCustomRoleErrorCode>> {\n\t\tif (!ROLE_SLUG_PATTERN.test(input.slug) || input.slug.length > SLUG_MAX_LENGTH) {\n\t\t\treturn new ResponseError('INVALID_SLUG', `Slug must match ${ROLE_SLUG_PATTERN} and be at most ${SLUG_MAX_LENGTH} characters long`)\n\t\t}\n\t\tif (BUILTIN_TENANT_ROLES.has(input.slug)) {\n\t\t\treturn new ResponseError('INVALID_SLUG', `Slug ${input.slug} collides with a built-in role`)\n\t\t}\n\t\tconst parsed = this.parseGrants(input.grants)\n\t\tif (parsed instanceof ResponseError) {\n\t\t\treturn parsed\n\t\t}\n\t\tconst referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, new Set([input.slug]))\n\t\tif (referenceError !== null) {\n\t\t\treturn referenceError\n\t\t}\n\t\tconst existing = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [input.slug] }))\n\t\tif (existing.length > 0) {\n\t\t\treturn new ResponseError('SLUG_ALREADY_EXISTS', `Custom role ${input.slug} already exists`)\n\t\t}\n\t\t// Only legacy rows can match: every assignment path rejects a slug with no custom_role row,\n\t\t// so no concurrent writer can add one before this insert commits.\n\t\tconst holders = await db.queryHandler.fetch(new IdentitiesHoldingRoleCountQuery(input.slug))\n\t\tif (holders > 0) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'SLUG_ALREADY_ASSIGNED',\n\t\t\t\t`Role string ${input.slug} is already held by ${holders} identities; remove it from them before defining the role`,\n\t\t\t)\n\t\t}\n\t\t// A racing INSERT aborts the transaction, so UniqueViolationError cannot be mapped\n\t\t// here — the caller catches it outside, once the transaction has rolled back.\n\t\tconst id = await db.commandBus.execute(\n\t\t\tnew CreateCustomRoleCommand({\n\t\t\t\tslug: input.slug,\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: parsed.grants,\n\t\t\t}),\n\t\t)\n\t\treturn new ResponseOk({\n\t\t\tid,\n\t\t\trole: {\n\t\t\t\tslug: input.slug,\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: parsed.grants,\n\t\t\t},\n\t\t})\n\t}\n\n\t/** Maps the racing-insert failure the transaction could not report itself. */\n\tstatic isSlugConflict(error: unknown): boolean {\n\t\treturn error instanceof UniqueViolationError\n\t}\n\n\tasync updateRole(\n\t\tdb: DatabaseContext,\n\t\tslug: string,\n\t\tinput: { description?: string | null; grants?: unknown },\n\t): Promise<Response<UpdateResult, UpdateCustomRoleErrorCode>> {\n\t\tconst [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }))\n\t\tif (current === undefined) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\tlet canonicalGrants: readonly CanonicalCustomRoleGrant[] | undefined\n\t\tif (input.grants !== undefined) {\n\t\t\tconst parsed = this.parseGrants(input.grants)\n\t\t\tif (parsed instanceof ResponseError) {\n\t\t\t\treturn parsed\n\t\t\t}\n\t\t\tconst referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, new Set([slug]))\n\t\t\tif (referenceError !== null) {\n\t\t\t\treturn referenceError\n\t\t\t}\n\t\t\tcanonicalGrants = parsed.grants\n\t\t}\n\t\tconst before = this.toState(current)\n\t\tconst updated = await db.commandBus.execute(\n\t\t\tnew UpdateCustomRoleCommand(slug, {\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: canonicalGrants,\n\t\t\t}),\n\t\t)\n\t\tif (!updated) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\treturn new ResponseOk({\n\t\t\tbefore,\n\t\t\tafter: {\n\t\t\t\tslug,\n\t\t\t\tdescription: input.description === undefined ? before.description : input.description,\n\t\t\t\tgrants: canonicalGrants ?? before.grants,\n\t\t\t},\n\t\t})\n\t}\n\n\tasync deleteRole(db: DatabaseContext, slug: string): Promise<Response<DeleteResult, DeleteCustomRoleErrorCode>> {\n\t\tconst [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }))\n\t\tif (current === undefined) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\t// References live inside an opaque jsonb blob — no FK can catch this. Read the other rows\n\t\t// unlocked: a concurrent create/update naming this slug holds FOR SHARE on the row we\n\t\t// already hold FOR UPDATE, so the two serialize without a second lock (and without the\n\t\t// deadlock a reversed acquisition order would invite).\n\t\tconst referencedBy = (await db.queryHandler.fetch(new CustomRolesQuery()))\n\t\t\t.filter(row => row.slug !== slug && parsePersistedCustomRoleReferences(row.grants).includes(slug))\n\t\t\t.map(row => row.slug)\n\t\tif (referencedBy.length > 0) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'ROLE_IN_USE',\n\t\t\t\t`Custom role ${slug} is referenced by the grant configuration of ${referencedBy.join(', ')}`,\n\t\t\t)\n\t\t}\n\t\tconst deleted = await db.commandBus.execute(new DeleteCustomRoleCommand(slug))\n\t\tif (!deleted) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\tconst removedAssignmentIdentityIds = await db.commandBus.execute(new RemoveCustomRoleAssignmentsCommand(slug))\n\t\treturn new ResponseOk({\n\t\t\tbefore: this.toState(current),\n\t\t\tremovedAssignments: removedAssignmentIdentityIds.length,\n\t\t\tremovedAssignmentIdentityIds,\n\t\t})\n\t}\n\n\tprivate parseGrants(\n\t\tgrants: unknown,\n\t): ReturnType<typeof parseCustomRoleGrants> | ResponseError<'UNKNOWN_PERMISSION' | 'DUPLICATE_PERMISSION' | 'INVALID_PERMISSION_CONFIGURATION'> {\n\t\ttry {\n\t\t\treturn parseCustomRoleGrants(grants)\n\t\t} catch (error) {\n\t\t\tif (error instanceof CustomRoleGrantValidationError) {\n\t\t\t\treturn new ResponseError(error.code, error.message)\n\t\t\t}\n\t\t\tthrow error\n\t\t}\n\t}\n\n\tprivate async validateReferences(\n\t\tdb: DatabaseContext,\n\t\troles: readonly string[],\n\t\tprojects: readonly string[],\n\t\tadditionallyActiveRoles: ReadonlySet<string>,\n\t): Promise<ResponseError<'INVALID_PERMISSION_CONFIGURATION'> | null> {\n\t\tconst invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles, additionallyActiveRoles)\n\t\tif (invalidRole !== null) {\n\t\t\treturn new ResponseError('INVALID_PERMISSION_CONFIGURATION', `Referenced role ${invalidRole} does not exist or is not globally assignable`)\n\t\t}\n\t\tif (projects.length > 0) {\n\t\t\tconst existingProjects = new Set((await db.queryHandler.fetch(new ProjectsQuery())).map(project => project.slug))\n\t\t\tconst missingProject = projects.find(project => !existingProjects.has(project))\n\t\t\tif (missingProject !== undefined) {\n\t\t\t\treturn new ResponseError('INVALID_PERMISSION_CONFIGURATION', `Referenced project ${missingProject} does not exist`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n\n\tprivate toState(row: CustomRoleRow): CustomRoleState {\n\t\treturn {\n\t\t\tslug: row.slug,\n\t\t\tdescription: row.description,\n\t\t\tgrants: parsePersistedCustomRoleGrants(row.grants),\n\t\t}\n\t}\n}\n"],"names":["GlobalRoleValidator","CustomRolesQuery","ROLE_SLUG_PATTERN","ResponseError","BUILTIN_TENANT_ROLES","IdentitiesHoldingRoleCountQuery","CreateCustomRoleCommand","ResponseOk","UniqueViolationError","LockType","UpdateCustomRoleCommand","parsePersistedCustomRoleReferences","DeleteCustomRoleCommand","RemoveCustomRoleAssignmentsCommand","parseCustomRoleGrants","CustomRoleGrantValidationError","ProjectsQuery","parsePersistedCustomRoleGrants"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkBA,MAAM,kBAAkB;AAyBjB,MAAM,kBAAkB;AAAA,EAC9B,YACkB,sBAA2C,IAAIA,oBAAAA,uBAC/D;AADgB,SAAA,sBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,IAAiD;AAChE,UAAM,OAAO,MAAM,GAAG,aAAa,MAAM,IAAIC,iBAAAA,kBAAkB;AAC/D,WAAO,KAAK,IAAI,CAAA,QAAO,KAAK,QAAQ,GAAG,CAAC;AAAA,EACzC;AAAA,EAEA,MAAM,WACL,IACA,OAC6D;AAC7D,QAAI,CAACC,MAAAA,kBAAkB,KAAK,MAAM,IAAI,KAAK,MAAM,KAAK,SAAS,iBAAiB;AAC/E,aAAO,IAAIC,SAAAA,cAAc,gBAAgB,mBAAmBD,MAAAA,iBAAiB,mBAAmB,eAAe,kBAAkB;AAAA,IAClI;AACA,QAAIE,2CAAqB,IAAI,MAAM,IAAI,GAAG;AACzC,aAAO,IAAID,SAAAA,cAAc,gBAAgB,QAAQ,MAAM,IAAI,gCAAgC;AAAA,IAC5F;AACA,UAAM,SAAS,KAAK,YAAY,MAAM,MAAM;AAC5C,QAAI,kBAAkBA,SAAAA,eAAe;AACpC,aAAO;AAAA,IACR;AACA,UAAM,iBAAiB,MAAM,KAAK,mBAAmB,IAAI,OAAO,iBAAiB,OAAO,wCAAwB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;AACjI,QAAI,mBAAmB,MAAM;AAC5B,aAAO;AAAA,IACR;AACA,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIF,kCAAiB,EAAE,OAAO,CAAC,MAAM,IAAI,EAAA,CAAG,CAAC;AAC1F,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO,IAAIE,SAAAA,cAAc,uBAAuB,eAAe,MAAM,IAAI,iBAAiB;AAAA,IAC3F;AAGA,UAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAIE,gCAAAA,gCAAgC,MAAM,IAAI,CAAC;AAC3F,QAAI,UAAU,GAAG;AAChB,aAAO,IAAIF,SAAAA;AAAAA,QACV;AAAA,QACA,eAAe,MAAM,IAAI,uBAAuB,OAAO;AAAA,MAAA;AAAA,IAEzD;AAGA,UAAM,KAAK,MAAM,GAAG,WAAW;AAAA,MAC9B,IAAIG,gDAAwB;AAAA,QAC3B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,QAAQ,OAAO;AAAA,MAAA,CACf;AAAA,IAAA;AAEF,WAAO,IAAIC,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,MAAM;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,QAAQ,OAAO;AAAA,MAAA;AAAA,IAChB,CACA;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,eAAe,OAAyB;AAC9C,WAAO,iBAAiBC,SAAAA;AAAAA,EACzB;AAAA,EAEA,MAAM,WACL,IACA,MACA,OAC6D;AAC7D,UAAM,CAAC,OAAO,IAAI,MAAM,GAAG,aAAa,MAAM,IAAIP,iBAAAA,iBAAiB,EAAE,OAAO,CAAC,IAAI,GAAG,MAAMQ,SAAAA,SAAS,UAAA,CAAW,CAAC;AAC/G,QAAI,YAAY,QAAW;AAC1B,aAAO,IAAIN,SAAAA,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,QAAI;AACJ,QAAI,MAAM,WAAW,QAAW;AAC/B,YAAM,SAAS,KAAK,YAAY,MAAM,MAAM;AAC5C,UAAI,kBAAkBA,SAAAA,eAAe;AACpC,eAAO;AAAA,MACR;AACA,YAAM,iBAAiB,MAAM,KAAK,mBAAmB,IAAI,OAAO,iBAAiB,OAAO,oBAAoB,oBAAI,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3H,UAAI,mBAAmB,MAAM;AAC5B,eAAO;AAAA,MACR;AACA,wBAAkB,OAAO;AAAA,IAC1B;AACA,UAAM,SAAS,KAAK,QAAQ,OAAO;AACnC,UAAM,UAAU,MAAM,GAAG,WAAW;AAAA,MACnC,IAAIO,wBAAAA,wBAAwB,MAAM;AAAA,QACjC,aAAa,MAAM;AAAA,QACnB,QAAQ;AAAA,MAAA,CACR;AAAA,IAAA;AAEF,QAAI,CAAC,SAAS;AACb,aAAO,IAAIP,SAAAA,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,WAAO,IAAII,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,QACN;AAAA,QACA,aAAa,MAAM,gBAAgB,SAAY,OAAO,cAAc,MAAM;AAAA,QAC1E,QAAQ,mBAAmB,OAAO;AAAA,MAAA;AAAA,IACnC,CACA;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,IAAqB,MAA0E;AAC/G,UAAM,CAAC,OAAO,IAAI,MAAM,GAAG,aAAa,MAAM,IAAIN,iBAAAA,iBAAiB,EAAE,OAAO,CAAC,IAAI,GAAG,MAAMQ,SAAAA,SAAS,UAAA,CAAW,CAAC;AAC/G,QAAI,YAAY,QAAW;AAC1B,aAAO,IAAIN,SAAAA,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AAKA,UAAM,gBAAgB,MAAM,GAAG,aAAa,MAAM,IAAIF,iBAAAA,iBAAA,CAAkB,GACtE,OAAO,CAAA,QAAO,IAAI,SAAS,QAAQU,yDAAmC,IAAI,MAAM,EAAE,SAAS,IAAI,CAAC,EAChG,IAAI,CAAA,QAAO,IAAI,IAAI;AACrB,QAAI,aAAa,SAAS,GAAG;AAC5B,aAAO,IAAIR,SAAAA;AAAAA,QACV;AAAA,QACA,eAAe,IAAI,gDAAgD,aAAa,KAAK,IAAI,CAAC;AAAA,MAAA;AAAA,IAE5F;AACA,UAAM,UAAU,MAAM,GAAG,WAAW,QAAQ,IAAIS,wBAAAA,wBAAwB,IAAI,CAAC;AAC7E,QAAI,CAAC,SAAS;AACb,aAAO,IAAIT,SAAAA,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,UAAM,+BAA+B,MAAM,GAAG,WAAW,QAAQ,IAAIU,mCAAAA,mCAAmC,IAAI,CAAC;AAC7G,WAAO,IAAIN,SAAAA,WAAW;AAAA,MACrB,QAAQ,KAAK,QAAQ,OAAO;AAAA,MAC5B,oBAAoB,6BAA6B;AAAA,MACjD;AAAA,IAAA,CACA;AAAA,EACF;AAAA,EAEQ,YACP,QAC+I;AAC/I,QAAI;AACH,aAAOO,sBAAAA,sBAAsB,MAAM;AAAA,IACpC,SAAS,OAAO;AACf,UAAI,iBAAiBC,sBAAAA,gCAAgC;AACpD,eAAO,IAAIZ,SAAAA,cAAc,MAAM,MAAM,MAAM,OAAO;AAAA,MACnD;AACA,YAAM;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAc,mBACb,IACA,OACA,UACA,yBACoE;AACpE,UAAM,cAAc,MAAM,KAAK,oBAAoB,gBAAgB,IAAI,OAAO,uBAAuB;AACrG,QAAI,gBAAgB,MAAM;AACzB,aAAO,IAAIA,SAAAA,cAAc,oCAAoC,mBAAmB,WAAW,+CAA+C;AAAA,IAC3I;AACA,QAAI,SAAS,SAAS,GAAG;AACxB,YAAM,mBAAmB,IAAI,KAAK,MAAM,GAAG,aAAa,MAAM,IAAIa,cAAAA,cAAA,CAAe,GAAG,IAAI,CAAA,YAAW,QAAQ,IAAI,CAAC;AAChH,YAAM,iBAAiB,SAAS,KAAK,CAAA,YAAW,CAAC,iBAAiB,IAAI,OAAO,CAAC;AAC9E,UAAI,mBAAmB,QAAW;AACjC,eAAO,IAAIb,SAAAA,cAAc,oCAAoC,sBAAsB,cAAc,iBAAiB;AAAA,MACnH;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEQ,QAAQ,KAAqC;AACpD,WAAO;AAAA,MACN,MAAM,IAAI;AAAA,MACV,aAAa,IAAI;AAAA,MACjB,QAAQc,sBAAAA,+BAA+B,IAAI,MAAM;AAAA,IAAA;AAAA,EAEnD;AACD;;"}

package/dist/development/src/model/service/CustomRoleManager.js

@@ -0,0 +1,170 @@
+import { UniqueViolationError, LockType } from "@contember/database";
+import { ResponseError, ResponseOk } from "../utils/Response.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import "../type/ApiKey.js";
+import { CustomRolesQuery } from "../queries/customRole/CustomRolesQuery.js";
+import { IdentitiesHoldingRoleCountQuery } from "../queries/identity/IdentitiesHoldingRoleCountQuery.js";
+import { ProjectsQuery } from "../queries/project/ProjectsQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import { ROLE_SLUG_PATTERN } from "../authorization/Roles.js";
+import { BUILTIN_TENANT_ROLES, parsePersistedCustomRoleReferences, parseCustomRoleGrants, CustomRoleGrantValidationError, parsePersistedCustomRoleGrants } from "../authorization/CustomRolePermissions.js";
+import "../authorization/PermissionContext.js";
+import "../authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
+import { CreateCustomRoleCommand } from "../commands/customRole/CreateCustomRoleCommand.js";
+import { DeleteCustomRoleCommand } from "../commands/customRole/DeleteCustomRoleCommand.js";
+import { RemoveCustomRoleAssignmentsCommand } from "../commands/customRole/RemoveCustomRoleAssignmentsCommand.js";
+import { UpdateCustomRoleCommand } from "../commands/customRole/UpdateCustomRoleCommand.js";
+import { GlobalRoleValidator } from "./GlobalRoleValidator.js";
+const SLUG_MAX_LENGTH = 64;
+class CustomRoleManager {
+  constructor(globalRoleValidator = new GlobalRoleValidator()) {
+    this.globalRoleValidator = globalRoleValidator;
+  }
+  async listRoles(db) {
+    const rows = await db.queryHandler.fetch(new CustomRolesQuery());
+    return rows.map((row) => this.toState(row));
+  }
+  async createRole(db, input) {
+    if (!ROLE_SLUG_PATTERN.test(input.slug) || input.slug.length > SLUG_MAX_LENGTH) {
+      return new ResponseError("INVALID_SLUG", `Slug must match ${ROLE_SLUG_PATTERN} and be at most ${SLUG_MAX_LENGTH} characters long`);
+    }
+    if (BUILTIN_TENANT_ROLES.has(input.slug)) {
+      return new ResponseError("INVALID_SLUG", `Slug ${input.slug} collides with a built-in role`);
+    }
+    const parsed = this.parseGrants(input.grants);
+    if (parsed instanceof ResponseError) {
+      return parsed;
+    }
+    const referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, /* @__PURE__ */ new Set([input.slug]));
+    if (referenceError !== null) {
+      return referenceError;
+    }
+    const existing = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [input.slug] }));
+    if (existing.length > 0) {
+      return new ResponseError("SLUG_ALREADY_EXISTS", `Custom role ${input.slug} already exists`);
+    }
+    const holders = await db.queryHandler.fetch(new IdentitiesHoldingRoleCountQuery(input.slug));
+    if (holders > 0) {
+      return new ResponseError(
+        "SLUG_ALREADY_ASSIGNED",
+        `Role string ${input.slug} is already held by ${holders} identities; remove it from them before defining the role`
+      );
+    }
+    const id = await db.commandBus.execute(
+      new CreateCustomRoleCommand({
+        slug: input.slug,
+        description: input.description,
+        grants: parsed.grants
+      })
+    );
+    return new ResponseOk({
+      id,
+      role: {
+        slug: input.slug,
+        description: input.description,
+        grants: parsed.grants
+      }
+    });
+  }
+  /** Maps the racing-insert failure the transaction could not report itself. */
+  static isSlugConflict(error) {
+    return error instanceof UniqueViolationError;
+  }
+  async updateRole(db, slug, input) {
+    const [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }));
+    if (current === void 0) {
+      return new ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    let canonicalGrants;
+    if (input.grants !== void 0) {
+      const parsed = this.parseGrants(input.grants);
+      if (parsed instanceof ResponseError) {
+        return parsed;
+      }
+      const referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, /* @__PURE__ */ new Set([slug]));
+      if (referenceError !== null) {
+        return referenceError;
+      }
+      canonicalGrants = parsed.grants;
+    }
+    const before = this.toState(current);
+    const updated = await db.commandBus.execute(
+      new UpdateCustomRoleCommand(slug, {
+        description: input.description,
+        grants: canonicalGrants
+      })
+    );
+    if (!updated) {
+      return new ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    return new ResponseOk({
+      before,
+      after: {
+        slug,
+        description: input.description === void 0 ? before.description : input.description,
+        grants: canonicalGrants ?? before.grants
+      }
+    });
+  }
+  async deleteRole(db, slug) {
+    const [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }));
+    if (current === void 0) {
+      return new ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    const referencedBy = (await db.queryHandler.fetch(new CustomRolesQuery())).filter((row) => row.slug !== slug && parsePersistedCustomRoleReferences(row.grants).includes(slug)).map((row) => row.slug);
+    if (referencedBy.length > 0) {
+      return new ResponseError(
+        "ROLE_IN_USE",
+        `Custom role ${slug} is referenced by the grant configuration of ${referencedBy.join(", ")}`
+      );
+    }
+    const deleted = await db.commandBus.execute(new DeleteCustomRoleCommand(slug));
+    if (!deleted) {
+      return new ResponseError("NOT_FOUND", `Custom role ${slug} not found`);
+    }
+    const removedAssignmentIdentityIds = await db.commandBus.execute(new RemoveCustomRoleAssignmentsCommand(slug));
+    return new ResponseOk({
+      before: this.toState(current),
+      removedAssignments: removedAssignmentIdentityIds.length,
+      removedAssignmentIdentityIds
+    });
+  }
+  parseGrants(grants) {
+    try {
+      return parseCustomRoleGrants(grants);
+    } catch (error) {
+      if (error instanceof CustomRoleGrantValidationError) {
