npm - @contember/engine-tenant-api - Versions diffs - 2.2.0-alpha.1 → 2.2.0-alpha.10 - Mend

@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2014) hide show

package/dist/development/src/model/service/ProjectMemberManager.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ProjectMemberManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectMemberManager.ts"],"sourcesContent":["import {\n\tAddProjectMemberCommand,\n\tMembershipUpdateInput,\n\tRemoveProjectMemberCommand,\n\tRemoveProjectMemberResponse,\n\tUpdateProjectMemberCommand,\n\tUpdateProjectMemberResponse,\n} from '../commands/index.js'\nimport { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries/index.js'\nimport { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema/index.js'\nimport { AccessVerifier, PermissionActions, TenantRole } from '../authorization/index.js'\nimport { indexListBy, notEmpty } from '../../utils/array.js'\nimport { createSetMembershipVariables } from './membershipUtils.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { Response } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class ProjectMemberManager {\n\tasync addProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t): Promise<AddProjectMemberResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await db.commandBus.execute(\n\t\t\t\tnew AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),\n\t\t\t)\n\t\t})\n\t}\n\n\tasync updateProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly MembershipUpdateInput[],\n\t): Promise<UpdateProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships)),\n\t\t)\n\t}\n\n\tasync removeProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string): Promise<RemoveProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId)),\n\t\t)\n\t}\n\n\tasync getAllProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } \| { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t\tverifier: AccessVerifier \| undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\treturn [\n\t\t\t...this.getImplicitProjectMemberships(identity),\n\t\t\t...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier),\n\t\t]\n\t}\n\n\tasync getEffectiveProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } \| { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst implicit = this.getImplicitProjectMemberships(identity)\n\t\tif (implicit.length > 0) {\n\t\t\treturn implicit\n\t\t}\n\t\treturn await this.getStoredProjectsMemberships(dbContext, project, identity, undefined)\n\t}\n\n\tasync getStoredProjectsMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } \| { slug: string },\n\t\tidentity: { id: string },\n\t\tverifier: AccessVerifier \| undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst memberships = await dbContext.queryHandler.fetch(\n\t\t\tnew ProjectMembershipByIdentityQuery(project, [identity.id]),\n\t\t)\n\t\tif (verifier === undefined) {\n\t\t\treturn memberships\n\t\t}\n\t\treturn await this.filterMemberships(memberships, verifier)\n\t}\n\n\tprivate getImplicitProjectMemberships(identity: { id: string; roles?: readonly string[] }): readonly Acl.Membership[] {\n\t\tif (identity.roles?.includes(TenantRole.SUPER_ADMIN) \|\| identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {\n\t\t\treturn [{ role: ProjectRole.ADMIN, variables: [] }]\n\t\t}\n\t\treturn []\n\t}\n\n\tasync getProjectMembers(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\taccessVerifier: AccessVerifier,\n\t\tinput: ProjectMembersInput,\n\t): Promise<GetProjectMembersResponse> {\n\t\treturn dbContext.transaction(async db => {\n\t\t\tconst members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))\n\t\t\tconst memberships = await db.queryHandler.fetch(\n\t\t\t\tnew ProjectMembershipByIdentityQuery(\n\t\t\t\t\t{ id: projectId },\n\t\t\t\t\tmembers.map(it => it.id),\n\t\t\t\t),\n\t\t\t)\n\t\t\tconst filteredMemberships = await this.filterMemberships(memberships, accessVerifier)\n\t\t\tconst byIdentity = indexListBy(filteredMemberships, 'identityId')\n\t\t\treturn members\n\t\t\t\t.map(it => (byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null))\n\t\t\t\t.filter(notEmpty)\n\t\t})\n\t}\n\n\tprivate async filterMemberships<T extends Acl.Membership>(\n\t\tmemberships: readonly T[],\n\t\tverifier: AccessVerifier,\n\t): Promise<T[]> {\n\t\tconst filteredMemberships: T[] = []\n\t\tnextMembership: for (const membership of memberships) {\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst variables: { values: Acl.MembershipVariable['values']; name: string }[] = []\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)\n\t\t\t\tif (values.length === 0) {\n\t\t\t\t\tcontinue nextMembership\n\t\t\t\t}\n\t\t\t\tvariables.push({ name: variable.name, values })\n\t\t\t}\n\t\t\tfilteredMemberships.push({ ...membership, variables })\n\t\t}\n\n\t\treturn filteredMemberships\n\t}\n\n\tprivate async filterProjectMembershipVariableValues(\n\t\tmembership: Acl.Membership,\n\t\tvariable: Acl.MembershipVariable,\n\t\tverifier: AccessVerifier,\n\t): Promise<Acl.MembershipVariable['values']> {\n\t\tconst values = await Promise.all(\n\t\t\tvariable.values.map(async (value): Promise<string \| null> => {\n\t\t\t\tconst subMembership = {\n\t\t\t\t\trole: membership.role,\n\t\t\t\t\tvariables: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: variable.name,\n\t\t\t\t\t\t\tvalues: [value],\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t}\n\n\t\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership])))) {\n\t\t\t\t\treturn null\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t}),\n\t\t)\n\t\treturn values.filter(notEmpty)\n\t}\n}\n\nexport type AddProjectMemberResponse = Response<null, AddProjectMemberErrorCode>\n\nexport type GetProjectMembersResponse = {\n\tidentity: { id: string }\n\tmemberships: readonly Acl.Membership[]\n}[]\n"],"names":[],"mappings":"~~;;;;;;;;;;;;;;;;;~~AAiBO,MAAM,qBAAqB;AAAA,EACjC,MAAM,iBACL,WACA,WACA,YACA,aACoC;AACpC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,GAAG,WAAW;AAAA,QAC1B,IAAI,wBAAwB,WAAW,YAAY,6BAA6B,WAAW,CAAC;AAAA,MAAA;AAAA,IAE9F,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,oBACL,WACA,WACA,YACA,aACuC;AACvC,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,YAAY,WAAW,CAAC;AAAA,IAAA;AAAA,EAE5G;AAAA,EAEA,MAAM,oBAAoB,WAA4B,WAAmB,YAA0D;AAClI,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,UAAU,CAAC;AAAA,IAAA;AAAA,EAE/F;AAAA,EAEA,MAAM,yBACL,WACA,SACA,UACA,UACqC;AACrC,WAAO;AAAA,MACN,GAAG,KAAK,8BAA8B,QAAQ;AAAA,MAC9C,GAAG,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,QAAQ;AAAA,IAAA;AAAA,EAEnF;AAAA,EAEA,MAAM,+BACL,WACA,SACA,UACqC;AACrC,UAAM,WAAW,KAAK,8BAA8B,QAAQ;AAC5D,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,MAAS;AAAA,EACvF;AAAA,EAEA,MAAM,6BACL,WACA,SACA,UACA,UACqC;AACrC,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAI,iCAAiC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,IAAA;AAE5D,QAAI,aAAa,QAAW;AAC3B,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,kBAAkB,aAAa,QAAQ;AAAA,EAC1D;AAAA,EAEQ,8BAA8B,UAAgF;AACrH,QAAI,SAAS,OAAO,SAAS,WAAW,WAAW,KAAK,SAAS,OAAO,SAAS,WAAW,aAAa,GAAG;AAC3G,aAAO,CAAC,EAAE,MAAM,YAAY,OAAO,WAAW,CAAA,GAAI;AAAA,IACnD;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAM,kBACL,WACA,WACA,gBACA,OACqC;AACrC,WAAO,UAAU,YAAY,OAAM,OAAM;AACxC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,CAAC;AACrF,YAAM,cAAc,MAAM,GAAG,aAAa;AAAA,QACzC,IAAI;AAAA,UACH,EAAE,IAAI,UAAA;AAAA,UACN,QAAQ,IAAI,CAAA,OAAM,GAAG,EAAE;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,sBAAsB,MAAM,KAAK,kBAAkB,aAAa,cAAc;AACpF,YAAM,aAAa,YAAY,qBAAqB,YAAY;AAChE,aAAO,QACL,IAAI,CAAA,OAAO,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa,WAAW,GAAG,EAAE,EAAA,IAAM,IAAK,EACvF,OAAO,QAAQ;AAAA,IAClB,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,aACA,UACe;AACf,UAAM,sBAA2B,CAAA;AACjC,mBAAgB,YAAW,cAAc,aAAa;AACrD,UAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,EAAE,MAAM,WAAW,MAAM,WAAW,GAAC,CAAG,CAAC,CAAC,GAAI;AACzG;AAAA,MACD;AACA,YAAM,YAA0E,CAAA;AAChF,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,SAAS,MAAM,KAAK,sCAAsC,YAAY,UAAU,QAAQ;AAC9F,YAAI,OAAO,WAAW,GAAG;AACxB,mBAAS;AAAA,QACV;AACA,kBAAU,KAAK,EAAE,MAAM,SAAS,MAAM,QAAQ;AAAA,MAC/C;AACA,0BAAoB,KAAK,EAAE,GAAG,YAAY,WAAW;AAAA,IACtD;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,sCACb,YACA,UACA,UAC4C;AAC5C,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC5B,SAAS,OAAO,IAAI,OAAO,UAAkC;AAC5D,cAAM,gBAAgB;AAAA,UACrB,MAAM,WAAW;AAAA,UACjB,WAAW;AAAA,YACV;AAAA,cACC,MAAM,SAAS;AAAA,cACf,QAAQ,CAAC,KAAK;AAAA,YAAA;AAAA,UACf;AAAA,QACD;AAGD,YAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,aAAa,CAAC,CAAC,GAAI;AAC9E,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,MACR,CAAC;AAAA,IAAA;AAEF,WAAO,OAAO,OAAO,QAAQ;AAAA,EAC9B;AACD;"}
1	+ {"version":3,"file":"ProjectMemberManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/ProjectMemberManager.ts"],"sourcesContent":["import {\n\tAddProjectMemberCommand,\n\tMembershipUpdateInput,\n\tRemoveProjectMemberCommand,\n\tRemoveProjectMemberResponse,\n\tUpdateProjectMemberCommand,\n\tUpdateProjectMemberResponse,\n} from '../commands/index.js'\nimport { ProjectMembershipByIdentityQuery, ProjectMembersQuery } from '../queries/index.js'\nimport { AddProjectMemberErrorCode, ProjectMembersInput } from '../../schema/index.js'\nimport { AccessVerifier, PermissionActions, TenantRole } from '../authorization/index.js'\nimport { indexListBy, notEmpty } from '../../utils/array.js'\nimport { createSetMembershipVariables } from './membershipUtils.js'\nimport { Acl, ProjectRole } from '@contember/schema'\nimport { Response } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class ProjectMemberManager {\n\tasync addProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t): Promise<AddProjectMemberResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await db.commandBus.execute(\n\t\t\t\tnew AddProjectMemberCommand(projectId, identityId, createSetMembershipVariables(memberships)),\n\t\t\t)\n\t\t})\n\t}\n\n\tasync updateProjectMember(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tidentityId: string,\n\t\tmemberships: readonly MembershipUpdateInput[],\n\t): Promise<UpdateProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new UpdateProjectMemberCommand(projectId, identityId, memberships)),\n\t\t)\n\t}\n\n\tasync removeProjectMember(dbContext: DatabaseContext, projectId: string, identityId: string): Promise<RemoveProjectMemberResponse> {\n\t\treturn await dbContext.transaction(\n\t\t\tasync db => await db.commandBus.execute(new RemoveProjectMemberCommand(projectId, identityId)),\n\t\t)\n\t}\n\n\tasync getAllProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } \| { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t\tverifier: AccessVerifier \| undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\treturn [\n\t\t\t...this.getImplicitProjectMemberships(identity),\n\t\t\t...await this.getStoredProjectsMemberships(dbContext, project, identity, verifier),\n\t\t]\n\t}\n\n\tasync getEffectiveProjectMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } \| { slug: string },\n\t\tidentity: { id: string; roles?: readonly string[] },\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst implicit = this.getImplicitProjectMemberships(identity)\n\t\tif (implicit.length > 0) {\n\t\t\treturn implicit\n\t\t}\n\t\treturn await this.getStoredProjectsMemberships(dbContext, project, identity, undefined)\n\t}\n\n\tasync getStoredProjectsMemberships(\n\t\tdbContext: DatabaseContext,\n\t\tproject: { id: string } \| { slug: string },\n\t\tidentity: { id: string },\n\t\tverifier: AccessVerifier \| undefined,\n\t): Promise<readonly Acl.Membership[]> {\n\t\tconst memberships = await dbContext.queryHandler.fetch(\n\t\t\tnew ProjectMembershipByIdentityQuery(project, [identity.id]),\n\t\t)\n\t\tif (verifier === undefined) {\n\t\t\treturn memberships\n\t\t}\n\t\treturn await this.filterMemberships(memberships, verifier)\n\t}\n\n\tprivate getImplicitProjectMemberships(identity: { id: string; roles?: readonly string[] }): readonly Acl.Membership[] {\n\t\tif (identity.roles?.includes(TenantRole.SUPER_ADMIN) \|\| identity.roles?.includes(TenantRole.PROJECT_ADMIN)) {\n\t\t\treturn [{ role: ProjectRole.ADMIN, variables: [] }]\n\t\t}\n\t\treturn []\n\t}\n\n\tasync getProjectMembers(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\taccessVerifier: AccessVerifier,\n\t\tinput: ProjectMembersInput,\n\t): Promise<GetProjectMembersResponse> {\n\t\treturn dbContext.transaction(async db => {\n\t\t\tconst members = await db.queryHandler.fetch(new ProjectMembersQuery(projectId, input))\n\t\t\tconst memberships = await db.queryHandler.fetch(\n\t\t\t\tnew ProjectMembershipByIdentityQuery(\n\t\t\t\t\t{ id: projectId },\n\t\t\t\t\tmembers.map(it => it.id),\n\t\t\t\t),\n\t\t\t)\n\t\t\tconst filteredMemberships = await this.filterMemberships(memberships, accessVerifier)\n\t\t\tconst byIdentity = indexListBy(filteredMemberships, 'identityId')\n\t\t\treturn members\n\t\t\t\t.map(it => (byIdentity[it.id] ? { identity: it, memberships: byIdentity[it.id] } : null))\n\t\t\t\t.filter(notEmpty)\n\t\t})\n\t}\n\n\tprivate async filterMemberships<T extends Acl.Membership>(\n\t\tmemberships: readonly T[],\n\t\tverifier: AccessVerifier,\n\t): Promise<T[]> {\n\t\tconst filteredMemberships: T[] = []\n\t\tnextMembership: for (const membership of memberships) {\n\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([{ role: membership.role, variables: [] }])))) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst variables: { values: Acl.MembershipVariable['values']; name: string }[] = []\n\t\t\tfor (const variable of membership.variables) {\n\t\t\t\tconst values = await this.filterProjectMembershipVariableValues(membership, variable, verifier)\n\t\t\t\tif (values.length === 0) {\n\t\t\t\t\tcontinue nextMembership\n\t\t\t\t}\n\t\t\t\tvariables.push({ name: variable.name, values })\n\t\t\t}\n\t\t\tfilteredMemberships.push({ ...membership, variables })\n\t\t}\n\n\t\treturn filteredMemberships\n\t}\n\n\tprivate async filterProjectMembershipVariableValues(\n\t\tmembership: Acl.Membership,\n\t\tvariable: Acl.MembershipVariable,\n\t\tverifier: AccessVerifier,\n\t): Promise<Acl.MembershipVariable['values']> {\n\t\tconst values = await Promise.all(\n\t\t\tvariable.values.map(async (value): Promise<string \| null> => {\n\t\t\t\tconst subMembership = {\n\t\t\t\t\trole: membership.role,\n\t\t\t\t\tvariables: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tname: variable.name,\n\t\t\t\t\t\t\tvalues: [value],\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t}\n\n\t\t\t\tif (!(await verifier(PermissionActions.PROJECT_VIEW_MEMBER([subMembership])))) {\n\t\t\t\t\treturn null\n\t\t\t\t}\n\t\t\t\treturn value\n\t\t\t}),\n\t\t)\n\t\treturn values.filter(notEmpty)\n\t}\n}\n\nexport type AddProjectMemberResponse = Response<null, AddProjectMemberErrorCode>\n\nexport type GetProjectMembersResponse = {\n\tidentity: { id: string }\n\tmemberships: readonly Acl.Membership[]\n}[]\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAiBO,MAAM,qBAAqB;AAAA,EACjC,MAAM,iBACL,WACA,WACA,YACA,aACoC;AACpC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,GAAG,WAAW;AAAA,QAC1B,IAAI,wBAAwB,WAAW,YAAY,6BAA6B,WAAW,CAAC;AAAA,MAAA;AAAA,IAE9F,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,oBACL,WACA,WACA,YACA,aACuC;AACvC,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,YAAY,WAAW,CAAC;AAAA,IAAA;AAAA,EAE5G;AAAA,EAEA,MAAM,oBAAoB,WAA4B,WAAmB,YAA0D;AAClI,WAAO,MAAM,UAAU;AAAA,MACtB,OAAM,OAAM,MAAM,GAAG,WAAW,QAAQ,IAAI,2BAA2B,WAAW,UAAU,CAAC;AAAA,IAAA;AAAA,EAE/F;AAAA,EAEA,MAAM,yBACL,WACA,SACA,UACA,UACqC;AACrC,WAAO;AAAA,MACN,GAAG,KAAK,8BAA8B,QAAQ;AAAA,MAC9C,GAAG,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,QAAQ;AAAA,IAAA;AAAA,EAEnF;AAAA,EAEA,MAAM,+BACL,WACA,SACA,UACqC;AACrC,UAAM,WAAW,KAAK,8BAA8B,QAAQ;AAC5D,QAAI,SAAS,SAAS,GAAG;AACxB,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,6BAA6B,WAAW,SAAS,UAAU,MAAS;AAAA,EACvF;AAAA,EAEA,MAAM,6BACL,WACA,SACA,UACA,UACqC;AACrC,UAAM,cAAc,MAAM,UAAU,aAAa;AAAA,MAChD,IAAI,iCAAiC,SAAS,CAAC,SAAS,EAAE,CAAC;AAAA,IAAA;AAE5D,QAAI,aAAa,QAAW;AAC3B,aAAO;AAAA,IACR;AACA,WAAO,MAAM,KAAK,kBAAkB,aAAa,QAAQ;AAAA,EAC1D;AAAA,EAEQ,8BAA8B,UAAgF;AACrH,QAAI,SAAS,OAAO,SAAS,WAAW,WAAW,KAAK,SAAS,OAAO,SAAS,WAAW,aAAa,GAAG;AAC3G,aAAO,CAAC,EAAE,MAAM,YAAY,OAAO,WAAW,CAAA,GAAI;AAAA,IACnD;AACA,WAAO,CAAA;AAAA,EACR;AAAA,EAEA,MAAM,kBACL,WACA,WACA,gBACA,OACqC;AACrC,WAAO,UAAU,YAAY,OAAM,OAAM;AACxC,YAAM,UAAU,MAAM,GAAG,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,CAAC;AACrF,YAAM,cAAc,MAAM,GAAG,aAAa;AAAA,QACzC,IAAI;AAAA,UACH,EAAE,IAAI,UAAA;AAAA,UACN,QAAQ,IAAI,CAAA,OAAM,GAAG,EAAE;AAAA,QAAA;AAAA,MACxB;AAED,YAAM,sBAAsB,MAAM,KAAK,kBAAkB,aAAa,cAAc;AACpF,YAAM,aAAa,YAAY,qBAAqB,YAAY;AAChE,aAAO,QACL,IAAI,CAAA,OAAO,WAAW,GAAG,EAAE,IAAI,EAAE,UAAU,IAAI,aAAa,WAAW,GAAG,EAAE,EAAA,IAAM,IAAK,EACvF,OAAO,QAAQ;AAAA,IAClB,CAAC;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,aACA,UACe;AACf,UAAM,sBAA2B,CAAA;AACjC,mBAAgB,YAAW,cAAc,aAAa;AACrD,UAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,EAAE,MAAM,WAAW,MAAM,WAAW,GAAC,CAAG,CAAC,CAAC,GAAI;AACzG;AAAA,MACD;AACA,YAAM,YAA0E,CAAA;AAChF,iBAAW,YAAY,WAAW,WAAW;AAC5C,cAAM,SAAS,MAAM,KAAK,sCAAsC,YAAY,UAAU,QAAQ;AAC9F,YAAI,OAAO,WAAW,GAAG;AACxB,mBAAS;AAAA,QACV;AACA,kBAAU,KAAK,EAAE,MAAM,SAAS,MAAM,QAAQ;AAAA,MAC/C;AACA,0BAAoB,KAAK,EAAE,GAAG,YAAY,WAAW;AAAA,IACtD;AAEA,WAAO;AAAA,EACR;AAAA,EAEA,MAAc,sCACb,YACA,UACA,UAC4C;AAC5C,UAAM,SAAS,MAAM,QAAQ;AAAA,MAC5B,SAAS,OAAO,IAAI,OAAO,UAAkC;AAC5D,cAAM,gBAAgB;AAAA,UACrB,MAAM,WAAW;AAAA,UACjB,WAAW;AAAA,YACV;AAAA,cACC,MAAM,SAAS;AAAA,cACf,QAAQ,CAAC,KAAK;AAAA,YAAA;AAAA,UACf;AAAA,QACD;AAGD,YAAI,CAAE,MAAM,SAAS,kBAAkB,oBAAoB,CAAC,aAAa,CAAC,CAAC,GAAI;AAC9E,iBAAO;AAAA,QACR;AACA,eAAO;AAAA,MACR,CAAC;AAAA,IAAA;AAEF,WAAO,OAAO,OAAO,QAAQ;AAAA,EAC9B;AACD;"}

