@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/development/src/model/service/EmailOtpManager.cjs

@@ -68,7 +68,6 @@ class EmailOtpManager {
     const validation = token.validateToken({
       entry: tokenResult,
       token: code,
-      now: this.providers.now(),
       validationType: "otp"
     });
     if (!validation.ok) {

package/dist/development/src/model/service/EmailOtpManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"EmailOtpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailOtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries/index.js'\nimport { DatabaseContext, MAX_OTP_ATTEMPTS, validateToken } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ClaimOtpAttemptCommand, InvalidateEmailOtpTokensCommand, InvalidateTokenCommand, SaveEmailOtpTokenCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { RateLimitDecision, RateLimiter } from './RateLimiter.js'\nimport { RateLimitScopes } from '../type/RateLimit.js'\nimport { Config } from '../type/Config.js'\n\n/** Email-OTP codes are short-lived numeric codes delivered by email. */\nconst EMAIL_OTP_EXPIRATION_MINUTES = 10\nconst EMAIL_OTP_DIGITS = 6\n\n/**\n * Email OTP as a second factor (A05). Opt-in per person via\n * `person_mfa.email_otp_enabled`. The emitted code is a 6-digit numeric code,\n * transported through a short-lived `mfa_email_otp` person_token (the code's hash\n * lives in `otp_hash`), validated through the shared `'otp'` token path (max 3\n * attempts). Behavior for anyone who hasn't enabled it is unchanged.\n */\nexport class EmailOtpManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly providers: Pick<Providers, 'randomBytes' | 'now' | 'uuid'>,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\t/**\n\t * Generates a fresh code, invalidates any prior unused email-OTP tokens for the\n\t * person, persists the new one and emails the code. Must run inside the request's\n\t * db context (it issues commands + sends mail).\n\t *\n\t * Gated by the per-person `email_otp_per_person` rate limit so an attacker who\n\t * knows the password cannot re-issue codes to reset the per-code 3-attempt\n\t * counter, nor email-bomb a person. When the limit is hit nothing is sent and\n\t * the returned decision is `ok: false` (the caller decides how to surface it);\n\t * a previously emailed, still-valid code remains usable.\n\t */\n\tasync sendCode(dbContext: DatabaseContext, person: PersonRow, config: Config): Promise<RateLimitDecision> {\n\t\tconst decision = await this.rateLimiter.consume(dbContext, RateLimitScopes.emailOtpPerPerson, person.id, config)\n\t\tif (!decision.ok) {\n\t\t\treturn decision\n\t\t}\n\t\tconst code = await this.generateCode()\n\t\t// Only the latest emailed code may ever verify.\n\t\tawait dbContext.commandBus.execute(new InvalidateEmailOtpTokensCommand(person.id))\n\t\tawait dbContext.commandBus.execute(new SaveEmailOtpTokenCommand(person.id, code, EMAIL_OTP_EXPIRATION_MINUTES))\n\t\tawait this.mailer.sendEmailOtpEmail(dbContext, {\n\t\t\temail: person.email ?? '',\n\t\t\tcode,\n\t\t}, {\n\t\t\tvariant: '',\n\t\t\tprojectId: null,\n\t\t})\n\t\treturn decision\n\t}\n\n\t/**\n\t * Fetches the latest unused email-OTP token for the person and validates the\n\t * supplied code via the shared `'otp'` path; on success, consumes (invalidates)\n\t * the token. Returns whether the code was accepted.\n\t *\n\t * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}\n\t * — a single conditional UPDATE that increments `otp_attempts` only while it is\n\t * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent\n\t * writers on the row, N parallel guesses can never collectively exceed the cap;\n\t * a plain read-then-increment let them all pass with a stale counter.\n\t */\n\tasync verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean> {\n\t\tconst tokenResult = await dbContext.queryHandler.fetch(PersonTokenQuery.latestUnusedByPerson(person.id, 'mfa_email_otp'))\n\t\tif (!tokenResult) {\n\t\t\treturn false\n\t\t}\n\t\t// Atomically reserve a guess slot before comparing the code. A false result\n\t\t// means the token was already used/replaced or the attempt cap is exhausted.\n\t\tconst reserved = await dbContext.commandBus.execute(new ClaimOtpAttemptCommand(tokenResult.id, MAX_OTP_ATTEMPTS))\n\t\tif (!reserved) {\n\t\t\treturn false\n\t\t}\n\t\t// otp_hash and expires_at are immutable for a token, so validating against the\n\t\t// pre-claim snapshot is correct; the attempt has already been counted.\n\t\tconst validation = validateToken({\n\t\t\tentry: tokenResult,\n\t\t\ttoken: code,\n\t\t\tnow: this.providers.now(),\n\t\t\tvalidationType: 'otp',\n\t\t})\n\t\tif (!validation.ok) {\n\t\t\treturn false\n\t\t}\n\t\tawait dbContext.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\treturn true\n\t}\n\n\tprivate async generateCode(): Promise<string> {\n\t\t// Rejection-free uniform-ish digits is acceptable here: this is a second factor\n\t\t// behind a valid password, short-lived, and capped at 3 attempts.\n\t\tconst bytes = await this.providers.randomBytes(EMAIL_OTP_DIGITS)\n\t\tlet code = ''\n\t\tfor (let i = 0; i < EMAIL_OTP_DIGITS; i++) {\n\t\t\tcode += (bytes[i] % 10).toString()\n\t\t}\n\t\treturn code\n\t}\n}\n"],"names":["RateLimitScopes","InvalidateEmailOtpTokensCommand","SaveEmailOtpTokenCommand","PersonTokenQuery","ClaimOtpAttemptCommand","MAX_OTP_ATTEMPTS","validateToken","InvalidateTokenCommand"],"mappings":";;;;;;;;;;;AAWA,MAAM,+BAA+B;AACrC,MAAM,mBAAmB;AASlB,MAAM,gBAAgB;AAAA,EAC5B,YACkB,QACA,WACA,aAChB;AAHgB,SAAA,SAAA;AACA,SAAA,YAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaH,MAAM,SAAS,WAA4B,QAAmB,QAA4C;AACzG,UAAM,WAAW,MAAM,KAAK,YAAY,QAAQ,WAAWA,UAAAA,gBAAgB,mBAAmB,OAAO,IAAI,MAAM;AAC/G,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,aAAA;AAExB,UAAM,UAAU,WAAW,QAAQ,IAAIC,gCAAAA,gCAAgC,OAAO,EAAE,CAAC;AACjF,UAAM,UAAU,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,OAAO,IAAI,MAAM,4BAA4B,CAAC;AAC9G,UAAM,KAAK,OAAO,kBAAkB,WAAW;AAAA,MAC9C,OAAO,OAAO,SAAS;AAAA,MACvB;AAAA,IAAA,GACE;AAAA,MACF,SAAS;AAAA,MACT,WAAW;AAAA,IAAA,CACX;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,iBAAiB,WAA4B,QAAmB,MAAgC;AACrG,UAAM,cAAc,MAAM,UAAU,aAAa,MAAMC,kCAAiB,qBAAqB,OAAO,IAAI,eAAe,CAAC;AACxH,QAAI,CAAC,aAAa;AACjB,aAAO;AAAA,IACR;AAGA,UAAM,WAAW,MAAM,UAAU,WAAW,QAAQ,IAAIC,uBAAAA,uBAAuB,YAAY,IAAIC,MAAAA,gBAAgB,CAAC;AAChH,QAAI,CAAC,UAAU;AACd,aAAO;AAAA,IACR;AAGA,UAAM,aAAaC,MAAAA,cAAc;AAAA,MAChC,OAAO;AAAA,MACP,OAAO;AAAA,MACP,KAAK,KAAK,UAAU,IAAA;AAAA,MACpB,gBAAgB;AAAA,IAAA,CAChB;AACD,QAAI,CAAC,WAAW,IAAI;AACnB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,uBAAAA,uBAAuB,WAAW,OAAO,EAAE,CAAC;AACnF,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,eAAgC;AAG7C,UAAM,QAAQ,MAAM,KAAK,UAAU,YAAY,gBAAgB;AAC/D,QAAI,OAAO;AACX,aAAS,IAAI,GAAG,IAAI,kBAAkB,KAAK;AAC1C,eAAS,MAAM,CAAC,IAAI,IAAI,SAAA;AAAA,IACzB;AACA,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"EmailOtpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailOtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries/index.js'\nimport { DatabaseContext, MAX_OTP_ATTEMPTS, validateToken } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ClaimOtpAttemptCommand, InvalidateEmailOtpTokensCommand, InvalidateTokenCommand, SaveEmailOtpTokenCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { RateLimitDecision, RateLimiter } from './RateLimiter.js'\nimport { RateLimitScopes } from '../type/RateLimit.js'\nimport { Config } from '../type/Config.js'\n\n/** Email-OTP codes are short-lived numeric codes delivered by email. */\nconst EMAIL_OTP_EXPIRATION_MINUTES = 10\nconst EMAIL_OTP_DIGITS = 6\n\n/**\n * Email OTP as a second factor (A05). Opt-in per person via\n * `person_mfa.email_otp_enabled`. The emitted code is a 6-digit numeric code,\n * transported through a short-lived `mfa_email_otp` person_token (the code's hash\n * lives in `otp_hash`), validated through the shared `'otp'` token path (max 3\n * attempts). Behavior for anyone who hasn't enabled it is unchanged.\n */\nexport class EmailOtpManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly providers: Pick<Providers, 'randomBytes' | 'now' | 'uuid'>,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\t/**\n\t * Generates a fresh code, invalidates any prior unused email-OTP tokens for the\n\t * person, persists the new one and emails the code. Must run inside the request's\n\t * db context (it issues commands + sends mail).\n\t *\n\t * Gated by the per-person `email_otp_per_person` rate limit so an attacker who\n\t * knows the password cannot re-issue codes to reset the per-code 3-attempt\n\t * counter, nor email-bomb a person. When the limit is hit nothing is sent and\n\t * the returned decision is `ok: false` (the caller decides how to surface it);\n\t * a previously emailed, still-valid code remains usable.\n\t */\n\tasync sendCode(dbContext: DatabaseContext, person: PersonRow, config: Config): Promise<RateLimitDecision> {\n\t\tconst decision = await this.rateLimiter.consume(dbContext, RateLimitScopes.emailOtpPerPerson, person.id, config)\n\t\tif (!decision.ok) {\n\t\t\treturn decision\n\t\t}\n\t\tconst code = await this.generateCode()\n\t\t// Only the latest emailed code may ever verify.\n\t\tawait dbContext.commandBus.execute(new InvalidateEmailOtpTokensCommand(person.id))\n\t\tawait dbContext.commandBus.execute(new SaveEmailOtpTokenCommand(person.id, code, EMAIL_OTP_EXPIRATION_MINUTES))\n\t\tawait this.mailer.sendEmailOtpEmail(dbContext, {\n\t\t\temail: person.email ?? '',\n\t\t\tcode,\n\t\t}, {\n\t\t\tvariant: '',\n\t\t\tprojectId: null,\n\t\t})\n\t\treturn decision\n\t}\n\n\t/**\n\t * Fetches the latest unused email-OTP token for the person and validates the\n\t * supplied code via the shared `'otp'` path; on success, consumes (invalidates)\n\t * the token. Returns whether the code was accepted.\n\t *\n\t * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}\n\t * — a single conditional UPDATE that increments `otp_attempts` only while it is\n\t * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent\n\t * writers on the row, N parallel guesses can never collectively exceed the cap;\n\t * a plain read-then-increment let them all pass with a stale counter.\n\t */\n\tasync verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean> {\n\t\tconst tokenResult = await dbContext.queryHandler.fetch(PersonTokenQuery.latestUnusedByPerson(person.id, 'mfa_email_otp'))\n\t\tif (!tokenResult) {\n\t\t\treturn false\n\t\t}\n\t\t// Atomically reserve a guess slot before comparing the code. A false result\n\t\t// means the token was already used/replaced or the attempt cap is exhausted.\n\t\tconst reserved = await dbContext.commandBus.execute(new ClaimOtpAttemptCommand(tokenResult.id, MAX_OTP_ATTEMPTS))\n\t\tif (!reserved) {\n\t\t\treturn false\n\t\t}\n\t\t// otp_hash and expires_at are immutable for a token, so validating against the\n\t\t// pre-claim snapshot is correct; the attempt has already been counted.\n\t\tconst validation = validateToken({\n\t\t\tentry: tokenResult,\n\t\t\ttoken: code,\n\t\t\tvalidationType: 'otp',\n\t\t})\n\t\tif (!validation.ok) {\n\t\t\treturn false\n\t\t}\n\t\tawait dbContext.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\treturn true\n\t}\n\n\tprivate async generateCode(): Promise<string> {\n\t\t// Rejection-free uniform-ish digits is acceptable here: this is a second factor\n\t\t// behind a valid password, short-lived, and capped at 3 attempts.\n\t\tconst bytes = await this.providers.randomBytes(EMAIL_OTP_DIGITS)\n\t\tlet code = ''\n\t\tfor (let i = 0; i < EMAIL_OTP_DIGITS; i++) {\n\t\t\tcode += (bytes[i] % 10).toString()\n\t\t}\n\t\treturn code\n\t}\n}\n"],"names":["RateLimitScopes","InvalidateEmailOtpTokensCommand","SaveEmailOtpTokenCommand","PersonTokenQuery","ClaimOtpAttemptCommand","MAX_OTP_ATTEMPTS","validateToken","InvalidateTokenCommand"],"mappings":";;;;;;;;;;;AAWA,MAAM,+BAA+B;AACrC,MAAM,mBAAmB;AASlB,MAAM,gBAAgB;AAAA,EAC5B,YACkB,QACA,WACA,aAChB;AAHgB,SAAA,SAAA;AACA,SAAA,YAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaH,MAAM,SAAS,WAA4B,QAAmB,QAA4C;AACzG,UAAM,WAAW,MAAM,KAAK,YAAY,QAAQ,WAAWA,UAAAA,gBAAgB,mBAAmB,OAAO,IAAI,MAAM;AAC/G,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,aAAA;AAExB,UAAM,UAAU,WAAW,QAAQ,IAAIC,gCAAAA,gCAAgC,OAAO,EAAE,CAAC;AACjF,UAAM,UAAU,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,OAAO,IAAI,MAAM,4BAA4B,CAAC;AAC9G,UAAM,KAAK,OAAO,kBAAkB,WAAW;AAAA,MAC9C,OAAO,OAAO,SAAS;AAAA,MACvB;AAAA,IAAA,GACE;AAAA,MACF,SAAS;AAAA,MACT,WAAW;AAAA,IAAA,CACX;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,iBAAiB,WAA4B,QAAmB,MAAgC;AACrG,UAAM,cAAc,MAAM,UAAU,aAAa,MAAMC,kCAAiB,qBAAqB,OAAO,IAAI,eAAe,CAAC;AACxH,QAAI,CAAC,aAAa;AACjB,aAAO;AAAA,IACR;AAGA,UAAM,WAAW,MAAM,UAAU,WAAW,QAAQ,IAAIC,uBAAAA,uBAAuB,YAAY,IAAIC,MAAAA,gBAAgB,CAAC;AAChH,QAAI,CAAC,UAAU;AACd,aAAO;AAAA,IACR;AAGA,UAAM,aAAaC,MAAAA,cAAc;AAAA,MAChC,OAAO;AAAA,MACP,OAAO;AAAA,MACP,gBAAgB;AAAA,IAAA,CAChB;AACD,QAAI,CAAC,WAAW,IAAI;AACnB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAIC,uBAAAA,uBAAuB,WAAW,OAAO,EAAE,CAAC;AACnF,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,eAAgC;AAG7C,UAAM,QAAQ,MAAM,KAAK,UAAU,YAAY,gBAAgB;AAC/D,QAAI,OAAO;AACX,aAAS,IAAI,GAAG,IAAI,kBAAkB,KAAK;AAC1C,eAAS,MAAM,CAAC,IAAI,IAAI,SAAA;AAAA,IACzB;AACA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/service/EmailOtpManager.js