+        return new ResponseError(error.code, error.message);
+      }
+      throw error;
+    }
+  }
+  async validateReferences(db, roles, projects, additionallyActiveRoles) {
+    const invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles, additionallyActiveRoles);
+    if (invalidRole !== null) {
+      return new ResponseError("INVALID_PERMISSION_CONFIGURATION", `Referenced role ${invalidRole} does not exist or is not globally assignable`);
+    }
+    if (projects.length > 0) {
+      const existingProjects = new Set((await db.queryHandler.fetch(new ProjectsQuery())).map((project) => project.slug));
+      const missingProject = projects.find((project) => !existingProjects.has(project));
+      if (missingProject !== void 0) {
+        return new ResponseError("INVALID_PERMISSION_CONFIGURATION", `Referenced project ${missingProject} does not exist`);
+      }
+    }
+    return null;
+  }
+  toState(row) {
+    return {
+      slug: row.slug,
+      description: row.description,
+      grants: parsePersistedCustomRoleGrants(row.grants)
+    };
+  }
+}
+export {
+  CustomRoleManager
+};
+//# sourceMappingURL=CustomRoleManager.js.map

package/dist/development/src/model/service/CustomRoleManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/CustomRoleManager.ts"],"sourcesContent":["import { LockType, UniqueViolationError } from '@contember/database'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { CustomRolesQuery, IdentitiesHoldingRoleCountQuery, ProjectsQuery } from '../queries/index.js'\nimport { CreateCustomRoleCommand, DeleteCustomRoleCommand, RemoveCustomRoleAssignmentsCommand, UpdateCustomRoleCommand } from '../commands/index.js'\nimport { CustomRoleRow } from '../type/index.js'\nimport {\n\tBUILTIN_TENANT_ROLES,\n\tCanonicalCustomRoleGrant,\n\tCustomRoleGrantValidationError,\n\tparseCustomRoleGrants,\n\tparsePersistedCustomRoleGrants,\n\tparsePersistedCustomRoleReferences,\n} from '../authorization/CustomRolePermissions.js'\nimport { ROLE_SLUG_PATTERN } from '../authorization/Roles.js'\nimport { CreateCustomRoleErrorCode, DeleteCustomRoleErrorCode, UpdateCustomRoleErrorCode } from '../../schema/index.js'\nimport { GlobalRoleValidator } from './GlobalRoleValidator.js'\n\nconst SLUG_MAX_LENGTH = 64\n\nexport type CustomRoleState = {\n\treadonly slug: string\n\treadonly description: string | null\n\treadonly grants: readonly CanonicalCustomRoleGrant[]\n}\n\ntype CreateResult = {\n\treadonly id: string\n\treadonly role: CustomRoleState\n}\n\ntype UpdateResult = {\n\treadonly before: CustomRoleState\n\treadonly after: CustomRoleState\n}\n\ntype DeleteResult = {\n\treadonly before: CustomRoleState\n\treadonly removedAssignments: number\n\t/** Which identities lost the role — a count alone cannot answer \"who lost what\" after the fact. */\n\treadonly removedAssignmentIdentityIds: readonly string[]\n}\n\nexport class CustomRoleManager {\n\tconstructor(\n\t\tprivate readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),\n\t) {\n\t}\n\n\tasync listRoles(db: DatabaseContext): Promise<CustomRoleState[]> {\n\t\tconst rows = await db.queryHandler.fetch(new CustomRolesQuery())\n\t\treturn rows.map(row => this.toState(row))\n\t}\n\n\tasync createRole(\n\t\tdb: DatabaseContext,\n\t\tinput: { slug: string; description: string | null; grants: unknown },\n\t): Promise<Response<CreateResult, CreateCustomRoleErrorCode>> {\n\t\tif (!ROLE_SLUG_PATTERN.test(input.slug) || input.slug.length > SLUG_MAX_LENGTH) {\n\t\t\treturn new ResponseError('INVALID_SLUG', `Slug must match ${ROLE_SLUG_PATTERN} and be at most ${SLUG_MAX_LENGTH} characters long`)\n\t\t}\n\t\tif (BUILTIN_TENANT_ROLES.has(input.slug)) {\n\t\t\treturn new ResponseError('INVALID_SLUG', `Slug ${input.slug} collides with a built-in role`)\n\t\t}\n\t\tconst parsed = this.parseGrants(input.grants)\n\t\tif (parsed instanceof ResponseError) {\n\t\t\treturn parsed\n\t\t}\n\t\tconst referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, new Set([input.slug]))\n\t\tif (referenceError !== null) {\n\t\t\treturn referenceError\n\t\t}\n\t\tconst existing = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [input.slug] }))\n\t\tif (existing.length > 0) {\n\t\t\treturn new ResponseError('SLUG_ALREADY_EXISTS', `Custom role ${input.slug} already exists`)\n\t\t}\n\t\t// Only legacy rows can match: every assignment path rejects a slug with no custom_role row,\n\t\t// so no concurrent writer can add one before this insert commits.\n\t\tconst holders = await db.queryHandler.fetch(new IdentitiesHoldingRoleCountQuery(input.slug))\n\t\tif (holders > 0) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'SLUG_ALREADY_ASSIGNED',\n\t\t\t\t`Role string ${input.slug} is already held by ${holders} identities; remove it from them before defining the role`,\n\t\t\t)\n\t\t}\n\t\t// A racing INSERT aborts the transaction, so UniqueViolationError cannot be mapped\n\t\t// here — the caller catches it outside, once the transaction has rolled back.\n\t\tconst id = await db.commandBus.execute(\n\t\t\tnew CreateCustomRoleCommand({\n\t\t\t\tslug: input.slug,\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: parsed.grants,\n\t\t\t}),\n\t\t)\n\t\treturn new ResponseOk({\n\t\t\tid,\n\t\t\trole: {\n\t\t\t\tslug: input.slug,\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: parsed.grants,\n\t\t\t},\n\t\t})\n\t}\n\n\t/** Maps the racing-insert failure the transaction could not report itself. */\n\tstatic isSlugConflict(error: unknown): boolean {\n\t\treturn error instanceof UniqueViolationError\n\t}\n\n\tasync updateRole(\n\t\tdb: DatabaseContext,\n\t\tslug: string,\n\t\tinput: { description?: string | null; grants?: unknown },\n\t): Promise<Response<UpdateResult, UpdateCustomRoleErrorCode>> {\n\t\tconst [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }))\n\t\tif (current === undefined) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\tlet canonicalGrants: readonly CanonicalCustomRoleGrant[] | undefined\n\t\tif (input.grants !== undefined) {\n\t\t\tconst parsed = this.parseGrants(input.grants)\n\t\t\tif (parsed instanceof ResponseError) {\n\t\t\t\treturn parsed\n\t\t\t}\n\t\t\tconst referenceError = await this.validateReferences(db, parsed.referencedRoles, parsed.referencedProjects, new Set([slug]))\n\t\t\tif (referenceError !== null) {\n\t\t\t\treturn referenceError\n\t\t\t}\n\t\t\tcanonicalGrants = parsed.grants\n\t\t}\n\t\tconst before = this.toState(current)\n\t\tconst updated = await db.commandBus.execute(\n\t\t\tnew UpdateCustomRoleCommand(slug, {\n\t\t\t\tdescription: input.description,\n\t\t\t\tgrants: canonicalGrants,\n\t\t\t}),\n\t\t)\n\t\tif (!updated) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\treturn new ResponseOk({\n\t\t\tbefore,\n\t\t\tafter: {\n\t\t\t\tslug,\n\t\t\t\tdescription: input.description === undefined ? before.description : input.description,\n\t\t\t\tgrants: canonicalGrants ?? before.grants,\n\t\t\t},\n\t\t})\n\t}\n\n\tasync deleteRole(db: DatabaseContext, slug: string): Promise<Response<DeleteResult, DeleteCustomRoleErrorCode>> {\n\t\tconst [current] = await db.queryHandler.fetch(new CustomRolesQuery({ slugs: [slug], lock: LockType.forUpdate }))\n\t\tif (current === undefined) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\t// References live inside an opaque jsonb blob — no FK can catch this. Read the other rows\n\t\t// unlocked: a concurrent create/update naming this slug holds FOR SHARE on the row we\n\t\t// already hold FOR UPDATE, so the two serialize without a second lock (and without the\n\t\t// deadlock a reversed acquisition order would invite).\n\t\tconst referencedBy = (await db.queryHandler.fetch(new CustomRolesQuery()))\n\t\t\t.filter(row => row.slug !== slug && parsePersistedCustomRoleReferences(row.grants).includes(slug))\n\t\t\t.map(row => row.slug)\n\t\tif (referencedBy.length > 0) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'ROLE_IN_USE',\n\t\t\t\t`Custom role ${slug} is referenced by the grant configuration of ${referencedBy.join(', ')}`,\n\t\t\t)\n\t\t}\n\t\tconst deleted = await db.commandBus.execute(new DeleteCustomRoleCommand(slug))\n\t\tif (!deleted) {\n\t\t\treturn new ResponseError('NOT_FOUND', `Custom role ${slug} not found`)\n\t\t}\n\t\tconst removedAssignmentIdentityIds = await db.commandBus.execute(new RemoveCustomRoleAssignmentsCommand(slug))\n\t\treturn new ResponseOk({\n\t\t\tbefore: this.toState(current),\n\t\t\tremovedAssignments: removedAssignmentIdentityIds.length,\n\t\t\tremovedAssignmentIdentityIds,\n\t\t})\n\t}\n\n\tprivate parseGrants(\n\t\tgrants: unknown,\n\t): ReturnType<typeof parseCustomRoleGrants> | ResponseError<'UNKNOWN_PERMISSION' | 'DUPLICATE_PERMISSION' | 'INVALID_PERMISSION_CONFIGURATION'> {\n\t\ttry {\n\t\t\treturn parseCustomRoleGrants(grants)\n\t\t} catch (error) {\n\t\t\tif (error instanceof CustomRoleGrantValidationError) {\n\t\t\t\treturn new ResponseError(error.code, error.message)\n\t\t\t}\n\t\t\tthrow error\n\t\t}\n\t}\n\n\tprivate async validateReferences(\n\t\tdb: DatabaseContext,\n\t\troles: readonly string[],\n\t\tprojects: readonly string[],\n\t\tadditionallyActiveRoles: ReadonlySet<string>,\n\t): Promise<ResponseError<'INVALID_PERMISSION_CONFIGURATION'> | null> {\n\t\tconst invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles, additionallyActiveRoles)\n\t\tif (invalidRole !