package/dist/development/src/model/service/RateLimiter.cjs CHANGED Viewed

@@ -36,8 +36,7 @@ class RateLimiter {
     if (limit <= 0 || windowSeconds <= 0) {
       return { ok: true };
     }
-    const windowStart = new Date(this.providers.now().getTime() - windowSeconds * 1e3);
-    const count = await db.queryHandler.fetch(new RateLimitCountQuery.RateLimitCountQuery(scope, this.hashKey(key), windowStart));
+    const count = await db.queryHandler.fetch(new RateLimitCountQuery.RateLimitCountQuery(scope, this.hashKey(key), windowSeconds));
     if (count < limit) {
       return { ok: true };
     }

package/dist/development/src/model/service/RateLimiter.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"RateLimiter.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RateLimiter.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { Config } from '../type/Config.js'\nimport { RateLimitCountQuery } from '../queries/rateLimit/RateLimitCountQuery.js'\nimport { RecordRateLimitEventCommand } from '../commands/rateLimit/RecordRateLimitEventCommand.js'\nimport { RateLimitScope } from '../type/RateLimit.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nexport interface RateLimitWindow {\n\treadonly limit: number\n\treadonly window: {/* IPostgresInterval shape /}\n}\n\nexport interface RateLimitDecision {\n\treadonly ok: boolean\n\treadonly retryAfterSeconds?: number\n}\n\n/\n Sliding-window rate limiter backed by the `rate_limit_event` table.\n \n Cost: one COUNT() and (on success) one INSERT per check. The event row is\n recorded only when the call passes — denied calls do not extend the window,\n * matching the spec's \"max N successful attempts per window\".\n \n The raw key (IP, email, ...) is hashed with the configured provider so the\n * raw value is not stored at rest. Note this is pseudonymization, not strong\n * anonymization: an unsalted SHA-256 of a low-entropy input (e.g. an IPv4\n * address) is recoverable by brute force, so treat key_hash as sensitive.\n /\nexport class RateLimiter {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'hash' ~~\| 'now'~~>,\n\t) {}\n\n\tprivate hashKey(key: string): Buffer {\n\t\treturn this.providers.hash(key, 'sha256')\n\t}\n\n\tprivate resolveWindow(scope: RateLimitScope, config: Config): { limit: number; windowSeconds: number } {\n\t\tconst r = config.rateLimits\n\t\tswitch (scope) {\n\t\t\tcase 'sign_up_per_ip':\n\t\t\t\treturn { limit: r.signUpPerIp.limit, windowSeconds: intervalToSeconds(r.signUpPerIp.window as any) }\n\t\t\tcase 'login_per_ip':\n\t\t\t\treturn { limit: r.loginPerIp.limit, windowSeconds: intervalToSeconds(r.loginPerIp.window as any) }\n\t\t\tcase 'password_reset_per_ip':\n\t\t\t\treturn { limit: r.passwordResetPerIp.limit, windowSeconds: intervalToSeconds(r.passwordResetPerIp.window as any) }\n\t\t\tcase 'passwordless_init_per_ip':\n\t\t\t\treturn { limit: r.passwordlessInitPerIp.limit, windowSeconds: intervalToSeconds(r.passwordlessInitPerIp.window as any) }\n\t\t\tcase 'email_otp_per_person':\n\t\t\t\treturn { limit: r.emailOtpPerPerson.limit, windowSeconds: intervalToSeconds(r.emailOtpPerPerson.window as any) }\n\t\t\tcase 'email_verification_per_ip':\n\t\t\t\treturn { limit: r.emailVerificationPerIp.limit, windowSeconds: intervalToSeconds(r.emailVerificationPerIp.window as any) }\n\t\t}\n\t}\n\n\t/\n\t Check whether the next attempt fits within the configured window without\n\t * recording it. Use {@link record} after a successful gating decision.\n\t /\n\tasync check(db: DatabaseContext, scope: RateLimitScope, key: string, config: Config): Promise<RateLimitDecision> {\n\t\tconst { limit, windowSeconds } = this.resolveWindow(scope, config)\n\t\tif (limit <= 0 \|\| windowSeconds <= 0) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst ~~windowStart = new Date(this.providers.now().getTime() - windowSeconds 1000)\n\t\tconst~~ count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), ~~windowStart~~))\n\t\tif (count < limit) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\treturn { ok: false, retryAfterSeconds: windowSeconds }\n\t}\n\n\tasync record(db: DatabaseContext, scope: RateLimitScope, key: string): Promise<void> {\n\t\tawait db.commandBus.execute(new RecordRateLimitEventCommand(scope, this.hashKey(key)))\n\t}\n\n\t/*\n\t Combined check + record. Returns the decision; only records on success.\n\t \n\t Not atomic: the COUNT and the INSERT are separate statements, so under\n\t * concurrent requests for the same key a few attempts beyond the limit can\n\t * slip through (the window is a soft ceiling). That is acceptable for abuse\n\t * mitigation — do not rely on it as a hard quota.\n\t */\n\tasync consume(db: DatabaseContext, scope: RateLimitScope, key: string \| null \| undefined, config: Config): Promise<RateLimitDecision> {\n\t\tif (!key) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst decision = await this.check(db, scope, key, config)\n\t\tif (decision.ok) {\n\t\t\tawait this.record(db, scope, key)\n\t\t}\n\t\treturn decision\n\t}\n}\n"],"names":["intervalToSeconds","RateLimitCountQuery","RecordRateLimitEventCommand"],"mappings":";;;;;AA8BO,MAAM,YAAY;AAAA,EACxB,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEK,QAAQ,KAAqB;AACpC,WAAO,KAAK,UAAU,KAAK,KAAK,QAAQ;AAAA,EACzC;AAAA,EAEQ,cAAc,OAAuB,QAA0D;AACtG,UAAM,IAAI,OAAO;AACjB,YAAQ,OAAA;AAAA,MACP,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,YAAY,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,YAAY,MAAa,EAAA;AAAA,MAClG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,WAAW,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,WAAW,MAAa,EAAA;AAAA,MAChG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,mBAAmB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,mBAAmB,MAAa,EAAA;AAAA,MAChH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,sBAAsB,MAAa,EAAA;AAAA,MACtH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,kBAAkB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,kBAAkB,MAAa,EAAA;AAAA,MAC9G,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,uBAAuB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,uBAAuB,MAAa,EAAA;AAAA,IAAE;AAAA,EAE5H;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,IAAqB,OAAuB,KAAa,QAA4C;AAChH,UAAM,EAAE,OAAO,cAAA,IAAkB,KAAK,cAAc,OAAO,MAAM;AACjE,QAAI,SAAS,KAAK,iBAAiB,GAAG;AACrC,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,~~cAAc,IAAI,KAAK,KAAK,UAAU,MAAM,QAAA,IAAY,gBAAgB,GAAI;AAClF,UAAM,~~QAAQ,MAAM,GAAG,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,OAAO,KAAK,QAAQ,GAAG,GAAG,~~WAAW~~,CAAC;~~AACxG~~,QAAI,QAAQ,OAAO;AAClB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,WAAO,EAAE,IAAI,OAAO,mBAAmB,cAAA;AAAA,EACxC;AAAA,EAEA,MAAM,OAAO,IAAqB,OAAuB,KAA4B;AACpF,UAAM,GAAG,WAAW,QAAQ,IAAIC,4BAAAA,4BAA4B,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,IAAqB,OAAuB,KAAgC,QAA4C;AACrI,QAAI,CAAC,KAAK;AACT,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM;AACxD,QAAI,SAAS,IAAI;AAChB,YAAM,KAAK,OAAO,IAAI,OAAO,GAAG;AAAA,IACjC;AACA,WAAO;AAAA,EACR;AACD;;"}
1	+ {"version":3,"file":"RateLimiter.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RateLimiter.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { Config } from '../type/Config.js'\nimport { RateLimitCountQuery } from '../queries/rateLimit/RateLimitCountQuery.js'\nimport { RecordRateLimitEventCommand } from '../commands/rateLimit/RecordRateLimitEventCommand.js'\nimport { RateLimitScope } from '../type/RateLimit.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nexport interface RateLimitWindow {\n\treadonly limit: number\n\treadonly window: {/* IPostgresInterval shape /}\n}\n\nexport interface RateLimitDecision {\n\treadonly ok: boolean\n\treadonly retryAfterSeconds?: number\n}\n\n/\n Sliding-window rate limiter backed by the `rate_limit_event` table.\n \n Cost: one COUNT() and (on success) one INSERT per check. The event row is\n recorded only when the call passes — denied calls do not extend the window,\n * matching the spec's \"max N successful attempts per window\".\n \n The raw key (IP, email, ...) is hashed with the configured provider so the\n * raw value is not stored at rest. Note this is pseudonymization, not strong\n * anonymization: an unsalted SHA-256 of a low-entropy input (e.g. an IPv4\n * address) is recoverable by brute force, so treat key_hash as sensitive.\n /\nexport class RateLimiter {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'hash'>,\n\t) {}\n\n\tprivate hashKey(key: string): Buffer {\n\t\treturn this.providers.hash(key, 'sha256')\n\t}\n\n\tprivate resolveWindow(scope: RateLimitScope, config: Config): { limit: number; windowSeconds: number } {\n\t\tconst r = config.rateLimits\n\t\tswitch (scope) {\n\t\t\tcase 'sign_up_per_ip':\n\t\t\t\treturn { limit: r.signUpPerIp.limit, windowSeconds: intervalToSeconds(r.signUpPerIp.window as any) }\n\t\t\tcase 'login_per_ip':\n\t\t\t\treturn { limit: r.loginPerIp.limit, windowSeconds: intervalToSeconds(r.loginPerIp.window as any) }\n\t\t\tcase 'password_reset_per_ip':\n\t\t\t\treturn { limit: r.passwordResetPerIp.limit, windowSeconds: intervalToSeconds(r.passwordResetPerIp.window as any) }\n\t\t\tcase 'passwordless_init_per_ip':\n\t\t\t\treturn { limit: r.passwordlessInitPerIp.limit, windowSeconds: intervalToSeconds(r.passwordlessInitPerIp.window as any) }\n\t\t\tcase 'email_otp_per_person':\n\t\t\t\treturn { limit: r.emailOtpPerPerson.limit, windowSeconds: intervalToSeconds(r.emailOtpPerPerson.window as any) }\n\t\t\tcase 'email_verification_per_ip':\n\t\t\t\treturn { limit: r.emailVerificationPerIp.limit, windowSeconds: intervalToSeconds(r.emailVerificationPerIp.window as any) }\n\t\t}\n\t}\n\n\t/\n\t Check whether the next attempt fits within the configured window without\n\t * recording it. Use {@link record} after a successful gating decision.\n\t /\n\tasync check(db: DatabaseContext, scope: RateLimitScope, key: string, config: Config): Promise<RateLimitDecision> {\n\t\tconst { limit, windowSeconds } = this.resolveWindow(scope, config)\n\t\tif (limit <= 0 \|\| windowSeconds <= 0) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowSeconds))\n\t\tif (count < limit) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\treturn { ok: false, retryAfterSeconds: windowSeconds }\n\t}\n\n\tasync record(db: DatabaseContext, scope: RateLimitScope, key: string): Promise<void> {\n\t\tawait db.commandBus.execute(new RecordRateLimitEventCommand(scope, this.hashKey(key)))\n\t}\n\n\t/\n\t Combined check + record. Returns the decision; only records on success.\n\t \n\t Not atomic: the COUNT and the INSERT are separate statements, so under\n\t * concurrent requests for the same key a few attempts beyond the limit can\n\t * slip through (the window is a soft ceiling). That is acceptable for abuse\n\t * mitigation — do not rely on it as a hard quota.\n\t */\n\tasync consume(db: DatabaseContext, scope: RateLimitScope, key: string \| null \| undefined, config: Config): Promise<RateLimitDecision> {\n\t\tif (!key) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst decision = await this.check(db, scope, key, config)\n\t\tif (decision.ok) {\n\t\t\tawait this.record(db, scope, key)\n\t\t}\n\t\treturn decision\n\t}\n}\n"],"names":["intervalToSeconds","RateLimitCountQuery","RecordRateLimitEventCommand"],"mappings":";;;;;AA8BO,MAAM,YAAY;AAAA,EACxB,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEK,QAAQ,KAAqB;AACpC,WAAO,KAAK,UAAU,KAAK,KAAK,QAAQ;AAAA,EACzC;AAAA,EAEQ,cAAc,OAAuB,QAA0D;AACtG,UAAM,IAAI,OAAO;AACjB,YAAQ,OAAA;AAAA,MACP,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,YAAY,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,YAAY,MAAa,EAAA;AAAA,MAClG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,WAAW,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,WAAW,MAAa,EAAA;AAAA,MAChG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,mBAAmB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,mBAAmB,MAAa,EAAA;AAAA,MAChH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,sBAAsB,MAAa,EAAA;AAAA,MACtH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,kBAAkB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,kBAAkB,MAAa,EAAA;AAAA,MAC9G,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,uBAAuB,OAAO,eAAeA,SAAAA,kBAAkB,EAAE,uBAAuB,MAAa,EAAA;AAAA,IAAE;AAAA,EAE5H;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,IAAqB,OAAuB,KAAa,QAA4C;AAChH,UAAM,EAAE,OAAO,cAAA,IAAkB,KAAK,cAAc,OAAO,MAAM;AACjE,QAAI,SAAS,KAAK,iBAAiB,GAAG;AACrC,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,QAAQ,MAAM,GAAG,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,OAAO,KAAK,QAAQ,GAAG,GAAG,aAAa,CAAC;AAC1G,QAAI,QAAQ,OAAO;AAClB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,WAAO,EAAE,IAAI,OAAO,mBAAmB,cAAA;AAAA,EACxC;AAAA,EAEA,MAAM,OAAO,IAAqB,OAAuB,KAA4B;AACpF,UAAM,GAAG,WAAW,QAAQ,IAAIC,4BAAAA,4BAA4B,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,IAAqB,OAAuB,KAAgC,QAA4C;AACrI,QAAI,CAAC,KAAK;AACT,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM;AACxD,QAAI,SAAS,IAAI;AAChB,YAAM,KAAK,OAAO,IAAI,OAAO,GAAG;AAAA,IACjC;AACA,WAAO;AAAA,EACR;AACD;;"}