@@ -66,7 +66,6 @@ class EmailOtpManager {
     const validation = validateToken({
       entry: tokenResult,
       token: code,
-      now: this.providers.now(),
       validationType: "otp"
     });
     if (!validation.ok) {

package/dist/development/src/model/service/EmailOtpManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"EmailOtpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailOtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries/index.js'\nimport { DatabaseContext, MAX_OTP_ATTEMPTS, validateToken } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ClaimOtpAttemptCommand, InvalidateEmailOtpTokensCommand, InvalidateTokenCommand, SaveEmailOtpTokenCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { RateLimitDecision, RateLimiter } from './RateLimiter.js'\nimport { RateLimitScopes } from '../type/RateLimit.js'\nimport { Config } from '../type/Config.js'\n\n/** Email-OTP codes are short-lived numeric codes delivered by email. */\nconst EMAIL_OTP_EXPIRATION_MINUTES = 10\nconst EMAIL_OTP_DIGITS = 6\n\n/**\n * Email OTP as a second factor (A05). Opt-in per person via\n * `person_mfa.email_otp_enabled`. The emitted code is a 6-digit numeric code,\n * transported through a short-lived `mfa_email_otp` person_token (the code's hash\n * lives in `otp_hash`), validated through the shared `'otp'` token path (max 3\n * attempts). Behavior for anyone who hasn't enabled it is unchanged.\n */\nexport class EmailOtpManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly providers: Pick<Providers, 'randomBytes' | 'now' | 'uuid'>,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\t/**\n\t * Generates a fresh code, invalidates any prior unused email-OTP tokens for the\n\t * person, persists the new one and emails the code. Must run inside the request's\n\t * db context (it issues commands + sends mail).\n\t *\n\t * Gated by the per-person `email_otp_per_person` rate limit so an attacker who\n\t * knows the password cannot re-issue codes to reset the per-code 3-attempt\n\t * counter, nor email-bomb a person. When the limit is hit nothing is sent and\n\t * the returned decision is `ok: false` (the caller decides how to surface it);\n\t * a previously emailed, still-valid code remains usable.\n\t */\n\tasync sendCode(dbContext: DatabaseContext, person: PersonRow, config: Config): Promise<RateLimitDecision> {\n\t\tconst decision = await this.rateLimiter.consume(dbContext, RateLimitScopes.emailOtpPerPerson, person.id, config)\n\t\tif (!decision.ok) {\n\t\t\treturn decision\n\t\t}\n\t\tconst code = await this.generateCode()\n\t\t// Only the latest emailed code may ever verify.\n\t\tawait dbContext.commandBus.execute(new InvalidateEmailOtpTokensCommand(person.id))\n\t\tawait dbContext.commandBus.execute(new SaveEmailOtpTokenCommand(person.id, code, EMAIL_OTP_EXPIRATION_MINUTES))\n\t\tawait this.mailer.sendEmailOtpEmail(dbContext, {\n\t\t\temail: person.email ?? '',\n\t\t\tcode,\n\t\t}, {\n\t\t\tvariant: '',\n\t\t\tprojectId: null,\n\t\t})\n\t\treturn decision\n\t}\n\n\t/**\n\t * Fetches the latest unused email-OTP token for the person and validates the\n\t * supplied code via the shared `'otp'` path; on success, consumes (invalidates)\n\t * the token. Returns whether the code was accepted.\n\t *\n\t * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}\n\t * — a single conditional UPDATE that increments `otp_attempts` only while it is\n\t * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent\n\t * writers on the row, N parallel guesses can never collectively exceed the cap;\n\t * a plain read-then-increment let them all pass with a stale counter.\n\t */\n\tasync verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean> {\n\t\tconst tokenResult = await dbContext.queryHandler.fetch(PersonTokenQuery.latestUnusedByPerson(person.id, 'mfa_email_otp'))\n\t\tif (!tokenResult) {\n\t\t\treturn false\n\t\t}\n\t\t// Atomically reserve a guess slot before comparing the code. A false result\n\t\t// means the token was already used/replaced or the attempt cap is exhausted.\n\t\tconst reserved = await dbContext.commandBus.execute(new ClaimOtpAttemptCommand(tokenResult.id, MAX_OTP_ATTEMPTS))\n\t\tif (!reserved) {\n\t\t\treturn false\n\t\t}\n\t\t// otp_hash and expires_at are immutable for a token, so validating against the\n\t\t// pre-claim snapshot is correct; the attempt has already been counted.\n\t\tconst validation = validateToken({\n\t\t\tentry: tokenResult,\n\t\t\ttoken: code,\n\t\t\tnow: this.providers.now(),\n\t\t\tvalidationType: 'otp',\n\t\t})\n\t\tif (!validation.ok) {\n\t\t\treturn false\n\t\t}\n\t\tawait dbContext.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\treturn true\n\t}\n\n\tprivate async generateCode(): Promise<string> {\n\t\t// Rejection-free uniform-ish digits is acceptable here: this is a second factor\n\t\t// behind a valid password, short-lived, and capped at 3 attempts.\n\t\tconst bytes = await this.providers.randomBytes(EMAIL_OTP_DIGITS)\n\t\tlet code = ''\n\t\tfor (let i = 0; i < EMAIL_OTP_DIGITS; i++) {\n\t\t\tcode += (bytes[i] % 10).toString()\n\t\t}\n\t\treturn code\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AAWA,MAAM,+BAA+B;AACrC,MAAM,mBAAmB;AASlB,MAAM,gBAAgB;AAAA,EAC5B,YACkB,QACA,WACA,aAChB;AAHgB,SAAA,SAAA;AACA,SAAA,YAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaH,MAAM,SAAS,WAA4B,QAAmB,QAA4C;AACzG,UAAM,WAAW,MAAM,KAAK,YAAY,QAAQ,WAAW,gBAAgB,mBAAmB,OAAO,IAAI,MAAM;AAC/G,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,aAAA;AAExB,UAAM,UAAU,WAAW,QAAQ,IAAI,gCAAgC,OAAO,EAAE,CAAC;AACjF,UAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,OAAO,IAAI,MAAM,4BAA4B,CAAC;AAC9G,UAAM,KAAK,OAAO,kBAAkB,WAAW;AAAA,MAC9C,OAAO,OAAO,SAAS;AAAA,MACvB;AAAA,IAAA,GACE;AAAA,MACF,SAAS;AAAA,MACT,WAAW;AAAA,IAAA,CACX;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,iBAAiB,WAA4B,QAAmB,MAAgC;AACrG,UAAM,cAAc,MAAM,UAAU,aAAa,MAAM,iBAAiB,qBAAqB,OAAO,IAAI,eAAe,CAAC;AACxH,QAAI,CAAC,aAAa;AACjB,aAAO;AAAA,IACR;AAGA,UAAM,WAAW,MAAM,UAAU,WAAW,QAAQ,IAAI,uBAAuB,YAAY,IAAI,gBAAgB,CAAC;AAChH,QAAI,CAAC,UAAU;AACd,aAAO;AAAA,IACR;AAGA,UAAM,aAAa,cAAc;AAAA,MAChC,OAAO;AAAA,MACP,OAAO;AAAA,MACP,KAAK,KAAK,UAAU,IAAA;AAAA,MACpB,gBAAgB;AAAA,IAAA,CAChB;AACD,QAAI,CAAC,WAAW,IAAI;AACnB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAI,uBAAuB,WAAW,OAAO,EAAE,CAAC;AACnF,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,eAAgC;AAG7C,UAAM,QAAQ,MAAM,KAAK,UAAU,YAAY,gBAAgB;AAC/D,QAAI,OAAO;AACX,aAAS,IAAI,GAAG,IAAI,kBAAkB,KAAK;AAC1C,eAAS,MAAM,CAAC,IAAI,IAAI,SAAA;AAAA,IACzB;AACA,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"EmailOtpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailOtpManager.ts"],"sourcesContent":["import { PersonRow } from '../queries/index.js'\nimport { DatabaseContext, MAX_OTP_ATTEMPTS, validateToken } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ClaimOtpAttemptCommand, InvalidateEmailOtpTokensCommand, InvalidateTokenCommand, SaveEmailOtpTokenCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { RateLimitDecision, RateLimiter } from './RateLimiter.js'\nimport { RateLimitScopes } from '../type/RateLimit.js'\nimport { Config } from '../type/Config.js'\n\n/** Email-OTP codes are short-lived numeric codes delivered by email. */\nconst EMAIL_OTP_EXPIRATION_MINUTES = 10\nconst EMAIL_OTP_DIGITS = 6\n\n/**\n * Email OTP as a second factor (A05). Opt-in per person via\n * `person_mfa.email_otp_enabled`. The emitted code is a 6-digit numeric code,\n * transported through a short-lived `mfa_email_otp` person_token (the code's hash\n * lives in `otp_hash`), validated through the shared `'otp'` token path (max 3\n * attempts). Behavior for anyone who hasn't enabled it is unchanged.\n */\nexport class EmailOtpManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly providers: Pick<Providers, 'randomBytes' | 'now' | 'uuid'>,\n\t\tprivate readonly rateLimiter: RateLimiter,\n\t) {}\n\n\t/**\n\t * Generates a fresh code, invalidates any prior unused email-OTP tokens for the\n\t * person, persists the new one and emails the code. Must run inside the request's\n\t * db context (it issues commands + sends mail).\n\t *\n\t * Gated by the per-person `email_otp_per_person` rate limit so an attacker who\n\t * knows the password cannot re-issue codes to reset the per-code 3-attempt\n\t * counter, nor email-bomb a person. When the limit is hit nothing is sent and\n\t * the returned decision is `ok: false` (the caller decides how to surface it);\n\t * a previously emailed, still-valid code remains usable.\n\t */\n\tasync sendCode(dbContext: DatabaseContext, person: PersonRow, config: Config): Promise<RateLimitDecision> {\n\t\tconst decision = await this.rateLimiter.consume(dbContext, RateLimitScopes.emailOtpPerPerson, person.id, config)\n\t\tif (!decision.ok) {\n\t\t\treturn decision\n\t\t}\n\t\tconst code = await this.generateCode()\n\t\t// Only the latest emailed code may ever verify.\n\t\tawait dbContext.commandBus.execute(new InvalidateEmailOtpTokensCommand(person.id))\n\t\tawait dbContext.commandBus.execute(new SaveEmailOtpTokenCommand(person.id, code, EMAIL_OTP_EXPIRATION_MINUTES))\n\t\tawait this.mailer.sendEmailOtpEmail(dbContext, {\n\t\t\temail: person.email ?? '',\n\t\t\tcode,\n\t\t}, {\n\t\t\tvariant: '',\n\t\t\tprojectId: null,\n\t\t})\n\t\treturn decision\n\t}\n\n\t/**\n\t * Fetches the latest unused email-OTP token for the person and validates the\n\t * supplied code via the shared `'otp'` path; on success, consumes (invalidates)\n\t * the token. Returns whether the code was accepted.\n\t *\n\t * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}\n\t * — a single conditional UPDATE that increments `otp_attempts` only while it is\n\t * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent\n\t * writers on the row, N parallel guesses can never collectively exceed the cap;\n\t * a plain read-then-increment let them all pass with a stale counter.\n\t */\n\tasync verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean> {\n\t\tconst tokenResult = await dbContext.queryHandler.fetch(PersonTokenQuery.latestUnusedByPerson(person.id, 'mfa_email_otp'))\n\t\tif (!tokenResult) {\n\t\t\treturn false\n\t\t}\n\t\t// Atomically reserve a guess slot before comparing the code. A false result\n\t\t// means the token was already used/replaced or the attempt cap is exhausted.\n\t\tconst reserved = await dbContext.commandBus.execute(new ClaimOtpAttemptCommand(tokenResult.id, MAX_OTP_ATTEMPTS))\n\t\tif (!reserved) {\n\t\t\treturn false\n\t\t}\n\t\t// otp_hash and expires_at are immutable for a token, so validating against the\n\t\t// pre-claim snapshot is correct; the attempt has already been counted.\n\t\tconst validation = validateToken({\n\t\t\tentry: tokenResult,\n\t\t\ttoken: code,\n\t\t\tvalidationType: 'otp',\n\t\t})\n\t\tif (!validation.ok) {\n\t\t\treturn false\n\t\t}\n\t\tawait dbContext.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\treturn true\n\t}\n\n\tprivate async generateCode(): Promise<string> {\n\t\t// Rejection-free uniform-ish digits is acceptable here: this is a second factor\n\t\t// behind a valid password, short-lived, and capped at 3 attempts.\n\t\tconst bytes = await this.providers.randomBytes(EMAIL_OTP_DIGITS)\n\t\tlet code = ''\n\t\tfor (let i = 0; i < EMAIL_OTP_DIGITS; i++) {\n\t\t\tcode += (bytes[i] % 10).toString()\n\t\t}\n\t\treturn code\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;AAWA,MAAM,+BAA+B;AACrC,MAAM,mBAAmB;AASlB,MAAM,gBAAgB;AAAA,EAC5B,YACkB,QACA,WACA,aAChB;AAHgB,SAAA,SAAA;AACA,SAAA,YAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaH,MAAM,SAAS,WAA4B,QAAmB,QAA4C;AACzG,UAAM,WAAW,MAAM,KAAK,YAAY,QAAQ,WAAW,gBAAgB,mBAAmB,OAAO,IAAI,MAAM;AAC/G,QAAI,CAAC,SAAS,IAAI;AACjB,aAAO;AAAA,IACR;AACA,UAAM,OAAO,MAAM,KAAK,aAAA;AAExB,UAAM,UAAU,WAAW,QAAQ,IAAI,gCAAgC,OAAO,EAAE,CAAC;AACjF,UAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,OAAO,IAAI,MAAM,4BAA4B,CAAC;AAC9G,UAAM,KAAK,OAAO,kBAAkB,WAAW;AAAA,MAC9C,OAAO,OAAO,SAAS;AAAA,MACvB;AAAA,IAAA,GACE;AAAA,MACF,SAAS;AAAA,MACT,WAAW;AAAA,IAAA,CACX;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,iBAAiB,WAA4B,QAAmB,MAAgC;AACrG,UAAM,cAAc,MAAM,UAAU,aAAa,MAAM,iBAAiB,qBAAqB,OAAO,IAAI,eAAe,CAAC;AACxH,QAAI,CAAC,aAAa;AACjB,aAAO;AAAA,IACR;AAGA,UAAM,WAAW,MAAM,UAAU,WAAW,QAAQ,IAAI,uBAAuB,YAAY,IAAI,gBAAgB,CAAC;AAChH,QAAI,CAAC,UAAU;AACd,aAAO;AAAA,IACR;AAGA,UAAM,aAAa,cAAc;AAAA,MAChC,OAAO;AAAA,MACP,OAAO;AAAA,MACP,gBAAgB;AAAA,IAAA,CAChB;AACD,QAAI,CAAC,WAAW,IAAI;AACnB,aAAO;AAAA,IACR;AACA,UAAM,UAAU,WAAW,QAAQ,IAAI,uBAAuB,WAAW,OAAO,EAAE,CAAC;AACnF,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,eAAgC;AAG7C,UAAM,QAAQ,MAAM,KAAK,UAAU,YAAY,gBAAgB;AAC/D,QAAI,OAAO;AACX,aAAS,IAAI,GAAG,IAAI,kBAAkB,KAAK;AAC1C,eAAS,MAAM,CAAC,IAAI,IAAI,SAAA;AAAA,IACzB;AACA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/service/EmailValidator.cjs

