@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/development/src/model/service/SignInManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, MfaEnrollment, SignInErrorCode } from '../../schema/index.js'\nimport { ApiKeyManager, AuthPolicyResolver, BackupCodeManager, EmailOtpManager, LoginRiskAnalyzer, OtpManager } from '../service/index.js'\nimport { ConfigurationQuery, PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries/index.js'\nimport { Config } from '../type/Config.js'\nimport { Providers } from '../providers.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ApiKeyRequestInfo, SetMfaGraceUntilCommand } from '../commands/index.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly emailOtpManager: EmailOtpManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t\tprivate readonly loginRiskAnalyzer: LoginRiskAnalyzer,\n\t\tprivate readonly userMailer: UserMailer,\n\t) {}\n\n\tasync signIn(\n\t\tdbContext: DatabaseContext,\n\t\temail: string,\n\t\tpassword: string,\n\t\texpiration?: number,\n\t\totpCode?: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t\tbackupCode?: string,\n\t\tconfig?: Config,\n\t\tgeoCountry?: string,\n\t): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\t// Block sign-in for accounts that were created while email verification\n\t\t// was required but never proved ownership. Accounts predating the\n\t\t// requirement carry email_verification_required = false and pass through.\n\t\tif (person.email_verification_required && person.email_verified_at === null) {\n\t\t\treturn new ResponseError('EMAIL_NOT_VERIFIED', `E-mail address has not been verified`, authLogData)\n\t\t}\n\n\t\tlet usedBackupCode = false\n\t\t// Whether a second factor was actively proven in THIS request. Anomaly\n\t\t// step-up (A03) reuses this: a login that already cleared a second factor\n\t\t// is not asked to step up again.\n\t\tlet mfaSatisfiedThisRequest = false\n\t\tconst hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at)\n\t\tif (hasActiveTotp) {\n\t\t\t// Active TOTP takes precedence (A07 path, unchanged).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.otpManager.verifyOtp(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\t\t} else if (person.email_otp_enabled) {\n\t\t\t// No active TOTP, but email OTP is enabled (A05).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\t// Dispatch a fresh code and ask the client to retry with otpToken. Reuses\n\t\t\t\t// the existing OTP_REQUIRED contract so clients that already handle it work.\n\t\t\t\t// The send is rate-limited per person; when throttled nothing is emailed\n\t\t\t\t// (emailOtpSent: false) but a previously emailed code stays valid.\n\t\t\t\t// Independent fetch (not the passed-in `config`): the email-OTP send is\n\t\t\t\t// rate-limited by the live config and this branch never reaches the\n\t\t\t\t// anomaly analyzer, so query shape stays as before A03.\n\t\t\t\tconst emailOtpConfig = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, emailOtpConfig)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t} else {\n\t\t\t// No active factor at all (A06). Enforce MFA if a matching auth_policy\n\t\t\t// requires it. With no policy rows configured this resolves to\n\t\t\t// mfaRequired=false and sign-in proceeds exactly as before.\n\t\t\tconst enforcement = await this.enforceMfaEnrollment(dbContext, person, otpCode, authLogData)\n\t\t\tif (enforcement !== null) {\n\t\t\t\tif ('error' in enforcement) {\n\t\t\t\t\treturn enforcement\n\t\t\t\t}\n\t\t\t\t// Enrollment completed in this request (pending TOTP promoted to active),\n\t\t\t\t// so MFA is definitively satisfied — anomaly step-up cannot apply.\n\t\t\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\t\t\tconfig,\n\t\t\t\t\tgeoCountry,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\totpCode,\n\t\t\t\t\tmfaSatisfiedThisRequest: true,\n\t\t\t\t\tauthLogData,\n\t\t\t\t})\n\t\t\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\t\t\treturn riskHandled\n\t\t\t\t}\n\t\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(\n\t\t\t\t\tdbContext,\n\t\t\t\t\tperson.identity_id,\n\t\t\t\t\texpiration,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\ttrustForwardedInfo,\n\t\t\t\t)\n\t\t\t\treturn new ResponseOk({\n\t\t\t\t\tperson,\n\t\t\t\t\ttoken: sessionToken,\n\t\t\t\t\tbackupCodes: enforcement.backupCodes,\n\t\t\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected || undefined,\n\t\t\t\t\trisk: riskHandled?.risk,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\tconfig,\n\t\t\tgeoCountry,\n\t\t\trequestInfo,\n\t\t\totpCode,\n\t\t\tmfaSatisfiedThisRequest,\n\t\t\tauthLogData,\n\t\t})\n\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\treturn riskHandled\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\tusedBackupCode,\n\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected || undefined,\n\t\t\trisk: riskHandled?.risk,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\t/**\n\t * A03 — evaluate the sign-in risk score and act per policy. Returns:\n\t * - `null` when anomaly detection is off or no `config` was supplied (the\n\t *   default): no DB work, sign-in proceeds unchanged.\n\t * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email\n\t *   was sent (best-effort) but the session may still be issued.\n\t * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was\n\t *   supplied — reuses the email-OTP step-up channel (dispatches a code).\n\t * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but\n\t *   did not verify. A valid code consumes the token and the session is issued.\n\t * - `{ unusualLoginDetected: false }` when the score was below every threshold.