package/dist/development/src/model/service/RateLimiter.js CHANGED Viewed

@@ -34,8 +34,7 @@ class RateLimiter {
     if (limit <= 0 || windowSeconds <= 0) {
       return { ok: true };
     }
-    const windowStart = new Date(this.providers.now().getTime() - windowSeconds * 1e3);
-    const count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowStart));
+    const count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowSeconds));
     if (count < limit) {
       return { ok: true };
     }

package/dist/development/src/model/service/RateLimiter.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"RateLimiter.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RateLimiter.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { Config } from '../type/Config.js'\nimport { RateLimitCountQuery } from '../queries/rateLimit/RateLimitCountQuery.js'\nimport { RecordRateLimitEventCommand } from '../commands/rateLimit/RecordRateLimitEventCommand.js'\nimport { RateLimitScope } from '../type/RateLimit.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nexport interface RateLimitWindow {\n\treadonly limit: number\n\treadonly window: {/* IPostgresInterval shape /}\n}\n\nexport interface RateLimitDecision {\n\treadonly ok: boolean\n\treadonly retryAfterSeconds?: number\n}\n\n/\n Sliding-window rate limiter backed by the `rate_limit_event` table.\n \n Cost: one COUNT() and (on success) one INSERT per check. The event row is\n recorded only when the call passes — denied calls do not extend the window,\n * matching the spec's \"max N successful attempts per window\".\n \n The raw key (IP, email, ...) is hashed with the configured provider so the\n * raw value is not stored at rest. Note this is pseudonymization, not strong\n * anonymization: an unsalted SHA-256 of a low-entropy input (e.g. an IPv4\n * address) is recoverable by brute force, so treat key_hash as sensitive.\n /\nexport class RateLimiter {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'hash' ~~\| 'now'~~>,\n\t) {}\n\n\tprivate hashKey(key: string): Buffer {\n\t\treturn this.providers.hash(key, 'sha256')\n\t}\n\n\tprivate resolveWindow(scope: RateLimitScope, config: Config): { limit: number; windowSeconds: number } {\n\t\tconst r = config.rateLimits\n\t\tswitch (scope) {\n\t\t\tcase 'sign_up_per_ip':\n\t\t\t\treturn { limit: r.signUpPerIp.limit, windowSeconds: intervalToSeconds(r.signUpPerIp.window as any) }\n\t\t\tcase 'login_per_ip':\n\t\t\t\treturn { limit: r.loginPerIp.limit, windowSeconds: intervalToSeconds(r.loginPerIp.window as any) }\n\t\t\tcase 'password_reset_per_ip':\n\t\t\t\treturn { limit: r.passwordResetPerIp.limit, windowSeconds: intervalToSeconds(r.passwordResetPerIp.window as any) }\n\t\t\tcase 'passwordless_init_per_ip':\n\t\t\t\treturn { limit: r.passwordlessInitPerIp.limit, windowSeconds: intervalToSeconds(r.passwordlessInitPerIp.window as any) }\n\t\t\tcase 'email_otp_per_person':\n\t\t\t\treturn { limit: r.emailOtpPerPerson.limit, windowSeconds: intervalToSeconds(r.emailOtpPerPerson.window as any) }\n\t\t\tcase 'email_verification_per_ip':\n\t\t\t\treturn { limit: r.emailVerificationPerIp.limit, windowSeconds: intervalToSeconds(r.emailVerificationPerIp.window as any) }\n\t\t}\n\t}\n\n\t/\n\t Check whether the next attempt fits within the configured window without\n\t * recording it. Use {@link record} after a successful gating decision.\n\t /\n\tasync check(db: DatabaseContext, scope: RateLimitScope, key: string, config: Config): Promise<RateLimitDecision> {\n\t\tconst { limit, windowSeconds } = this.resolveWindow(scope, config)\n\t\tif (limit <= 0 \|\| windowSeconds <= 0) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst ~~windowStart = new Date(this.providers.now().getTime() - windowSeconds 1000)\n\t\tconst~~ count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), ~~windowStart~~))\n\t\tif (count < limit) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\treturn { ok: false, retryAfterSeconds: windowSeconds }\n\t}\n\n\tasync record(db: DatabaseContext, scope: RateLimitScope, key: string): Promise<void> {\n\t\tawait db.commandBus.execute(new RecordRateLimitEventCommand(scope, this.hashKey(key)))\n\t}\n\n\t/*\n\t Combined check + record. Returns the decision; only records on success.\n\t \n\t Not atomic: the COUNT and the INSERT are separate statements, so under\n\t * concurrent requests for the same key a few attempts beyond the limit can\n\t * slip through (the window is a soft ceiling). That is acceptable for abuse\n\t * mitigation — do not rely on it as a hard quota.\n\t */\n\tasync consume(db: DatabaseContext, scope: RateLimitScope, key: string \| null \| undefined, config: Config): Promise<RateLimitDecision> {\n\t\tif (!key) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst decision = await this.check(db, scope, key, config)\n\t\tif (decision.ok) {\n\t\t\tawait this.record(db, scope, key)\n\t\t}\n\t\treturn decision\n\t}\n}\n"],"names":[],"mappings":";;;AA8BO,MAAM,YAAY;AAAA,EACxB,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEK,QAAQ,KAAqB;AACpC,WAAO,KAAK,UAAU,KAAK,KAAK,QAAQ;AAAA,EACzC;AAAA,EAEQ,cAAc,OAAuB,QAA0D;AACtG,UAAM,IAAI,OAAO;AACjB,YAAQ,OAAA;AAAA,MACP,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,YAAY,OAAO,eAAe,kBAAkB,EAAE,YAAY,MAAa,EAAA;AAAA,MAClG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,WAAW,OAAO,eAAe,kBAAkB,EAAE,WAAW,MAAa,EAAA;AAAA,MAChG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,mBAAmB,OAAO,eAAe,kBAAkB,EAAE,mBAAmB,MAAa,EAAA;AAAA,MAChH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,eAAe,kBAAkB,EAAE,sBAAsB,MAAa,EAAA;AAAA,MACtH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,kBAAkB,OAAO,eAAe,kBAAkB,EAAE,kBAAkB,MAAa,EAAA;AAAA,MAC9G,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,uBAAuB,OAAO,eAAe,kBAAkB,EAAE,uBAAuB,MAAa,EAAA;AAAA,IAAE;AAAA,EAE5H;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,IAAqB,OAAuB,KAAa,QAA4C;AAChH,UAAM,EAAE,OAAO,cAAA,IAAkB,KAAK,cAAc,OAAO,MAAM;AACjE,QAAI,SAAS,KAAK,iBAAiB,GAAG;AACrC,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,~~cAAc,IAAI,KAAK,KAAK,UAAU,MAAM,QAAA,IAAY,gBAAgB,GAAI;AAClF,UAAM,~~QAAQ,MAAM,GAAG,aAAa,MAAM,IAAI,oBAAoB,OAAO,KAAK,QAAQ,GAAG,GAAG,~~WAAW~~,CAAC;~~AACxG~~,QAAI,QAAQ,OAAO;AAClB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,WAAO,EAAE,IAAI,OAAO,mBAAmB,cAAA;AAAA,EACxC;AAAA,EAEA,MAAM,OAAO,IAAqB,OAAuB,KAA4B;AACpF,UAAM,GAAG,WAAW,QAAQ,IAAI,4BAA4B,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,IAAqB,OAAuB,KAAgC,QAA4C;AACrI,QAAI,CAAC,KAAK;AACT,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM;AACxD,QAAI,SAAS,IAAI;AAChB,YAAM,KAAK,OAAO,IAAI,OAAO,GAAG;AAAA,IACjC;AACA,WAAO;AAAA,EACR;AACD;"}
1	+ {"version":3,"file":"RateLimiter.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RateLimiter.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { Providers } from '../providers.js'\nimport { Config } from '../type/Config.js'\nimport { RateLimitCountQuery } from '../queries/rateLimit/RateLimitCountQuery.js'\nimport { RecordRateLimitEventCommand } from '../commands/rateLimit/RecordRateLimitEventCommand.js'\nimport { RateLimitScope } from '../type/RateLimit.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nexport interface RateLimitWindow {\n\treadonly limit: number\n\treadonly window: {/* IPostgresInterval shape /}\n}\n\nexport interface RateLimitDecision {\n\treadonly ok: boolean\n\treadonly retryAfterSeconds?: number\n}\n\n/\n Sliding-window rate limiter backed by the `rate_limit_event` table.\n \n Cost: one COUNT() and (on success) one INSERT per check. The event row is\n recorded only when the call passes — denied calls do not extend the window,\n * matching the spec's \"max N successful attempts per window\".\n \n The raw key (IP, email, ...) is hashed with the configured provider so the\n * raw value is not stored at rest. Note this is pseudonymization, not strong\n * anonymization: an unsalted SHA-256 of a low-entropy input (e.g. an IPv4\n * address) is recoverable by brute force, so treat key_hash as sensitive.\n /\nexport class RateLimiter {\n\tconstructor(\n\t\tprivate readonly providers: Pick<Providers, 'hash'>,\n\t) {}\n\n\tprivate hashKey(key: string): Buffer {\n\t\treturn this.providers.hash(key, 'sha256')\n\t}\n\n\tprivate resolveWindow(scope: RateLimitScope, config: Config): { limit: number; windowSeconds: number } {\n\t\tconst r = config.rateLimits\n\t\tswitch (scope) {\n\t\t\tcase 'sign_up_per_ip':\n\t\t\t\treturn { limit: r.signUpPerIp.limit, windowSeconds: intervalToSeconds(r.signUpPerIp.window as any) }\n\t\t\tcase 'login_per_ip':\n\t\t\t\treturn { limit: r.loginPerIp.limit, windowSeconds: intervalToSeconds(r.loginPerIp.window as any) }\n\t\t\tcase 'password_reset_per_ip':\n\t\t\t\treturn { limit: r.passwordResetPerIp.limit, windowSeconds: intervalToSeconds(r.passwordResetPerIp.window as any) }\n\t\t\tcase 'passwordless_init_per_ip':\n\t\t\t\treturn { limit: r.passwordlessInitPerIp.limit, windowSeconds: intervalToSeconds(r.passwordlessInitPerIp.window as any) }\n\t\t\tcase 'email_otp_per_person':\n\t\t\t\treturn { limit: r.emailOtpPerPerson.limit, windowSeconds: intervalToSeconds(r.emailOtpPerPerson.window as any) }\n\t\t\tcase 'email_verification_per_ip':\n\t\t\t\treturn { limit: r.emailVerificationPerIp.limit, windowSeconds: intervalToSeconds(r.emailVerificationPerIp.window as any) }\n\t\t}\n\t}\n\n\t/\n\t Check whether the next attempt fits within the configured window without\n\t * recording it. Use {@link record} after a successful gating decision.\n\t /\n\tasync check(db: DatabaseContext, scope: RateLimitScope, key: string, config: Config): Promise<RateLimitDecision> {\n\t\tconst { limit, windowSeconds } = this.resolveWindow(scope, config)\n\t\tif (limit <= 0 \|\| windowSeconds <= 0) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst count = await db.queryHandler.fetch(new RateLimitCountQuery(scope, this.hashKey(key), windowSeconds))\n\t\tif (count < limit) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\treturn { ok: false, retryAfterSeconds: windowSeconds }\n\t}\n\n\tasync record(db: DatabaseContext, scope: RateLimitScope, key: string): Promise<void> {\n\t\tawait db.commandBus.execute(new RecordRateLimitEventCommand(scope, this.hashKey(key)))\n\t}\n\n\t/\n\t Combined check + record. Returns the decision; only records on success.\n\t \n\t Not atomic: the COUNT and the INSERT are separate statements, so under\n\t * concurrent requests for the same key a few attempts beyond the limit can\n\t * slip through (the window is a soft ceiling). That is acceptable for abuse\n\t * mitigation — do not rely on it as a hard quota.\n\t */\n\tasync consume(db: DatabaseContext, scope: RateLimitScope, key: string \| null \| undefined, config: Config): Promise<RateLimitDecision> {\n\t\tif (!key) {\n\t\t\treturn { ok: true }\n\t\t}\n\t\tconst decision = await this.check(db, scope, key, config)\n\t\tif (decision.ok) {\n\t\t\tawait this.record(db, scope, key)\n\t\t}\n\t\treturn decision\n\t}\n}\n"],"names":[],"mappings":";;;AA8BO,MAAM,YAAY;AAAA,EACxB,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEK,QAAQ,KAAqB;AACpC,WAAO,KAAK,UAAU,KAAK,KAAK,QAAQ;AAAA,EACzC;AAAA,EAEQ,cAAc,OAAuB,QAA0D;AACtG,UAAM,IAAI,OAAO;AACjB,YAAQ,OAAA;AAAA,MACP,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,YAAY,OAAO,eAAe,kBAAkB,EAAE,YAAY,MAAa,EAAA;AAAA,MAClG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,WAAW,OAAO,eAAe,kBAAkB,EAAE,WAAW,MAAa,EAAA;AAAA,MAChG,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,mBAAmB,OAAO,eAAe,kBAAkB,EAAE,mBAAmB,MAAa,EAAA;AAAA,MAChH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,sBAAsB,OAAO,eAAe,kBAAkB,EAAE,sBAAsB,MAAa,EAAA;AAAA,MACtH,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,kBAAkB,OAAO,eAAe,kBAAkB,EAAE,kBAAkB,MAAa,EAAA;AAAA,MAC9G,KAAK;AACJ,eAAO,EAAE,OAAO,EAAE,uBAAuB,OAAO,eAAe,kBAAkB,EAAE,uBAAuB,MAAa,EAAA;AAAA,IAAE;AAAA,EAE5H;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,IAAqB,OAAuB,KAAa,QAA4C;AAChH,UAAM,EAAE,OAAO,cAAA,IAAkB,KAAK,cAAc,OAAO,MAAM;AACjE,QAAI,SAAS,KAAK,iBAAiB,GAAG;AACrC,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,QAAQ,MAAM,GAAG,aAAa,MAAM,IAAI,oBAAoB,OAAO,KAAK,QAAQ,GAAG,GAAG,aAAa,CAAC;AAC1G,QAAI,QAAQ,OAAO;AAClB,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,WAAO,EAAE,IAAI,OAAO,mBAAmB,cAAA;AAAA,EACxC;AAAA,EAEA,MAAM,OAAO,IAAqB,OAAuB,KAA4B;AACpF,UAAM,GAAG,WAAW,QAAQ,IAAI,4BAA4B,OAAO,KAAK,QAAQ,GAAG,CAAC,CAAC;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM,QAAQ,IAAqB,OAAuB,KAAgC,QAA4C;AACrI,QAAI,CAAC,KAAK;AACT,aAAO,EAAE,IAAI,KAAA;AAAA,IACd;AACA,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,OAAO,KAAK,MAAM;AACxD,QAAI,SAAS,IAAI;AAChB,YAAM,KAAK,OAAO,IAAI,OAAO,GAAG;AAAA,IACjC;AACA,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/model/service/RolesManager.cjs CHANGED Viewed