@@ -8,8 +8,9 @@ require("../type/ApiKey.cjs");
 const PersonQuery = require("../queries/person/PersonQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 class EmailValidator {
   async validateEmail(db, email$1) {

package/dist/development/src/model/service/EmailValidator.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"EmailValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailValidator.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { validateEmail } from '../utils/email.js'\nimport { ResponseError } from '../utils/Response.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\n\nexport class EmailValidator {\n\tpublic async validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\t\tif (await this.findExistingPerson(db, email) !== null) {\n\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)\n\t\t}\n\t\treturn null\n\t}\n\n\tpublic async findExistingPerson(db: DatabaseContext, email: string): Promise<PersonRow | null> {\n\t\treturn await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t}\n}\n\nexport type EmailValidatorError =\n\t| 'EMAIL_ALREADY_EXISTS'\n\t| 'INVALID_EMAIL_FORMAT'\n"],"names":["email","validateEmail","ResponseError","PersonQuery"],"mappings":";;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,MAAa,cAAc,IAAqBA,SAAmE;AAClH,QAAI,CAACC,MAAAA,cAAcD,QAAM,KAAA,CAAM,GAAG;AACjC,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AACA,QAAI,MAAM,KAAK,mBAAmB,IAAIF,OAAK,MAAM,MAAM;AACtD,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,mBAAmBF,OAAK,iBAAiB;AAAA,IAC3F;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,mBAAmB,IAAqBA,QAA0C;AAC9F,WAAO,MAAM,GAAG,aAAa,MAAMG,YAAAA,YAAY,QAAQH,MAAK,CAAC;AAAA,EAC9D;AACD;;"}
+{"version":3,"file":"EmailValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailValidator.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { validateEmail } from '../utils/email.js'\nimport { ResponseError } from '../utils/Response.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\n\nexport class EmailValidator {\n\tpublic async validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\t\tif (await this.findExistingPerson(db, email) !== null) {\n\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)\n\t\t}\n\t\treturn null\n\t}\n\n\tpublic async findExistingPerson(db: DatabaseContext, email: string): Promise<PersonRow | null> {\n\t\treturn await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t}\n}\n\nexport type EmailValidatorError =\n\t| 'EMAIL_ALREADY_EXISTS'\n\t| 'INVALID_EMAIL_FORMAT'\n"],"names":["email","validateEmail","ResponseError","PersonQuery"],"mappings":";;;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,MAAa,cAAc,IAAqBA,SAAmE;AAClH,QAAI,CAACC,MAAAA,cAAcD,QAAM,KAAA,CAAM,GAAG;AACjC,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AACA,QAAI,MAAM,KAAK,mBAAmB,IAAIF,OAAK,MAAM,MAAM;AACtD,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,mBAAmBF,OAAK,iBAAiB;AAAA,IAC3F;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,mBAAmB,IAAqBA,QAA0C;AAC9F,WAAO,MAAM,GAAG,aAAa,MAAMG,YAAAA,YAAY,QAAQH,MAAK,CAAC;AAAA,EAC9D;AACD;;"}

package/dist/development/src/model/service/EmailValidator.js

@@ -6,8 +6,9 @@ import "../type/ApiKey.js";
 import { PersonQuery } from "../queries/person/PersonQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 class EmailValidator {
   async validateEmail(db, email) {

package/dist/development/src/model/service/EmailValidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"EmailValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailValidator.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { validateEmail } from '../utils/email.js'\nimport { ResponseError } from '../utils/Response.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\n\nexport class EmailValidator {\n\tpublic async validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\t\tif (await this.findExistingPerson(db, email) !== null) {\n\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)\n\t\t}\n\t\treturn null\n\t}\n\n\tpublic async findExistingPerson(db: DatabaseContext, email: string): Promise<PersonRow | null> {\n\t\treturn await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t}\n}\n\nexport type EmailValidatorError =\n\t| 'EMAIL_ALREADY_EXISTS'\n\t| 'INVALID_EMAIL_FORMAT'\n"],"names":[],"mappings":";;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,MAAa,cAAc,IAAqB,OAAmE;AAClH,QAAI,CAAC,cAAc,MAAM,KAAA,CAAM,GAAG;AACjC,aAAO,IAAI,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AACA,QAAI,MAAM,KAAK,mBAAmB,IAAI,KAAK,MAAM,MAAM;AACtD,aAAO,IAAI,cAAc,wBAAwB,mBAAmB,KAAK,iBAAiB;AAAA,IAC3F;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,mBAAmB,IAAqB,OAA0C;AAC9F,WAAO,MAAM,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAAA,EAC9D;AACD;"}
+{"version":3,"file":"EmailValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailValidator.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { validateEmail } from '../utils/email.js'\nimport { ResponseError } from '../utils/Response.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\n\nexport class EmailValidator {\n\tpublic async validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null> {\n\t\tif (!validateEmail(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\t\tif (await this.findExistingPerson(db, email) !== null) {\n\t\t\treturn new ResponseError('EMAIL_ALREADY_EXISTS', `User with email ${email} already exists`)\n\t\t}\n\t\treturn null\n\t}\n\n\tpublic async findExistingPerson(db: DatabaseContext, email: string): Promise<PersonRow | null> {\n\t\treturn await db.queryHandler.fetch(PersonQuery.byEmail(email))\n\t}\n}\n\nexport type EmailValidatorError =\n\t| 'EMAIL_ALREADY_EXISTS'\n\t| 'INVALID_EMAIL_FORMAT'\n"],"names":[],"mappings":";;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,MAAa,cAAc,IAAqB,OAAmE;AAClH,QAAI,CAAC,cAAc,MAAM,KAAA,CAAM,GAAG;AACjC,aAAO,IAAI,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AACA,QAAI,MAAM,KAAK,mBAAmB,IAAI,KAAK,MAAM,MAAM;AACtD,aAAO,IAAI,cAAc,wBAAwB,mBAAmB,KAAK,iBAAiB;AAAA,IAC3F;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,mBAAmB,IAAqB,OAA0C;AAC9F,WAAO,MAAM,GAAG,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAAA,EAC9D;AACD;"}

package/dist/development/src/model/service/EmailVerificationManager.cjs

@@ -8,8 +8,9 @@ const exceptions = require("../../exceptions.cjs");
 const PersonQuery = require("../queries/person/PersonQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 const getPreferredProject = require("./helpers/getPreferredProject.cjs");
 const token = require("../utils/token.cjs");
@@ -35,10 +36,10 @@ class EmailVerificationManager {
     if (!person.email) {
       throw new exceptions.ImplementationException();
     }
-    const nextAllowed = await dbContext.queryHandler.fetch(
+    const retryAfter = await dbContext.queryHandler.fetch(
       new NextMailAttemptQuery.NextMailAttemptQuery(person.email, "email_verify_init", "email_verify_complete")
     );
-    if (nextAllowed > dbContext.providers.now()) {
+    if (retryAfter > 0) {
       return false;
     }
     const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.CreatePersonTokenCommand.createEmailVerificationRequest(person.id, person.email));
@@ -61,7 +62,7 @@ class EmailVerificationManager {
   }
   async verifyEmail(dbContext, token$1) {
     const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.PersonTokenQuery.byToken(token$1, "email_verification"));
-    const validation = token.validateToken({ entry: tokenRow, token: token$1, now: dbContext.providers.now(), validationType: "token" });
+    const validation = token.validateToken({ entry: tokenRow, token: token$1, validationType: "token" });
     if (!validation.ok) {
       return new Response.ResponseError(validation.error, validation.errorMessage, {
         [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag(