\n\t *\n\t * The audit entries (`unusual_login_detected`, `step_up_required`) are emitted\n\t * by the resolver from the response metadata, matching the project convention.\n\t */\n\tprivate async applyRiskPolicy(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\targs: {\n\t\t\tconfig?: Config\n\t\t\tgeoCountry?: string\n\t\t\trequestInfo?: ApiKeyRequestInfo\n\t\t\totpCode?: string\n\t\t\tmfaSatisfiedThisRequest: boolean\n\t\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag }\n\t\t},\n\t): Promise<RiskPolicyOutcome> {\n\t\tconst { config, geoCountry, requestInfo, otpCode, mfaSatisfiedThisRequest, authLogData } = args\n\t\tconst policy = config?.login.anomalyDetection\n\t\tif (!config || !policy?.enabled) {\n\t\t\treturn null\n\t\t}\n\n\t\tconst assessment = await this.loginRiskAnalyzer.analyze(dbContext, person.id, {\n\t\t\tgeoCountry: geoCountry ?? null,\n\t\t\tdeviceFingerprint: this.loginRiskAnalyzer.fingerprint(requestInfo?.userAgent),\n\t\t\tip: requestInfo?.ip ?? null,\n\t\t}, policy)\n\n\t\tif (assessment.action === 'allow') {\n\t\t\treturn { unusualLoginDetected: false }\n\t\t}\n\n\t\tconst riskMeta = { score: assessment.score, reasons: assessment.reasons }\n\n\t\tif (assessment.action === 'stepUp' && !mfaSatisfiedThisRequest) {\n\t\t\t// Reuse the existing email-OTP step-up channel. This is independent of\n\t\t\t// `person.email_otp_enabled`, which gates email OTP only as the *primary*\n\t\t\t// second factor (A05); the step-up challenge stands on its own, so a person\n\t\t\t// with no standing MFA can still complete it. Without consuming the code\n\t\t\t// here, such a person would never satisfy the step-up and would loop on\n\t\t\t// OTP_REQUIRED forever (the score is unchanged on every retry).\n\t\t\tif (otpCode) {\n\t\t\t\t// Retry leg: the client resent the emailed code as otpToken. Mirror the\n\t\t\t\t// A05 contract — an invalid code is rejected (not re-sent); the per-code\n\t\t\t\t// 3-attempt cap still applies, and a fresh code is issued only when the\n\t\t\t\t// client retries without a code.\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\t// A failed *forced* second factor is itself an anomaly signal — carry the\n\t\t\t\t\t// step-up/risk metadata so the resolver still emits unusual_login_detected\n\t\t\t\t\t// + step_up_required with the score/reasons, rather than logging it as an\n\t\t\t\t\t// ordinary mistyped-OTP login indistinguishable from a normal 2FA typo.\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t\t...authLogData,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\t// Step-up satisfied this request — fall through to notify + allow below.\n\t\t\t} else {\n\t\t\t\t// First leg: dispatch a code and ask the client to retry with otpToken.\n\t\t\t\t// Rate-limited per person; a previously emailed code stays valid when throttled.\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, config)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', 'Additional verification is required for this sign-in', {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\t// action === 'email', or step-up satisfied (already this request, or just now\n\t\t// via the emailed code): notify the person of the unusual sign-in. A failed\n\t\t// email must never block sign-in.\n\t\tawait this.sendUnusualLoginEmail(dbContext, person, geoCountry ?? null, requestInfo?.ip ?? null)\n\t\treturn { unusualLoginDetected: true, risk: riskMeta }\n\t}\n\n\tprivate async sendUnusualLoginEmail(dbContext: DatabaseContext, person: PersonRow, geoCountry: string | null, ip: string | null): Promise<void> {\n\t\tif (!person.email) {\n\t\t\t// No address to notify (e.g. an IDP-only person) — nothing to send.\n\t\t\treturn\n\t\t}\n\t\ttry {\n\t\t\tawait this.userMailer.sendUnusualLoginEmail(dbContext, {\n\t\t\t\temail: person.email,\n\t\t\t\tgeoCountry,\n\t\t\t\tipAddress: ip,\n\t\t\t}, { projectId: null, variant: '' })\n\t\t} catch {\n\t\t\t// ignore — informational only\n\t\t}\n\t}\n\n\t/**\n\t * A06 enforcement for the no-active-factor case. Returns:\n\t * - `null` when MFA is not required, or grace currently allows sign-in\n\t *   (caller proceeds to issue a session as normal). With zero auth_policy\n\t *   rows this is always the outcome — no behavior change.\n\t * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to\n\t *   enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.\n\t * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP\n\t *   promoted to active); caller issues the session.\n\t */\n\tprivate async enforceMfaEnrollment(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\totpCode: string | undefined,\n\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag },\n\t): Promise<\n\t\t| null\n\t\t| ResponseError<SignInErrorCode, {\n\t\t\temailOtpSent?: boolean\n\t\t\tmfaEnrollmentRequired?: boolean\n\t\t\tmfaEnrollment?: MfaEnrollment\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}>\n\t\t| { backupCodes: string[] }\n\t> {\n\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(dbContext, person.identity_id, person.roles)\n\t\tif (!policy.mfaRequired) {\n\t\t\treturn null\n\t\t}\n\n\t\tconst now = this.providers.now()\n\n\t\t// Resolve the effective grace duration (seconds). A per-policy override\n\t\t// wins; otherwise we fall back to the global config default. Only fetch the\n\t\t// config when the override is absent, to keep query shapes minimal.\n\t\tlet graceSeconds: number\n\t\tif (policy.graceDuration !