== null) {\n\t\t\treturn new ResponseError('INVALID_PERMISSION_CONFIGURATION', `Referenced role ${invalidRole} does not exist or is not globally assignable`)\n\t\t}\n\t\tif (projects.length > 0) {\n\t\t\tconst existingProjects = new Set((await db.queryHandler.fetch(new ProjectsQuery())).map(project => project.slug))\n\t\t\tconst missingProject = projects.find(project => !existingProjects.has(project))\n\t\t\tif (missingProject !== undefined) {\n\t\t\t\treturn new ResponseError('INVALID_PERMISSION_CONFIGURATION', `Referenced project ${missingProject} does not exist`)\n\t\t\t}\n\t\t}\n\t\treturn null\n\t}\n\n\tprivate toState(row: CustomRoleRow): CustomRoleState {\n\t\treturn {\n\t\t\tslug: row.slug,\n\t\t\tdescription: row.description,\n\t\t\tgrants: parsePersistedCustomRoleGrants(row.grants),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAkBA,MAAM,kBAAkB;AAyBjB,MAAM,kBAAkB;AAAA,EAC9B,YACkB,sBAA2C,IAAI,uBAC/D;AADgB,SAAA,sBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,UAAU,IAAiD;AAChE,UAAM,OAAO,MAAM,GAAG,aAAa,MAAM,IAAI,kBAAkB;AAC/D,WAAO,KAAK,IAAI,CAAA,QAAO,KAAK,QAAQ,GAAG,CAAC;AAAA,EACzC;AAAA,EAEA,MAAM,WACL,IACA,OAC6D;AAC7D,QAAI,CAAC,kBAAkB,KAAK,MAAM,IAAI,KAAK,MAAM,KAAK,SAAS,iBAAiB;AAC/E,aAAO,IAAI,cAAc,gBAAgB,mBAAmB,iBAAiB,mBAAmB,eAAe,kBAAkB;AAAA,IAClI;AACA,QAAI,qBAAqB,IAAI,MAAM,IAAI,GAAG;AACzC,aAAO,IAAI,cAAc,gBAAgB,QAAQ,MAAM,IAAI,gCAAgC;AAAA,IAC5F;AACA,UAAM,SAAS,KAAK,YAAY,MAAM,MAAM;AAC5C,QAAI,kBAAkB,eAAe;AACpC,aAAO;AAAA,IACR;AACA,UAAM,iBAAiB,MAAM,KAAK,mBAAmB,IAAI,OAAO,iBAAiB,OAAO,wCAAwB,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;AACjI,QAAI,mBAAmB,MAAM;AAC5B,aAAO;AAAA,IACR;AACA,UAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAI,iBAAiB,EAAE,OAAO,CAAC,MAAM,IAAI,EAAA,CAAG,CAAC;AAC1F,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO,IAAI,cAAc,uBAAuB,eAAe,MAAM,IAAI,iBAAiB;AAAA,IAC3F;AAGA,UAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,gCAAgC,MAAM,IAAI,CAAC;AAC3F,QAAI,UAAU,GAAG;AAChB,aAAO,IAAI;AAAA,QACV;AAAA,QACA,eAAe,MAAM,IAAI,uBAAuB,OAAO;AAAA,MAAA;AAAA,IAEzD;AAGA,UAAM,KAAK,MAAM,GAAG,WAAW;AAAA,MAC9B,IAAI,wBAAwB;AAAA,QAC3B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,QAAQ,OAAO;AAAA,MAAA,CACf;AAAA,IAAA;AAEF,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,MAAM;AAAA,QACL,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,QAAQ,OAAO;AAAA,MAAA;AAAA,IAChB,CACA;AAAA,EACF;AAAA;AAAA,EAGA,OAAO,eAAe,OAAyB;AAC9C,WAAO,iBAAiB;AAAA,EACzB;AAAA,EAEA,MAAM,WACL,IACA,MACA,OAC6D;AAC7D,UAAM,CAAC,OAAO,IAAI,MAAM,GAAG,aAAa,MAAM,IAAI,iBAAiB,EAAE,OAAO,CAAC,IAAI,GAAG,MAAM,SAAS,UAAA,CAAW,CAAC;AAC/G,QAAI,YAAY,QAAW;AAC1B,aAAO,IAAI,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,QAAI;AACJ,QAAI,MAAM,WAAW,QAAW;AAC/B,YAAM,SAAS,KAAK,YAAY,MAAM,MAAM;AAC5C,UAAI,kBAAkB,eAAe;AACpC,eAAO;AAAA,MACR;AACA,YAAM,iBAAiB,MAAM,KAAK,mBAAmB,IAAI,OAAO,iBAAiB,OAAO,oBAAoB,oBAAI,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3H,UAAI,mBAAmB,MAAM;AAC5B,eAAO;AAAA,MACR;AACA,wBAAkB,OAAO;AAAA,IAC1B;AACA,UAAM,SAAS,KAAK,QAAQ,OAAO;AACnC,UAAM,UAAU,MAAM,GAAG,WAAW;AAAA,MACnC,IAAI,wBAAwB,MAAM;AAAA,QACjC,aAAa,MAAM;AAAA,QACnB,QAAQ;AAAA,MAAA,CACR;AAAA,IAAA;AAEF,QAAI,CAAC,SAAS;AACb,aAAO,IAAI,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,QACN;AAAA,QACA,aAAa,MAAM,gBAAgB,SAAY,OAAO,cAAc,MAAM;AAAA,QAC1E,QAAQ,mBAAmB,OAAO;AAAA,MAAA;AAAA,IACnC,CACA;AAAA,EACF;AAAA,EAEA,MAAM,WAAW,IAAqB,MAA0E;AAC/G,UAAM,CAAC,OAAO,IAAI,MAAM,GAAG,aAAa,MAAM,IAAI,iBAAiB,EAAE,OAAO,CAAC,IAAI,GAAG,MAAM,SAAS,UAAA,CAAW,CAAC;AAC/G,QAAI,YAAY,QAAW;AAC1B,aAAO,IAAI,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AAKA,UAAM,gBAAgB,MAAM,GAAG,aAAa,MAAM,IAAI,iBAAA,CAAkB,GACtE,OAAO,CAAA,QAAO,IAAI,SAAS,QAAQ,mCAAmC,IAAI,MAAM,EAAE,SAAS,IAAI,CAAC,EAChG,IAAI,CAAA,QAAO,IAAI,IAAI;AACrB,QAAI,aAAa,SAAS,GAAG;AAC5B,aAAO,IAAI;AAAA,QACV;AAAA,QACA,eAAe,IAAI,gDAAgD,aAAa,KAAK,IAAI,CAAC;AAAA,MAAA;AAAA,IAE5F;AACA,UAAM,UAAU,MAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,IAAI,CAAC;AAC7E,QAAI,CAAC,SAAS;AACb,aAAO,IAAI,cAAc,aAAa,eAAe,IAAI,YAAY;AAAA,IACtE;AACA,UAAM,+BAA+B,MAAM,GAAG,WAAW,QAAQ,IAAI,mCAAmC,IAAI,CAAC;AAC7G,WAAO,IAAI,WAAW;AAAA,MACrB,QAAQ,KAAK,QAAQ,OAAO;AAAA,MAC5B,oBAAoB,6BAA6B;AAAA,MACjD;AAAA,IAAA,CACA;AAAA,EACF;AAAA,EAEQ,YACP,QAC+I;AAC/I,QAAI;AACH,aAAO,sBAAsB,MAAM;AAAA,IACpC,SAAS,OAAO;AACf,UAAI,iBAAiB,gCAAgC;AACpD,eAAO,IAAI,cAAc,MAAM,MAAM,MAAM,OAAO;AAAA,MACnD;AACA,YAAM;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAc,mBACb,IACA,OACA,UACA,yBACoE;AACpE,UAAM,cAAc,MAAM,KAAK,oBAAoB,gBAAgB,IAAI,OAAO,uBAAuB;AACrG,QAAI,gBAAgB,MAAM;AACzB,aAAO,IAAI,cAAc,oCAAoC,mBAAmB,WAAW,+CAA+C;AAAA,IAC3I;AACA,QAAI,SAAS,SAAS,GAAG;AACxB,YAAM,mBAAmB,IAAI,KAAK,MAAM,GAAG,aAAa,MAAM,IAAI,cAAA,CAAe,GAAG,IAAI,CAAA,YAAW,QAAQ,IAAI,CAAC;AAChH,YAAM,iBAAiB,SAAS,KAAK,CAAA,YAAW,CAAC,iBAAiB,IAAI,OAAO,CAAC;AAC9E,UAAI,mBAAmB,QAAW;AACjC,eAAO,IAAI,cAAc,oCAAoC,sBAAsB,cAAc,iBAAiB;AAAA,MACnH;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEQ,QAAQ,KAAqC;AACpD,WAAO;AAAA,MACN,MAAM,IAAI;AAAA,MACV,aAAa,IAAI;AAAA,MACjB,QAAQ,+BAA+B,IAAI,MAAM;AAAA,IAAA;AAAA,EAEnD;AACD;"}

package/dist/development/src/model/service/EmailChangeManager.cjs

@@ -8,8 +8,9 @@ const exceptions = require("../../exceptions.cjs");
 const PersonQuery = require("../queries/person/PersonQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 const getPreferredProject = require("./helpers/getPreferredProject.cjs");
 const token = require("../utils/token.cjs");
@@ -41,10 +42,10 @@ class EmailChangeManager {
     if (validationError !== null) {
       return new Response.ResponseError(validationError.error, validationError.errorMessage);
     }
-    const nextAllowed = await dbContext.queryHandler.fetch(
+    const retryAfter = await dbContext.queryHandler.fetch(
       new NextMailAttemptQuery.NextMailAttemptQuery(normalizedNewEmail, "email_change_init", "email_change_complete")
     );
-    if (nextAllowed > dbContext.providers.now()) {
+    if (retryAfter > 0) {
       return new Response.ResponseError("RATE_LIMIT_EXCEEDED", "Too many e-mail change requests for this address.");
     }
     const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
@@ -74,7 +75,7 @@ class EmailChangeManager {
   }
   async confirmEmailChange(dbContext, token$1) {
     const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byToken(token$1, "email_change"));
-    const validation = token.validateToken({ entry: tokenRow, token: token$1, now: dbContext.providers.now(), validationType: "token" });
+    const validation = token.validateToken({ entry: tokenRow, token: token$1, validationType: "token" });
     if (!validation.ok) {
       return new Response.ResponseError(validation.error, validation.errorMessage, {
         [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag(

package/dist/development/src/model/service/EmailChangeManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"EmailChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailChangeManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext, PermissionContextFactory } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { ApiKeyManager } from './apiKey/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { normalizeEmail } from '../utils/email.js'\nimport { PersonToken } from '../type/index.js'\nimport { UniqueViolationError } from '@contember/database'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailChangeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\t/**\n\t * Request an e-mail change. Validation and rate-limiting run BEFORE any\n\t * write, so a rejected request never leaves a half-applied profile (e.g. a\n\t * persisted name change without the e-mail change going through). Any\n\t * immediate side-changes the caller wants applied atomically with the token\n\t * (the name change) are passed via `applyWithinTransaction`.\n\t */\n\tpublic async requestEmailChange(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tnewEmail: string,\n\t\tmailOptions: MailOptions = {},\n\t\tapplyWithinTransaction?: (db: DatabaseContext) => Promise<void>,\n\t): Promise<RequestEmailChangeResponse> {\n\t\tconst normalizedNewEmail = normalizeEmail(newEmail)\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t}\n\n\t\t// Per-recipient exponential backoff: an authenticated user (or a hijacked\n\t\t// session) must not be able to flood an arbitrary address with\n\t\t// \"confirm your new e-mail\" mails. Keyed on the normalized NEW address so\n\t\t// the `email_change_init` auth-log entries (written with the same\n\t\t// normalized address) actually drive the backoff. Reuses login_* config.