package/dist/development/src/model/service/EmailVerificationManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"EmailVerificationManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailVerificationManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { PersonToken } from '../type/index.js'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailVerificationManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\t/**\n\t * Sends a verification mail unless the per-email backoff says to hold off.\n\t * Returns whether a mail was actually sent, so the caller only records an\n\t * `email_verify_init` audit entry for mails that really went out — otherwise\n\t * a throttled attempt would both tell the user to check their inbox and log\n\t * a phantom init that pushes the backoff out further.\n\t */\n\tpublic async sendVerificationEmail(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<boolean> {\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Per-email exponential backoff on outbound mails, so a resend button\n\t\t// (or an attacker poking the endpoint) can't be used to flood the\n\t\t// mailbox. Reuses the login_* backoff config against person_auth_log.\n\t\tconst nextAllowed = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(person.email, 'email_verify_init', 'email_verify_complete'),\n\t\t)\n\t\tif (nextAllowed > dbContext.providers.now()) {\n\t\t\treturn false\n\t\t}\n\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createEmailVerificationRequest(person.id, person.email))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait this.mailer.sendEmailVerificationEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t\treturn true\n\t}\n\n\tpublic async verifyEmail(dbContext: DatabaseContext, token: string): Promise<VerifyEmailResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_verification'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Carry whatever we know about the subject so the audit log can tie the\n\t\t\t// failure to a person/token even on an invalid/expired token (matches\n\t\t\t// PasswordResetManager — see email_verify_complete audit entry).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\t// Bind the token to the address it was issued for: if the person's e-mail\n\t\t// changed after the token was minted (an admin profile edit, or a separate\n\t\t// email-change flow), a stale verification link must not stamp the new,\n\t\t// unproven address as verified. Tokens issued before this binding carry no\n\t\t// email payload — fall back to the legacy behaviour for those.\n\t\tconst issuedFor = validation.result.meta?.email\n\t\tif (issuedFor != null && issuedFor !== person.email) {\n\t\t\treturn new ResponseError('TOKEN_INVALID', 'Verification token was issued for a different e-mail address', {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn await dbContext.transaction(async db => {\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(validation.result.person_id))\n\t\t\treturn new ResponseOk({ [AuthLogService.Key]: authLogData })\n\t\t})\n\t}\n}\n\nexport type VerifyEmailResponse = Response<\n\t{ [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":["ImplementationException","NextMailAttemptQuery","CreatePersonTokenCommand","getPreferredProject","token","PersonTokenQuery","validateToken","ResponseError","AuthLogService","PersonQuery","InvalidateTokenCommand","MarkEmailVerifiedCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAoBO,MAAM,yBAAyB;AAAA,EACrC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,sBACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACR;AACnB,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,IAAIA,WAAAA,wBAAA;AAAA,IACX;AAKA,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAIC,0CAAqB,OAAO,OAAO,qBAAqB,uBAAuB;AAAA,IAAA;AAEpF,QAAI,cAAc,UAAU,UAAU,IAAA,GAAO;AAC5C,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQC,yBAAAA,yBAAyB,+BAA+B,OAAO,IAAI,OAAO,KAAK,CAAC;AAClI,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUC,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA;AAAA,MAEvB;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAC3B;AAED,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,YAAY,WAA4BC,SAA6C;AACjG,UAAM,WAAW,MAAM,UAAU,aAAa,MAAMC,iBAAAA,iBAAiB,QAAQD,SAAO,oBAAoB,CAAC;AACzG,UAAM,aAAaE,MAAAA,cAAc,EAAE,OAAO,UAAA,OAAUF,SAAO,KAAK,UAAU,UAAU,IAAA,GAAO,gBAAgB,SAAS;AACpH,QAAI,CAAC,WAAW,IAAI;AAInB,aAAO,IAAIG,SAAAA,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAIA,eAAAA,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMC,wBAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIT,WAAAA,wBAAA;AAAA,IACX;AAMA,UAAM,YAAY,WAAW,OAAO,MAAM;AAC1C,QAAI,aAAa,QAAQ,cAAc,OAAO,OAAO;AACpD,aAAO,IAAIO,SAAAA,cAAc,iBAAiB,gEAAgE;AAAA,QACzG,CAACC,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,YAAM,GAAG,WAAW,QAAQ,IAAIE,uBAAAA,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,YAAM,GAAG,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,WAAW,OAAO,SAAS,CAAC;AACrF,aAAO,IAAIC,SAAAA,WAAW,EAAE,CAACJ,eAAAA,eAAe,GAAG,GAAG,aAAa;AAAA,IAC5D,CAAC;AAAA,EACF;AACD;;"}
+{"version":3,"file":"EmailVerificationManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailVerificationManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { PersonToken } from '../type/index.js'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailVerificationManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\t/**\n\t * Sends a verification mail unless the per-email backoff says to hold off.\n\t * Returns whether a mail was actually sent, so the caller only records an\n\t * `email_verify_init` audit entry for mails that really went out — otherwise\n\t * a throttled attempt would both tell the user to check their inbox and log\n\t * a phantom init that pushes the backoff out further.\n\t */\n\tpublic async sendVerificationEmail(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<boolean> {\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Per-email exponential backoff on outbound mails, so a resend button\n\t\t// (or an attacker poking the endpoint) can't be used to flood the\n\t\t// mailbox. Reuses the login_* backoff config against person_auth_log.\n\t\tconst retryAfter = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(person.email, 'email_verify_init', 'email_verify_complete'),\n\t\t)\n\t\tif (retryAfter > 0) {\n\t\t\treturn false\n\t\t}\n\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createEmailVerificationRequest(person.id, person.email))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait this.mailer.sendEmailVerificationEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t\treturn true\n\t}\n\n\tpublic async verifyEmail(dbContext: DatabaseContext, token: string): Promise<VerifyEmailResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_verification'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Carry whatever we know about the subject so the audit log can tie the\n\t\t\t// failure to a person/token even on an invalid/expired token (matches\n\t\t\t// PasswordResetManager — see email_verify_complete audit entry).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\t// Bind the token to the address it was issued for: if the person's e-mail\n\t\t// changed after the token was minted (an admin profile edit, or a separate\n\t\t// email-change flow), a stale verification link must not stamp the new,\n\t\t// unproven address as verified. Tokens issued before this binding carry no\n\t\t// email payload — fall back to the legacy behaviour for those.\n\t\tconst issuedFor = validation.result.meta?.email\n\t\tif (issuedFor != null && issuedFor !== person.email) {\n\t\t\treturn new ResponseError('TOKEN_INVALID', 'Verification token was issued for a different e-mail address', {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn await dbContext.transaction(async db => {\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(validation.result.person_id))\n\t\t\treturn new ResponseOk({ [AuthLogService.Key]: authLogData })\n\t\t})\n\t}\n}\n\nexport type VerifyEmailResponse = Response<\n\t{ [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":["ImplementationException","NextMailAttemptQuery","CreatePersonTokenCommand","getPreferredProject","token","PersonTokenQuery","validateToken","ResponseError","AuthLogService","PersonQuery","InvalidateTokenCommand","MarkEmailVerifiedCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAoBO,MAAM,yBAAyB;AAAA,EACrC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,sBACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACR;AACnB,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,IAAIA,WAAAA,wBAAA;AAAA,IACX;AAKA,UAAM,aAAa,MAAM,UAAU,aAAa;AAAA,MAC/C,IAAIC,0CAAqB,OAAO,OAAO,qBAAqB,uBAAuB;AAAA,IAAA;AAEpF,QAAI,aAAa,GAAG;AACnB,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQC,yBAAAA,yBAAyB,+BAA+B,OAAO,IAAI,OAAO,KAAK,CAAC;AAClI,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAUC,oBAAAA,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA;AAAA,MAEvB;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAC3B;AAED,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,YAAY,WAA4BC,SAA6C;AACjG,UAAM,WAAW,MAAM,UAAU,aAAa,MAAMC,iBAAAA,iBAAiB,QAAQD,SAAO,oBAAoB,CAAC;AACzG,UAAM,aAAaE,MAAAA,cAAc,EAAE,OAAO,iBAAUF,SAAO,gBAAgB,SAAS;AACpF,QAAI,CAAC,WAAW,IAAI;AAInB,aAAO,IAAIG,SAAAA,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAIA,eAAAA,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMC,wBAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAIT,WAAAA,wBAAA;AAAA,IACX;AAMA,UAAM,YAAY,WAAW,OAAO,MAAM;AAC1C,QAAI,aAAa,QAAQ,cAAc,OAAO,OAAO;AACpD,aAAO,IAAIO,SAAAA,cAAc,iBAAiB,gEAAgE;AAAA,QACzG,CAACC,eAAAA,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,YAAM,GAAG,WAAW,QAAQ,IAAIE,uBAAAA,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,YAAM,GAAG,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,WAAW,OAAO,SAAS,CAAC;AACrF,aAAO,IAAIC,SAAAA,WAAW,EAAE,CAACJ,eAAAA,eAAe,GAAG,GAAG,aAAa;AAAA,IAC5D,CAAC;AAAA,EACF;AACD;;"}

package/dist/development/src/model/service/EmailVerificationManager.js

@@ -6,8 +6,9 @@ import { ImplementationException } from "../../exceptions.js";
 import { PersonQuery } from "../queries/person/PersonQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 import { getPreferredProject } from "./helpers/getPreferredProject.js";
 import { validateToken } from "../utils/token.js";
@@ -33,10 +34,10 @@ class EmailVerificationManager {
     if (!person.email) {
       throw new ImplementationException();
     }
-    const nextAllowed = await dbContext.queryHandler.fetch(
+    const retryAfter = await dbContext.queryHandler.fetch(
       new NextMailAttemptQuery(person.email, "email_verify_init", "email_verify_complete")
     );
-    if (nextAllowed > dbContext.providers.now()) {
+    if (retryAfter > 0) {
       return false;
     }
     const result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createEmailVerificationRequest(person.id, person.email));
@@ -59,7 +60,7 @@ class EmailVerificationManager {
   }
   async verifyEmail(dbContext, token) {
     const tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, "email_verification"));
-    const validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: "token" });
+    const validation = validateToken({ entry: tokenRow, token, validationType: "token" });
     if (!validation.ok) {
       return new ResponseError(validation.error, validation.errorMessage, {
         [AuthLogService.Key]: new AuthLogService.Bag(

package/dist/development/src/model/service/EmailVerificationManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"EmailVerificationManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailVerificationManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { PersonToken } from '../type/index.js'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailVerificationManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\t/**\n\t * Sends a verification mail unless the per-email backoff says to hold off.\n\t * Returns whether a mail was actually sent, so the caller only records an\n\t * `email_verify_init` audit entry for mails that really went out — otherwise\n\t * a throttled attempt would both tell the user to check their inbox and log\n\t * a phantom init that pushes the backoff out further.\n\t */\n\tpublic async sendVerificationEmail(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<boolean> {\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Per-email exponential backoff on outbound mails, so a resend button\n\t\t// (or an attacker poking the endpoint) can't be used to flood the\n\t\t// mailbox. Reuses the login_* backoff config against person_auth_log.\n\t\tconst nextAllowed = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(person.email, 'email_verify_init', 'email_verify_complete'),\n\t\t)\n\t\tif (nextAllowed > dbContext.providers.now()) {\n\t\t\treturn false\n\t\t}\n\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createEmailVerificationRequest(person.id, person.email))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait this.mailer.sendEmailVerificationEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t\treturn true\n\t}\n\n\tpublic async verifyEmail(dbContext: DatabaseContext, token: string): Promise<VerifyEmailResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_verification'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, now: dbContext.providers.now(), validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Carry whatever we know about the subject so the audit log can tie the\n\t\t\t// failure to a person/token even on an invalid/expired token (matches\n\t\t\t// PasswordResetManager — see email_verify_complete audit entry).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\t// Bind the token to the address it was issued for: if the person's e-mail\n\t\t// changed after the token was minted (an admin profile edit, or a separate\n\t\t// email-change flow), a stale verification link must not stamp the new,\n\t\t// unproven address as verified. Tokens issued before this binding carry no\n\t\t// email payload — fall back to the legacy behaviour for those.\n\t\tconst issuedFor = validation.result.meta?.email\n\t\tif (issuedFor != null && issuedFor !== person.email) {\n\t\t\treturn new ResponseError('TOKEN_INVALID', 'Verification token was issued for a different e-mail address', {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn await dbContext.transaction(async db => {\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(validation.result.person_id))\n\t\t\treturn new ResponseOk({ [AuthLogService.Key]: authLogData })\n\t\t})\n\t}\n}\n\nexport type VerifyEmailResponse = Response<\n\t{ [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAoBO,MAAM,yBAAyB;AAAA,EACrC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,sBACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACR;AACnB,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,IAAI,wBAAA;AAAA,IACX;AAKA,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAI,qBAAqB,OAAO,OAAO,qBAAqB,uBAAuB;AAAA,IAAA;AAEpF,QAAI,cAAc,UAAU,UAAU,IAAA,GAAO;AAC5C,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,yBAAyB,+BAA+B,OAAO,IAAI,OAAO,KAAK,CAAC;AAClI,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA;AAAA,MAEvB;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAC3B;AAED,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,YAAY,WAA4B,OAA6C;AACjG,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,iBAAiB,QAAQ,OAAO,oBAAoB,CAAC;AACzG,UAAM,aAAa,cAAc,EAAE,OAAO,UAAU,OAAO,KAAK,UAAU,UAAU,IAAA,GAAO,gBAAgB,SAAS;AACpH,QAAI,CAAC,WAAW,IAAI;AAInB,aAAO,IAAI,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAI,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAA;AAAA,IACX;AAMA,UAAM,YAAY,WAAW,OAAO,MAAM;AAC1C,QAAI,aAAa,QAAQ,cAAc,OAAO,OAAO;AACpD,aAAO,IAAI,cAAc,iBAAiB,gEAAgE;AAAA,QACzG,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,YAAM,GAAG,WAAW,QAAQ,IAAI,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,YAAM,GAAG,WAAW,QAAQ,IAAI,yBAAyB,WAAW,OAAO,SAAS,CAAC;AACrF,aAAO,IAAI,WAAW,EAAE,CAAC,eAAe,GAAG,GAAG,aAAa;AAAA,IAC5D,CAAC;AAAA,EACF;AACD;"}
+{"version":3,"file":"EmailVerificationManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/EmailVerificationManager.ts"],"sourcesContent":["import { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { PersonQuery, PersonRow } from '../queries/index.js'\nimport { PermissionContext } from '../authorization/index.js'\nimport { ProjectManager } from './ProjectManager.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { getPreferredProject } from './helpers/getPreferredProject.js'\nimport { CreatePersonTokenCommand, InvalidateTokenCommand, MarkEmailVerifiedCommand } from '../commands/index.js'\nimport { PersonTokenQuery } from '../queries/personToken/PersonTokenQuery.js'\nimport { NextMailAttemptQuery } from '../queries/authLog/NextMailAttemptQuery.js'\nimport { validateToken } from '../utils/index.js'\nimport { PersonToken } from '../type/index.js'\nimport { AuthLogService } from './AuthLogService.js'\n\ninterface MailOptions {\n\tproject?: string\n\tmailVariant?: string\n}\n\nexport class EmailVerificationManager {\n\tconstructor(\n\t\tprivate readonly mailer: UserMailer,\n\t\tprivate readonly projectManager: ProjectManager,\n\t) {}\n\n\t/**\n\t * Sends a verification mail unless the per-email backoff says to hold off.\n\t * Returns whether a mail was actually sent, so the caller only records an\n\t * `email_verify_init` audit entry for mails that really went out — otherwise\n\t * a throttled attempt would both tell the user to check their inbox and log\n\t * a phantom init that pushes the backoff out further.\n\t */\n\tpublic async sendVerificationEmail(\n\t\tdbContext: DatabaseContext,\n\t\tpermissionContext: PermissionContext,\n\t\tperson: PersonRow,\n\t\tmailOptions: MailOptions = {},\n\t): Promise<boolean> {\n\t\tif (!person.email) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\t// Per-email exponential backoff on outbound mails, so a resend button\n\t\t// (or an attacker poking the endpoint) can't be used to flood the\n\t\t// mailbox. Reuses the login_* backoff config against person_auth_log.\n\t\tconst retryAfter = await dbContext.queryHandler.fetch(\n\t\t\tnew NextMailAttemptQuery(person.email, 'email_verify_init', 'email_verify_complete'),\n\t\t)\n\t\tif (retryAfter > 0) {\n\t\t\treturn false\n\t\t}\n\n\t\tconst result = await dbContext.commandBus.execute(CreatePersonTokenCommand.createEmailVerificationRequest(person.id, person.email))\n\t\tconst projects = await this.projectManager.getProjectsByIdentity(dbContext, person.identity_id, permissionContext)\n\t\tconst project = getPreferredProject(projects, mailOptions.project ?? null)\n\n\t\tawait this.mailer.sendEmailVerificationEmail(\n\t\t\tdbContext,\n\t\t\t{\n\t\t\t\temail: person.email,\n\t\t\t\ttoken: result.token,\n\t\t\t\tproject: project?.name,\n\t\t\t\tprojectSlug: project?.slug,\n\t\t\t},\n\t\t\t{\n\t\t\t\tvariant: mailOptions.mailVariant || '',\n\t\t\t\tprojectId: project?.id ?? null,\n\t\t\t},\n\t\t)\n\t\treturn true\n\t}\n\n\tpublic async verifyEmail(dbContext: DatabaseContext, token: string): Promise<VerifyEmailResponse> {\n\t\tconst tokenRow = await dbContext.queryHandler.fetch(PersonTokenQuery.byToken(token, 'email_verification'))\n\t\tconst validation = validateToken({ entry: tokenRow, token, validationType: 'token' })\n\t\tif (!validation.ok) {\n\t\t\t// Carry whatever we know about the subject so the audit log can tie the\n\t\t\t// failure to a person/token even on an invalid/expired token (matches\n\t\t\t// PasswordResetManager — see email_verify_complete audit entry).\n\t\t\treturn new ResponseError(validation.error, validation.errorMessage, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag(\n\t\t\t\t\ttokenRow ? { personId: tokenRow.person_id, tokenId: tokenRow.id } : {},\n\t\t\t\t),\n\t\t\t})\n\t\t}\n\t\tconst authLogData = new AuthLogService.Bag({\n\t\t\tpersonId: validation.result.person_id,\n\t\t\ttokenId: validation.result.id,\n\t\t})\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byId(validation.result.person_id))\n\t\tif (!person) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\t// Bind the token to the address it was issued for: if the person's e-mail\n\t\t// changed after the token was minted (an admin profile edit, or a separate\n\t\t// email-change flow), a stale verification link must not stamp the new,\n\t\t// unproven address as verified. Tokens issued before this binding carry no\n\t\t// email payload — fall back to the legacy behaviour for those.\n\t\tconst issuedFor = validation.result.meta?.email\n\t\tif (issuedFor != null && issuedFor !== person.email) {\n\t\t\treturn new ResponseError('TOKEN_INVALID', 'Verification token was issued for a different e-mail address', {\n\t\t\t\t[AuthLogService.Key]: authLogData,\n\t\t\t})\n\t\t}\n\t\treturn await dbContext.transaction(async db => {\n\t\t\tawait db.commandBus.execute(new InvalidateTokenCommand(validation.result.id))\n\t\t\tawait db.commandBus.execute(new MarkEmailVerifiedCommand(validation.result.person_id))\n\t\t\treturn new ResponseOk({ [AuthLogService.Key]: authLogData })\n\t\t})\n\t}\n}\n\nexport type VerifyEmailResponse = Response<\n\t{ [AuthLogService.Key]: AuthLogService.Bag },\n\tPersonToken.TokenValidationError,\n\t{ [AuthLogService.Key]: AuthLogService.Bag }\n>\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBO,MAAM,yBAAyB;AAAA,EACrC,YACkB,QACA,gBAChB;AAFgB,SAAA,SAAA;AACA,SAAA,iBAAA;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASH,MAAa,sBACZ,WACA,mBACA,QACA,cAA2B,CAAA,GACR;AACnB,QAAI,CAAC,OAAO,OAAO;AAClB,YAAM,IAAI,wBAAA;AAAA,IACX;AAKA,UAAM,aAAa,MAAM,UAAU,aAAa;AAAA,MAC/C,IAAI,qBAAqB,OAAO,OAAO,qBAAqB,uBAAuB;AAAA,IAAA;AAEpF,QAAI,aAAa,GAAG;AACnB,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,yBAAyB,+BAA+B,OAAO,IAAI,OAAO,KAAK,CAAC;AAClI,UAAM,WAAW,MAAM,KAAK,eAAe,sBAAsB,WAAW,OAAO,aAAa,iBAAiB;AACjH,UAAM,UAAU,oBAAoB,UAAU,YAAY,WAAW,IAAI;AAEzE,UAAM,KAAK,OAAO;AAAA,MACjB;AAAA,MACA;AAAA,QACC,OAAO,OAAO;AAAA,QACd,OAAO,OAAO;AAAA,QACd,SAAS,SAAS;AAAA,QAClB,aAAa,SAAS;AAAA,MAAA;AAAA,MAEvB;AAAA,QACC,SAAS,YAAY,eAAe;AAAA,QACpC,WAAW,SAAS,MAAM;AAAA,MAAA;AAAA,IAC3B;AAED,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,YAAY,WAA4B,OAA6C;AACjG,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,iBAAiB,QAAQ,OAAO,oBAAoB,CAAC;AACzG,UAAM,aAAa,cAAc,EAAE,OAAO,UAAU,OAAO,gBAAgB,SAAS;AACpF,QAAI,CAAC,WAAW,IAAI;AAInB,aAAO,IAAI,cAAc,WAAW,OAAO,WAAW,cAAc;AAAA,QACnE,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe;AAAA,UACxC,WAAW,EAAE,UAAU,SAAS,WAAW,SAAS,SAAS,OAAO,CAAA;AAAA,QAAC;AAAA,MACtE,CACA;AAAA,IACF;AACA,UAAM,cAAc,IAAI,eAAe,IAAI;AAAA,MAC1C,UAAU,WAAW,OAAO;AAAA,MAC5B,SAAS,WAAW,OAAO;AAAA,IAAA,CAC3B;AACD,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,KAAK,WAAW,OAAO,SAAS,CAAC;AAC/F,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,wBAAA;AAAA,IACX;AAMA,UAAM,YAAY,WAAW,OAAO,MAAM;AAC1C,QAAI,aAAa,QAAQ,cAAc,OAAO,OAAO;AACpD,aAAO,IAAI,cAAc,iBAAiB,gEAAgE;AAAA,QACzG,CAAC,eAAe,GAAG,GAAG;AAAA,MAAA,CACtB;AAAA,IACF;AACA,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,YAAM,GAAG,WAAW,QAAQ,IAAI,uBAAuB,WAAW,OAAO,EAAE,CAAC;AAC5E,YAAM,GAAG,WAAW,QAAQ,IAAI,yBAAyB,WAAW,OAAO,SAAS,CAAC;AACrF,aAAO,IAAI,WAAW,EAAE,CAAC,eAAe,GAAG,GAAG,aAAa;AAAA,IAC5D,CAAC;AAAA,EACF;AACD;"}