== null) {\n\t\t\tgraceSeconds = intervalToSeconds(policy.graceDuration)\n\t\t} else {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\tgraceSeconds = intervalToSeconds(config.login.mfaGraceDuration)\n\t\t}\n\n\t\t// Grace handling. Default grace duration is 0 (immediate enforcement), so\n\t\t// by default neither branch below opens a window.\n\t\tif (person.mfa_grace_until !== null) {\n\t\t\tif (person.mfa_grace_until.getTime() > now.getTime()) {\n\t\t\t\t// Still inside an open grace window — allow sign-in.\n\t\t\t\treturn null\n\t\t\t}\n\t\t\t// Grace expired → fall through to enforcement.\n\t\t} else if (graceSeconds > 0) {\n\t\t\t// Open the grace window now and allow this sign-in.\n\t\t\tconst graceUntil = new Date(now.getTime() + graceSeconds * 1000)\n\t\t\tawait dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceUntil))\n\t\t\treturn null\n\t\t}\n\n\t\t// Enforce.\n\t\tif (otpCode && person.otp_pending_secret) {\n\t\t\t// Enrollment completion: verify against the pending secret, then promote.\n\t\t\tif (!await this.otpManager.verifyPendingOtp(person, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst promoted = await this.otpManager.confirmOtp(dbContext, person)\n\t\t\tif (!promoted) {\n\t\t\t\t// Lost a concurrent enrollment-completion race: the pending secret was\n\t\t\t\t// already promoted by the other request (which issued the backup codes).\n\t\t\t\t// Don't regenerate here — that would invalidate the codes already\n\t\t\t\t// returned. TOTP is now active, so a retry signs in via the normal path.\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst backupCodes = await this.backupCodeManager.generate(dbContext, person.id)\n\t\t\treturn { backupCodes }\n\t\t}\n\n\t\t// Provision a fresh pending TOTP secret and ask the client to enroll.\n\t\tconst otp = await this.otpManager.prepareOtp(dbContext, person, 'Contember')\n\t\tconst mfaEnrollment: MfaEnrollment = { otpUri: otp.uri, otpSecret: otp.secret }\n\t\treturn new ResponseError('MFA_ENROLLMENT_REQUIRED', 'MFA enrollment is required', {\n\t\t\tmfaEnrollmentRequired: true,\n\t\t\tmfaEnrollment,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\n/** A03: greppable payload describing why a sign-in scored as unusual. */\nexport interface RiskMeta {\n\treadonly score: number\n\treadonly reasons: readonly string[]\n}\n\n/**\n * Result of {@link SignInManager.applyRiskPolicy}: `null` = feature off / no\n * config; a metadata object when the session may still be issued; a\n * `ResponseError` when step-up blocks the session.\n */\ntype RiskPolicyOutcome =\n\t| null\n\t| { unusualLoginDetected: boolean; risk?: RiskMeta }\n\t| ResponseError<SignInErrorCode, {\n\t\temailOtpSent?: boolean\n\t\tstepUpRequired?: boolean\n\t\tunusualLoginDetected?: boolean\n\t\trisk?: RiskMeta\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t/** True when MFA was satisfied by consuming a backup code (instead of a TOTP token). */\n\treadonly usedBackupCode?: boolean\n\t/** Set when sign-in completed an MFA enrollment (A06): the freshly issued backup codes, shown once. */\n\treadonly backupCodes?: string[]\n\t/** A03: true when this sign-in scored as unusual and an UNUSUAL_LOGIN email was sent. */\n\treadonly unusualLoginDetected?: boolean\n\t/** A03: the risk score + reasons, recorded in the `unusual_login_detected` audit `event_data`. */\n\treadonly risk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t/** Set on an OTP_REQUIRED error when an email-OTP code was just dispatched (A05). */\n\temailOtpSent?: boolean\n\t/** Set on a MFA_ENROLLMENT_REQUIRED error (A06): triggers the `mfa_enrollment_required` audit. */\n\tmfaEnrollmentRequired?: boolean\n\t/** Set on a MFA_ENROLLMENT_REQUIRED error (A06): the pending secret the client must enroll. */\n\tmfaEnrollment?: MfaEnrollment\n\t/** Set on an OTP_REQUIRED error raised by A03 anomaly step-up: triggers the `step_up_required` audit. */\n\tstepUpRequired?: boolean\n\t/** A03: true when the sign-in scored as unusual (triggers the `unusual_login_detected` audit). */\n\tunusualLoginDetected?: boolean\n\t/** A03: the risk score + reasons, recorded in the audit `event_data`. */\n\trisk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":["riskHandled","sessionToken"],"mappings":";;;;;;;;;;;;;;;;AAaA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,YACA,mBACA,iBACA,oBACA,mBACA,YAChB;AARgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,kBAAA;AACA,SAAA,qBAAA;AACA,SAAA,oBAAA;AACA,SAAA,aAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,WACA,OACA,UACA,YACA,SACA,aACA,oBACA,YACA,QACA,YAC0B;AAC1B,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAI,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAEF,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAI,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAI,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAKA,QAAI,OAAO,+BAA+B,OAAO,sBAAsB,MAAM;AAC5E,aAAO,IAAI,cAAc,sBAAsB,wCAAwC,WAAW;AAAA,IACnG;AAEA,QAAI,iBAAiB;AAIrB,QAAI,0BAA0B;AAC9B,UAAM,gBAAgB,QAAQ,OAAO,cAAc,OAAO,gBAAgB;AAC1E,QAAI,eAAe;AAElB,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,WAAW,UAAU,WAAW,QAAQ,OAAO,GAAG;AACjE,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AACN,eAAO,IAAI,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAAA,IACD,WAAW,OAAO,mBAAmB;AAEpC,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAC7E,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AAQN,cAAM,iBAAiB,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AACrG,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,cAAc;AACtF,eAAO,IAAI,cAAc,gBAAgB,yCAAyC;AAAA,UACjF,cAAc,SAAS;AAAA,UACvB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD,OAAO;AAIN,YAAM,cAAc,MAAM,KAAK,qBAAqB,WAAW,QAAQ,SAAS,WAAW;AAC3F,UAAI,gBAAgB,MAAM;AACzB,YAAI,WAAW,aAAa;AAC3B,iBAAO;AAAA,QACR;AAGA,cAAMA,eAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,UACjE;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,yBAAyB;AAAA,UACzB;AAAA,QAAA,CACA;AACD,YAAIA,iBAAgB,QAAQ,WAAWA,cAAa;AACnD,iBAAOA;AAAAA,QACR;AACA,cAAMC,gBAAe,MAAM,KAAK,cAAc;AAAA,UAC7C;AAAA,UACA,OAAO;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,QAAA;AAED,eAAO,IAAI,WAAW;AAAA,UACrB;AAAA,UACA,OAAOA;AAAAA,UACP,aAAa,YAAY;AAAA,UACzB,sBAAsBD,cAAa,wBAAwB;AAAA,UAC3D,MAAMA,cAAa;AAAA,UACnB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAEA,UAAM,cAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACA;AACD,QAAI,gBAAgB,QAAQ,WAAW,aAAa;AACnD,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAE5I,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,sBAAsB,aAAa,wBAAwB;AAAA,MAC3D,MAAM,aAAa;AAAA,MACnB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAc,gBACb,WACA,QACA,MAQ6B;AAC7B,UAAM,EAAE,QAAQ,YAAY,aAAa,SAAS,yBAAyB,gBAAgB;AAC3F,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,CAAC,UAAU,CAAC,QAAQ,SAAS;AAChC,aAAO;AAAA,IACR;AAEA,UAAM,aAAa,MAAM,KAAK,kBAAkB,QAAQ,WAAW,OAAO,IAAI;AAAA,MAC7E,YAAY,cAAc;AAAA,MAC1B,mBAAmB,KAAK,kBAAkB,YAAY,aAAa,SAAS;AAAA,MAC5E,IAAI,aAAa,MAAM;AAAA,IAAA,GACrB,MAAM;AAET,QAAI,WAAW,WAAW,SAAS;AAClC,aAAO,EAAE,sBAAsB,MAAA;AAAA,IAChC;AAEA,UAAM,WAAW,EAAE,OAAO,WAAW,OAAO,SAAS,WAAW,QAAA;AAEhE,QAAI,WAAW,WAAW,YAAY,CAAC,yBAAyB;AAO/D,UAAI,SAAS;AAKZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAK7E,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,gBAAgB;AAAA,YAChB,sBAAsB;AAAA,YACtB,MAAM;AAAA,YACN,GAAG;AAAA,UAAA,CACH;AAAA,QACF;AAAA,MAED,OAAO;AAGN,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,MAAM;AAC9E,eAAO,IAAI,cAAc,gBAAgB,wDAAwD;AAAA,UAChG,cAAc,SAAS;AAAA,UACvB,gBAAgB;AAAA,UAChB,sBAAsB;AAAA,UACtB,MAAM;AAAA,UACN,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAKA,UAAM,KAAK,sBAAsB,WAAW,QAAQ,cAAc,MAAM,aAAa,MAAM,IAAI;AAC/F,WAAO,EAAE,sBAAsB,MAAM,MAAM,SAAA;AAAA,EAC5C;AAAA,EAEA,MAAc,sBAAsB,WAA4B,QAAmB,YAA2B,IAAkC;AAC/I,QAAI,CAAC,OAAO,OAAO;AAElB;AAAA,IACD;AACA,QAAI;AACH,YAAM,KAAK,WAAW,sBAAsB,WAAW;AAAA,QACtD,OAAO,OAAO;AAAA,QACd;AAAA,QACA,WAAW;AAAA,MAAA,GACT,EAAE,WAAW,MAAM,SAAS,IAAI;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,qBACb,WACA,QACA,SACA,aAUC;AACD,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,WAAW,OAAO,aAAa,OAAO,KAAK;AAC3G,QAAI,CAAC,OAAO,aAAa;AACxB,aAAO;AAAA,IACR;AAEA,UAAM,MAAM,KAAK,UAAU,IAAA;AAK3B,QAAI;AACJ,QAAI,OAAO,kBAAkB,MAAM;AAClC,qBAAe,kBAAkB,OAAO,aAAa;AAAA,IACtD,OAAO;AACN,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AAC7F,qBAAe,kBAAkB,OAAO,MAAM,gBAAgB;AAAA,IAC/D;AAIA,QAAI,OAAO,oBAAoB,MAAM;AACpC,UAAI,OAAO,gBAAgB,QAAA,IAAY,IAAI,WAAW;AAErD,eAAO;AAAA,MACR;AAAA,IAED,WAAW,eAAe,GAAG;AAE5B,YAAM,aAAa,IAAI,KAAK,IAAI,QAAA,IAAY,eAAe,GAAI;AAC/D,YAAM,UAAU,WAAW,QAAQ,IAAI,wBAAwB,OAAO,IAAI,UAAU,CAAC;AACrF,aAAO;AAAA,IACR;AAGA,QAAI,WAAW,OAAO,oBAAoB;AAEzC,UAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,OAAO,GAAG;AAC7D,eAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,WAAW,MAAM,KAAK,WAAW,WAAW,WAAW,MAAM;AACnE,UAAI,CAAC,UAAU;AAKd,eAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,WAAW,OAAO,EAAE;AAC9E,aAAO,EAAE,YAAA;AAAA,IACV;AAGA,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,WAAW,QAAQ,WAAW;AAC3E,UAAM,gBAA+B,EAAE,QAAQ,IAAI,KAAK,WAAW,IAAI,OAAA;AACvE,WAAO,IAAI,cAAc,2BAA2B,8BAA8B;AAAA,MACjF,uBAAuB;AAAA,MACvB;AAAA,MACA,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACA,aACA,oBACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAI,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAI,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAI,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAC5I,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;"}
+{"version":3,"file":"SignInManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignInManager.ts"],"sourcesContent":["import { CreateSessionTokenErrorCode, MfaEnrollment, SignInErrorCode } from '../../schema/index.js'\nimport { ApiKeyManager, AuthPolicyResolver, BackupCodeManager, EmailOtpManager, LoginRiskAnalyzer, OtpManager } from '../service/index.js'\nimport { ConfigurationQuery, LocalAuthDisablingIdpsQuery, PersonQuery, PersonRow, PersonUniqueIdentifier } from '../queries/index.js'\nimport { Config } from '../type/Config.js'\nimport { Providers } from '../providers.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { ImplementationException } from '../../exceptions.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { UserMailer } from '../mailing/index.js'\nimport { ApiKeyRequestInfo, SetMfaGraceUntilCommand } from '../commands/index.js'\nimport { intervalToSeconds } from '../utils/interval.js'\n\nclass SignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly providers: Providers,\n\t\tprivate readonly otpManager: OtpManager,\n\t\tprivate readonly backupCodeManager: BackupCodeManager,\n\t\tprivate readonly emailOtpManager: EmailOtpManager,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t\tprivate readonly loginRiskAnalyzer: LoginRiskAnalyzer,\n\t\tprivate readonly userMailer: UserMailer,\n\t) {}\n\n\tasync signIn(\n\t\tdbContext: DatabaseContext,\n\t\temail: string,\n\t\tpassword: string,\n\t\texpiration?: number,\n\t\totpCode?: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t\tbackupCode?: string,\n\t\tconfig?: Config,\n\t\tgeoCountry?: string,\n\t): Promise<SignInResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byEmail(email))\n\n\t\tif (person === null) {\n\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${email} not found`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonInput: email,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tconst authLogData = {\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonInput: email,\n\t\t\t\tpersonId: person.id,\n\t\t\t}),\n\t\t}\n\t\t// Refused before the password is even looked at: for a person federated\n\t\t// through a provider with `disableLocalAuthentication`, a password is not a\n\t\t// credential this tenant accepts, however it got set.