@@ -5,38 +5,37 @@ require("@contember/database");
 require("node:crypto");
 const Response = require("../utils/Response.cjs");
 const PatchIdentityGlobalRoles = require("../commands/identity/PatchIdentityGlobalRoles.cjs");
-require("../authorization/PermissionActions.cjs");
-require("@contember/authorization");
-const Roles = require("../authorization/Roles.cjs");
-require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
-require("@contember/schema");
+const GlobalRoleValidator = require("./GlobalRoleValidator.cjs");
 class RolesManager {
+  constructor(globalRoleValidator = new GlobalRoleValidator.GlobalRoleValidator()) {
+    this.globalRoleValidator = globalRoleValidator;
+  }
   async addGlobalRoles(dbContext, identityId, roles) {
+    return await dbContext.transaction(async (db) => {
+      const validation = await this.validateAddedGlobalRoles(db, roles);
+      if (!validation.ok) {
+        return validation;
+      }
+      return await this.addValidatedGlobalRoles(db, identityId, roles);
+    }, { isolation: "readCommitted" });
+  }
+  async addValidatedGlobalRoles(dbContext, identityId, roles) {
     return this.patchGlobalRoles(dbContext, identityId, roles, []);
   }
+  async validateAddedGlobalRoles(dbContext, roles) {
+    const invalidRole = await this.globalRoleValidator.findInvalidRole(dbContext, roles);
+    return invalidRole === null ? new Response.ResponseOk(null) : new Response.ResponseError("INVALID_ROLE", `Role ${invalidRole} is not valid or globally assignable`);
+  }
   async removeGlobalRoles(dbContext, identityId, roles) {
     return this.patchGlobalRoles(dbContext, identityId, [], roles);
   }
   async patchGlobalRoles(dbContext, identityId, addRoles, removeRoles) {
-    const rolesValidationError = this.validateRoles([...addRoles, ...removeRoles]);
-    if (rolesValidationError) {
-      return rolesValidationError;
-    }
     const result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles.PatchIdentityGlobalRoles(identityId, addRoles, removeRoles));
     if (!result) {
       return new Response.ResponseError("IDENTITY_NOT_FOUND", `Identity ${identityId} not found`);
     }
     return new Response.ResponseOk(null);
   }
-  validateRoles(roles) {
-    for (const role of roles) {
-      if (!Object.values(Roles.TenantRole).includes(role)) {
-        return new Response.ResponseError("INVALID_ROLE", `Role ${role} is not valid`);
-      }
-    }
-    return null;
-  }
 }
 exports.RolesManager = RolesManager;
 //# sourceMappingURL=RolesManager.cjs.map

package/dist/development/src/model/service/RolesManager.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"RolesManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { PatchIdentityGlobalRoles } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ~~TenantRole~~ } from '~~../authorization/index~~.js'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.~~patchGlobalRoles~~(~~dbContext~~, identityId, roles, [])\n\t}\n\n\tasync ~~removeGlobalRoles~~(~~dbContext~~: DatabaseContext~~, identityId~~: string~~, roles~~: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, []~~, roles~~)\n\t}\n\n\~~tprivate~~ ~~async patchGlobalRoles~~(~~\n\t\tdbContext~~: DatabaseContext~~,\n\t\tidentityId:~~ ~~string,\n\t\taddRoles~~: readonly string[]~~,\n\t\tremoveRoles: readonly string[],\n\t~~): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst ~~rolesValidationError~~ = this.~~validateRoles~~(~~[...addRoles~~, ~~...removeRoles]~~)\n\t\~~tif~~ ~~(rolesValidationError)~~ {\n\t\t\~~treturn~~ ~~rolesValidationError~~\n\t\t}\n\t~~\tconst~~ ~~result = await dbContext.commandBus.execute(~~new ~~PatchIdentityGlobalRoles~~(~~identityId~~, ~~addRoles,~~ ~~removeRoles~~))\n\t\~~tif~~ (~~!result~~) {\n\t\t\treturn ~~new ResponseError~~(~~'IDENTITY_NOT_FOUND'~~, ~~`Identity ${~~identityId} ~~not~~ ~~found`~~)\n\t\t}\n\t\~~treturn~~ ~~new~~ ~~ResponseOk~~(~~null)~~\n\t}\n\n\~~tprivate~~ ~~validateRoles(roles~~: string[]): Response<null, GlobalRolesErrorCode> ~~\| null~~ {\n\t\~~tfor~~ (~~const~~ ~~role~~ of ~~roles~~) {\n\t\t\tif (!~~Object.values(TenantRole~~)~~.includes(role~~ ~~as TenantRole))~~ {\n\t\t\t\treturn new ResponseError('~~INVALID_ROLE~~', `~~Role~~ ${~~role~~} is not ~~valid~~`)\n\t\t\t}\n\t\~~t}\n\t\~~treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t\| 'IDENTITY_NOT_FOUND'\n\t\| 'INVALID_ROLE'\n"],"names":["~~PatchIdentityGlobalRoles~~","~~ResponseError~~","~~ResponseOk~~","~~TenantRole~~"],"mappings":"~~;;;;;;;;;;;;;AAKO~~,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,~~uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,~~SAAS,MAAM,UAAU,WAAW,QAAQ,~~IAAIA~~,yBAAAA,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,~~IAAIC~~,SAAAA,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,~~IAAIC~~,SAAAA,WAAW,IAAI;AAAA,EAC3B;~~AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAOC,MAAAA,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAIF,SAAAA,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;~~AACD;;"}
1	+ {"version":3,"file":"RolesManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { PatchIdentityGlobalRoles } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { GlobalRoleValidator } from './GlobalRoleValidator.js'\nimport { Connection } from '@contember/database'\n\nexport class RolesManager {\n\tconstructor(\n\t\tprivate readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),\n\t) {\n\t}\n\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\tconst validation = await this.validateAddedGlobalRoles(db, roles)\n\t\t\tif (!validation.ok) {\n\t\t\t\treturn validation\n\t\t\t}\n\t\t\treturn await this.addValidatedGlobalRoles(db, identityId, roles)\n\t\t}, { isolation: 'readCommitted' })\n\t}\n\n\tasync addValidatedGlobalRoles(\n\t\tdbContext: DatabaseContext<Connection.TransactionLike>,\n\t\tidentityId: string,\n\t\troles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync validateAddedGlobalRoles(dbContext: DatabaseContext, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst invalidRole = await this.globalRoleValidator.findInvalidRole(dbContext, roles)\n\t\treturn invalidRole === null\n\t\t\t? new ResponseOk(null)\n\t\t\t: new ResponseError('INVALID_ROLE', `Role ${invalidRole} is not valid or globally assignable`)\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t\| 'IDENTITY_NOT_FOUND'\n\t\| 'INVALID_ROLE'\n"],"names":["GlobalRoleValidator","ResponseOk","ResponseError","PatchIdentityGlobalRoles"],"mappings":";;;;;;;;AAMO,MAAM,aAAa;AAAA,EACzB,YACkB,sBAA2C,IAAIA,oBAAAA,uBAC/D;AADgB,SAAA,sBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,YAAM,aAAa,MAAM,KAAK,yBAAyB,IAAI,KAAK;AAChE,UAAI,CAAC,WAAW,IAAI;AACnB,eAAO;AAAA,MACR;AACA,aAAO,MAAM,KAAK,wBAAwB,IAAI,YAAY,KAAK;AAAA,IAChE,GAAG,EAAE,WAAW,iBAAiB;AAAA,EAClC;AAAA,EAEA,MAAM,wBACL,WACA,YACA,OACgD;AAChD,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,yBAAyB,WAA4B,OAAyE;AACnI,UAAM,cAAc,MAAM,KAAK,oBAAoB,gBAAgB,WAAW,KAAK;AACnF,WAAO,gBAAgB,OACpB,IAAIC,SAAAA,WAAW,IAAI,IACnB,IAAIC,SAAAA,cAAc,gBAAgB,QAAQ,WAAW,sCAAsC;AAAA,EAC/F;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAIC,yBAAAA,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAID,SAAAA,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAID,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}

package/dist/development/src/model/service/RolesManager.js CHANGED Viewed

@@ -1,40 +1,39 @@
 import "../type/ApiKey.js";
 import "@contember/database";
 import "node:crypto";
-import { ResponseError, ResponseOk } from "../utils/Response.js";
+import { ResponseOk, ResponseError } from "../utils/Response.js";
 import { PatchIdentityGlobalRoles } from "../commands/identity/PatchIdentityGlobalRoles.js";
-import "../authorization/PermissionActions.js";
-import "@contember/authorization";
-import { TenantRole } from "../authorization/Roles.js";
-import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
-import "@contember/schema";
+import { GlobalRoleValidator } from "./GlobalRoleValidator.js";
 class RolesManager {
+  constructor(globalRoleValidator = new GlobalRoleValidator()) {
+    this.globalRoleValidator = globalRoleValidator;
+  }
   async addGlobalRoles(dbContext, identityId, roles) {
+    return await dbContext.transaction(async (db) => {
+      const validation = await this.validateAddedGlobalRoles(db, roles);
+      if (!validation.ok) {
+        return validation;
+      }
+      return await this.addValidatedGlobalRoles(db, identityId, roles);
+    }, { isolation: "readCommitted" });
+  }
+  async addValidatedGlobalRoles(dbContext, identityId, roles) {
     return this.patchGlobalRoles(dbContext, identityId, roles, []);
   }
+  async validateAddedGlobalRoles(dbContext, roles) {
+    const invalidRole = await this.globalRoleValidator.findInvalidRole(dbContext, roles);
+    return invalidRole === null ? new ResponseOk(null) : new ResponseError("INVALID_ROLE", `Role ${invalidRole} is not valid or globally assignable`);
+  }
   async removeGlobalRoles(dbContext, identityId, roles) {
     return this.patchGlobalRoles(dbContext, identityId, [], roles);
   }
   async patchGlobalRoles(dbContext, identityId, addRoles, removeRoles) {
-    const rolesValidationError = this.validateRoles([...addRoles, ...removeRoles]);
-    if (rolesValidationError) {
-      return rolesValidationError;
-    }
     const result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles));
     if (!result) {
       return new ResponseError("IDENTITY_NOT_FOUND", `Identity ${identityId} not found`);
     }
     return new ResponseOk(null);
   }
-  validateRoles(roles) {
-    for (const role of roles) {
-      if (!Object.values(TenantRole).includes(role)) {
-        return new ResponseError("INVALID_ROLE", `Role ${role} is not valid`);
-      }
-    }
-    return null;
-  }
 }
 export {
   RolesManager