\n\t\tconst nextAllowed = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(normalizedNewEmail, 'email_change_init', 'email_change_complete'),\n\t\t)\n\t\tif (nextAllowed > dbContext.providers.now()) {\n\t\t\treturn new ResponseError('RATE_LIMIT_EXCEEDED', 'Too many e-mail change requests for this address.')\n\t\t}\n\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait dbContext.transaction(async db => {\n\t\t\tif (applyWithinTransaction) {\n\t\t\t\tawait applyWithinTransaction(db)\n\t\t\t}\n\t\t\tconst result = await db.commandBus.execute(\n\t\t\t\tCreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail),\n\t\t\t)\n\t\t\t// The verification link goes to the NEW address — clicking it proves\n\t\t\t// ownership of the address being switched to, which is the whole point.\n\t\t\tawait this.mailer.sendEmailChangeVerifyEmail(\n\t\t\t\tdb,\n\t\t\t\t{\n\t\t\t\t\temail: normalizedNewEmail,\n\t\t\t\t\ttoken: result.token,\n\t\t\t\t\tproject: project?.name,\n\t\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t\t},\n\t\t\t)\n\t\t})\n\t\treturn new ResponseOk(null)\n\t}\n\n\tpublic async confirmEmailChange(dbContext: DatabaseContext, token: string): Promise<ConfirmEmailChangeResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_change'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Tie the failure to a person/token in the audit log when we can, even\n\t\t\t// for an invalid/expired token (matches verifyEmail / password reset).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst newEmail = validation.result.meta?.email\n\t\tif (!newEmail) {\n\t\t\tthrow new ImplementationException('email_change token is missing its email payload')\n\t\t}\n\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Re-check uniqueness at confirmation time: another account may have\n\t\t// claimed the address between request and confirmation.\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, newEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\n\t\tconst oldEmail = person.email\n\t\ttry {\n\t\t\tawait dbContext.transaction(async db => {\n\t\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(person.id, newEmail))\n\t\t\t\t// An email change is a takeover-grade event: drop every existing\n\t\t\t\t// session so a stale attacker session cannot ride the new address.\n\t\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id)\n\t\t\t})\n\t\t} catch (e) {\n\t\t\t// The uniqueness re-check above narrows but cannot fully close the\n\t\t\t// window: another account may claim the address between the check and\n\t\t\t// this UPDATE. The unique index is the real guard — translate its\n\t\t\t// violation into a clean error instead of leaking a 500.\n\t\t\tif (e instanceof UniqueViolationError) {\n\t\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${newEmail} already exists`, {\n\t\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\n\t\tif (oldEmail) {\n\t\t\t// Resolve the person's preferred project so a per-project\n\t\t\t// EMAIL_CHANGE_NOTIFY template (and branding) is honoured, mirroring\n\t\t\t// requestEmailChange. The token carries no project, so derive it from the\n\t\t\t// person's own identity.\n\t\t\tconst permissionContext = this.permissionContextFactory.create(dbContext, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, null)\n\t\t\tawait this.mailer.sendEmailChangeNotifyEmail(\n\t\t\t\tdbContext,\n\t\t\t\t{ email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },\n\t\t\t\t{ projectId: project?.id ?? null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn new ResponseOk({ personId: person.id, newEmail, [AuthLogService.Key]: authLogData })\n\t}\n}\n\nexport type RequestEmailChangeResponse = Response<null, EmailValidatorError | 'RATE_LIMIT_EXCEEDED'>\n\nexport type ConfirmEmailChangeResponse = Response<\n\t{ personId: string; newEmail: string; [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError | EmailValidatorError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":["normalizeEmail","ResponseError","NextMailAttemptQuery","getPreferredProject","CreatePersonTokenCommand","ResponseOk","token","PersonTokenQuery","validateToken","AuthLogService","ImplementationException","PersonQuery","InvalidateTokenCommand","MarkEmailVerifiedCommand","UniqueViolationError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAwBO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,QACA,gBACA,gBACA,eACA,0BAChB;AALgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,iBAAA;AACA,SAAA,gBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,mBACZ,WACA,mBACA,QACA,UACA,cAA2B,CAAA,GAC3B,wBACsC;AACtC,UAAM,qBAAqBA,MAAAA,eAAe,QAAQ;AAClD,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,kBAAkB;AAC7F,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAIC,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,IAC7E;AAOA,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAIC,qBAAAA,qBAAqB,oBAAoB,qBAAqB,uBAAuB;AAAA,IAAA;AAE1F,QAAI,cAAc,UAAU,UAAU,IAAA,GAAO;AAC5C,aAAO,IAAID,SAAAA,cAAc,uBAAuB,mDAAmD;AAAA,IACpG;AAEA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUE,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,UAAI,wBAAwB;AAC3B,cAAM,uBAAuB,EAAE;AAAA,MAChC;AACA,YAAM,SAAS,MAAM,GAAG,WAAW;AAAA,QAClCC,yBAAAA,yBAAyB,yBAAyB,OAAO,IAAI,kBAAkB;AAAA,MAAA;AAIhF,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA;AAAA,UACC,OAAO;AAAA,UACP,OAAO,OAAO;AAAA,UACd,SAAS,SAAS;AAAA,UAClB,aAAa,SAAS;AAAA,QAAA;AAAA,QAEvB;AAAA,UACC,SAAS,YAAY,eAAe;AAAA,UACpC,WAAW,SAAS,MAAM;AAAA,QAAA;AAAA,MAC3B;AAAA,IAEF,CAAC;AACD,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAa,mBAAmB,WAA4BC,SAAoD;AAC/G,UAAM,WAAW,MAAM,UAAU,aAAa,MAAMC,iBAAAA,iBAAiB,QAAQD,SAAO,cAAc,CAAC;AACnG,UAAM,aAAaE,MAAAA,cAAc,EAAE,OAAO,UAAA,OAAUF,SAAO,KAAK,UAAU,UAAU,IAAA,GAAO,gBAAgB,SAAS;AACpH,QAAI,CAAC,WAAW,IAAI;AAGnB,aAAO,IAAIL,SAAAA,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAACQ,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAIA,eAAAA,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,WAAW,OAAO,MAAM;AACzC,QAAI,CAAC,UAAU;AACd,YAAM,IAAIC,WAAAA,wBAAwB,iDAAiD;AAAA,IACpF;AAEA,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMC,wBAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAID,WAAAA,wBAAA;AAAA,IACX;AAIA,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,QAAQ;AACnF,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAIT,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,cAAc;AAAA,QAC7E,CAACQ,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AAEA,UAAM,WAAW,OAAO;AACxB,QAAI;AACH,YAAM,UAAU,YAAY,OAAM,OAAM;AACvC,cAAM,GAAG,WAAW,QAAQ,IAAIG,uBAAAA,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,cAAM,GAAG,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,OAAO,IAAI,QAAQ,CAAC;AAG7E,cAAM,KAAK,cAAc,uBAAuB,IAAI,OAAO,WAAW;AAAA,MACvE,CAAC;AAAA,IACF,SAAS,GAAG;AAKX,UAAI,aAAaC,SAAAA,sBAAsB;AACtC,eAAO,IAAIb,SAAAA,cAAc,wBAAwB,mBAAmB,QAAQ,mBAAmB;AAAA,UAC9F,CAACQ,eAAAA,eAAe,GAAG,GAAG;AAAA,QAAA,CACtB;AAAA,MACF;AACA,YAAM;AAAA,IACP;AAEA,QAAI,UAAU;AAKb,YAAM,oBAAoB,KAAK,yBAAyB,OAAO,WAAW;AAAA,QACzE,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,YAAM,UAAUN,oBAAAA,oBAAoB,UAAU,IAAI;AAClD,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA,EAAE,OAAO,UAAU,UAAU,SAAS,SAAS,MAAM,aAAa,SAAS,KAAA;AAAA,QAC3E,EAAE,WAAW,SAAS,MAAM,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEhD;AAEA,WAAO,IAAIE,SAAAA,WAAW,EAAE,UAAU,OAAO,IAAI,UAAU,CAACI,eAAAA,eAAe,GAAG,GAAG,aAAa;AAAA,EAC3F;AACD;;"}