\n\t\tconst exclusiveIdps = await dbContext.queryHandler.fetch(new LocalAuthDisablingIdpsQuery(person.id))\n\t\tif (exclusiveIdps.length > 0) {\n\t\t\treturn new ResponseError('IDP_REQUIRED', `Sign in using ${exclusiveIdps.join(' or ')}`, authLogData)\n\t\t}\n\n\t\tif (!person.password_hash) {\n\t\t\treturn new ResponseError('NO_PASSWORD_SET', `No password set`, authLogData)\n\t\t}\n\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person is disabled`, authLogData)\n\t\t}\n\n\t\tconst passwordValid = await this.providers.bcryptCompare(password, person.password_hash)\n\n\t\tif (!passwordValid) {\n\t\t\treturn new ResponseError('INVALID_PASSWORD', `Password does not match`, authLogData)\n\t\t}\n\n\t\t// Block sign-in for accounts that were created while email verification\n\t\t// was required but never proved ownership. Accounts predating the\n\t\t// requirement carry email_verification_required = false and pass through.\n\t\tif (person.email_verification_required && person.email_verified_at === null) {\n\t\t\treturn new ResponseError('EMAIL_NOT_VERIFIED', `E-mail address has not been verified`, authLogData)\n\t\t}\n\n\t\tlet usedBackupCode = false\n\t\t// Whether a second factor was actively proven in THIS request. Anomaly\n\t\t// step-up (A03) reuses this: a login that already cleared a second factor\n\t\t// is not asked to step up again.\n\t\tlet mfaSatisfiedThisRequest = false\n\t\tconst hasActiveTotp = Boolean(person.otp_secret && person.otp_activated_at)\n\t\tif (hasActiveTotp) {\n\t\t\t// Active TOTP takes precedence (A07 path, unchanged).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.otpManager.verifyOtp(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, authLogData)\n\t\t\t}\n\t\t} else if (person.email_otp_enabled) {\n\t\t\t// No active TOTP, but email OTP is enabled (A05).\n\t\t\tif (otpCode) {\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else if (backupCode) {\n\t\t\t\tif (!await this.backupCodeManager.verifyAndConsume(dbContext, person, backupCode)) {\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t\t}\n\t\t\t\tusedBackupCode = true\n\t\t\t\tmfaSatisfiedThisRequest = true\n\t\t\t} else {\n\t\t\t\t// Dispatch a fresh code and ask the client to retry with otpToken. Reuses\n\t\t\t\t// the existing OTP_REQUIRED contract so clients that already handle it work.\n\t\t\t\t// The send is rate-limited per person; when throttled nothing is emailed\n\t\t\t\t// (emailOtpSent: false) but a previously emailed code stays valid.\n\t\t\t\t// Independent fetch (not the passed-in `config`): the email-OTP send is\n\t\t\t\t// rate-limited by the live config and this branch never reaches the\n\t\t\t\t// anomaly analyzer, so query shape stays as before A03.\n\t\t\t\tconst emailOtpConfig = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, emailOtpConfig)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', `2FA is enabled. OTP token is required`, {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t} else {\n\t\t\t// No active factor at all (A06). Enforce MFA if a matching auth_policy\n\t\t\t// requires it. With no policy rows configured this resolves to\n\t\t\t// mfaRequired=false and sign-in proceeds exactly as before.\n\t\t\tconst enforcement = await this.enforceMfaEnrollment(dbContext, person, otpCode, authLogData)\n\t\t\tif (enforcement !== null) {\n\t\t\t\tif ('error' in enforcement) {\n\t\t\t\t\treturn enforcement\n\t\t\t\t}\n\t\t\t\t// Enrollment completed in this request (pending TOTP promoted to active),\n\t\t\t\t// so MFA is definitively satisfied — anomaly step-up cannot apply.\n\t\t\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\t\t\tconfig,\n\t\t\t\t\tgeoCountry,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\totpCode,\n\t\t\t\t\tmfaSatisfiedThisRequest: true,\n\t\t\t\t\tauthLogData,\n\t\t\t\t})\n\t\t\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\t\t\treturn riskHandled\n\t\t\t\t}\n\t\t\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(\n\t\t\t\t\tdbContext,\n\t\t\t\t\tperson.identity_id,\n\t\t\t\t\texpiration,\n\t\t\t\t\trequestInfo,\n\t\t\t\t\ttrustForwardedInfo,\n\t\t\t\t)\n\t\t\t\treturn new ResponseOk({\n\t\t\t\t\tperson,\n\t\t\t\t\ttoken: sessionToken,\n\t\t\t\t\tbackupCodes: enforcement.backupCodes,\n\t\t\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected || undefined,\n\t\t\t\t\trisk: riskHandled?.risk,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\tconst riskHandled = await this.applyRiskPolicy(dbContext, person, {\n\t\t\tconfig,\n\t\t\tgeoCountry,\n\t\t\trequestInfo,\n\t\t\totpCode,\n\t\t\tmfaSatisfiedThisRequest,\n\t\t\tauthLogData,\n\t\t})\n\t\tif (riskHandled !== null && 'error' in riskHandled) {\n\t\t\treturn riskHandled\n\t\t}\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\tusedBackupCode,\n\t\t\tunusualLoginDetected: riskHandled?.unusualLoginDetected || undefined,\n\t\t\trisk: riskHandled?.risk,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\t/**\n\t * A03 — evaluate the sign-in risk score and act per policy. Returns:\n\t * - `null` when anomaly detection is off or no `config` was supplied (the\n\t *   default): no DB work, sign-in proceeds unchanged.\n\t * - `{ unusualLoginDetected: true }` when an informational UNUSUAL_LOGIN email\n\t *   was sent (best-effort) but the session may still be issued.