package/dist/development/src/model/service/RolesManager.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"RolesManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { PatchIdentityGlobalRoles } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ~~TenantRole~~ } from '~~../authorization/index~~.js'\n\nexport class RolesManager {\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.~~patchGlobalRoles~~(~~dbContext~~, identityId, roles, [])\n\t}\n\n\tasync ~~removeGlobalRoles~~(~~dbContext~~: DatabaseContext~~, identityId~~: string~~, roles~~: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, []~~, roles~~)\n\t}\n\n\~~tprivate~~ ~~async patchGlobalRoles~~(~~\n\t\tdbContext~~: DatabaseContext~~,\n\t\tidentityId:~~ ~~string,\n\t\taddRoles~~: readonly string[]~~,\n\t\tremoveRoles: readonly string[],\n\t~~): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst ~~rolesValidationError~~ = this.~~validateRoles~~(~~[...addRoles~~, ~~...removeRoles]~~)\n\t\~~tif~~ ~~(rolesValidationError)~~ {\n\t\t\~~treturn~~ ~~rolesValidationError~~\n\t\t}\n\t~~\tconst~~ ~~result = await dbContext.commandBus.execute(~~new ~~PatchIdentityGlobalRoles~~(~~identityId~~, ~~addRoles,~~ ~~removeRoles~~))\n\t\~~tif~~ (~~!result~~) {\n\t\t\treturn ~~new ResponseError~~(~~'IDENTITY_NOT_FOUND'~~, ~~`Identity ${~~identityId} ~~not~~ ~~found`~~)\n\t\t}\n\t\~~treturn~~ ~~new~~ ~~ResponseOk~~(~~null)~~\n\t}\n\n\~~tprivate~~ ~~validateRoles(roles~~: string[]): Response<null, GlobalRolesErrorCode> ~~\| null~~ {\n\t\~~tfor~~ (~~const~~ ~~role~~ of ~~roles~~) {\n\t\t\tif (!~~Object.values(TenantRole~~)~~.includes(role~~ ~~as TenantRole))~~ {\n\t\t\t\treturn new ResponseError('~~INVALID_ROLE~~', `~~Role~~ ${~~role~~} is not ~~valid~~`)\n\t\t\t}\n\t\~~t}\n\t\~~treturn null\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t\| 'IDENTITY_NOT_FOUND'\n\t\| 'INVALID_ROLE'\n"],"names":[],"mappings":"~~;;;;;;;;;;;AAKO~~,MAAM,aAAa;AAAA,EACzB,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,~~uBAAuB,KAAK,cAAc,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;AAC7E,QAAI,sBAAsB;AACzB,aAAO;AAAA,IACR;AACA,UAAM,~~SAAS,MAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;~~AAAA,EAEQ,cAAc,OAA8D;AACnF,eAAW,QAAQ,OAAO;AACzB,UAAI,CAAC,OAAO,OAAO,UAAU,EAAE,SAAS,IAAkB,GAAG;AAC5D,eAAO,IAAI,cAAc,gBAAgB,QAAQ,IAAI,eAAe;AAAA,MACrE;AAAA,IACD;AACA,WAAO;AAAA,EACR;~~AACD;"}
1	+ {"version":3,"file":"RolesManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/RolesManager.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { PatchIdentityGlobalRoles } from '../commands/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { GlobalRoleValidator } from './GlobalRoleValidator.js'\nimport { Connection } from '@contember/database'\n\nexport class RolesManager {\n\tconstructor(\n\t\tprivate readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),\n\t) {\n\t}\n\n\tasync addGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\tconst validation = await this.validateAddedGlobalRoles(db, roles)\n\t\t\tif (!validation.ok) {\n\t\t\t\treturn validation\n\t\t\t}\n\t\t\treturn await this.addValidatedGlobalRoles(db, identityId, roles)\n\t\t}, { isolation: 'readCommitted' })\n\t}\n\n\tasync addValidatedGlobalRoles(\n\t\tdbContext: DatabaseContext<Connection.TransactionLike>,\n\t\tidentityId: string,\n\t\troles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, roles, [])\n\t}\n\n\tasync validateAddedGlobalRoles(dbContext: DatabaseContext, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst invalidRole = await this.globalRoleValidator.findInvalidRole(dbContext, roles)\n\t\treturn invalidRole === null\n\t\t\t? new ResponseOk(null)\n\t\t\t: new ResponseError('INVALID_ROLE', `Role ${invalidRole} is not valid or globally assignable`)\n\t}\n\n\tasync removeGlobalRoles(dbContext: DatabaseContext, identityId: string, roles: readonly string[]): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\treturn this.patchGlobalRoles(dbContext, identityId, [], roles)\n\t}\n\n\tprivate async patchGlobalRoles(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\taddRoles: readonly string[],\n\t\tremoveRoles: readonly string[],\n\t): Promise<Response<null, GlobalRolesErrorCode>> {\n\t\tconst result = await dbContext.commandBus.execute(new PatchIdentityGlobalRoles(identityId, addRoles, removeRoles))\n\t\tif (!result) {\n\t\t\treturn new ResponseError('IDENTITY_NOT_FOUND', `Identity ${identityId} not found`)\n\t\t}\n\t\treturn new ResponseOk(null)\n\t}\n}\n\ntype GlobalRolesErrorCode =\n\t\| 'IDENTITY_NOT_FOUND'\n\t\| 'INVALID_ROLE'\n"],"names":[],"mappings":";;;;;;AAMO,MAAM,aAAa;AAAA,EACzB,YACkB,sBAA2C,IAAI,uBAC/D;AADgB,SAAA,sBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,eAAe,WAA4B,YAAoB,OAAyE;AAC7I,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,YAAM,aAAa,MAAM,KAAK,yBAAyB,IAAI,KAAK;AAChE,UAAI,CAAC,WAAW,IAAI;AACnB,eAAO;AAAA,MACR;AACA,aAAO,MAAM,KAAK,wBAAwB,IAAI,YAAY,KAAK;AAAA,IAChE,GAAG,EAAE,WAAW,iBAAiB;AAAA,EAClC;AAAA,EAEA,MAAM,wBACL,WACA,YACA,OACgD;AAChD,WAAO,KAAK,iBAAiB,WAAW,YAAY,OAAO,CAAA,CAAE;AAAA,EAC9D;AAAA,EAEA,MAAM,yBAAyB,WAA4B,OAAyE;AACnI,UAAM,cAAc,MAAM,KAAK,oBAAoB,gBAAgB,WAAW,KAAK;AACnF,WAAO,gBAAgB,OACpB,IAAI,WAAW,IAAI,IACnB,IAAI,cAAc,gBAAgB,QAAQ,WAAW,sCAAsC;AAAA,EAC/F;AAAA,EAEA,MAAM,kBAAkB,WAA4B,YAAoB,OAAyE;AAChJ,WAAO,KAAK,iBAAiB,WAAW,YAAY,CAAA,GAAI,KAAK;AAAA,EAC9D;AAAA,EAEA,MAAc,iBACb,WACA,YACA,UACA,aACgD;AAChD,UAAM,SAAS,MAAM,UAAU,WAAW,QAAQ,IAAI,yBAAyB,YAAY,UAAU,WAAW,CAAC;AACjH,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,sBAAsB,YAAY,UAAU,YAAY;AAAA,IAClF;AACA,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}

package/dist/development/src/model/service/SecretsManager.cjs CHANGED Viewed

@@ -10,8 +10,9 @@ const ProjectSecretsQuery = require("../queries/project/ProjectSecretsQuery.cjs"
 const ProjectSecretKeysQuery = require("../queries/project/ProjectSecretKeysQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 class SecretsManager {
   constructor(providers) {

package/dist/development/src/model/service/SecretsManager.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SecretsManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { Providers } from '../providers.js'\nimport { ProjectSecretInfoRow, ProjectSecretKeysQuery, ProjectSecretsQuery } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\t/** Lists secret keys (with timestamps) without decrypting any values. */\n\tpublic async listSecretKeys(dbContext: DatabaseContext, projectId: string): Promise<ProjectSecretInfoRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery(projectId))\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":["ProjectSecretKeysQuery","ProjectSecretsQuery","SetProjectSecretCommand","UpdateProjectCommand"],"mappings":"~~;;;;;;;;;;;;;;;~~AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA;AAAA,EAGA,MAAa,eAAe,WAA4B,WAAoD;AAC3G,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIA,uBAAAA,uBAAuB,SAAS,CAAC;AAAA,EAChF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;;"}
1	+ {"version":3,"file":"SecretsManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { Providers } from '../providers.js'\nimport { ProjectSecretInfoRow, ProjectSecretKeysQuery, ProjectSecretsQuery } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\t/** Lists secret keys (with timestamps) without decrypting any values. */\n\tpublic async listSecretKeys(dbContext: DatabaseContext, projectId: string): Promise<ProjectSecretInfoRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery(projectId))\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":["ProjectSecretKeysQuery","ProjectSecretsQuery","SetProjectSecretCommand","UpdateProjectCommand"],"mappings":";;;;;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA;AAAA,EAGA,MAAa,eAAe,WAA4B,WAAoD;AAC3G,WAAO,MAAM,UAAU,aAAa,MAAM,IAAIA,uBAAAA,uBAAuB,SAAS,CAAC;AAAA,EAChF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIC,oBAAAA,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAIC,qBAAAA,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;;"}

package/dist/development/src/model/service/SecretsManager.js CHANGED Viewed

@@ -8,8 +8,9 @@ import { ProjectSecretsQuery } from "../queries/project/ProjectSecretsQuery.js";
 import { ProjectSecretKeysQuery } from "../queries/project/ProjectSecretKeysQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 class SecretsManager {
   constructor(providers) {

package/dist/development/src/model/service/SecretsManager.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SecretsManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { Providers } from '../providers.js'\nimport { ProjectSecretInfoRow, ProjectSecretKeysQuery, ProjectSecretsQuery } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\t/** Lists secret keys (with timestamps) without decrypting any values. */\n\tpublic async listSecretKeys(dbContext: DatabaseContext, projectId: string): Promise<ProjectSecretInfoRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery(projectId))\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":[],"mappings":"~~;;;;;;;;;;;;;~~AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA;AAAA,EAGA,MAAa,eAAe,WAA4B,WAAoD;AAC3G,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,uBAAuB,SAAS,CAAC;AAAA,EAChF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAI,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;"}
1	+ {"version":3,"file":"SecretsManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SecretsManager.ts"],"sourcesContent":["import { SetProjectSecretCommand, UpdateProjectCommand } from '../commands/index.js'\nimport { Providers } from '../providers.js'\nimport { ProjectSecretInfoRow, ProjectSecretKeysQuery, ProjectSecretsQuery } from '../queries/index.js'\nimport { DatabaseContext } from '../utils/index.js'\n\nexport class SecretsManager {\n\tconstructor(private providers: Providers) {}\n\n\tpublic async setSecret(dbContext: DatabaseContext, projectId: string, key: string, value: string): Promise<void> {\n\t\tawait this.setSecrets(dbContext, projectId, [{ key, value: Buffer.from(value) }])\n\t}\n\n\t/** Lists secret keys (with timestamps) without decrypting any values. */\n\tpublic async listSecretKeys(dbContext: DatabaseContext, projectId: string): Promise<ProjectSecretInfoRow[]> {\n\t\treturn await dbContext.queryHandler.fetch(new ProjectSecretKeysQuery(projectId))\n\t}\n\n\tpublic async readSecrets(dbContext: DatabaseContext, projectId: string): Promise<Record<string, string>> {\n\t\tconst result = await dbContext.queryHandler.fetch(new ProjectSecretsQuery(projectId, this.providers))\n\t\tconst forUpdate = result.filter(it => it.needsReEncrypt)\n\t\tawait this.setSecrets(dbContext, projectId, forUpdate)\n\t\treturn Object.fromEntries(result.map(it => [it.key, it.value.toString()]))\n\t}\n\n\tprivate async setSecrets(dbContext: DatabaseContext, projectId: string, secrets: { key: string; value: Buffer }[]): Promise<void> {\n\t\tif (secrets.length === 0) {\n\t\t\treturn\n\t\t}\n\t\tawait dbContext.transaction(async db => {\n\t\t\tfor (const { key, value } of secrets) {\n\t\t\t\tawait db.commandBus.execute(new SetProjectSecretCommand(projectId, key, Buffer.from(value)))\n\t\t\t}\n\t\t\tawait db.commandBus.execute(new UpdateProjectCommand(projectId, {}))\n\t\t})\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAKO,MAAM,eAAe;AAAA,EAC3B,YAAoB,WAAsB;AAAtB,SAAA,YAAA;AAAA,EAAuB;AAAA,EAE3C,MAAa,UAAU,WAA4B,WAAmB,KAAa,OAA8B;AAChH,UAAM,KAAK,WAAW,WAAW,WAAW,CAAC,EAAE,KAAK,OAAO,OAAO,KAAK,KAAK,EAAA,CAAG,CAAC;AAAA,EACjF;AAAA;AAAA,EAGA,MAAa,eAAe,WAA4B,WAAoD;AAC3G,WAAO,MAAM,UAAU,aAAa,MAAM,IAAI,uBAAuB,SAAS,CAAC;AAAA,EAChF;AAAA,EAEA,MAAa,YAAY,WAA4B,WAAoD;AACxG,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,oBAAoB,WAAW,KAAK,SAAS,CAAC;AACpG,UAAM,YAAY,OAAO,OAAO,CAAA,OAAM,GAAG,cAAc;AACvD,UAAM,KAAK,WAAW,WAAW,WAAW,SAAS;AACrD,WAAO,OAAO,YAAY,OAAO,IAAI,CAAA,OAAM,CAAC,GAAG,KAAK,GAAG,MAAM,SAAA,CAAU,CAAC,CAAC;AAAA,EAC1E;AAAA,EAEA,MAAc,WAAW,WAA4B,WAAmB,SAA0D;AACjI,QAAI,QAAQ,WAAW,GAAG;AACzB;AAAA,IACD;AACA,UAAM,UAAU,YAAY,OAAM,OAAM;AACvC,iBAAW,EAAE,KAAK,MAAA,KAAW,SAAS;AACrC,cAAM,GAAG,WAAW,QAAQ,IAAI,wBAAwB,WAAW,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;AAAA,MAC5F;AACA,YAAM,GAAG,WAAW,QAAQ,IAAI,qBAAqB,WAAW,CAAA,CAAE,CAAC;AAAA,IACpE,CAAC;AAAA,EACF;AACD;"}

package/dist/development/src/model/service/SignInManager.cjs CHANGED Viewed

@@ -6,10 +6,12 @@ require("../type/ApiKey.cjs");
 const ConfigurationQuery = require("../queries/configuration/ConfigurationQuery.cjs");
 const exceptions = require("../../exceptions.cjs");
 const PersonQuery = require("../queries/person/PersonQuery.cjs");
+const LocalAuthDisablingIdpsQuery = require("../queries/idp/LocalAuthDisablingIdpsQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 const Response = require("../utils/Response.cjs");
 const AuthLogService = require("./AuthLogService.cjs");
@@ -42,6 +44,10 @@ class SignInManager {
         personId: person.id
       })
     };
+    const exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery.LocalAuthDisablingIdpsQuery(person.id));
+    if (exclusiveIdps.length > 0) {
+      return new Response.ResponseError("IDP_REQUIRED", `Sign in using ${exclusiveIdps.join(" or ")}`, authLogData);
+    }
     if (!person.password_hash) {
       return new Response.ResponseError("NO_PASSWORD_SET", `No password set`, authLogData);
     }
@@ -230,7 +236,6 @@ class SignInManager {
     if (!policy.mfaRequired) {
       return null;
     }
-    const now = this.providers.now();
     let graceSeconds;
     if (policy.graceDuration !== null) {
       graceSeconds = interval.intervalToSeconds(policy.graceDuration);
@@ -239,12 +244,11 @@ class SignInManager {
       graceSeconds = interval.intervalToSeconds(config.login.mfaGraceDuration);
     }
     if (person.mfa_grace_until !== null) {
-      if (person.mfa_grace_until.getTime() > now.getTime()) {
+      if (person.is_in_grace) {
         return null;
       }
     } else if (graceSeconds > 0) {
-      const graceUntil = new Date(now.getTime() + graceSeconds * 1e3);
-      await dbContext.commandBus.execute(new SetMfaGraceUntilCommand.SetMfaGraceUntilCommand(person.id, graceUntil));
+      await dbContext.commandBus.execute(new SetMfaGraceUntilCommand.SetMfaGraceUntilCommand(person.id, graceSeconds));
       return null;
     }
     if (otpCode && person.otp_pending_secret) {