+{"version":3,"file":"EmailChangeManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailChangeManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext, PermissionContextFactory } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { ApiKeyManager } from './apiKey/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { normalizeEmail } from '../utils/email.js'\nimport { PersonToken } from '../type/index.js'\nimport { UniqueViolationError } from '@contember/database'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailChangeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\t/**\n\t * Request an e-mail change. Validation and rate-limiting run BEFORE any\n\t * write, so a rejected request never leaves a half-applied profile (e.g. a\n\t * persisted name change without the e-mail change going through). Any\n\t * immediate side-changes the caller wants applied atomically with the token\n\t * (the name change) are passed via `applyWithinTransaction`.\n\t */\n\tpublic async requestEmailChange(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tnewEmail: string,\n\t\tmailOptions: MailOptions = {},\n\t\tapplyWithinTransaction?: (db: DatabaseContext) => Promise<void>,\n\t): Promise<RequestEmailChangeResponse> {\n\t\tconst normalizedNewEmail = normalizeEmail(newEmail)\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t}\n\n\t\t// Per-recipient exponential backoff: an authenticated user (or a hijacked\n\t\t// session) must not be able to flood an arbitrary address with\n\t\t// \"confirm your new e-mail\" mails. Keyed on the normalized NEW address so\n\t\t// the `email_change_init` auth-log entries (written with the same\n\t\t// normalized address) actually drive the backoff. Reuses login_* config.\n\t\tconst retryAfter = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(normalizedNewEmail, 'email_change_init', 'email_change_complete'),\n\t\t)\n\t\tif (retryAfter > 0) {\n\t\t\treturn new ResponseError('RATE_LIMIT_EXCEEDED', 'Too many e-mail change requests for this address.')\n\t\t}\n\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait dbContext.transaction(async db => {\n\t\t\tif (applyWithinTransaction) {\n\t\t\t\tawait applyWithinTransaction(db)\n\t\t\t}\n\t\t\tconst result = await db.commandBus.execute(\n\t\t\t\tCreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail),\n\t\t\t)\n\t\t\t// The verification link goes to the NEW address — clicking it proves\n\t\t\t// ownership of the address being switched to, which is the whole point.\n\t\t\tawait this.mailer.sendEmailChangeVerifyEmail(\n\t\t\t\tdb,\n\t\t\t\t{\n\t\t\t\t\temail: normalizedNewEmail,\n\t\t\t\t\ttoken: result.token,\n\t\t\t\t\tproject: project?.name,\n\t\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t\t},\n\t\t\t)\n\t\t})\n\t\treturn new ResponseOk(null)\n\t}\n\n\tpublic async confirmEmailChange(dbContext: DatabaseContext, token: string): Promise<ConfirmEmailChangeResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_change'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Tie the failure to a person/token in the audit log when we can, even\n\t\t\t// for an invalid/expired token (matches verifyEmail / password reset).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst newEmail = validation.result.meta?.email\n\t\tif (!newEmail) {\n\t\t\tthrow new ImplementationException('email_change token is missing its email payload')\n\t\t}\n\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Re-check uniqueness at confirmation time: another account may have\n\t\t// claimed the address between request and confirmation.\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, newEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\n\t\tconst oldEmail = person.email\n\t\ttry {\n\t\t\tawait dbContext.transaction(async db => {\n\t\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(person.id, newEmail))\n\t\t\t\t// An email change is a takeover-grade event: drop every existing\n\t\t\t\t// session so a stale attacker session cannot ride the new address.\n\t\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id)\n\t\t\t})\n\t\t} catch (e) {\n\t\t\t// The uniqueness re-check above narrows but cannot fully close the\n\t\t\t// window: another account may claim the address between the check and\n\t\t\t// this UPDATE. The unique index is the real guard — translate its\n\t\t\t// violation into a clean error instead of leaking a 500.\n\t\t\tif (e instanceof UniqueViolationError) {\n\t\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${newEmail} already exists`, {\n\t\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\n\t\tif (oldEmail) {\n\t\t\t// Resolve the person's preferred project so a per-project\n\t\t\t// EMAIL_CHANGE_NOTIFY template (and branding) is honoured, mirroring\n\t\t\t// requestEmailChange. The token carries no project, so derive it from the\n\t\t\t// person's own identity.\n\t\t\tconst permissionContext = this.permissionContextFactory.create(dbContext, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, null)\n\t\t\tawait this.mailer.sendEmailChangeNotifyEmail(\n\t\t\t\tdbContext,\n\t\t\t\t{ email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },\n\t\t\t\t{ projectId: project?.id ?? null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn new ResponseOk({ personId: person.id, newEmail, [AuthLogService.Key]: authLogData })\n\t}\n}\n\nexport type RequestEmailChangeResponse = Response<null, EmailValidatorError | 'RATE_LIMIT_EXCEEDED'>\n\nexport type ConfirmEmailChangeResponse = Response<\n\t{ personId: string; newEmail: string; [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError | EmailValidatorError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":["normalizeEmail","ResponseError","NextMailAttemptQuery","getPreferredProject","CreatePersonTokenCommand","ResponseOk","token","PersonTokenQuery","validateToken","AuthLogService","ImplementationException","PersonQuery","InvalidateTokenCommand","MarkEmailVerifiedCommand","UniqueViolationError"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAwBO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,QACA,gBACA,gBACA,eACA,0BAChB;AALgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,iBAAA;AACA,SAAA,gBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,mBACZ,WACA,mBACA,QACA,UACA,cAA2B,CAAA,GAC3B,wBACsC;AACtC,UAAM,qBAAqBA,MAAAA,eAAe,QAAQ;AAClD,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,kBAAkB;AAC7F,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAIC,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,IAC7E;AAOA,UAAM,aAAa,MAAM,UAAU,aAAa;AAAA,MAC/C,IAAIC,qBAAAA,qBAAqB,oBAAoB,qBAAqB,uBAAuB;AAAA,IAAA;AAE1F,QAAI,aAAa,GAAG;AACnB,aAAO,IAAID,SAAAA,cAAc,uBAAuB,mDAAmD;AAAA,IACpG;AAEA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUE,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,UAAI,wBAAwB;AAC3B,cAAM,uBAAuB,EAAE;AAAA,MAChC;AACA,YAAM,SAAS,MAAM,GAAG,WAAW;AAAA,QAClCC,yBAAAA,yBAAyB,yBAAyB,OAAO,IAAI,kBAAkB;AAAA,MAAA;AAIhF,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA;AAAA,UACC,OAAO;AAAA,UACP,OAAO,OAAO;AAAA,UACd,SAAS,SAAS;AAAA,UAClB,aAAa,SAAS;AAAA,QAAA;AAAA,QAEvB;AAAA,UACC,SAAS,YAAY,eAAe;AAAA,UACpC,WAAW,SAAS,MAAM;AAAA,QAAA;AAAA,MAC3B;AAAA,IAEF,CAAC;AACD,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAa,mBAAmB,WAA4BC,SAAoD;AAC/G,UAAM,WAAW,MAAM,UAAU,aAAa,MAAMC,iBAAAA,iBAAiB,QAAQD,SAAO,cAAc,CAAC;AACnG,UAAM,aAAaE,MAAAA,cAAc,EAAE,OAAO,iBAAUF,SAAO,gBAAgB,SAAS;AACpF,QAAI,CAAC,WAAW,IAAI;AAGnB,aAAO,IAAIL,SAAAA,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAACQ,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAIA,eAAAA,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,WAAW,OAAO,MAAM;AACzC,QAAI,CAAC,UAAU;AACd,YAAM,IAAIC,WAAAA,wBAAwB,iDAAiD;AAAA,IACpF;AAEA,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMC,wBAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAID,WAAAA,wBAAA;AAAA,IACX;AAIA,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,QAAQ;AACnF,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAIT,SAAAA,cAAc,gBAAgB,OAAO,gBAAgB,cAAc;AAAA,QAC7E,CAACQ,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AAEA,UAAM,WAAW,OAAO;AACxB,QAAI;AACH,YAAM,UAAU,YAAY,OAAM,OAAM;AACvC,cAAM,GAAG,WAAW,QAAQ,IAAIG,uBAAAA,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,cAAM,GAAG,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,OAAO,IAAI,QAAQ,CAAC;AAG7E,cAAM,KAAK,cAAc,uBAAuB,IAAI,OAAO,WAAW;AAAA,MACvE,CAAC;AAAA,IACF,SAAS,GAAG;AAKX,UAAI,aAAaC,SAAAA,sBAAsB;AACtC,eAAO,IAAIb,SAAAA,cAAc,wBAAwB,mBAAmB,QAAQ,mBAAmB;AAAA,UAC9F,CAACQ,eAAAA,eAAe,GAAG,GAAG;AAAA,QAAA,CACtB;AAAA,MACF;AACA,YAAM;AAAA,IACP;AAEA,QAAI,UAAU;AAKb,YAAM,oBAAoB,KAAK,yBAAyB,OAAO,WAAW;AAAA,QACzE,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,YAAM,UAAUN,oBAAAA,oBAAoB,UAAU,IAAI;AAClD,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA,EAAE,OAAO,UAAU,UAAU,SAAS,SAAS,MAAM,aAAa,SAAS,KAAA;AAAA,QAC3E,EAAE,WAAW,SAAS,MAAM,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEhD;AAEA,WAAO,IAAIE,SAAAA,WAAW,EAAE,UAAU,OAAO,IAAI,UAAU,CAACI,eAAAA,eAAe,GAAG,GAAG,aAAa;AAAA,EAC3F;AACD;;"}

package/dist/development/src/model/service/EmailChangeManager.js

@@ -6,8 +6,9 @@ import { ImplementationException } from "../../exceptions.js";
 import { PersonQuery } from "../queries/person/PersonQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 import { getPreferredProject } from "./helpers/getPreferredProject.js";
 import { validateToken } from "../utils/token.js";
@@ -39,10 +40,10 @@ class EmailChangeManager {
     if (validationError !== null) {
       return new ResponseError(validationError.error, validationError.errorMessage);
     }
-    const nextAllowed = await dbContext.queryHandler.fetch(
+    const retryAfter = await dbContext.queryHandler.fetch(
       new NextMailAttemptQuery(normalizedNewEmail, "email_change_init", "email_change_complete")
     );
-    if (nextAllowed > dbContext.providers.now()) {
+    if (retryAfter > 0) {
       return new ResponseError("RATE_LIMIT_EXCEEDED", "Too many e-mail change requests for this address.");
     }
     const projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext);
@@ -72,7 +73,7 @@ class EmailChangeManager {
   }
   async confirmEmailChange(dbContext, token) {