\n\t * - a `ResponseError('OTP_REQUIRED')` when step-up is required and no code was\n\t *   supplied — reuses the email-OTP step-up channel (dispatches a code).\n\t * - a `ResponseError('INVALID_OTP_TOKEN')` when a step-up code was supplied but\n\t *   did not verify. A valid code consumes the token and the session is issued.\n\t * - `{ unusualLoginDetected: false }` when the score was below every threshold.\n\t *\n\t * The audit entries (`unusual_login_detected`, `step_up_required`) are emitted\n\t * by the resolver from the response metadata, matching the project convention.\n\t */\n\tprivate async applyRiskPolicy(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\targs: {\n\t\t\tconfig?: Config\n\t\t\tgeoCountry?: string\n\t\t\trequestInfo?: ApiKeyRequestInfo\n\t\t\totpCode?: string\n\t\t\tmfaSatisfiedThisRequest: boolean\n\t\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag }\n\t\t},\n\t): Promise<RiskPolicyOutcome> {\n\t\tconst { config, geoCountry, requestInfo, otpCode, mfaSatisfiedThisRequest, authLogData } = args\n\t\tconst policy = config?.login.anomalyDetection\n\t\tif (!config || !policy?.enabled) {\n\t\t\treturn null\n\t\t}\n\n\t\tconst assessment = await this.loginRiskAnalyzer.analyze(dbContext, person.id, {\n\t\t\tgeoCountry: geoCountry ?? null,\n\t\t\tdeviceFingerprint: this.loginRiskAnalyzer.fingerprint(requestInfo?.userAgent),\n\t\t\tip: requestInfo?.ip ?? null,\n\t\t}, policy)\n\n\t\tif (assessment.action === 'allow') {\n\t\t\treturn { unusualLoginDetected: false }\n\t\t}\n\n\t\tconst riskMeta = { score: assessment.score, reasons: assessment.reasons }\n\n\t\tif (assessment.action === 'stepUp' && !mfaSatisfiedThisRequest) {\n\t\t\t// Reuse the existing email-OTP step-up channel. This is independent of\n\t\t\t// `person.email_otp_enabled`, which gates email OTP only as the *primary*\n\t\t\t// second factor (A05); the step-up challenge stands on its own, so a person\n\t\t\t// with no standing MFA can still complete it. Without consuming the code\n\t\t\t// here, such a person would never satisfy the step-up and would loop on\n\t\t\t// OTP_REQUIRED forever (the score is unchanged on every retry).\n\t\t\tif (otpCode) {\n\t\t\t\t// Retry leg: the client resent the emailed code as otpToken. Mirror the\n\t\t\t\t// A05 contract — an invalid code is rejected (not re-sent); the per-code\n\t\t\t\t// 3-attempt cap still applies, and a fresh code is issued only when the\n\t\t\t\t// client retries without a code.\n\t\t\t\tif (!await this.emailOtpManager.verifyAndConsume(dbContext, person, otpCode)) {\n\t\t\t\t\t// A failed *forced* second factor is itself an anomaly signal — carry the\n\t\t\t\t\t// step-up/risk metadata so the resolver still emits unusual_login_detected\n\t\t\t\t\t// + step_up_required with the score/reasons, rather than logging it as an\n\t\t\t\t\t// ordinary mistyped-OTP login indistinguishable from a normal 2FA typo.\n\t\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', {\n\t\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t\t...authLogData,\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\t// Step-up satisfied this request — fall through to notify + allow below.\n\t\t\t} else {\n\t\t\t\t// First leg: dispatch a code and ask the client to retry with otpToken.\n\t\t\t\t// Rate-limited per person; a previously emailed code stays valid when throttled.\n\t\t\t\tconst decision = await this.emailOtpManager.sendCode(dbContext, person, config)\n\t\t\t\treturn new ResponseError('OTP_REQUIRED', 'Additional verification is required for this sign-in', {\n\t\t\t\t\temailOtpSent: decision.ok,\n\t\t\t\t\tstepUpRequired: true,\n\t\t\t\t\tunusualLoginDetected: true,\n\t\t\t\t\trisk: riskMeta,\n\t\t\t\t\t...authLogData,\n\t\t\t\t})\n\t\t\t}\n\t\t}\n\n\t\t// action === 'email', or step-up satisfied (already this request, or just now\n\t\t// via the emailed code): notify the person of the unusual sign-in. A failed\n\t\t// email must never block sign-in.\n\t\tawait this.sendUnusualLoginEmail(dbContext, person, geoCountry ?? null, requestInfo?.ip ?? null)\n\t\treturn { unusualLoginDetected: true, risk: riskMeta }\n\t}\n\n\tprivate async sendUnusualLoginEmail(dbContext: DatabaseContext, person: PersonRow, geoCountry: string | null, ip: string | null): Promise<void> {\n\t\tif (!person.email) {\n\t\t\t// No address to notify (e.g. an IDP-only person) — nothing to send.\n\t\t\treturn\n\t\t}\n\t\ttry {\n\t\t\tawait this.userMailer.sendUnusualLoginEmail(dbContext, {\n\t\t\t\temail: person.email,\n\t\t\t\tgeoCountry,\n\t\t\t\tipAddress: ip,\n\t\t\t}, { projectId: null, variant: '' })\n\t\t} catch {\n\t\t\t// ignore — informational only\n\t\t}\n\t}\n\n\t/**\n\t * A06 enforcement for the no-active-factor case. Returns:\n\t * - `null` when MFA is not required, or grace currently allows sign-in\n\t *   (caller proceeds to issue a session as normal). With zero auth_policy\n\t *   rows this is always the outcome — no behavior change.\n\t * - a `ResponseError` (MFA_ENROLLMENT_REQUIRED with the pending secret to\n\t *   enroll, or INVALID_OTP_TOKEN) when sign-in must be blocked.\n\t * - `{ ok: true, backupCodes }` when enrollment just completed (pending TOTP\n\t *   promoted to active); caller issues the session.