package/dist/development/src/model/service/SignInManager.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, MfaEnrollment, SignInErrorCode } from '../../schema/index.js'\nimport { ApiKeyManager, AuthPolicyResolver, BackupCodeManager, EmailOtpManager, LoginRiskAnalyzer, OtpManager } from '../service/index.js'\nimport { ConfigurationQuery, PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries/index.js'\nimport { Config } from '../type/Config.js'\nimport { Providers } from '../providers.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ApiKeyRequestInfo, SetMfaGraceUntilCommand } from '../commands/index.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly emailOtpManager: EmailOtpManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t\tprivate readonly loginRiskAnalyzer: LoginRiskAnalyzer,\n\t\tprivate readonly userMailer: UserMailer,\n\t) {}\n\n\tasync signIn(\n\t\tdbContext: DatabaseContext,\n\t\temail: string,\n\t\tpassword: string,\n\t\texpiration?: number,\n\t\totpCode?: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t\tbackupCode?: string,\n\t\tconfig?: Config,\n\t\tgeoCountry?: string,\n\t): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\t// Block sign-in for accounts that were created while email verification\n\t\t// was required but never proved ownership. Accounts predating the\n\t\t// requirement carry email_verification_required = false and pass through.\n\t\tif (person.email_verification_required && person.email_verified_at === null) {\n\t\t\treturn new ResponseError('EMAIL_NOT_VERIFIED', `E-mail address has not been verified`, authLogData)\n\t\t}\n\n\t\tlet usedBackupCode = false\n\t\t// Whether a second factor was actively proven in THIS request. Anomaly\n\t\t// step-up (A03) reuses this: a login that already cleared a second factor\n\t\t// is not asked to step up again.\n\t\tlet mfaSatisfiedThisRequest = false\n\t\tconst hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at)\n\t\tif (hasActiveTotp) {\n\t\t\t// Active TOTP takes precedence (A07 path, unchanged).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.otpManager.verifyOtp(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\t\t} else if (person.email_otp_enabled) {\n\t\t\t// No active TOTP, but email OTP is enabled (A05).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\t// Dispatch a fresh code and ask the client to retry with otpToken. Reuses\n\t\t\t\t// the existing OTP_REQUIRED contract so clients that already handle it work.\n\t\t\t\t// The send is rate-limited per person; when throttled nothing is emailed\n\t\t\t\t// (emailOtpSent: false) but a previously emailed code stays valid.\n\t\t\t\t// Independent fetch (not the passed-in `config`): the email-OTP send is\n\t\t\t\t// rate-limited by the live config and this branch never reaches the\n\t\t\t\t// anomaly analyzer, so query shape stays as before A03.\n\t\t\t\tconst emailOtpConfig = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, emailOtpConfig)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t} else {\n\t\t\t// No active factor at all (A06). Enforce MFA if a matching auth_policy\n\t\t\t// requires it. With no policy rows configured this resolves to\n\t\t\t// mfaRequired=false and sign-in proceeds exactly as before.\n\t\t\tconst enforcement = await this.enforceMfaEnrollment(dbContext, person, otpCode, authLogData)\n\t\t\tif (enforcement !== null) {\n\t\t\t\tif ('error' in enforcement) {\n\t\t\t\t\treturn enforcement\n\t\t\t\t}\n\t\t\t\t// Enrollment completed in this request (pending TOTP promoted to active),\n\t\t\t\t// so MFA is definitively satisfied — anomaly step-up cannot apply.\n\t\t\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\t\t\tconfig,\n\t\t\t\t\tgeoCountry,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\totpCode,\n\t\t\t\t\tmfaSatisfiedThisRequest: true,\n\t\t\t\t\tauthLogData,\n\t\t\t\t})\n\t\t\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\t\t\treturn riskHandled\n\t\t\t\t}\n\t\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(\n\t\t\t\t\tdbContext,\n\t\t\t\t\tperson.identity_id,\n\t\t\t\t\texpiration,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\ttrustForwardedInfo,\n\t\t\t\t)\n\t\t\t\treturn new ResponseOk({\n\t\t\t\t\tperson,\n\t\t\t\t\ttoken: sessionToken,\n\t\t\t\t\tbackupCodes: enforcement.backupCodes,\n\t\t\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected \|\| undefined,\n\t\t\t\t\trisk: riskHandled?.risk,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\tconfig,\n\t\t\tgeoCountry,\n\t\t\trequestInfo,\n\t\t\totpCode,\n\t\t\tmfaSatisfiedThisRequest,\n\t\t\tauthLogData,\n\t\t})\n\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\treturn riskHandled\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\tusedBackupCode,\n\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected \|\| undefined,\n\t\t\trisk: riskHandled?.risk,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\t/*\n\t A03 — evaluate the sign-in risk score and act per policy. Returns:\n\t * - `null` when anomaly detection is off or no `config` was supplied (the\n\t * default): no DB work, sign-in proceeds unchanged.\n\t * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email\n\t * was sent (best-effort) but the session may still be issued.\n\t * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was\n\t * supplied — reuses the email-OTP step-up channel (dispatches a code).\n\t * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but\n\t * did not verify. A valid code consumes the token and the session is issued.\n\t * - `{ unusualLoginDetected: false }` when the score was below every threshold.\n\t \n\t The audit entries (`unusual_login_detected`, `step_up_required`) are emitted\n\t * by the resolver from the response metadata, matching the project convention.\n\t /\n\tprivate async applyRiskPolicy(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\targs: {\n\t\t\tconfig?: Config\n\t\t\tgeoCountry?: string\n\t\t\trequestInfo?: ApiKeyRequestInfo\n\t\t\totpCode?: string\n\t\t\tmfaSatisfiedThisRequest: boolean\n\t\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag }\n\t\t},\n\t): Promise<RiskPolicyOutcome> {\n\t\tconst { config, geoCountry, requestInfo, otpCode, mfaSatisfiedThisRequest, authLogData } = args\n\t\tconst policy = config?.login.anomalyDetection\n\t\tif (!config \|\| !policy?.enabled) {\n\t\t\treturn null\n\t\t}\n\n\t\tconst assessment = await this.loginRiskAnalyzer.analyze(dbContext, person.id, {\n\t\t\tgeoCountry: geoCountry ?? null,\n\t\t\tdeviceFingerprint: this.loginRiskAnalyzer.fingerprint(requestInfo?.userAgent),\n\t\t\tip: requestInfo?.ip ?? null,\n\t\t}, policy)\n\n\t\tif (assessment.action === 'allow') {\n\t\t\treturn { unusualLoginDetected: false }\n\t\t}\n\n\t\tconst riskMeta = { score: assessment.score, reasons: assessment.reasons }\n\n\t\tif (assessment.action === 'stepUp' && !mfaSatisfiedThisRequest) {\n\t\t\t// Reuse the existing email-OTP step-up channel. This is independent of\n\t\t\t// `person.email_otp_enabled`, which gates email OTP only as the primary\n\t\t\t// second factor (A05); the step-up challenge stands on its own, so a person\n\t\t\t// with no standing MFA can still complete it. Without consuming the code\n\t\t\t// here, such a person would never satisfy the step-up and would loop on\n\t\t\t// OTP_REQUIRED forever (the score is unchanged on every retry).\n\t\t\tif (otpCode) {\n\t\t\t\t// Retry leg: the client resent the emailed code as otpToken. Mirror the\n\t\t\t\t// A05 contract — an invalid code is rejected (not re-sent); the per-code\n\t\t\t\t// 3-attempt cap still applies, and a fresh code is issued only when the\n\t\t\t\t// client retries without a code.\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\t// A failed forced* second factor is itself an anomaly signal — carry the\n\t\t\t\t\t// step-up/risk metadata so the resolver still emits unusual_login_detected\n\t\t\t\t\t// + step_up_required with the score/reasons, rather than logging it as an\n\t\t\t\t\t// ordinary mistyped-OTP login indistinguishable from a normal 2FA typo.\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t\t...authLogData,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\t// Step-up satisfied this request — fall through to notify + allow below.\n\t\t\t} else {\n\t\t\t\t// First leg: dispatch a code and ask the client to retry with otpToken.\n\t\t\t\t// Rate-limited per person; a previously emailed code stays valid when throttled.\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, config)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', 'Additional verification is required for this sign-in', {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\t// action === 'email', or step-up satisfied (already this request, or just now\n\t\t// via the emailed code): notify the person of the unusual sign-in. A failed\n\t\t// email must never block sign-in.\n\t\tawait this.sendUnusualLoginEmail(dbContext, person, geoCountry ?? null, requestInfo?.ip ?? null)\n\t\treturn { unusualLoginDetected: true, risk: riskMeta }\n\t}\n\n\tprivate async sendUnusualLoginEmail(dbContext: DatabaseContext, person: PersonRow, geoCountry: string \| null, ip: string \| null): Promise<void> {\n\t\tif (!person.email) {\n\t\t\t// No address to notify (e.g. an IDP-only person) — nothing to send.\n\t\t\treturn\n\t\t}\n\t\ttry {\n\t\t\tawait this.userMailer.sendUnusualLoginEmail(dbContext, {\n\t\t\t\temail: person.email,\n\t\t\t\tgeoCountry,\n\t\t\t\tipAddress: ip,\n\t\t\t}, { projectId: null, variant: '' })\n\t\t} catch {\n\t\t\t// ignore — informational only\n\t\t}\n\t}\n\n\t/*\n\t A06 enforcement for the no-active-factor case. Returns:\n\t * - `null` when MFA is not required, or grace currently allows sign-in\n\t * (caller proceeds to issue a session as normal). With zero auth_policy\n\t * rows this is always the outcome — no behavior change.\n\t * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to\n\t * enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.\n\t * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP\n\t * promoted to active); caller issues the session.\n\t /\n\tprivate async enforceMfaEnrollment(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\totpCode: string \| undefined,\n\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag },\n\t): Promise<\n\t\t\| null\n\t\t\| ResponseError<SignInErrorCode, {\n\t\t\temailOtpSent?: boolean\n\t\t\tmfaEnrollmentRequired?: boolean\n\t\t\tmfaEnrollment?: MfaEnrollment\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}>\n\t\t\| { backupCodes: string[] }\n\t> {\n\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(dbContext, person.identity_id, person.roles)\n\t\tif (!policy.mfaRequired) {\n\t\t\treturn null\n\t\t}\n\n\t\tconst now = this.providers.now()\n\n\t\t// Resolve the effective grace duration (seconds). A per-policy override\n\t\t// wins; otherwise we fall back to the global config default. Only fetch the\n\t\t// config when the override is absent, to keep query shapes minimal.\n\t\tlet graceSeconds: number\n\t\tif (policy.graceDuration !== null) {\n\t\t\tgraceSeconds = intervalToSeconds(policy.graceDuration)\n\t\t} else {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\tgraceSeconds = intervalToSeconds(config.login.mfaGraceDuration)\n\t\t}\n\n\t\t// Grace handling. Default grace duration is 0 (immediate enforcement), so\n\t\t// by default neither branch below opens a window.\n\t\tif (person.mfa_grace_until !== null) {\n\t\t\tif (person.mfa_grace_until.getTime() > now.getTime()) {\n\t\t\t\t// Still inside an open grace window — allow sign-in.\n\t\t\t\treturn null\n\t\t\t}\n\t\t\t// Grace expired → fall through to enforcement.\n\t\t} else if (graceSeconds > 0) {\n\t\t\t// Open the grace window now and allow this sign-in.\n\t\t\tconst graceUntil = new Date(now.getTime() + graceSeconds 1000)\n\t\t\tawait dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceUntil))\n\t\t\treturn null\n\t\t}\n\n\t\t// Enforce.\n\t\tif (otpCode && person.otp_pending_secret) {\n\t\t\t// Enrollment completion: verify against the pending secret, then promote.\n\t\t\tif (!await this.otpManager.verifyPendingOtp(person, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst promoted = await this.otpManager.confirmOtp(dbContext, person)\n\t\t\tif (!promoted) {\n\t\t\t\t// Lost a concurrent enrollment-completion race: the pending secret was\n\t\t\t\t// already promoted by the other request (which issued the backup codes).\n\t\t\t\t// Don't regenerate here — that would invalidate the codes already\n\t\t\t\t// returned. TOTP is now active, so a retry signs in via the normal path.\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst backupCodes = await this.backupCodeManager.generate(dbContext, person.id)\n\t\t\treturn { backupCodes }\n\t\t}\n\n\t\t// Provision a fresh pending TOTP secret and ask the client to enroll.\n\t\tconst otp = await this.otpManager.prepareOtp(dbContext, person, 'Contember')\n\t\tconst mfaEnrollment: MfaEnrollment = { otpUri: otp.uri, otpSecret: otp.secret }\n\t\treturn new ResponseError('MFA_ENROLLMENT_REQUIRED', 'MFA enrollment is required', {\n\t\t\tmfaEnrollmentRequired: true,\n\t\t\tmfaEnrollment,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\n/** A03: greppable payload describing why a sign-in scored as unusual. /\nexport interface RiskMeta {\n\treadonly score: number\n\treadonly reasons: readonly string[]\n}\n\n/\n Result of {@link SignInManager.applyRiskPolicy}: `null` = feature off / no\n * config; a metadata object when the session may still be issued; a\n * `ResponseError` when step-up blocks the session.\n /\ntype RiskPolicyOutcome =\n\t\| null\n\t\| { unusualLoginDetected: boolean; risk?: RiskMeta }\n\t\| ResponseError<SignInErrorCode, {\n\t\temailOtpSent?: boolean\n\t\tstepUpRequired?: boolean\n\t\tunusualLoginDetected?: boolean\n\t\trisk?: RiskMeta\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t/* True when MFA was satisfied by consuming a backup code (instead of a TOTP token). /\n\treadonly usedBackupCode?: boolean\n\t/* Set when sign-in completed an MFA enrollment (A06): the freshly issued backup codes, shown once. /\n\treadonly backupCodes?: string[]\n\t/* A03: true when this sign-in scored as unusual and an UNUSUAL_LOGIN email was sent. /\n\treadonly unusualLoginDetected?: boolean\n\t/* A03: the risk score + reasons, recorded in the `unusual_login_detected` audit `event_data`. /\n\treadonly risk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t/* Set on an OTP_REQUIRED error when an email-OTP code was just dispatched (A05). /\n\temailOtpSent?: boolean\n\t/* Set on a MFA_ENROLLMENT_REQUIRED error (A06): triggers the `mfa_enrollment_required` audit. /\n\tmfaEnrollmentRequired?: boolean\n\t/* Set on a MFA_ENROLLMENT_REQUIRED error (A06): the pending secret the client must enroll. /\n\tmfaEnrollment?: MfaEnrollment\n\t/* Set on an OTP_REQUIRED error raised by A03 anomaly step-up: triggers the `step_up_required` audit. /\n\tstepUpRequired?: boolean\n\t/* A03: true when the sign-in scored as unusual (triggers the `unusual_login_detected` audit). /\n\tunusualLoginDetected?: boolean\n\t/* A03: the risk score + reasons, recorded in the audit `event_data`. */\n\trisk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":["PersonQuery","ResponseError","AuthLogService","ConfigurationQuery","riskHandled","sessionToken","ResponseOk","intervalToSeconds","SetMfaGraceUntilCommand","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;AAaA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,YACA,mBACA,iBACA,oBACA,mBACA,YAChB;AARgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,kBAAA;AACA,SAAA,qBAAA;AACA,SAAA,oBAAA;AACA,SAAA,aAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,WACA,OACA,UACA,YACA,SACA,aACA,oBACA,YACA,QACA,YAC0B;AAC1B,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMA,wBAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAACA,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAID,SAAAA,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIA,SAAAA,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAKA,QAAI,OAAO,+BAA+B,OAAO,sBAAsB,MAAM;AAC5E,aAAO,IAAIA,SAAAA,cAAc,sBAAsB,wCAAwC,WAAW;AAAA,IACnG;AAEA,QAAI,iBAAiB;AAIrB,QAAI,0BAA0B;AAC9B,UAAM,gBAAgB,QAAQ,OAAO,cAAc,OAAO,gBAAgB;AAC1E,QAAI,eAAe;AAElB,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,WAAW,UAAU,WAAW,QAAQ,OAAO,GAAG;AACjE,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AACN,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAAA,IACD,WAAW,OAAO,mBAAmB;AAEpC,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAC7E,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AAQN,cAAM,iBAAiB,MAAM,UAAU,aAAa,MAAM,IAAIE,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AACrG,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,cAAc;AACtF,eAAO,IAAIF,SAAAA,cAAc,gBAAgB,yCAAyC;AAAA,UACjF,cAAc,SAAS;AAAA,UACvB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD,OAAO;AAIN,YAAM,cAAc,MAAM,KAAK,qBAAqB,WAAW,QAAQ,SAAS,WAAW;AAC3F,UAAI,gBAAgB,MAAM;AACzB,YAAI,WAAW,aAAa;AAC3B,iBAAO;AAAA,QACR;AAGA,cAAMG,eAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,UACjE;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,yBAAyB;AAAA,UACzB;AAAA,QAAA,CACA;AACD,YAAIA,iBAAgB,QAAQ,WAAWA,cAAa;AACnD,iBAAOA;AAAAA,QACR;AACA,cAAMC,gBAAe,MAAM,KAAK,cAAc;AAAA,UAC7C;AAAA,UACA,OAAO;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,QAAA;AAED,eAAO,IAAIC,SAAAA,WAAW;AAAA,UACrB;AAAA,UACA,OAAOD;AAAAA,UACP,aAAa,YAAY;AAAA,UACzB,sBAAsBD,cAAa,wBAAwB;AAAA,UAC3D,MAAMA,cAAa;AAAA,UACnB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAEA,UAAM,cAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACA;AACD,QAAI,gBAAgB,QAAQ,WAAW,aAAa;AACnD,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAE5I,WAAO,IAAIE,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,sBAAsB,aAAa,wBAAwB;AAAA,MAC3D,MAAM,aAAa;AAAA,MACnB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAc,gBACb,WACA,QACA,MAQ6B;AAC7B,UAAM,EAAE,QAAQ,YAAY,aAAa,SAAS,yBAAyB,gBAAgB;AAC3F,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,CAAC,UAAU,CAAC,QAAQ,SAAS;AAChC,aAAO;AAAA,IACR;AAEA,UAAM,aAAa,MAAM,KAAK,kBAAkB,QAAQ,WAAW,OAAO,IAAI;AAAA,MAC7E,YAAY,cAAc;AAAA,MAC1B,mBAAmB,KAAK,kBAAkB,YAAY,aAAa,SAAS;AAAA,MAC5E,IAAI,aAAa,MAAM;AAAA,IAAA,GACrB,MAAM;AAET,QAAI,WAAW,WAAW,SAAS;AAClC,aAAO,EAAE,sBAAsB,MAAA;AAAA,IAChC;AAEA,UAAM,WAAW,EAAE,OAAO,WAAW,OAAO,SAAS,WAAW,QAAA;AAEhE,QAAI,WAAW,WAAW,YAAY,CAAC,yBAAyB;AAO/D,UAAI,SAAS;AAKZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAK7E,iBAAO,IAAIL,SAAAA,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,gBAAgB;AAAA,YAChB,sBAAsB;AAAA,YACtB,MAAM;AAAA,YACN,GAAG;AAAA,UAAA,CACH;AAAA,QACF;AAAA,MAED,OAAO;AAGN,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,MAAM;AAC9E,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,wDAAwD;AAAA,UAChG,cAAc,SAAS;AAAA,UACvB,gBAAgB;AAAA,UAChB,sBAAsB;AAAA,UACtB,MAAM;AAAA,UACN,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAKA,UAAM,KAAK,sBAAsB,WAAW,QAAQ,cAAc,MAAM,aAAa,MAAM,IAAI;AAC/F,WAAO,EAAE,sBAAsB,MAAM,MAAM,SAAA;AAAA,EAC5C;AAAA,EAEA,MAAc,sBAAsB,WAA4B,QAAmB,YAA2B,IAAkC;AAC/I,QAAI,CAAC,OAAO,OAAO;AAElB;AAAA,IACD;AACA,QAAI;AACH,YAAM,KAAK,WAAW,sBAAsB,WAAW;AAAA,QACtD,OAAO,OAAO;AAAA,QACd;AAAA,QACA,WAAW;AAAA,MAAA,GACT,EAAE,WAAW,MAAM,SAAS,IAAI;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,qBACb,WACA,QACA,SACA,aAUC;AACD,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,WAAW,OAAO,aAAa,OAAO,KAAK;AAC3G,QAAI,CAAC,OAAO,aAAa;AACxB,aAAO;AAAA,IACR;AAEA,UAAM,MAAM,KAAK,UAAU,IAAA;AAK3B,QAAI;AACJ,QAAI,OAAO,kBAAkB,MAAM;AAClC,qBAAeM,SAAAA,kBAAkB,OAAO,aAAa;AAAA,IACtD,OAAO;AACN,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIJ,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AAC7F,qBAAeI,SAAAA,kBAAkB,OAAO,MAAM,gBAAgB;AAAA,IAC/D;AAIA,QAAI,OAAO,oBAAoB,MAAM;AACpC,UAAI,OAAO,gBAAgB,QAAA,IAAY,IAAI,WAAW;AAErD,eAAO;AAAA,MACR;AAAA,IAED,WAAW,eAAe,GAAG;AAE5B,YAAM,aAAa,IAAI,KAAK,IAAI,QAAA,IAAY,eAAe,GAAI;AAC/D,YAAM,UAAU,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,OAAO,IAAI,UAAU,CAAC;AACrF,aAAO;AAAA,IACR;AAGA,QAAI,WAAW,OAAO,oBAAoB;AAEzC,UAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,OAAO,GAAG;AAC7D,eAAO,IAAIP,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,WAAW,MAAM,KAAK,WAAW,WAAW,WAAW,MAAM;AACnE,UAAI,CAAC,UAAU;AAKd,eAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,WAAW,OAAO,EAAE;AAC9E,aAAO,EAAE,YAAA;AAAA,IACV;AAGA,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,WAAW,QAAQ,WAAW;AAC3E,UAAM,gBAA+B,EAAE,QAAQ,IAAI,KAAK,WAAW,IAAI,OAAA;AACvE,WAAO,IAAIA,SAAAA,cAAc,2BAA2B,8BAA8B;AAAA,MACjF,uBAAuB;AAAA,MACvB;AAAA,MACA,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACA,aACA,oBACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMD,wBAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAID,SAAAA,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAIO,WAAAA,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIR,SAAAA,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAC5I,WAAO,IAAII,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAACJ,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;;"}