     const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, "email_change"));
-    const validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: "token" });
+    const validation = validateToken({ entry: tokenRow, token, validationType: "token" });
     if (!validation.ok) {
       return new ResponseError(validation.error, validation.errorMessage, {
         [AuthLogService.Key]: new AuthLogService.Bag(

package/dist/development/src/model/service/EmailChangeManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"EmailChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailChangeManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext, PermissionContextFactory } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { ApiKeyManager } from './apiKey/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { normalizeEmail } from '../utils/email.js'\nimport { PersonToken } from '../type/index.js'\nimport { UniqueViolationError } from '@contember/database'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailChangeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\t/**\n\t * Request an e-mail change. Validation and rate-limiting run BEFORE any\n\t * write, so a rejected request never leaves a half-applied profile (e.g. a\n\t * persisted name change without the e-mail change going through). Any\n\t * immediate side-changes the caller wants applied atomically with the token\n\t * (the name change) are passed via `applyWithinTransaction`.\n\t */\n\tpublic async requestEmailChange(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tnewEmail: string,\n\t\tmailOptions: MailOptions = {},\n\t\tapplyWithinTransaction?: (db: DatabaseContext) => Promise<void>,\n\t): Promise<RequestEmailChangeResponse> {\n\t\tconst normalizedNewEmail = normalizeEmail(newEmail)\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t}\n\n\t\t// Per-recipient exponential backoff: an authenticated user (or a hijacked\n\t\t// session) must not be able to flood an arbitrary address with\n\t\t// \"confirm your new e-mail\" mails. Keyed on the normalized NEW address so\n\t\t// the `email_change_init` auth-log entries (written with the same\n\t\t// normalized address) actually drive the backoff. Reuses login_* config.\n\t\tconst nextAllowed = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(normalizedNewEmail, 'email_change_init', 'email_change_complete'),\n\t\t)\n\t\tif (nextAllowed > dbContext.providers.now()) {\n\t\t\treturn new ResponseError('RATE_LIMIT_EXCEEDED', 'Too many e-mail change requests for this address.')\n\t\t}\n\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait dbContext.transaction(async db => {\n\t\t\tif (applyWithinTransaction) {\n\t\t\t\tawait applyWithinTransaction(db)\n\t\t\t}\n\t\t\tconst result = await db.commandBus.execute(\n\t\t\t\tCreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail),\n\t\t\t)\n\t\t\t// The verification link goes to the NEW address — clicking it proves\n\t\t\t// ownership of the address being switched to, which is the whole point.\n\t\t\tawait this.mailer.sendEmailChangeVerifyEmail(\n\t\t\t\tdb,\n\t\t\t\t{\n\t\t\t\t\temail: normalizedNewEmail,\n\t\t\t\t\ttoken: result.token,\n\t\t\t\t\tproject: project?.name,\n\t\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t\t},\n\t\t\t)\n\t\t})\n\t\treturn new ResponseOk(null)\n\t}\n\n\tpublic async confirmEmailChange(dbContext: DatabaseContext, token: string): Promise<ConfirmEmailChangeResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_change'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Tie the failure to a person/token in the audit log when we can, even\n\t\t\t// for an invalid/expired token (matches verifyEmail / password reset).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst newEmail = validation.result.meta?.email\n\t\tif (!newEmail) {\n\t\t\tthrow new ImplementationException('email_change token is missing its email payload')\n\t\t}\n\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Re-check uniqueness at confirmation time: another account may have\n\t\t// claimed the address between request and confirmation.\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, newEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\n\t\tconst oldEmail = person.email\n\t\ttry {\n\t\t\tawait dbContext.transaction(async db => {\n\t\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(person.id, newEmail))\n\t\t\t\t// An email change is a takeover-grade event: drop every existing\n\t\t\t\t// session so a stale attacker session cannot ride the new address.\n\t\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id)\n\t\t\t})\n\t\t} catch (e) {\n\t\t\t// The uniqueness re-check above narrows but cannot fully close the\n\t\t\t// window: another account may claim the address between the check and\n\t\t\t// this UPDATE. The unique index is the real guard — translate its\n\t\t\t// violation into a clean error instead of leaking a 500.\n\t\t\tif (e instanceof UniqueViolationError) {\n\t\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${newEmail} already exists`, {\n\t\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\n\t\tif (oldEmail) {\n\t\t\t// Resolve the person's preferred project so a per-project\n\t\t\t// EMAIL_CHANGE_NOTIFY template (and branding) is honoured, mirroring\n\t\t\t// requestEmailChange. The token carries no project, so derive it from the\n\t\t\t// person's own identity.\n\t\t\tconst permissionContext = this.permissionContextFactory.create(dbContext, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, null)\n\t\t\tawait this.mailer.sendEmailChangeNotifyEmail(\n\t\t\t\tdbContext,\n\t\t\t\t{ email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },\n\t\t\t\t{ projectId: project?.id ?? null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn new ResponseOk({ personId: person.id, newEmail, [AuthLogService.Key]: authLogData })\n\t}\n}\n\nexport type RequestEmailChangeResponse = Response<null, EmailValidatorError | 'RATE_LIMIT_EXCEEDED'>\n\nexport type ConfirmEmailChangeResponse = Response<\n\t{ personId: string; newEmail: string; [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError | EmailValidatorError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAwBO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,QACA,gBACA,gBACA,eACA,0BAChB;AALgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,iBAAA;AACA,SAAA,gBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,mBACZ,WACA,mBACA,QACA,UACA,cAA2B,CAAA,GAC3B,wBACsC;AACtC,UAAM,qBAAqB,eAAe,QAAQ;AAClD,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,kBAAkB;AAC7F,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,IAC7E;AAOA,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAI,qBAAqB,oBAAoB,qBAAqB,uBAAuB;AAAA,IAAA;AAE1F,QAAI,cAAc,UAAU,UAAU,IAAA,GAAO;AAC5C,aAAO,IAAI,cAAc,uBAAuB,mDAAmD;AAAA,IACpG;AAEA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,UAAI,wBAAwB;AAC3B,cAAM,uBAAuB,EAAE;AAAA,MAChC;AACA,YAAM,SAAS,MAAM,GAAG,WAAW;AAAA,QAClC,yBAAyB,yBAAyB,OAAO,IAAI,kBAAkB;AAAA,MAAA;AAIhF,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA;AAAA,UACC,OAAO;AAAA,UACP,OAAO,OAAO;AAAA,UACd,SAAS,SAAS;AAAA,UAClB,aAAa,SAAS;AAAA,QAAA;AAAA,QAEvB;AAAA,UACC,SAAS,YAAY,eAAe;AAAA,UACpC,WAAW,SAAS,MAAM;AAAA,QAAA;AAAA,MAC3B;AAAA,IAEF,CAAC;AACD,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAa,mBAAmB,WAA4B,OAAoD;AAC/G,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,iBAAiB,QAAQ,OAAO,cAAc,CAAC;AACnG,UAAM,aAAa,cAAc,EAAE,OAAO,UAAU,OAAO,KAAK,UAAU,UAAU,IAAA,GAAO,gBAAgB,SAAS;AACpH,QAAI,CAAC,WAAW,IAAI;AAGnB,aAAO,IAAI,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAI,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,WAAW,OAAO,MAAM;AACzC,QAAI,CAAC,UAAU;AACd,YAAM,IAAI,wBAAwB,iDAAiD;AAAA,IACpF;AAEA,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAA;AAAA,IACX;AAIA,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,QAAQ;AACnF,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,cAAc;AAAA,QAC7E,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AAEA,UAAM,WAAW,OAAO;AACxB,QAAI;AACH,YAAM,UAAU,YAAY,OAAM,OAAM;AACvC,cAAM,GAAG,WAAW,QAAQ,IAAI,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,cAAM,GAAG,WAAW,QAAQ,IAAI,yBAAyB,OAAO,IAAI,QAAQ,CAAC;AAG7E,cAAM,KAAK,cAAc,uBAAuB,IAAI,OAAO,WAAW;AAAA,MACvE,CAAC;AAAA,IACF,SAAS,GAAG;AAKX,UAAI,aAAa,sBAAsB;AACtC,eAAO,IAAI,cAAc,wBAAwB,mBAAmB,QAAQ,mBAAmB;AAAA,UAC9F,CAAC,eAAe,GAAG,GAAG;AAAA,QAAA,CACtB;AAAA,MACF;AACA,YAAM;AAAA,IACP;AAEA,QAAI,UAAU;AAKb,YAAM,oBAAoB,KAAK,yBAAyB,OAAO,WAAW;AAAA,QACzE,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,YAAM,UAAU,oBAAoB,UAAU,IAAI;AAClD,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA,EAAE,OAAO,UAAU,UAAU,SAAS,SAAS,MAAM,aAAa,SAAS,KAAA;AAAA,QAC3E,EAAE,WAAW,SAAS,MAAM,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEhD;AAEA,WAAO,IAAI,WAAW,EAAE,UAAU,OAAO,IAAI,UAAU,CAAC,eAAe,GAAG,GAAG,aAAa;AAAA,EAC3F;AACD;"}