package/dist/development/src/model/service/GlobalRoleValidator.cjs

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+const CustomRolePermissions = require("../authorization/CustomRolePermissions.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("../type/ApiKey.cjs");
+const CustomRolesQuery = require("../queries/customRole/CustomRolesQuery.cjs");
+require("../authorization/PermissionActions.cjs");
+require("@contember/authorization");
+require("../authorization/PermissionContext.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
+require("@contember/schema");
+class GlobalRoleValidator {
+  async findInvalidRole(db, roles, additionallyActiveRoles = /* @__PURE__ */ new Set()) {
+    const invalidBuiltin = roles.find((role) => CustomRolePermissions.BUILTIN_TENANT_ROLES.has(role) && !CustomRolePermissions.GLOBALLY_ASSIGNABLE_BUILTIN_ROLES.has(role));
+    if (invalidBuiltin !== void 0) {
+      return invalidBuiltin;
+    }
+    const customCandidates = [
+      ...new Set(
+        roles.filter((role) => !CustomRolePermissions.BUILTIN_TENANT_ROLES.has(role) && !additionallyActiveRoles.has(role))
+      )
+    ].sort();
+    if (customCandidates.length === 0) {
+      return null;
+    }
+    const customRoles = await db.queryHandler.fetch(
+      new CustomRolesQuery.CustomRolesQuery({ slugs: customCandidates, lock: Database.LockType.forShare })
+    );
+    const existingSlugs = new Set(customRoles.map((role) => role.slug));
+    return customCandidates.find((role) => !existingSlugs.has(role)) ?? null;
+  }
+}
+exports.GlobalRoleValidator = GlobalRoleValidator;
+//# sourceMappingURL=GlobalRoleValidator.cjs.map

package/dist/development/src/model/service/GlobalRoleValidator.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"GlobalRoleValidator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/GlobalRoleValidator.ts"],"sourcesContent":["import { LockType } from '@contember/database'\nimport { BUILTIN_TENANT_ROLES, GLOBALLY_ASSIGNABLE_BUILTIN_ROLES } from '../authorization/CustomRolePermissions.js'\nimport { CustomRolesQuery } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class GlobalRoleValidator {\n\tasync findInvalidRole(\n\t\tdb: DatabaseContext,\n\t\troles: readonly string[],\n\t\tadditionallyActiveRoles: ReadonlySet<string> = new Set(),\n\t): Promise<string | null> {\n\t\tconst invalidBuiltin = roles.find(role => BUILTIN_TENANT_ROLES.has(role) && !GLOBALLY_ASSIGNABLE_BUILTIN_ROLES.has(role))\n\t\tif (invalidBuiltin !== undefined) {\n\t\t\treturn invalidBuiltin\n\t\t}\n\t\tconst customCandidates = [\n\t\t\t...new Set(\n\t\t\t\troles.filter(role => !BUILTIN_TENANT_ROLES.has(role) && !additionallyActiveRoles.has(role)),\n\t\t\t),\n\t\t].sort()\n\t\tif (customCandidates.length === 0) {\n\t\t\treturn null\n\t\t}\n\t\tconst customRoles = await db.queryHandler.fetch(\n\t\t\tnew CustomRolesQuery({ slugs: customCandidates, lock: LockType.forShare }),\n\t\t)\n\t\tconst existingSlugs = new Set(customRoles.map(role => role.slug))\n\t\treturn customCandidates.find(role => !existingSlugs.has(role)) ?? null\n\t}\n}\n"],"names":["BUILTIN_TENANT_ROLES","GLOBALLY_ASSIGNABLE_BUILTIN_ROLES","CustomRolesQuery","LockType"],"mappings":";;;;;;;;;;;;AAKO,MAAM,oBAAoB;AAAA,EAChC,MAAM,gBACL,IACA,OACA,0BAA+C,oBAAI,OAC1B;AACzB,UAAM,iBAAiB,MAAM,KAAK,CAAA,SAAQA,sBAAAA,qBAAqB,IAAI,IAAI,KAAK,CAACC,sBAAAA,kCAAkC,IAAI,IAAI,CAAC;AACxH,QAAI,mBAAmB,QAAW;AACjC,aAAO;AAAA,IACR;AACA,UAAM,mBAAmB;AAAA,MACxB,GAAG,IAAI;AAAA,QACN,MAAM,OAAO,CAAA,SAAQ,CAACD,sBAAAA,qBAAqB,IAAI,IAAI,KAAK,CAAC,wBAAwB,IAAI,IAAI,CAAC;AAAA,MAAA;AAAA,IAC3F,EACC,KAAA;AACF,QAAI,iBAAiB,WAAW,GAAG;AAClC,aAAO;AAAA,IACR;AACA,UAAM,cAAc,MAAM,GAAG,aAAa;AAAA,MACzC,IAAIE,iBAAAA,iBAAiB,EAAE,OAAO,kBAAkB,MAAMC,SAAAA,SAAS,UAAU;AAAA,IAAA;AAE1E,UAAM,gBAAgB,IAAI,IAAI,YAAY,IAAI,CAAA,SAAQ,KAAK,IAAI,CAAC;AAChE,WAAO,iBAAiB,KAAK,CAAA,SAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK;AAAA,EACnE;AACD;;"}

package/dist/development/src/model/service/GlobalRoleValidator.js

@@ -0,0 +1,35 @@
+import { LockType } from "@contember/database";
+import { BUILTIN_TENANT_ROLES, GLOBALLY_ASSIGNABLE_BUILTIN_ROLES } from "../authorization/CustomRolePermissions.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import "../type/ApiKey.js";
+import { CustomRolesQuery } from "../queries/customRole/CustomRolesQuery.js";
+import "../authorization/PermissionActions.js";
+import "@contember/authorization";
+import "../authorization/PermissionContext.js";
+import "../authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+class GlobalRoleValidator {
+  async findInvalidRole(db, roles, additionallyActiveRoles = /* @__PURE__ */ new Set()) {
+    const invalidBuiltin = roles.find((role) => BUILTIN_TENANT_ROLES.has(role) && !GLOBALLY_ASSIGNABLE_BUILTIN_ROLES.has(role));
+    if (invalidBuiltin !== void 0) {
+      return invalidBuiltin;
+    }
+    const customCandidates = [
+      ...new Set(
+        roles.filter((role) => !BUILTIN_TENANT_ROLES.has(role) && !additionallyActiveRoles.has(role))
+      )
+    ].sort();
+    if (customCandidates.length === 0) {
+      return null;
+    }
+    const customRoles = await db.queryHandler.fetch(
+      new CustomRolesQuery({ slugs: customCandidates, lock: LockType.forShare })
+    );
+    const existingSlugs = new Set(customRoles.map((role) => role.slug));
+    return customCandidates.find((role) => !existingSlugs.has(role)) ?? null;
+  }
+}
+export {
+  GlobalRoleValidator
+};
+//# sourceMappingURL=GlobalRoleValidator.js.map

package/dist/development/src/model/service/GlobalRoleValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GlobalRoleValidator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/GlobalRoleValidator.ts"],"sourcesContent":["import { LockType } from '@contember/database'\nimport { BUILTIN_TENANT_ROLES, GLOBALLY_ASSIGNABLE_BUILTIN_ROLES } from '../authorization/CustomRolePermissions.js'\nimport { CustomRolesQuery } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class GlobalRoleValidator {\n\tasync findInvalidRole(\n\t\tdb: DatabaseContext,\n\t\troles: readonly string[],\n\t\tadditionallyActiveRoles: ReadonlySet<string> = new Set(),\n\t): Promise<string | null> {\n\t\tconst invalidBuiltin = roles.find(role => BUILTIN_TENANT_ROLES.has(role) && !GLOBALLY_ASSIGNABLE_BUILTIN_ROLES.has(role))\n\t\tif (invalidBuiltin !== undefined) {\n\t\t\treturn invalidBuiltin\n\t\t}\n\t\tconst customCandidates = [\n\t\t\t...new Set(\n\t\t\t\troles.filter(role => !BUILTIN_TENANT_ROLES.has(role) && !additionallyActiveRoles.has(role)),\n\t\t\t),\n\t\t].sort()\n\t\tif (customCandidates.length === 0) {\n\t\t\treturn null\n\t\t}\n\t\tconst customRoles = await db.queryHandler.fetch(\n\t\t\tnew CustomRolesQuery({ slugs: customCandidates, lock: LockType.forShare }),\n\t\t)\n\t\tconst existingSlugs = new Set(customRoles.map(role => role.slug))\n\t\treturn customCandidates.find(role => !existingSlugs.has(role)) ?? null\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;AAKO,MAAM,oBAAoB;AAAA,EAChC,MAAM,gBACL,IACA,OACA,0BAA+C,oBAAI,OAC1B;AACzB,UAAM,iBAAiB,MAAM,KAAK,CAAA,SAAQ,qBAAqB,IAAI,IAAI,KAAK,CAAC,kCAAkC,IAAI,IAAI,CAAC;AACxH,QAAI,mBAAmB,QAAW;AACjC,aAAO;AAAA,IACR;AACA,UAAM,mBAAmB;AAAA,MACxB,GAAG,IAAI;AAAA,QACN,MAAM,OAAO,CAAA,SAAQ,CAAC,qBAAqB,IAAI,IAAI,KAAK,CAAC,wBAAwB,IAAI,IAAI,CAAC;AAAA,MAAA;AAAA,IAC3F,EACC,KAAA;AACF,QAAI,iBAAiB,WAAW,GAAG;AAClC,aAAO;AAAA,IACR;AACA,UAAM,cAAc,MAAM,GAAG,aAAa;AAAA,MACzC,IAAI,iBAAiB,EAAE,OAAO,kBAAkB,MAAM,SAAS,UAAU;AAAA,IAAA;AAE1E,UAAM,gBAAgB,IAAI,IAAI,YAAY,IAAI,CAAA,SAAQ,KAAK,IAAI,CAAC;AAChE,WAAO,iBAAiB,KAAK,CAAA,SAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,KAAK;AAAA,EACnE;AACD;"}