\n\t */\n\tprivate async enforceMfaEnrollment(\n\t\tdbContext: DatabaseContext,\n\t\tperson: PersonRow,\n\t\totpCode: string | undefined,\n\t\tauthLogData: { [AuthLogService.Key]: AuthLogService.Bag },\n\t): Promise<\n\t\t| null\n\t\t| ResponseError<SignInErrorCode, {\n\t\t\temailOtpSent?: boolean\n\t\t\tmfaEnrollmentRequired?: boolean\n\t\t\tmfaEnrollment?: MfaEnrollment\n\t\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t\t}>\n\t\t| { backupCodes: string[] }\n\t> {\n\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(dbContext, person.identity_id, person.roles)\n\t\tif (!policy.mfaRequired) {\n\t\t\treturn null\n\t\t}\n\n\t\t// Resolve the effective grace duration (seconds). A per-policy override\n\t\t// wins; otherwise we fall back to the global config default. Only fetch the\n\t\t// config when the override is absent, to keep query shapes minimal.\n\t\tlet graceSeconds: number\n\t\tif (policy.graceDuration !== null) {\n\t\t\tgraceSeconds = intervalToSeconds(policy.graceDuration)\n\t\t} else {\n\t\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\t\t\tgraceSeconds = intervalToSeconds(config.login.mfaGraceDuration)\n\t\t}\n\n\t\t// Grace handling. Default grace duration is 0 (immediate enforcement), so\n\t\t// by default neither branch below opens a window. Whether we're still inside\n\t\t// an open window is decided on the DB clock (PersonRow.is_in_grace, evaluated\n\t\t// against now()); the null check below only distinguishes \"never opened\" from\n\t\t// \"opened (and possibly expired)\". See engine-tenant-api/CLAUDE.md.\n\t\tif (person.mfa_grace_until !== null) {\n\t\t\tif (person.is_in_grace) {\n\t\t\t\t// Still inside an open grace window — allow sign-in.\n\t\t\t\treturn null\n\t\t\t}\n\t\t\t// Grace expired → fall through to enforcement.\n\t\t} else if (graceSeconds > 0) {\n\t\t\t// Open the grace window (now() + graceSeconds on the DB clock) and allow this sign-in.\n\t\t\tawait dbContext.commandBus.execute(new SetMfaGraceUntilCommand(person.id, graceSeconds))\n\t\t\treturn null\n\t\t}\n\n\t\t// Enforce.\n\t\tif (otpCode && person.otp_pending_secret) {\n\t\t\t// Enrollment completion: verify against the pending secret, then promote.\n\t\t\tif (!await this.otpManager.verifyPendingOtp(person, otpCode)) {\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst promoted = await this.otpManager.confirmOtp(dbContext, person)\n\t\t\tif (!promoted) {\n\t\t\t\t// Lost a concurrent enrollment-completion race: the pending secret was\n\t\t\t\t// already promoted by the other request (which issued the backup codes).\n\t\t\t\t// Don't regenerate here — that would invalidate the codes already\n\t\t\t\t// returned. TOTP is now active, so a retry signs in via the normal path.\n\t\t\t\treturn new ResponseError('INVALID_OTP_TOKEN', 'OTP token validation has failed', authLogData)\n\t\t\t}\n\t\t\tconst backupCodes = await this.backupCodeManager.generate(dbContext, person.id)\n\t\t\treturn { backupCodes }\n\t\t}\n\n\t\t// Provision a fresh pending TOTP secret and ask the client to enroll.\n\t\tconst otp = await this.otpManager.prepareOtp(dbContext, person, 'Contember')\n\t\tconst mfaEnrollment: MfaEnrollment = { otpUri: otp.uri, otpSecret: otp.secret }\n\t\treturn new ResponseError('MFA_ENROLLMENT_REQUIRED', 'MFA enrollment is required', {\n\t\t\tmfaEnrollmentRequired: true,\n\t\t\tmfaEnrollment,\n\t\t\t...authLogData,\n\t\t})\n\t}\n\n\tasync createSessionToken(\n\t\tdbContext: DatabaseContext,\n\t\tpersonIdentifier: PersonUniqueIdentifier,\n\t\texpiration?: number,\n\t\tverifier?: (person: PersonRow) => Promise<void>,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<CreateSessionTokenResponse> {\n\t\tconst person = await dbContext.queryHandler.fetch(PersonQuery.byUniqueIdentifier(personIdentifier))\n\n\t\tif (person === null) {\n\t\t\tif (personIdentifier.type === 'email') {\n\t\t\t\treturn new ResponseError('UNKNOWN_EMAIL', `Person with email ${personIdentifier.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.email,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t} else if (personIdentifier.type === 'id') {\n\t\t\t\treturn new ResponseError('UNKNOWN_PERSON_ID', `Person with id ${personIdentifier.id} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tpersonInput: personIdentifier.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tthrow new ImplementationException()\n\t\t}\n\n\t\tconst inputValue = personIdentifier.type === 'email' ? personIdentifier.email : personIdentifier.id\n\t\tif (person.disabled_at !== null) {\n\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with id ${person.id} is disabled`, {\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: person.id,\n\t\t\t\t\tpersonInput: inputValue,\n\t\t\t\t}),\n\t\t\t})\n\t\t}\n\n\t\tawait verifier?.(person)\n\n\t\tconst sessionToken = await this.apiKeyManager.createSessionApiKey(dbContext, person.identity_id, expiration, requestInfo, trustForwardedInfo)\n\t\treturn new ResponseOk({\n\t\t\tperson,\n\t\t\ttoken: sessionToken,\n\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\tpersonId: person.id,\n\t\t\t\tpersonInput: inputValue,\n\t\t\t}),\n\t\t})\n\t}\n}\n\n/** A03: greppable payload describing why a sign-in scored as unusual. */\nexport interface RiskMeta {\n\treadonly score: number\n\treadonly reasons: readonly string[]\n}\n\n/**\n * Result of {@link SignInManager.applyRiskPolicy}: `null` = feature off / no\n * config; a metadata object when the session may still be issued; a\n * `ResponseError` when step-up blocks the session.