1	+ {"version":3,"file":"SignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, MfaEnrollment, SignInErrorCode } from '../../schema/index.js'\nimport { ApiKeyManager, AuthPolicyResolver, BackupCodeManager, EmailOtpManager, LoginRiskAnalyzer, OtpManager } from '../service/index.js'\nimport { ConfigurationQuery, LocalAuthDisablingIdpsQuery, PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries/index.js'\nimport { Config } from '../type/Config.js'\nimport { Providers } from '../providers.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ApiKeyRequestInfo, SetMfaGraceUntilCommand } from '../commands/index.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly emailOtpManager: EmailOtpManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t\tprivate readonly loginRiskAnalyzer: LoginRiskAnalyzer,\n\t\tprivate readonly userMailer: UserMailer,\n\t) {}\n\n\tasync signIn(\n\t\tdbContext: DatabaseContext,\n\t\temail: string,\n\t\tpassword: string,\n\t\texpiration?: number,\n\t\totpCode?: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t\tbackupCode?: string,\n\t\tconfig?: Config,\n\t\tgeoCountry?: string,\n\t): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\t// Refused before the password is even looked at: for a person federated\n\t\t// through a provider with `disableLocalAuthentication`, a password is not a\n\t\t// credential this tenant accepts, however it got set.\n\t\tconst exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id))\n\t\tif (exclusiveIdps.length > 0) {\n\t\t\treturn new ResponseError('IDP_REQUIRED', `Sign in using ${exclusiveIdps.join(' or ')}`, authLogData)\n\t\t}\n\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\t// Block sign-in for accounts that were created while email verification\n\t\t// was required but never proved ownership. Accounts predating the\n\t\t// requirement carry email_verification_required = false and pass through.\n\t\tif (person.email_verification_required && person.email_verified_at === null) {\n\t\t\treturn new ResponseError('EMAIL_NOT_VERIFIED', `E-mail address has not been verified`, authLogData)\n\t\t}\n\n\t\tlet usedBackupCode = false\n\t\t// Whether a second factor was actively proven in THIS request. Anomaly\n\t\t// step-up (A03) reuses this: a login that already cleared a second factor\n\t\t// is not asked to step up again.\n\t\tlet mfaSatisfiedThisRequest = false\n\t\tconst hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at)\n\t\tif (hasActiveTotp) {\n\t\t\t// Active TOTP takes precedence (A07 path, unchanged).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.otpManager.verifyOtp(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\t\t} else if (person.email_otp_enabled) {\n\t\t\t// No active TOTP, but email OTP is enabled (A05).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\t// Dispatch a fresh code and ask the client to retry with otpToken. Reuses\n\t\t\t\t// the existing OTP_REQUIRED contract so clients that already handle it work.\n\t\t\t\t// The send is rate-limited per person; when throttled nothing is emailed\n\t\t\t\t// (emailOtpSent: false) but a previously emailed code stays valid.\n\t\t\t\t// Independent fetch (not the passed-in `config`): the email-OTP send is\n\t\t\t\t// rate-limited by the live config and this branch never reaches the\n\t\t\t\t// anomaly analyzer, so query shape stays as before A03.\n\t\t\t\tconst emailOtpConfig = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, emailOtpConfig)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t} else {\n\t\t\t// No active factor at all (A06). Enforce MFA if a matching auth_policy\n\t\t\t// requires it. With no policy rows configured this resolves to\n\t\t\t// mfaRequired=false and sign-in proceeds exactly as before.\n\t\t\tconst enforcement = await this.enforceMfaEnrollment(dbContext, person, otpCode, authLogData)\n\t\t\tif (enforcement !== null) {\n\t\t\t\tif ('error' in enforcement) {\n\t\t\t\t\treturn enforcement\n\t\t\t\t}\n\t\t\t\t// Enrollment completed in this request (pending TOTP promoted to active),\n\t\t\t\t// so MFA is definitively satisfied — anomaly step-up cannot apply.\n\t\t\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\t\t\tconfig,\n\t\t\t\t\tgeoCountry,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\totpCode,\n\t\t\t\t\tmfaSatisfiedThisRequest: true,\n\t\t\t\t\tauthLogData,\n\t\t\t\t})\n\t\t\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\t\t\treturn riskHandled\n\t\t\t\t}\n\t\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(\n\t\t\t\t\tdbContext,\n\t\t\t\t\tperson.identity_id,\n\t\t\t\t\texpiration,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\ttrustForwardedInfo,\n\t\t\t\t)\n\t\t\t\treturn new ResponseOk({\n\t\t\t\t\tperson,\n\t\t\t\t\ttoken: sessionToken,\n\t\t\t\t\tbackupCodes: enforcement.backupCodes,\n\t\t\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected \|\| undefined,\n\t\t\t\t\trisk: riskHandled?.risk,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\tconfig,\n\t\t\tgeoCountry,\n\t\t\trequestInfo,\n\t\t\totpCode,\n\t\t\tmfaSatisfiedThisRequest,\n\t\t\tauthLogData,\n\t\t})\n\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\treturn riskHandled\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\tusedBackupCode,\n\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected \|\| undefined,\n\t\t\trisk: riskHandled?.risk,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\t/*\n\t A03 — evaluate the sign-in risk score and act per policy. Returns:\n\t * - `null` when anomaly detection is off or no `config` was supplied (the\n\t * default): no DB work, sign-in proceeds unchanged.\n\t * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email\n\t * was sent (best-effort) but the session may still be issued.\n\t * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was\n\t * supplied — reuses the email-OTP step-up channel (dispatches a code).\n\t * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but\n\t * did not verify. A valid code consumes the token and the session is issued.\n\t * - `{ unusualLoginDetected: false }` when the score was below every threshold.\n\t \n\t The audit entries (`unusual_login_detected`, `step_up_required`) are emitted\n\t * by the resolver from the response metadata, matching the project convention.\n\t /\n\tprivate async applyRiskPolicy(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\targs: {\n\t\t\tconfig?: Config\n\t\t\tgeoCountry?: string\n\t\t\trequestInfo?: ApiKeyRequestInfo\n\t\t\totpCode?: string\n\t\t\tmfaSatisfiedThisRequest: boolean\n\t\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag }\n\t\t},\n\t): Promise<RiskPolicyOutcome> {\n\t\tconst { config, geoCountry, requestInfo, otpCode, mfaSatisfiedThisRequest, authLogData } = args\n\t\tconst policy = config?.login.anomalyDetection\n\t\tif (!config \|\| !policy?.enabled) {\n\t\t\treturn null\n\t\t}\n\n\t\tconst assessment = await this.loginRiskAnalyzer.analyze(dbContext, person.id, {\n\t\t\tgeoCountry: geoCountry ?? null,\n\t\t\tdeviceFingerprint: this.loginRiskAnalyzer.fingerprint(requestInfo?.userAgent),\n\t\t\tip: requestInfo?.ip ?? null,\n\t\t}, policy)\n\n\t\tif (assessment.action === 'allow') {\n\t\t\treturn { unusualLoginDetected: false }\n\t\t}\n\n\t\tconst riskMeta = { score: assessment.score, reasons: assessment.reasons }\n\n\t\tif (assessment.action === 'stepUp' && !mfaSatisfiedThisRequest) {\n\t\t\t// Reuse the existing email-OTP step-up channel. This is independent of\n\t\t\t// `person.email_otp_enabled`, which gates email OTP only as the primary\n\t\t\t// second factor (A05); the step-up challenge stands on its own, so a person\n\t\t\t// with no standing MFA can still complete it. Without consuming the code\n\t\t\t// here, such a person would never satisfy the step-up and would loop on\n\t\t\t// OTP_REQUIRED forever (the score is unchanged on every retry).\n\t\t\tif (otpCode) {\n\t\t\t\t// Retry leg: the client resent the emailed code as otpToken. Mirror the\n\t\t\t\t// A05 contract — an invalid code is rejected (not re-sent); the per-code\n\t\t\t\t// 3-attempt cap still applies, and a fresh code is issued only when the\n\t\t\t\t// client retries without a code.\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\t// A failed forced* second factor is itself an anomaly signal — carry the\n\t\t\t\t\t// step-up/risk metadata so the resolver still emits unusual_login_detected\n\t\t\t\t\t// + step_up_required with the score/reasons, rather than logging it as an\n\t\t\t\t\t// ordinary mistyped-OTP login indistinguishable from a normal 2FA typo.\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t\t...authLogData,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\t// Step-up satisfied this request — fall through to notify + allow below.\n\t\t\t} else {\n\t\t\t\t// First leg: dispatch a code and ask the client to retry with otpToken.\n\t\t\t\t// Rate-limited per person; a previously emailed code stays valid when throttled.\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, config)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', 'Additional verification is required for this sign-in', {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\t// action === 'email', or step-up satisfied (already this request, or just now\n\t\t// via the emailed code): notify the person of the unusual sign-in. A failed\n\t\t// email must never block sign-in.\n\t\tawait this.sendUnusualLoginEmail(dbContext, person, geoCountry ?? null, requestInfo?.ip ?? null)\n\t\treturn { unusualLoginDetected: true, risk: riskMeta }\n\t}\n\n\tprivate async sendUnusualLoginEmail(dbContext: DatabaseContext, person: PersonRow, geoCountry: string \| null, ip: string \| null): Promise<void> {\n\t\tif (!person.email) {\n\t\t\t// No address to notify (e.g. an IDP-only person) — nothing to send.\n\t\t\treturn\n\t\t}\n\t\ttry {\n\t\t\tawait this.userMailer.sendUnusualLoginEmail(dbContext, {\n\t\t\t\temail: person.email,\n\t\t\t\tgeoCountry,\n\t\t\t\tipAddress: ip,\n\t\t\t}, { projectId: null, variant: '' })\n\t\t} catch {\n\t\t\t// ignore — informational only\n\t\t}\n\t}\n\n\t/*\n\t A06 enforcement for the no-active-factor case. Returns:\n\t * - `null` when MFA is not required, or grace currently allows sign-in\n\t * (caller proceeds to issue a session as normal). With zero auth_policy\n\t * rows this is always the outcome — no behavior change.\n\t * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to\n\t * enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.\n\t * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP\n\t * promoted to active); caller issues the session.\n\t /\n\tprivate async enforceMfaEnrollment(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\totpCode: string \| undefined,\n\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag },\n\t): Promise<\n\t\t\| null\n\t\t\| ResponseError<SignInErrorCode, {\n\t\t\temailOtpSent?: boolean\n\t\t\tmfaEnrollmentRequired?: boolean\n\t\t\tmfaEnrollment?: MfaEnrollment\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}>\n\t\t\| { backupCodes: string[] }\n\t> {\n\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(dbContext, person.identity_id, person.roles)\n\t\tif (!policy.mfaRequired) {\n\t\t\treturn null\n\t\t}\n\n\t\t// Resolve the effective grace duration (seconds). A per-policy override\n\t\t// wins; otherwise we fall back to the global config default. Only fetch the\n\t\t// config when the override is absent, to keep query shapes minimal.\n\t\tlet graceSeconds: number\n\t\tif (policy.graceDuration !== null) {\n\t\t\tgraceSeconds = intervalToSeconds(policy.graceDuration)\n\t\t} else {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\tgraceSeconds = intervalToSeconds(config.login.mfaGraceDuration)\n\t\t}\n\n\t\t// Grace handling. Default grace duration is 0 (immediate enforcement), so\n\t\t// by default neither branch below opens a window. Whether we're still inside\n\t\t// an open window is decided on the DB clock (PersonRow.is_in_grace, evaluated\n\t\t// against now()); the null check below only distinguishes \"never opened\" from\n\t\t// \"opened (and possibly expired)\". See engine-tenant-api/CLAUDE.md.\n\t\tif (person.mfa_grace_until !== null) {\n\t\t\tif (person.is_in_grace) {\n\t\t\t\t// Still inside an open grace window — allow sign-in.\n\t\t\t\treturn null\n\t\t\t}\n\t\t\t// Grace expired → fall through to enforcement.\n\t\t} else if (graceSeconds > 0) {\n\t\t\t// Open the grace window (now() + graceSeconds on the DB clock) and allow this sign-in.\n\t\t\tawait dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceSeconds))\n\t\t\treturn null\n\t\t}\n\n\t\t// Enforce.\n\t\tif (otpCode && person.otp_pending_secret) {\n\t\t\t// Enrollment completion: verify against the pending secret, then promote.\n\t\t\tif (!await this.otpManager.verifyPendingOtp(person, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst promoted = await this.otpManager.confirmOtp(dbContext, person)\n\t\t\tif (!promoted) {\n\t\t\t\t// Lost a concurrent enrollment-completion race: the pending secret was\n\t\t\t\t// already promoted by the other request (which issued the backup codes).\n\t\t\t\t// Don't regenerate here — that would invalidate the codes already\n\t\t\t\t// returned. TOTP is now active, so a retry signs in via the normal path.\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst backupCodes = await this.backupCodeManager.generate(dbContext, person.id)\n\t\t\treturn { backupCodes }\n\t\t}\n\n\t\t// Provision a fresh pending TOTP secret and ask the client to enroll.\n\t\tconst otp = await this.otpManager.prepareOtp(dbContext, person, 'Contember')\n\t\tconst mfaEnrollment: MfaEnrollment = { otpUri: otp.uri, otpSecret: otp.secret }\n\t\treturn new ResponseError('MFA_ENROLLMENT_REQUIRED', 'MFA enrollment is required', {\n\t\t\tmfaEnrollmentRequired: true,\n\t\t\tmfaEnrollment,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\n/* A03: greppable payload describing why a sign-in scored as unusual. /\nexport interface RiskMeta {\n\treadonly score: number\n\treadonly reasons: readonly string[]\n}\n\n/\n Result of {@link SignInManager.applyRiskPolicy}: `null` = feature off / no\n * config; a metadata object when the session may still be issued; a\n * `ResponseError` when step-up blocks the session.\n /\ntype RiskPolicyOutcome =\n\t\| null\n\t\| { unusualLoginDetected: boolean; risk?: RiskMeta }\n\t\| ResponseError<SignInErrorCode, {\n\t\temailOtpSent?: boolean\n\t\tstepUpRequired?: boolean\n\t\tunusualLoginDetected?: boolean\n\t\trisk?: RiskMeta\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t/* True when MFA was satisfied by consuming a backup code (instead of a TOTP token). /\n\treadonly usedBackupCode?: boolean\n\t/* Set when sign-in completed an MFA enrollment (A06): the freshly issued backup codes, shown once. /\n\treadonly backupCodes?: string[]\n\t/* A03: true when this sign-in scored as unusual and an UNUSUAL_LOGIN email was sent. /\n\treadonly unusualLoginDetected?: boolean\n\t/* A03: the risk score + reasons, recorded in the `unusual_login_detected` audit `event_data`. /\n\treadonly risk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t/* Set on an OTP_REQUIRED error when an email-OTP code was just dispatched (A05). /\n\temailOtpSent?: boolean\n\t/* Set on a MFA_ENROLLMENT_REQUIRED error (A06): triggers the `mfa_enrollment_required` audit. /\n\tmfaEnrollmentRequired?: boolean\n\t/* Set on a MFA_ENROLLMENT_REQUIRED error (A06): the pending secret the client must enroll. /\n\tmfaEnrollment?: MfaEnrollment\n\t/* Set on an OTP_REQUIRED error raised by A03 anomaly step-up: triggers the `step_up_required` audit. /\n\tstepUpRequired?: boolean\n\t/* A03: true when the sign-in scored as unusual (triggers the `unusual_login_detected` audit). /\n\tunusualLoginDetected?: boolean\n\t/* A03: the risk score + reasons, recorded in the audit `event_data`. */\n\trisk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":["PersonQuery","ResponseError","AuthLogService","LocalAuthDisablingIdpsQuery","ConfigurationQuery","riskHandled","sessionToken","ResponseOk","intervalToSeconds","SetMfaGraceUntilCommand","ImplementationException"],"mappings":";;;;;;;;;;;;;;;;;;;;AAaA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,YACA,mBACA,iBACA,oBACA,mBACA,YAChB;AARgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,kBAAA;AACA,SAAA,qBAAA;AACA,SAAA,oBAAA;AACA,SAAA,aAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,WACA,OACA,UACA,YACA,SACA,aACA,oBACA,YACA,QACA,YAC0B;AAC1B,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMA,wBAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAACA,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAKF,UAAM,gBAAgB,MAAM,UAAU,aAAa,MAAM,IAAIC,4BAAAA,4BAA4B,OAAO,EAAE,CAAC;AACnG,QAAI,cAAc,SAAS,GAAG;AAC7B,aAAO,IAAIF,SAAAA,cAAc,gBAAgB,iBAAiB,cAAc,KAAK,MAAM,CAAC,IAAI,WAAW;AAAA,IACpG;AAEA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAIA,SAAAA,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIA,SAAAA,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAIA,SAAAA,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAKA,QAAI,OAAO,+BAA+B,OAAO,sBAAsB,MAAM;AAC5E,aAAO,IAAIA,SAAAA,cAAc,sBAAsB,wCAAwC,WAAW;AAAA,IACnG;AAEA,QAAI,iBAAiB;AAIrB,QAAI,0BAA0B;AAC9B,UAAM,gBAAgB,QAAQ,OAAO,cAAc,OAAO,gBAAgB;AAC1E,QAAI,eAAe;AAElB,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,WAAW,UAAU,WAAW,QAAQ,OAAO,GAAG;AACjE,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AACN,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAAA,IACD,WAAW,OAAO,mBAAmB;AAEpC,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAC7E,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AAQN,cAAM,iBAAiB,MAAM,UAAU,aAAa,MAAM,IAAIG,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AACrG,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,cAAc;AACtF,eAAO,IAAIH,SAAAA,cAAc,gBAAgB,yCAAyC;AAAA,UACjF,cAAc,SAAS;AAAA,UACvB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD,OAAO;AAIN,YAAM,cAAc,MAAM,KAAK,qBAAqB,WAAW,QAAQ,SAAS,WAAW;AAC3F,UAAI,gBAAgB,MAAM;AACzB,YAAI,WAAW,aAAa;AAC3B,iBAAO;AAAA,QACR;AAGA,cAAMI,eAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,UACjE;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,yBAAyB;AAAA,UACzB;AAAA,QAAA,CACA;AACD,YAAIA,iBAAgB,QAAQ,WAAWA,cAAa;AACnD,iBAAOA;AAAAA,QACR;AACA,cAAMC,gBAAe,MAAM,KAAK,cAAc;AAAA,UAC7C;AAAA,UACA,OAAO;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,QAAA;AAED,eAAO,IAAIC,SAAAA,WAAW;AAAA,UACrB;AAAA,UACA,OAAOD;AAAAA,UACP,aAAa,YAAY;AAAA,UACzB,sBAAsBD,cAAa,wBAAwB;AAAA,UAC3D,MAAMA,cAAa;AAAA,UACnB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAEA,UAAM,cAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACA;AACD,QAAI,gBAAgB,QAAQ,WAAW,aAAa;AACnD,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAE5I,WAAO,IAAIE,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,sBAAsB,aAAa,wBAAwB;AAAA,MAC3D,MAAM,aAAa;AAAA,MACnB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAc,gBACb,WACA,QACA,MAQ6B;AAC7B,UAAM,EAAE,QAAQ,YAAY,aAAa,SAAS,yBAAyB,gBAAgB;AAC3F,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,CAAC,UAAU,CAAC,QAAQ,SAAS;AAChC,aAAO;AAAA,IACR;AAEA,UAAM,aAAa,MAAM,KAAK,kBAAkB,QAAQ,WAAW,OAAO,IAAI;AAAA,MAC7E,YAAY,cAAc;AAAA,MAC1B,mBAAmB,KAAK,kBAAkB,YAAY,aAAa,SAAS;AAAA,MAC5E,IAAI,aAAa,MAAM;AAAA,IAAA,GACrB,MAAM;AAET,QAAI,WAAW,WAAW,SAAS;AAClC,aAAO,EAAE,sBAAsB,MAAA;AAAA,IAChC;AAEA,UAAM,WAAW,EAAE,OAAO,WAAW,OAAO,SAAS,WAAW,QAAA;AAEhE,QAAI,WAAW,WAAW,YAAY,CAAC,yBAAyB;AAO/D,UAAI,SAAS;AAKZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAK7E,iBAAO,IAAIN,SAAAA,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,gBAAgB;AAAA,YAChB,sBAAsB;AAAA,YACtB,MAAM;AAAA,YACN,GAAG;AAAA,UAAA,CACH;AAAA,QACF;AAAA,MAED,OAAO;AAGN,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,MAAM;AAC9E,eAAO,IAAIA,SAAAA,cAAc,gBAAgB,wDAAwD;AAAA,UAChG,cAAc,SAAS;AAAA,UACvB,gBAAgB;AAAA,UAChB,sBAAsB;AAAA,UACtB,MAAM;AAAA,UACN,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAKA,UAAM,KAAK,sBAAsB,WAAW,QAAQ,cAAc,MAAM,aAAa,MAAM,IAAI;AAC/F,WAAO,EAAE,sBAAsB,MAAM,MAAM,SAAA;AAAA,EAC5C;AAAA,EAEA,MAAc,sBAAsB,WAA4B,QAAmB,YAA2B,IAAkC;AAC/I,QAAI,CAAC,OAAO,OAAO;AAElB;AAAA,IACD;AACA,QAAI;AACH,YAAM,KAAK,WAAW,sBAAsB,WAAW;AAAA,QACtD,OAAO,OAAO;AAAA,QACd;AAAA,QACA,WAAW;AAAA,MAAA,GACT,EAAE,WAAW,MAAM,SAAS,IAAI;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,qBACb,WACA,QACA,SACA,aAUC;AACD,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,WAAW,OAAO,aAAa,OAAO,KAAK;AAC3G,QAAI,CAAC,OAAO,aAAa;AACxB,aAAO;AAAA,IACR;AAKA,QAAI;AACJ,QAAI,OAAO,kBAAkB,MAAM;AAClC,qBAAeO,SAAAA,kBAAkB,OAAO,aAAa;AAAA,IACtD,OAAO;AACN,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAIJ,mBAAAA,mBAAmB,UAAU,SAAS,CAAC;AAC7F,qBAAeI,SAAAA,kBAAkB,OAAO,MAAM,gBAAgB;AAAA,IAC/D;AAOA,QAAI,OAAO,oBAAoB,MAAM;AACpC,UAAI,OAAO,aAAa;AAEvB,eAAO;AAAA,MACR;AAAA,IAED,WAAW,eAAe,GAAG;AAE5B,YAAM,UAAU,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,OAAO,IAAI,YAAY,CAAC;AACvF,aAAO;AAAA,IACR;AAGA,QAAI,WAAW,OAAO,oBAAoB;AAEzC,UAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,OAAO,GAAG;AAC7D,eAAO,IAAIR,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,WAAW,MAAM,KAAK,WAAW,WAAW,WAAW,MAAM;AACnE,UAAI,CAAC,UAAU;AAKd,eAAO,IAAIA,SAAAA,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,WAAW,OAAO,EAAE;AAC9E,aAAO,EAAE,YAAA;AAAA,IACV;AAGA,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,WAAW,QAAQ,WAAW;AAC3E,UAAM,gBAA+B,EAAE,QAAQ,IAAI,KAAK,WAAW,IAAI,OAAA;AACvE,WAAO,IAAIA,SAAAA,cAAc,2BAA2B,8BAA8B;AAAA,MACjF,uBAAuB;AAAA,MACvB;AAAA,MACA,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACA,aACA,oBACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAMD,wBAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAIC,SAAAA,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAID,SAAAA,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAIQ,WAAAA,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAIT,SAAAA,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAC5I,WAAO,IAAIK,SAAAA,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;;"}