package/dist/development/src/model/service/IDPSignInManager.cjs

@@ -9,8 +9,9 @@ const IdentityProviderBySlugQuery = require("../queries/idp/IdentityProviderBySl
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
 const Roles = require("../authorization/Roles.cjs");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 require("node:crypto");
 const Response = require("../utils/Response.cjs");
@@ -19,7 +20,9 @@ const CreatePersonIdentityProviderIdentifierCommand = require("../commands/perso
 const CreateIdentityCommand = require("../commands/identity/CreateIdentityCommand.cjs");
 const CreateAuthLogEntryCommand = require("../commands/authLog/CreateAuthLogEntryCommand.cjs");
 require("./idp/IDPRevalidation.cjs");
+const ClaimMapping = require("./idp/ClaimMapping.cjs");
 const IDPValidationError = require("./idp/IDPValidationError.cjs");
+require("@contember/schema-utils");
 const IDPResponseError = require("./idp/IDPResponseError.cjs");
 require("./idp/providers/AppleProvider.cjs");
 require("openid-client");
@@ -31,9 +34,11 @@ const CreateIdpSessionCommand = require("../commands/idp/CreateIdpSessionCommand
 const Password = require("../dtos/Password.cjs");
 const AuthLogService = require("./AuthLogService.cjs");
 class IDPSignInManager {
-  constructor(apiKeyManager, idpRegistry) {
+  constructor(apiKeyManager, idpRegistry, claimSyncService, logger) {
     this.apiKeyManager = apiKeyManager;
     this.idpRegistry = idpRegistry;
+    this.claimSyncService = claimSyncService;
+    this.logger = logger;
   }
   async signInIDP(dbContext, idpSlug, responseData, expiration, requestInfo, trustForwardedInfo) {
     return dbContext.transaction(async (db) => {
@@ -89,6 +94,28 @@ class IDPSignInManager {
           })
         });
       }
+      let mapping = null;
+      let claimMappingFailed = false;
+      try {
+        mapping = ClaimMapping.parseClaimMapping(provider.configuration);
+      } catch (e) {
+        this.logger.warn(e, { message: "IdP sign-in: claim mapping configuration is invalid", identityProviderId: provider.id });
+        claimMappingFailed = true;
+      }
+      let claimMappingAudit = null;
+      if (mapping) {
+        const syncResult = await this.claimSyncService.sync(
+          db,
+          mapping,
+          claim,
+          { id: personRow.identity_id },
+          resolved.isNewPerson === true
+        );
+        claimMappingAudit = syncResult.audit;
+        if (syncResult.droppedUnsafeRules) {
+          claimMappingFailed = true;
+        }
+      }
       const { id: apiKeyId, token: sessionToken } = await this.apiKeyManager.createSessionApiKeyWithId(
         db,
         personRow.identity_id,
@@ -101,25 +128,34 @@ class IDPSignInManager {
         if (!hasTokens || db.providers.encryptionEnabled) {
           await db.commandBus.execute(new CreateIdpSessionCommand.CreateIdpSessionCommand(apiKeyId, provider.id, claim.idpSession));
         } else {
-          await db.commandBus.execute(
-            new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
-              type: "idp_session_revalidation_failed",
-              invokedById: personRow.identity_id,
-              personId: personRow.id,
-              identityProviderId: provider.id,
-              personTokenId: apiKeyId,
-              success: true,
-              errorCode: "encryption_disabled",
-              ipAddress: requestInfo?.ip,
-              userAgent: requestInfo?.userAgent
-            })
-          );
+          try {
+            await db.commandBus.transaction(
+              (bus) => bus.execute(
+                new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
+                  type: "idp_session_revalidation_failed",
+                  invokedById: personRow.identity_id,
+                  personId: personRow.id,
+                  identityProviderId: provider.id,
+                  success: true,
+                  errorCode: "encryption_disabled",
+                  ipAddress: requestInfo?.ip,
+                  userAgent: requestInfo?.userAgent,
+                  eventData: { apiKeyId }
+                })
+              )
+            );
+          } catch (e) {
+            this.logger.error(e, { message: "IdP sign-in: writing the encryption_disabled audit entry failed", identityProviderId: provider.id });
+          }
         }
       }
       return new Response.ResponseOk({
         person: personRow,
         token: sessionToken,
         idpResponse: claim,
+        claimMappingAudit,
+        claimMappingFailed,
+        identityProviderId: provider.id,
         [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
           personId: personRow.id,
           identityProviderId: provider.id,
@@ -169,7 +205,7 @@ class IDPSignInManager {
     if (provider.autoSignUp) {
       const signedUpPerson = await this.signUp(db, claim, provider);
       await this.saveIdpIdentifier(db, provider, claim, signedUpPerson);
-      return { person: signedUpPerson };
+      return { person: signedUpPerson, isNewPerson: true };
     }
     return { person: null };
   }