+{"version":3,"file":"EmailChangeManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailChangeManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext, PermissionContextFactory } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { ApiKeyManager } from './apiKey/index.js'\nimport { EmailValidator, EmailValidatorError } from './EmailValidator.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { normalizeEmail } from '../utils/email.js'\nimport { PersonToken } from '../type/index.js'\nimport { UniqueViolationError } from '@contember/database'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailChangeManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly permissionContextFactory: PermissionContextFactory,\n\t) {}\n\n\t/**\n\t * Request an e-mail change. Validation and rate-limiting run BEFORE any\n\t * write, so a rejected request never leaves a half-applied profile (e.g. a\n\t * persisted name change without the e-mail change going through). Any\n\t * immediate side-changes the caller wants applied atomically with the token\n\t * (the name change) are passed via `applyWithinTransaction`.\n\t */\n\tpublic async requestEmailChange(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tnewEmail: string,\n\t\tmailOptions: MailOptions = {},\n\t\tapplyWithinTransaction?: (db: DatabaseContext) => Promise<void>,\n\t): Promise<RequestEmailChangeResponse> {\n\t\tconst normalizedNewEmail = normalizeEmail(newEmail)\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, normalizedNewEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage)\n\t\t}\n\n\t\t// Per-recipient exponential backoff: an authenticated user (or a hijacked\n\t\t// session) must not be able to flood an arbitrary address with\n\t\t// \"confirm your new e-mail\" mails. Keyed on the normalized NEW address so\n\t\t// the `email_change_init` auth-log entries (written with the same\n\t\t// normalized address) actually drive the backoff. Reuses login_* config.\n\t\tconst retryAfter = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(normalizedNewEmail, 'email_change_init', 'email_change_complete'),\n\t\t)\n\t\tif (retryAfter > 0) {\n\t\t\treturn new ResponseError('RATE_LIMIT_EXCEEDED', 'Too many e-mail change requests for this address.')\n\t\t}\n\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait dbContext.transaction(async db => {\n\t\t\tif (applyWithinTransaction) {\n\t\t\t\tawait applyWithinTransaction(db)\n\t\t\t}\n\t\t\tconst result = await db.commandBus.execute(\n\t\t\t\tCreatePersonTokenCommand.createEmailChangeRequest(person.id, normalizedNewEmail),\n\t\t\t)\n\t\t\t// The verification link goes to the NEW address — clicking it proves\n\t\t\t// ownership of the address being switched to, which is the whole point.\n\t\t\tawait this.mailer.sendEmailChangeVerifyEmail(\n\t\t\t\tdb,\n\t\t\t\t{\n\t\t\t\t\temail: normalizedNewEmail,\n\t\t\t\t\ttoken: result.token,\n\t\t\t\t\tproject: project?.name,\n\t\t\t\t\tprojectSlug: project?.slug,\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t\t},\n\t\t\t)\n\t\t})\n\t\treturn new ResponseOk(null)\n\t}\n\n\tpublic async confirmEmailChange(dbContext: DatabaseContext, token: string): Promise<ConfirmEmailChangeResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_change'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Tie the failure to a person/token in the audit log when we can, even\n\t\t\t// for an invalid/expired token (matches verifyEmail / password reset).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst newEmail = validation.result.meta?.email\n\t\tif (!newEmail) {\n\t\t\tthrow new ImplementationException('email_change token is missing its email payload')\n\t\t}\n\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Re-check uniqueness at confirmation time: another account may have\n\t\t// claimed the address between request and confirmation.\n\t\tconst validationError = await this.emailValidator.validateEmail(dbContext, newEmail)\n\t\tif (validationError !== null) {\n\t\t\treturn new ResponseError(validationError.error, validationError.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\n\t\tconst oldEmail = person.email\n\t\ttry {\n\t\t\tawait dbContext.transaction(async db => {\n\t\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(person.id, newEmail))\n\t\t\t\t// An email change is a takeover-grade event: drop every existing\n\t\t\t\t// session so a stale attacker session cannot ride the new address.\n\t\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, person.identity_id)\n\t\t\t})\n\t\t} catch (e) {\n\t\t\t// The uniqueness re-check above narrows but cannot fully close the\n\t\t\t// window: another account may claim the address between the check and\n\t\t\t// this UPDATE. The unique index is the real guard — translate its\n\t\t\t// violation into a clean error instead of leaking a 500.\n\t\t\tif (e instanceof UniqueViolationError) {\n\t\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${newEmail} already exists`, {\n\t\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\n\t\tif (oldEmail) {\n\t\t\t// Resolve the person's preferred project so a per-project\n\t\t\t// EMAIL_CHANGE_NOTIFY template (and branding) is honoured, mirroring\n\t\t\t// requestEmailChange. The token carries no project, so derive it from the\n\t\t\t// person's own identity.\n\t\t\tconst permissionContext = this.permissionContextFactory.create(dbContext, {\n\t\t\t\tid: person.identity_id,\n\t\t\t\troles: person.roles,\n\t\t\t})\n\t\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\t\tconst project = getPreferredProject(projects, null)\n\t\t\tawait this.mailer.sendEmailChangeNotifyEmail(\n\t\t\t\tdbContext,\n\t\t\t\t{ email: oldEmail, newEmail, project: project?.name, projectSlug: project?.slug },\n\t\t\t\t{ projectId: project?.id ?? null, variant: '' },\n\t\t\t)\n\t\t}\n\n\t\treturn new ResponseOk({ personId: person.id, newEmail, [AuthLogService.Key]: authLogData })\n\t}\n}\n\nexport type RequestEmailChangeResponse = Response<null, EmailValidatorError | 'RATE_LIMIT_EXCEEDED'>\n\nexport type ConfirmEmailChangeResponse = Response<\n\t{ personId: string; newEmail: string; [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError | EmailValidatorError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAwBO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,QACA,gBACA,gBACA,eACA,0BAChB;AALgB,SAAA,SAAA;AACA,SAAA,iBAAA;AACA,SAAA,iBAAA;AACA,SAAA,gBAAA;AACA,SAAA,2BAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,mBACZ,WACA,mBACA,QACA,UACA,cAA2B,CAAA,GAC3B,wBACsC;AACtC,UAAM,qBAAqB,eAAe,QAAQ;AAClD,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,kBAAkB;AAC7F,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,YAAY;AAAA,IAC7E;AAOA,UAAM,aAAa,MAAM,UAAU,aAAa;AAAA,MAC/C,IAAI,qBAAqB,oBAAoB,qBAAqB,uBAAuB;AAAA,IAAA;AAE1F,QAAI,aAAa,GAAG;AACnB,aAAO,IAAI,cAAc,uBAAuB,mDAAmD;AAAA,IACpG;AAEA,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,UAAI,wBAAwB;AAC3B,cAAM,uBAAuB,EAAE;AAAA,MAChC;AACA,YAAM,SAAS,MAAM,GAAG,WAAW;AAAA,QAClC,yBAAyB,yBAAyB,OAAO,IAAI,kBAAkB;AAAA,MAAA;AAIhF,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA;AAAA,UACC,OAAO;AAAA,UACP,OAAO,OAAO;AAAA,UACd,SAAS,SAAS;AAAA,UAClB,aAAa,SAAS;AAAA,QAAA;AAAA,QAEvB;AAAA,UACC,SAAS,YAAY,eAAe;AAAA,UACpC,WAAW,SAAS,MAAM;AAAA,QAAA;AAAA,MAC3B;AAAA,IAEF,CAAC;AACD,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AAAA,EAEA,MAAa,mBAAmB,WAA4B,OAAoD;AAC/G,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,iBAAiB,QAAQ,OAAO,cAAc,CAAC;AACnG,UAAM,aAAa,cAAc,EAAE,OAAO,UAAU,OAAO,gBAAgB,SAAS;AACpF,QAAI,CAAC,WAAW,IAAI;AAGnB,aAAO,IAAI,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAI,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,WAAW,WAAW,OAAO,MAAM;AACzC,QAAI,CAAC,UAAU;AACd,YAAM,IAAI,wBAAwB,iDAAiD;AAAA,IACpF;AAEA,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAA;AAAA,IACX;AAIA,UAAM,kBAAkB,MAAM,KAAK,eAAe,cAAc,WAAW,QAAQ;AACnF,QAAI,oBAAoB,MAAM;AAC7B,aAAO,IAAI,cAAc,gBAAgB,OAAO,gBAAgB,cAAc;AAAA,QAC7E,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AAEA,UAAM,WAAW,OAAO;AACxB,QAAI;AACH,YAAM,UAAU,YAAY,OAAM,OAAM;AACvC,cAAM,GAAG,WAAW,QAAQ,IAAI,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,cAAM,GAAG,WAAW,QAAQ,IAAI,yBAAyB,OAAO,IAAI,QAAQ,CAAC;AAG7E,cAAM,KAAK,cAAc,uBAAuB,IAAI,OAAO,WAAW;AAAA,MACvE,CAAC;AAAA,IACF,SAAS,GAAG;AAKX,UAAI,aAAa,sBAAsB;AACtC,eAAO,IAAI,cAAc,wBAAwB,mBAAmB,QAAQ,mBAAmB;AAAA,UAC9F,CAAC,eAAe,GAAG,GAAG;AAAA,QAAA,CACtB;AAAA,MACF;AACA,YAAM;AAAA,IACP;AAEA,QAAI,UAAU;AAKb,YAAM,oBAAoB,KAAK,yBAAyB,OAAO,WAAW;AAAA,QACzE,IAAI,OAAO;AAAA,QACX,OAAO,OAAO;AAAA,MAAA,CACd;AACD,YAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,YAAM,UAAU,oBAAoB,UAAU,IAAI;AAClD,YAAM,KAAK,OAAO;AAAA,QACjB;AAAA,QACA,EAAE,OAAO,UAAU,UAAU,SAAS,SAAS,MAAM,aAAa,SAAS,KAAA;AAAA,QAC3E,EAAE,WAAW,SAAS,MAAM,MAAM,SAAS,GAAA;AAAA,MAAG;AAAA,IAEhD;AAEA,WAAO,IAAI,WAAW,EAAE,UAAU,OAAO,IAAI,UAAU,CAAC,eAAe,GAAG,GAAG,aAAa;AAAA,EAC3F;AACD;"}