package/dist/development/src/model/service/SignInManager.js CHANGED Viewed

@@ -4,10 +4,12 @@ import "../type/ApiKey.js";
 import { ConfigurationQuery } from "../queries/configuration/ConfigurationQuery.js";
 import { ImplementationException } from "../../exceptions.js";
 import { PersonQuery } from "../queries/person/PersonQuery.js";
+import { LocalAuthDisablingIdpsQuery } from "../queries/idp/LocalAuthDisablingIdpsQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 import { ResponseError, ResponseOk } from "../utils/Response.js";
 import { AuthLogService } from "./AuthLogService.js";
@@ -40,6 +42,10 @@ class SignInManager {
         personId: person.id
       })
     };
+    const exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id));
+    if (exclusiveIdps.length > 0) {
+      return new ResponseError("IDP_REQUIRED", `Sign in using ${exclusiveIdps.join(" or ")}`, authLogData);
+    }
     if (!person.password_hash) {
       return new ResponseError("NO_PASSWORD_SET", `No password set`, authLogData);
     }
@@ -228,7 +234,6 @@ class SignInManager {
     if (!policy.mfaRequired) {
       return null;
     }
-    const now = this.providers.now();
     let graceSeconds;
     if (policy.graceDuration !== null) {
       graceSeconds = intervalToSeconds(policy.graceDuration);
@@ -237,12 +242,11 @@ class SignInManager {
       graceSeconds = intervalToSeconds(config.login.mfaGraceDuration);
     }
     if (person.mfa_grace_until !== null) {
-      if (person.mfa_grace_until.getTime() > now.getTime()) {
+      if (person.is_in_grace) {
         return null;
       }
     } else if (graceSeconds > 0) {
-      const graceUntil = new Date(now.getTime() + graceSeconds * 1e3);
-      await dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceUntil));
+      await dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceSeconds));
       return null;
     }
     if (otpCode && person.otp_pending_secret) {