package/dist/development/src/model/service/IDPSignInManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IDPSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/IDPSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey/index.js'\nimport { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries/index.js'\nimport { IDPHandlerRegistry, IDPResponse, IDPResponseError, IDPValidationError } from './idp/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ApiKeyRequestInfo, CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProviderIdentifierCommand } from '../commands/index.js'\nimport { CreateIdpSessionCommand } from '../commands/idp/CreateIdpSessionCommand.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { TenantRole } from '../authorization/index.js'\nimport { NoPassword } from '../dtos/index.js'\nimport { IdentityProviderRow } from '../queries/idp/types.js'\nimport { AuthLogService } from './AuthLogService.js'\n\nclass IDPSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signInIDP(\n\t\tdbContext: DatabaseContext,\n\t\tidpSlug: string,\n\t\tresponseData: unknown,\n\t\texpiration?: number,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<IDPSignInManager.SignInIDPResponse> {\n\t\treturn dbContext.transaction(async (db): Promise<IDPSignInManager.SignInIDPResponse> => {\n\t\t\tconst provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\t\tif (!provider || provider.disabledAt) {\n\t\t\t\tthrow new Error('provider not found')\n\t\t\t}\n\t\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\t\tlet claim: IDPResponse\n\t\t\ttry {\n\t\t\t\tclaim = await providerService.processResponse(\n\t\t\t\t\tvalidatedConfig,\n\t\t\t\t\tresponseData,\n\t\t\t\t)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IDPResponseError) {\n\t\t\t\t\treturn new ResponseError('INVALID_IDP_RESPONSE', e.message, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: undefined,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: undefined,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tconst resolved = await this.resolvePerson(db, claim, provider)\n\t\t\tconst personRow = resolved.person\n\n\t\t\tif (!personRow) {\n\t\t\t\t// Keep the external error generic (no account-existence leak), but\n\t\t\t\t// record the email-verification gate block distinctly in the audit\n\t\t\t\t// log — it is a takeover-grade event, not an ordinary \"not found\".\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t\t\tpersonId: resolved.blockedPersonId,\n\t\t\t\t\t\teventData: resolved.blockedReason ? { reason: resolved.blockedReason } : undefined,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst { id: apiKeyId, token: sessionToken } = await this.apiKeyManager.createSessionApiKeyWithId(\n\t\t\t\tdb,\n\t\t\t\tpersonRow.identity_id,\n\t\t\t\texpiration,\n\t\t\t\trequestInfo,\n\t\t\t\ttrustForwardedInfo,\n\t\t\t)\n\n\t\t\t// Bind the federated-session state to this session so it can be re-validated\n\t\t\t// against the IdP later. Present only when the provider supports it and\n\t\t\t// revalidation is enabled on the IdP configuration (A24). Refresh tokens must be\n\t\t\t// encrypted at rest, so when no encryption key is configured we skip persisting a\n\t\t\t// token-bearing session (it would otherwise crash or store secrets in plaintext) —\n\t\t\t// the session then behaves like a plain session with no re-validation.\n\t\t\tif (claim.idpSession) {\n\t\t\t\tconst hasTokens = !!claim.idpSession.tokens && Object.keys(claim.idpSession.tokens).length > 0\n\t\t\t\tif (!hasTokens || db.providers.encryptionEnabled) {\n\t\t\t\t\tawait db.commandBus.execute(new CreateIdpSessionCommand(apiKeyId, provider.id, claim.idpSession))\n\t\t\t\t} else {\n\t\t\t\t\t// Re-validation is enabled on this IdP but no encryption key is configured, so we\n\t\t\t\t\t// won't store the token-bearing session — it silently degrades to a plain,\n\t\t\t\t\t// non-revalidated session. Audit the downgrade (errorCode `encryption_disabled`)\n\t\t\t\t\t// so the operator can see that a session they expected to be continuously\n\t\t\t\t\t// re-validated is in fact not protected, instead of failing closed at sign-in.\n\t\t\t\t\tawait db.commandBus.execute(\n\t\t\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\t\t\tinvokedById: personRow.identity_id,\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t\tpersonTokenId: apiKeyId,\n\t\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\t\terrorCode: 'encryption_disabled',\n\t\t\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t\t\t}),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\tidpResponse: claim,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse> {\n\t\tconst provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\tif (!provider || provider.disabledAt) {\n\t\t\treturn new ResponseError('PROVIDER_NOT_FOUND', `Identity provider ${idpSlug} not found`)\n\t\t}\n\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\ttry {\n\t\t\tconst initResponse = await providerService.initAuth(validatedConfig, data)\n\n\t\t\tconst publicConfig = providerService.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(validatedConfig)\n\t\t\t\t: validatedConfig\n\n\t\t\treturn new ResponseOk({\n\t\t\t\t...initResponse,\n\t\t\t\tidpConfiguration: provider.initReturnsConfig ? publicConfig : null,\n\t\t\t})\n\t\t} catch (e) {\n\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message)\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\t}\n\n\tprivate async resolvePerson(db: DatabaseContext, claim: IDPResponse, provider: IdentityProviderRow): Promise<IDPSignInManager.ResolvePersonResult> {\n\t\tconst personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)\n\t\tconst personByIdp = await db.queryHandler.fetch(personByIdPQuery)\n\t\tif (personByIdp) {\n\t\t\treturn { person: personByIdp }\n\t\t}\n\n\t\tif (!provider.exclusive) {\n\t\t\tconst personByEmail = typeof claim.email === 'string' && claim.email\n\t\t\t\t? await db.queryHandler.fetch(PersonQuery.byEmail(claim.email))\n\t\t\t\t: null\n\t\t\tif (personByEmail) {\n\t\t\t\t// Auto-linking an IdP identity to a pre-existing local account by\n\t\t\t\t// e-mail is takeover-grade: if the provider returns an unverified\n\t\t\t\t// (or attacker-controlled) e-mail, it could hijack the account. When\n\t\t\t\t// the provider requires a verified e-mail, refuse to link — and to\n\t\t\t\t// sign in — unless the address is asserted verified. `assumeEmailVerified`\n\t\t\t\t// lets a trusted IdP that never emits the claim still satisfy the gate.\n\t\t\t\tconst emailVerified = provider.assumeEmailVerified || claim.emailVerified === true\n\t\t\t\tif (provider.requireVerifiedEmail && !emailVerified) {\n\t\t\t\t\treturn { person: null, blockedReason: 'idp_email_unverified', blockedPersonId: personByEmail.id }\n\t\t\t\t}\n\t\t\t\tawait this.saveIdpIdentifier(db, provider, claim, personByEmail)\n\t\t\t\treturn { person: personByEmail }\n\t\t\t}\n\t\t}\n\n\t\tif (provider.autoSignUp) {\n\t\t\tconst signedUpPerson = await this.signUp(db, claim, provider)\n\t\t\tawait this.saveIdpIdentifier(db, provider, claim, signedUpPerson)\n\t\t\treturn { person: signedUpPerson }\n\t\t}\n\n\t\treturn { person: null }\n\t}\n\n\tprivate async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow> {\n\t\tconst roles = [TenantRole.PERSON]\n\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))\n\t\tconst newPerson = await db.commandBus.execute(\n\t\t\tnew CreatePersonCommand({\n\t\t\t\tidentityId,\n\t\t\t\temail: provider.exclusive ? undefined : email,\n\t\t\t\tpassword: NoPassword,\n\t\t\t\tname: name ?? email?.split('@')[0] ?? externalIdentifier,\n\t\t\t\tidpOnly: provider.exclusive,\n\t\t\t}),\n\t\t)\n\n\t\treturn {\n\t\t\t...newPerson,\n\t\t\troles,\n\t\t}\n\t}\n\n\tprivate async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPResponse, person: PersonRow) {\n\t\tawait db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier))\n\t}\n}\n\nnamespace IDPSignInManager {\n\texport type ResolvePersonResult = {\n\t\treadonly person: PersonRow | null\n\t\treadonly blockedReason?: 'idp_email_unverified'\n\t\treadonly blockedPersonId?: string\n\t}\n\n\texport type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>\n\n\tinterface SignInIDPResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\treadonly idpResponse?: Record<string, unknown>\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\n\texport type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { IDPSignInManager }\n"],"names":["IdentityProviderBySlugQuery","IDPResponseError","ResponseError","AuthLogService","IDPValidationError","CreateIdpSessionCommand","CreateAuthLogEntryCommand","ResponseOk","PersonByIdPQuery","PersonQuery","TenantRole","CreateIdentityCommand","CreatePersonCommand","NoPassword","CreatePersonIdentityProviderIdentifierCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAM,iBAAiB;AAAA,EACtB,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,UACL,WACA,SACA,cACA,YACA,aACA,oBAC8C;AAC9C,WAAO,UAAU,YAAY,OAAO,OAAoD;AACvF,YAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIA,4BAAAA,4BAA4B,OAAO,CAAC;AACrF,UAAI,CAAC,YAAY,SAAS,YAAY;AACrC,cAAM,IAAI,MAAM,oBAAoB;AAAA,MACrC;AACA,YAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,YAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AACpF,UAAI;AACJ,UAAI;AACH,gBAAQ,MAAM,gBAAgB;AAAA,UAC7B;AAAA,UACA;AAAA,QAAA;AAAA,MAEF,SAAS,GAAG;AACX,YAAI,aAAaC,iBAAAA,kBAAkB;AAClC,iBAAO,IAAIC,SAAAA,cAAc,wBAAwB,EAAE,SAAS;AAAA,YAC3D,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU;AAAA,cACV,oBAAoB,SAAS;AAAA,YAAA,CAC7B;AAAA,UAAA,CACD;AAAA,QACF;AACA,YAAI,aAAaC,mBAAAA,oBAAoB;AACpC,iBAAO,IAAIF,SAAAA,cAAc,yBAAyB,EAAE,SAAS;AAAA,YAC5D,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU;AAAA,cACV,oBAAoB,SAAS;AAAA,YAAA,CAC7B;AAAA,UAAA,CACD;AAAA,QACF;AACA,cAAM;AAAA,MACP;AACA,YAAM,WAAW,MAAM,KAAK,cAAc,IAAI,OAAO,QAAQ;AAC7D,YAAM,YAAY,SAAS;AAE3B,UAAI,CAAC,WAAW;AAIf,eAAO,IAAID,SAAAA,cAAc,oBAAoB,UAAU,MAAM,KAAK,cAAc;AAAA,UAC/E,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,oBAAoB,SAAS;AAAA,YAC7B,aAAa,MAAM;AAAA,YACnB,UAAU,SAAS;AAAA,YACnB,WAAW,SAAS,gBAAgB,EAAE,QAAQ,SAAS,kBAAkB;AAAA,UAAA,CACzE;AAAA,QAAA,CACD;AAAA,MACF;AAEA,UAAI,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAID,SAAAA,cAAc,mBAAmB,sBAAsB,MAAM,KAAK,gBAAgB;AAAA,UAC5F,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,oBAAoB,SAAS;AAAA,YAC7B,aAAa,MAAM;AAAA,YACnB,UAAU,UAAU;AAAA,UAAA,CACpB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,EAAE,IAAI,UAAU,OAAO,iBAAiB,MAAM,KAAK,cAAc;AAAA,QACtE;AAAA,QACA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AASD,UAAI,MAAM,YAAY;AACrB,cAAM,YAAY,CAAC,CAAC,MAAM,WAAW,UAAU,OAAO,KAAK,MAAM,WAAW,MAAM,EAAE,SAAS;AAC7F,YAAI,CAAC,aAAa,GAAG,UAAU,mBAAmB;AACjD,gBAAM,GAAG,WAAW,QAAQ,IAAIE,wBAAAA,wBAAwB,UAAU,SAAS,IAAI,MAAM,UAAU,CAAC;AAAA,QACjG,OAAO;AAMN,gBAAM,GAAG,WAAW;AAAA,YACnB,IAAIC,oDAA0B;AAAA,cAC7B,MAAM;AAAA,cACN,aAAa,UAAU;AAAA,cACvB,UAAU,UAAU;AAAA,cACpB,oBAAoB,SAAS;AAAA,cAC7B,eAAe;AAAA,cACf,SAAS;AAAA,cACT,WAAW;AAAA,cACX,WAAW,aAAa;AAAA,cACxB,WAAW,aAAa;AAAA,YAAA,CACxB;AAAA,UAAA;AAAA,QAEH;AAAA,MACD;AAEA,aAAO,IAAIC,SAAAA,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,aAAa;AAAA,QACb,CAACJ,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,oBAAoB,SAAS;AAAA,UAC7B,aAAa,MAAM;AAAA,QAAA,CACnB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,WAA4B,SAAiB,MAAgE;AAChI,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,IAAIH,4BAAAA,4BAA4B,OAAO,CAAC;AAC5F,QAAI,CAAC,YAAY,SAAS,YAAY;AACrC,aAAO,IAAIE,SAAAA,cAAc,sBAAsB,qBAAqB,OAAO,YAAY;AAAA,IACxF;AACA,UAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,UAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AACpF,QAAI;AACH,YAAM,eAAe,MAAM,gBAAgB,SAAS,iBAAiB,IAAI;AAEzE,YAAM,eAAe,gBAAgB,yBAClC,gBAAgB,uBAAuB,eAAe,IACtD;AAEH,aAAO,IAAIK,SAAAA,WAAW;AAAA,QACrB,GAAG;AAAA,QACH,kBAAkB,SAAS,oBAAoB,eAAe;AAAA,MAAA,CAC9D;AAAA,IACF,SAAS,GAAG;AACX,UAAI,aAAaH,mBAAAA,oBAAoB;AACpC,eAAO,IAAIF,SAAAA,cAAc,yBAAyB,EAAE,OAAO;AAAA,MAC5D;AACA,YAAM;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAc,cAAc,IAAqB,OAAoB,UAA8E;AAClJ,UAAM,mBAAmB,IAAIM,iBAAAA,iBAAiB,SAAS,IAAI,MAAM,kBAAkB;AACnF,UAAM,cAAc,MAAM,GAAG,aAAa,MAAM,gBAAgB;AAChE,QAAI,aAAa;AAChB,aAAO,EAAE,QAAQ,YAAA;AAAA,IAClB;AAEA,QAAI,CAAC,SAAS,WAAW;AACxB,YAAM,gBAAgB,OAAO,MAAM,UAAU,YAAY,MAAM,QAC5D,MAAM,GAAG,aAAa,MAAMC,wBAAY,QAAQ,MAAM,KAAK,CAAC,IAC5D;AACH,UAAI,eAAe;AAOlB,cAAM,gBAAgB,SAAS,uBAAuB,MAAM,kBAAkB;AAC9E,YAAI,SAAS,wBAAwB,CAAC,eAAe;AACpD,iBAAO,EAAE,QAAQ,MAAM,eAAe,wBAAwB,iBAAiB,cAAc,GAAA;AAAA,QAC9F;AACA,cAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,aAAa;AAC/D,eAAO,EAAE,QAAQ,cAAA;AAAA,MAClB;AAAA,IACD;AAEA,QAAI,SAAS,YAAY;AACxB,YAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,OAAO,QAAQ;AAC5D,YAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,cAAc;AAChE,aAAO,EAAE,QAAQ,eAAA;AAAA,IAClB;AAEA,WAAO,EAAE,QAAQ,KAAA;AAAA,EAClB;AAAA,EAEA,MAAc,OAAO,IAAqB,EAAE,OAAO,MAAM,mBAAA,GAAmC,UAAmD;AAC9I,UAAM,QAAQ,CAACC,MAAAA,WAAW,MAAM;AAChC,UAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,KAAK,CAAC;AAC/E,UAAM,YAAY,MAAM,GAAG,WAAW;AAAA,MACrC,IAAIC,wCAAoB;AAAA,QACvB;AAAA,QACA,OAAO,SAAS,YAAY,SAAY;AAAA,QACxC,UAAUC,SAAAA;AAAAA,QACV,MAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,QACtC,SAAS,SAAS;AAAA,MAAA,CAClB;AAAA,IAAA;AAGF,WAAO;AAAA,MACN,GAAG;AAAA,MACH;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAc,kBAAkB,IAAqB,UAA+B,OAAoB,QAAmB;AAC1H,UAAM,GAAG,WAAW,QAAQ,IAAIC,8CAAAA,8CAA8C,SAAS,IAAI,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,EAChI;AACD;;"}
+{"version":3,"file":"IDPSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/IDPSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey/index.js'\nimport { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries/index.js'\nimport { IDPHandlerRegistry, IDPResponse, IDPResponseError, IDPValidationError } from './idp/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ApiKeyRequestInfo, CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProviderIdentifierCommand } from '../commands/index.js'\nimport { CreateIdpSessionCommand } from '../commands/idp/CreateIdpSessionCommand.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { TenantRole } from '../authorization/index.js'\nimport { NoPassword } from '../dtos/index.js'\nimport { IdentityProviderRow } from '../queries/idp/types.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { ClaimMappingAudit, IDPClaimSyncService } from './idp/IDPClaimSyncService.js'\nimport { ClaimMapping, parseClaimMapping } from './idp/ClaimMapping.js'\nimport { Logger } from '@contember/logger'\n\nclass IDPSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t\tprivate readonly claimSyncService: IDPClaimSyncService,\n\t\tprivate readonly logger: Logger,\n\t) {}\n\n\tasync signInIDP(\n\t\tdbContext: DatabaseContext,\n\t\tidpSlug: string,\n\t\tresponseData: unknown,\n\t\texpiration?: number,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<IDPSignInManager.SignInIDPResponse> {\n\t\treturn dbContext.transaction(async (db): Promise<IDPSignInManager.SignInIDPResponse> => {\n\t\t\tconst provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\t\tif (!provider || provider.disabledAt) {\n\t\t\t\tthrow new Error('provider not found')\n\t\t\t}\n\t\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\t\tlet claim: IDPResponse\n\t\t\ttry {\n\t\t\t\tclaim = await providerService.processResponse(\n\t\t\t\t\tvalidatedConfig,\n\t\t\t\t\tresponseData,\n\t\t\t\t)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IDPResponseError) {\n\t\t\t\t\treturn new ResponseError('INVALID_IDP_RESPONSE', e.message, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: undefined,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: undefined,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tconst resolved = await this.resolvePerson(db, claim, provider)\n\t\t\tconst personRow = resolved.person\n\n\t\t\tif (!personRow) {\n\t\t\t\t// Keep the external error generic (no account-existence leak), but\n\t\t\t\t// record the email-verification gate block distinctly in the audit\n\t\t\t\t// log — it is a takeover-grade event, not an ordinary \"not found\".\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t\t\tpersonId: resolved.blockedPersonId,\n\t\t\t\t\t\teventData: resolved.blockedReason ? { reason: resolved.blockedReason } : undefined,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\t// A09 — map IdP claims to project memberships. Returns a `{ before, after }` delta only\n\t\t\t// when something actually changed; the resolver emits the `idp_role_mapped` audit from it\n\t\t\t// (audit stays at the resolver layer).\n\t\t\t//\n\t\t\t// Fail-open on a MALFORMED/out-of-band `claimMapping`: parsing is caught so a bad config can\n\t\t\t// never lock the user out — sign-in proceeds without claim mapping and the resolver emits an\n\t\t\t// `idp_role_mapping_failed` marker. A DB error during the apply itself is NOT caught: it\n\t\t\t// propagates and rolls back the whole sign-in transaction, so a half-applied set of grants is\n\t\t\t// never committed (failing sign-in on an infra error is the safe outcome).\n\t\t\tlet mapping: ClaimMapping | null = null\n\t\t\tlet claimMappingFailed = false\n\t\t\ttry {\n\t\t\t\tmapping = parseClaimMapping(provider.configuration)\n\t\t\t} catch (e) {\n\t\t\t\tthis.logger.warn(e, { message: 'IdP sign-in: claim mapping configuration is invalid', identityProviderId: provider.id })\n\t\t\t\tclaimMappingFailed = true\n\t\t\t}\n\t\t\tlet claimMappingAudit: ClaimMappingAudit | null = null\n\t\t\tif (mapping) {\n\t\t\t\tconst syncResult = await this.claimSyncService.sync(\n\t\t\t\t\tdb,\n\t\t\t\t\tmapping,\n\t\t\t\t\tclaim,\n\t\t\t\t\t{ id: personRow.identity_id },\n\t\t\t\t\tresolved.isNewPerson === true,\n\t\t\t\t)\n\t\t\t\tclaimMappingAudit = syncResult.audit\n\t\t\t\t// The apply-time safety backstop dropped a configured rule (config-time validation was skipped, or\n\t\t\t\t// the project's ACL drifted since): surface the same fail-open marker as a malformed config, so a\n\t\t\t\t// silently-unapplied grant is visible to the operator. The resolver emits `idp_role_mapping_failed`.\n\t\t\t\tif (syncResult.droppedUnsafeRules) {\n\t\t\t\t\tclaimMappingFailed = true\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst { id: apiKeyId, token: sessionToken } = await this.apiKeyManager.createSessionApiKeyWithId(\n\t\t\t\tdb,\n\t\t\t\tpersonRow.identity_id,\n\t\t\t\texpiration,\n\t\t\t\trequestInfo,\n\t\t\t\ttrustForwardedInfo,\n\t\t\t)\n\n\t\t\t// Bind the federated-session state to this session so it can be re-validated\n\t\t\t// against the IdP later. Present only when the provider supports it and\n\t\t\t// revalidation is enabled on the IdP configuration (A24). Refresh tokens must be\n\t\t\t// encrypted at rest, so when no encryption key is configured we skip persisting a\n\t\t\t// token-bearing session (it would otherwise crash or store secrets in plaintext) —\n\t\t\t// the session then behaves like a plain session with no re-validation.\n\t\t\tif (claim.idpSession) {\n\t\t\t\tconst hasTokens = !!claim.idpSession.tokens && Object.keys(claim.idpSession.tokens).length > 0\n\t\t\t\tif (!hasTokens || db.providers.encryptionEnabled) {\n\t\t\t\t\tawait db.commandBus.execute(new CreateIdpSessionCommand(apiKeyId, provider.id, claim.idpSession))\n\t\t\t\t} else {\n\t\t\t\t\t// Re-validation is enabled on this IdP but no encryption key is configured, so we\n\t\t\t\t\t// won't store the token-bearing session — it silently degrades to a plain,\n\t\t\t\t\t// non-revalidated session. Audit the downgrade (errorCode `encryption_disabled`)\n\t\t\t\t\t// so the operator can see that a session they expected to be continuously\n\t\t\t\t\t// re-validated is in fact not protected, instead of failing closed at sign-in.\n\t\t\t\t\t// Best-effort, in a savepoint: a failed insert would otherwise abort the whole\n\t\t\t\t\t// sign-in transaction, and a lost audit row must not block the sign-in.\n\t\t\t\t\ttry {\n\t\t\t\t\t\tawait db.commandBus.transaction(bus =>\n\t\t\t\t\t\t\tbus.execute(\n\t\t\t\t\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\t\t\t\t\tinvokedById: personRow.identity_id,\n\t\t\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\t\t\t\terrorCode: 'encryption_disabled',\n\t\t\t\t\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t\t\t\t\t\teventData: { apiKeyId },\n\t\t\t\t\t\t\t\t}),\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t)\n\t\t\t\t\t} catch (e) {\n\t\t\t\t\t\tthis.logger.error(e, { message: 'IdP sign-in: writing the encryption_disabled audit entry failed', identityProviderId: provider.id })\n\t\t\t\t\t\t// the savepoint is rolled back, the sign-in transaction stays usable\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\tidpResponse: claim,\n\t\t\t\tclaimMappingAudit,\n\t\t\t\tclaimMappingFailed,\n\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse> {\n\t\tconst provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\tif (!provider || provider.disabledAt) {\n\t\t\treturn new ResponseError('PROVIDER_NOT_FOUND', `Identity provider ${idpSlug} not found`)\n\t\t}\n\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\ttry {\n\t\t\tconst initResponse = await providerService.initAuth(validatedConfig, data)\n\n\t\t\tconst publicConfig = providerService.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(validatedConfig)\n\t\t\t\t: validatedConfig\n\n\t\t\treturn new ResponseOk({\n\t\t\t\t...initResponse,\n\t\t\t\tidpConfiguration: provider.initReturnsConfig ? publicConfig : null,\n\t\t\t})\n\t\t} catch (e) {\n\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message)\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\t}\n\n\tprivate async resolvePerson(db: DatabaseContext, claim: IDPResponse, provider: IdentityProviderRow): Promise<IDPSignInManager.ResolvePersonResult> {\n\t\tconst personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)\n\t\tconst personByIdp = await db.queryHandler.fetch(personByIdPQuery)\n\t\tif (personByIdp) {\n\t\t\treturn { person: personByIdp }\n\t\t}\n\n\t\tif (!provider.exclusive) {\n\t\t\tconst personByEmail = typeof claim.email === 'string' && claim.email\n\t\t\t\t? await db.queryHandler.fetch(PersonQuery.byEmail(claim.email))\n\t\t\t\t: null\n\t\t\tif (personByEmail) {\n\t\t\t\t// Auto-linking an IdP identity to a pre-existing local account by\n\t\t\t\t// e-mail is takeover-grade: if the provider returns an unverified\n\t\t\t\t// (or attacker-controlled) e-mail, it could hijack the account. When\n\t\t\t\t// the provider requires a verified e-mail, refuse to link — and to\n\t\t\t\t// sign in — unless the address is asserted verified. `assumeEmailVerified`\n\t\t\t\t// lets a trusted IdP that never emits the claim still satisfy the gate.\n\t\t\t\tconst emailVerified = provider.assumeEmailVerified || claim.emailVerified === true\n\t\t\t\tif (provider.requireVerifiedEmail && !emailVerified) {\n\t\t\t\t\treturn { person: null, blockedReason: 'idp_email_unverified', blockedPersonId: personByEmail.id }\n\t\t\t\t}\n\t\t\t\tawait this.saveIdpIdentifier(db, provider, claim, personByEmail)\n\t\t\t\treturn { person: personByEmail }\n\t\t\t}\n\t\t}\n\n\t\tif (provider.autoSignUp) {\n\t\t\tconst signedUpPerson = await this.signUp(db, claim, provider)\n\t\t\tawait this.saveIdpIdentifier(db, provider, claim, signedUpPerson)\n\t\t\treturn { person: signedUpPerson, isNewPerson: true }\n\t\t}\n\n\t\treturn { person: null }\n\t}\n\n\tprivate async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow> {\n\t\tconst roles = [TenantRole.PERSON]\n\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))\n\t\tconst newPerson = await db.commandBus.execute(\n\t\t\tnew CreatePersonCommand({\n\t\t\t\tidentityId,\n\t\t\t\temail: provider.exclusive ? undefined : email,\n\t\t\t\tpassword: NoPassword,\n\t\t\t\tname: name ?? email?.split('@')[0] ?? externalIdentifier,\n\t\t\t\tidpOnly: provider.exclusive,\n\t\t\t}),\n\t\t)\n\n\t\treturn {\n\t\t\t...newPerson,\n\t\t\troles,\n\t\t}\n\t}\n\n\tprivate async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPResponse, person: PersonRow) {\n\t\tawait db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier))\n\t}\n}\n\nnamespace IDPSignInManager {\n\texport type ResolvePersonResult = {\n\t\treadonly person: PersonRow | null\n\t\treadonly blockedReason?: 'idp_email_unverified'\n\t\treadonly blockedPersonId?: string\n\t\t/** True when the person row was just created by auto-sign-up (drives the `sticky` claim-mapping policy). */\n\t\treadonly isNewPerson?: boolean\n\t}\n\n\texport type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>\n\n\tinterface SignInIDPResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\treadonly idpResponse?: Record<string, unknown>\n\t\t/** Identity provider the sign-in went through (for the resolver's audit). */\n\t\treadonly identityProviderId?: string\n\t\t/** Claim-mapping (A09) before/after delta — present only when a mapping changed grants. */\n\t\treadonly claimMappingAudit?: ClaimMappingAudit | null\n\t\t/** True when claim mapping failed and was skipped (fail-open) — drives the `idp_role_mapping_failed` audit. */\n\t\treadonly claimMappingFailed?: boolean\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\n\texport type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { IDPSignInManager }\n"],"names":["IdentityProviderBySlugQuery","IDPResponseError","ResponseError","AuthLogService","IDPValidationError","parseClaimMapping","CreateIdpSessionCommand","CreateAuthLogEntryCommand","ResponseOk","PersonByIdPQuery","PersonQuery","TenantRole","CreateIdentityCommand","CreatePersonCommand","NoPassword","CreatePersonIdentityProviderIdentifierCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,iBAAiB;AAAA,EACtB,YACkB,eACA,aACA,kBACA,QAChB;AAJgB,SAAA,gBAAA;AACA,SAAA,cAAA;AACA,SAAA,mBAAA;AACA,SAAA,SAAA;AAAA,EACf;AAAA,EAEH,MAAM,UACL,WACA,SACA,cACA,YACA,aACA,oBAC8C;AAC9C,WAAO,UAAU,YAAY,OAAO,OAAoD;AACvF,YAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIA,4BAAAA,4BAA4B,OAAO,CAAC;AACrF,UAAI,CAAC,YAAY,SAAS,YAAY;AACrC,cAAM,IAAI,MAAM,oBAAoB;AAAA,MACrC;AACA,YAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,YAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AACpF,UAAI;AACJ,UAAI;AACH,gBAAQ,MAAM,gBAAgB;AAAA,UAC7B;AAAA,UACA;AAAA,QAAA;AAAA,MAEF,SAAS,GAAG;AACX,YAAI,aAAaC,iBAAAA,kBAAkB;AAClC,iBAAO,IAAIC,SAAAA,cAAc,wBAAwB,EAAE,SAAS;AAAA,YAC3D,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU;AAAA,cACV,oBAAoB,SAAS;AAAA,YAAA,CAC7B;AAAA,UAAA,CACD;AAAA,QACF;AACA,YAAI,aAAaC,mBAAAA,oBAAoB;AACpC,iBAAO,IAAIF,SAAAA,cAAc,yBAAyB,EAAE,SAAS;AAAA,YAC5D,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU;AAAA,cACV,oBAAoB,SAAS;AAAA,YAAA,CAC7B;AAAA,UAAA,CACD;AAAA,QACF;AACA,cAAM;AAAA,MACP;AACA,YAAM,WAAW,MAAM,KAAK,cAAc,IAAI,OAAO,QAAQ;AAC7D,YAAM,YAAY,SAAS;AAE3B,UAAI,CAAC,WAAW;AAIf,eAAO,IAAID,SAAAA,cAAc,oBAAoB,UAAU,MAAM,KAAK,cAAc;AAAA,UAC/E,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,oBAAoB,SAAS;AAAA,YAC7B,aAAa,MAAM;AAAA,YACnB,UAAU,SAAS;AAAA,YACnB,WAAW,SAAS,gBAAgB,EAAE,QAAQ,SAAS,kBAAkB;AAAA,UAAA,CACzE;AAAA,QAAA,CACD;AAAA,MACF;AAEA,UAAI,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAID,SAAAA,cAAc,mBAAmB,sBAAsB,MAAM,KAAK,gBAAgB;AAAA,UAC5F,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,oBAAoB,SAAS;AAAA,YAC7B,aAAa,MAAM;AAAA,YACnB,UAAU,UAAU;AAAA,UAAA,CACpB;AAAA,QAAA,CACD;AAAA,MACF;AAWA,UAAI,UAA+B;AACnC,UAAI,qBAAqB;AACzB,UAAI;AACH,kBAAUE,aAAAA,kBAAkB,SAAS,aAAa;AAAA,MACnD,SAAS,GAAG;AACX,aAAK,OAAO,KAAK,GAAG,EAAE,SAAS,uDAAuD,oBAAoB,SAAS,IAAI;AACvH,6BAAqB;AAAA,MACtB;AACA,UAAI,oBAA8C;AAClD,UAAI,SAAS;AACZ,cAAM,aAAa,MAAM,KAAK,iBAAiB;AAAA,UAC9C;AAAA,UACA;AAAA,UACA;AAAA,UACA,EAAE,IAAI,UAAU,YAAA;AAAA,UAChB,SAAS,gBAAgB;AAAA,QAAA;AAE1B,4BAAoB,WAAW;AAI/B,YAAI,WAAW,oBAAoB;AAClC,+BAAqB;AAAA,QACtB;AAAA,MACD;AAEA,YAAM,EAAE,IAAI,UAAU,OAAO,iBAAiB,MAAM,KAAK,cAAc;AAAA,QACtE;AAAA,QACA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AASD,UAAI,MAAM,YAAY;AACrB,cAAM,YAAY,CAAC,CAAC,MAAM,WAAW,UAAU,OAAO,KAAK,MAAM,WAAW,MAAM,EAAE,SAAS;AAC7F,YAAI,CAAC,aAAa,GAAG,UAAU,mBAAmB;AACjD,gBAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,UAAU,SAAS,IAAI,MAAM,UAAU,CAAC;AAAA,QACjG,OAAO;AAQN,cAAI;AACH,kBAAM,GAAG,WAAW;AAAA,cAAY,SAC/B,IAAI;AAAA,gBACH,IAAIC,oDAA0B;AAAA,kBAC7B,MAAM;AAAA,kBACN,aAAa,UAAU;AAAA,kBACvB,UAAU,UAAU;AAAA,kBACpB,oBAAoB,SAAS;AAAA,kBAC7B,SAAS;AAAA,kBACT,WAAW;AAAA,kBACX,WAAW,aAAa;AAAA,kBACxB,WAAW,aAAa;AAAA,kBACxB,WAAW,EAAE,SAAA;AAAA,gBAAS,CACtB;AAAA,cAAA;AAAA,YACF;AAAA,UAEF,SAAS,GAAG;AACX,iBAAK,OAAO,MAAM,GAAG,EAAE,SAAS,mEAAmE,oBAAoB,SAAS,IAAI;AAAA,UAErI;AAAA,QACD;AAAA,MACD;AAEA,aAAO,IAAIC,SAAAA,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,aAAa;AAAA,QACb;AAAA,QACA;AAAA,QACA,oBAAoB,SAAS;AAAA,QAC7B,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,oBAAoB,SAAS;AAAA,UAC7B,aAAa,MAAM;AAAA,QAAA,CACnB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,WAA4B,SAAiB,MAAgE;AAChI,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,IAAIH,4BAAAA,4BAA4B,OAAO,CAAC;AAC5F,QAAI,CAAC,YAAY,SAAS,YAAY;AACrC,aAAO,IAAIE,SAAAA,cAAc,sBAAsB,qBAAqB,OAAO,YAAY;AAAA,IACxF;AACA,UAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,UAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AACpF,QAAI;AACH,YAAM,eAAe,MAAM,gBAAgB,SAAS,iBAAiB,IAAI;AAEzE,YAAM,eAAe,gBAAgB,yBAClC,gBAAgB,uBAAuB,eAAe,IACtD;AAEH,aAAO,IAAIM,SAAAA,WAAW;AAAA,QACrB,GAAG;AAAA,QACH,kBAAkB,SAAS,oBAAoB,eAAe;AAAA,MAAA,CAC9D;AAAA,IACF,SAAS,GAAG;AACX,UAAI,aAAaJ,mBAAAA,oBAAoB;AACpC,eAAO,IAAIF,SAAAA,cAAc,yBAAyB,EAAE,OAAO;AAAA,MAC5D;AACA,YAAM;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAc,cAAc,IAAqB,OAAoB,UAA8E;AAClJ,UAAM,mBAAmB,IAAIO,iBAAAA,iBAAiB,SAAS,IAAI,MAAM,kBAAkB;AACnF,UAAM,cAAc,MAAM,GAAG,aAAa,MAAM,gBAAgB;AAChE,QAAI,aAAa;AAChB,aAAO,EAAE,QAAQ,YAAA;AAAA,IAClB;AAEA,QAAI,CAAC,SAAS,WAAW;AACxB,YAAM,gBAAgB,OAAO,MAAM,UAAU,YAAY,MAAM,QAC5D,MAAM,GAAG,aAAa,MAAMC,wBAAY,QAAQ,MAAM,KAAK,CAAC,IAC5D;AACH,UAAI,eAAe;AAOlB,cAAM,gBAAgB,SAAS,uBAAuB,MAAM,kBAAkB;AAC9E,YAAI,SAAS,wBAAwB,CAAC,eAAe;AACpD,iBAAO,EAAE,QAAQ,MAAM,eAAe,wBAAwB,iBAAiB,cAAc,GAAA;AAAA,QAC9F;AACA,cAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,aAAa;AAC/D,eAAO,EAAE,QAAQ,cAAA;AAAA,MAClB;AAAA,IACD;AAEA,QAAI,SAAS,YAAY;AACxB,YAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,OAAO,QAAQ;AAC5D,YAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,cAAc;AAChE,aAAO,EAAE,QAAQ,gBAAgB,aAAa,KAAA;AAAA,IAC/C;AAEA,WAAO,EAAE,QAAQ,KAAA;AAAA,EAClB;AAAA,EAEA,MAAc,OAAO,IAAqB,EAAE,OAAO,MAAM,mBAAA,GAAmC,UAAmD;AAC9I,UAAM,QAAQ,CAACC,MAAAA,WAAW,MAAM;AAChC,UAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,KAAK,CAAC;AAC/E,UAAM,YAAY,MAAM,GAAG,WAAW;AAAA,MACrC,IAAIC,wCAAoB;AAAA,QACvB;AAAA,QACA,OAAO,SAAS,YAAY,SAAY;AAAA,QACxC,UAAUC,SAAAA;AAAAA,QACV,MAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,QACtC,SAAS,SAAS;AAAA,MAAA,CAClB;AAAA,IAAA;AAGF,WAAO;AAAA,MACN,GAAG;AAAA,MACH;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAc,kBAAkB,IAAqB,UAA+B,OAAoB,QAAmB;AAC1H,UAAM,GAAG,WAAW,QAAQ,IAAIC,8CAAAA,8CAA8C,SAAS,IAAI,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,EAChI;AACD;;"}