\n */\ntype RiskPolicyOutcome =\n\t| null\n\t| { unusualLoginDetected: boolean; risk?: RiskMeta }\n\t| ResponseError<SignInErrorCode, {\n\t\temailOtpSent?: boolean\n\t\tstepUpRequired?: boolean\n\t\tunusualLoginDetected?: boolean\n\t\trisk?: RiskMeta\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n\nexport interface SignInResult {\n\treadonly person: PersonRow\n\treadonly token: string\n\t/** True when MFA was satisfied by consuming a backup code (instead of a TOTP token). */\n\treadonly usedBackupCode?: boolean\n\t/** Set when sign-in completed an MFA enrollment (A06): the freshly issued backup codes, shown once. */\n\treadonly backupCodes?: string[]\n\t/** A03: true when this sign-in scored as unusual and an UNUSUAL_LOGIN email was sent. */\n\treadonly unusualLoginDetected?: boolean\n\t/** A03: the risk score + reasons, recorded in the `unusual_login_detected` audit `event_data`. */\n\treadonly risk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}\n\nexport type SignInResponse = Response<SignInResult, SignInErrorCode, {\n\t/** Set on an OTP_REQUIRED error when an email-OTP code was just dispatched (A05). */\n\temailOtpSent?: boolean\n\t/** Set on a MFA_ENROLLMENT_REQUIRED error (A06): triggers the `mfa_enrollment_required` audit. */\n\tmfaEnrollmentRequired?: boolean\n\t/** Set on a MFA_ENROLLMENT_REQUIRED error (A06): the pending secret the client must enroll. */\n\tmfaEnrollment?: MfaEnrollment\n\t/** Set on an OTP_REQUIRED error raised by A03 anomaly step-up: triggers the `step_up_required` audit. */\n\tstepUpRequired?: boolean\n\t/** A03: true when the sign-in scored as unusual (triggers the `unusual_login_detected` audit). */\n\tunusualLoginDetected?: boolean\n\t/** A03: the risk score + reasons, recorded in the audit `event_data`. */\n\trisk?: RiskMeta\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\nexport type CreateSessionTokenResponse = Response<SignInResult, CreateSessionTokenErrorCode, {\n\t[AuthLogService.Key]: AuthLogService.Bag\n}>\n\nexport { SignInManager }\n"],"names":["riskHandled","sessionToken"],"mappings":";;;;;;;;;;;;;;;;;;AAaA,MAAM,cAAc;AAAA,EACnB,YACkB,eACA,WACA,YACA,mBACA,iBACA,oBACA,mBACA,YAChB;AARgB,SAAA,gBAAA;AACA,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,kBAAA;AACA,SAAA,qBAAA;AACA,SAAA,oBAAA;AACA,SAAA,aAAA;AAAA,EACf;AAAA,EAEH,MAAM,OACL,WACA,OACA,UACA,YACA,SACA,aACA,oBACA,YACA,QACA,YAC0B;AAC1B,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,QAAQ,KAAK,CAAC;AAE5E,QAAI,WAAW,MAAM;AACpB,aAAO,IAAI,cAAc,iBAAiB,qBAAqB,KAAK,cAAc;AAAA,QACjF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,cAAc;AAAA,MACnB,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,aAAa;AAAA,QACb,UAAU,OAAO;AAAA,MAAA,CACjB;AAAA,IAAA;AAKF,UAAM,gBAAgB,MAAM,UAAU,aAAa,MAAM,IAAI,4BAA4B,OAAO,EAAE,CAAC;AACnG,QAAI,cAAc,SAAS,GAAG;AAC7B,aAAO,IAAI,cAAc,gBAAgB,iBAAiB,cAAc,KAAK,MAAM,CAAC,IAAI,WAAW;AAAA,IACpG;AAEA,QAAI,CAAC,OAAO,eAAe;AAC1B,aAAO,IAAI,cAAc,mBAAmB,mBAAmB,WAAW;AAAA,IAC3E;AAEA,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,sBAAsB,WAAW;AAAA,IAC9E;AAEA,UAAM,gBAAgB,MAAM,KAAK,UAAU,cAAc,UAAU,OAAO,aAAa;AAEvF,QAAI,CAAC,eAAe;AACnB,aAAO,IAAI,cAAc,oBAAoB,2BAA2B,WAAW;AAAA,IACpF;AAKA,QAAI,OAAO,+BAA+B,OAAO,sBAAsB,MAAM;AAC5E,aAAO,IAAI,cAAc,sBAAsB,wCAAwC,WAAW;AAAA,IACnG;AAEA,QAAI,iBAAiB;AAIrB,QAAI,0BAA0B;AAC9B,UAAM,gBAAgB,QAAQ,OAAO,cAAc,OAAO,gBAAgB;AAC1E,QAAI,eAAe;AAElB,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,WAAW,UAAU,WAAW,QAAQ,OAAO,GAAG;AACjE,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AACN,eAAO,IAAI,cAAc,gBAAgB,yCAAyC,WAAW;AAAA,MAC9F;AAAA,IACD,WAAW,OAAO,mBAAmB;AAEpC,UAAI,SAAS;AACZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAC7E,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,kCAA0B;AAAA,MAC3B,WAAW,YAAY;AACtB,YAAI,CAAC,MAAM,KAAK,kBAAkB,iBAAiB,WAAW,QAAQ,UAAU,GAAG;AAClF,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,QAC7F;AACA,yBAAiB;AACjB,kCAA0B;AAAA,MAC3B,OAAO;AAQN,cAAM,iBAAiB,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AACrG,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,cAAc;AACtF,eAAO,IAAI,cAAc,gBAAgB,yCAAyC;AAAA,UACjF,cAAc,SAAS;AAAA,UACvB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD,OAAO;AAIN,YAAM,cAAc,MAAM,KAAK,qBAAqB,WAAW,QAAQ,SAAS,WAAW;AAC3F,UAAI,gBAAgB,MAAM;AACzB,YAAI,WAAW,aAAa;AAC3B,iBAAO;AAAA,QACR;AAGA,cAAMA,eAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,UACjE;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA,yBAAyB;AAAA,UACzB;AAAA,QAAA,CACA;AACD,YAAIA,iBAAgB,QAAQ,WAAWA,cAAa;AACnD,iBAAOA;AAAAA,QACR;AACA,cAAMC,gBAAe,MAAM,KAAK,cAAc;AAAA,UAC7C;AAAA,UACA,OAAO;AAAA,UACP;AAAA,UACA;AAAA,UACA;AAAA,QAAA;AAED,eAAO,IAAI,WAAW;AAAA,UACrB;AAAA,UACA,OAAOA;AAAAA,UACP,aAAa,YAAY;AAAA,UACzB,sBAAsBD,cAAa,wBAAwB;AAAA,UAC3D,MAAMA,cAAa;AAAA,UACnB,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAEA,UAAM,cAAc,MAAM,KAAK,gBAAgB,WAAW,QAAQ;AAAA,MACjE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA,CACA;AACD,QAAI,gBAAgB,QAAQ,WAAW,aAAa;AACnD,aAAO;AAAA,IACR;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAE5I,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP;AAAA,MACA,sBAAsB,aAAa,wBAAwB;AAAA,MAC3D,MAAM,aAAa;AAAA,MACnB,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,MAAc,gBACb,WACA,QACA,MAQ6B;AAC7B,UAAM,EAAE,QAAQ,YAAY,aAAa,SAAS,yBAAyB,gBAAgB;AAC3F,UAAM,SAAS,QAAQ,MAAM;AAC7B,QAAI,CAAC,UAAU,CAAC,QAAQ,SAAS;AAChC,aAAO;AAAA,IACR;AAEA,UAAM,aAAa,MAAM,KAAK,kBAAkB,QAAQ,WAAW,OAAO,IAAI;AAAA,MAC7E,YAAY,cAAc;AAAA,MAC1B,mBAAmB,KAAK,kBAAkB,YAAY,aAAa,SAAS;AAAA,MAC5E,IAAI,aAAa,MAAM;AAAA,IAAA,GACrB,MAAM;AAET,QAAI,WAAW,WAAW,SAAS;AAClC,aAAO,EAAE,sBAAsB,MAAA;AAAA,IAChC;AAEA,UAAM,WAAW,EAAE,OAAO,WAAW,OAAO,SAAS,WAAW,QAAA;AAEhE,QAAI,WAAW,WAAW,YAAY,CAAC,yBAAyB;AAO/D,UAAI,SAAS;AAKZ,YAAI,CAAC,MAAM,KAAK,gBAAgB,iBAAiB,WAAW,QAAQ,OAAO,GAAG;AAK7E,iBAAO,IAAI,cAAc,qBAAqB,mCAAmC;AAAA,YAChF,gBAAgB;AAAA,YAChB,sBAAsB;AAAA,YACtB,MAAM;AAAA,YACN,GAAG;AAAA,UAAA,CACH;AAAA,QACF;AAAA,MAED,OAAO;AAGN,cAAM,WAAW,MAAM,KAAK,gBAAgB,SAAS,WAAW,QAAQ,MAAM;AAC9E,eAAO,IAAI,cAAc,gBAAgB,wDAAwD;AAAA,UAChG,cAAc,SAAS;AAAA,UACvB,gBAAgB;AAAA,UAChB,sBAAsB;AAAA,UACtB,MAAM;AAAA,UACN,GAAG;AAAA,QAAA,CACH;AAAA,MACF;AAAA,IACD;AAKA,UAAM,KAAK,sBAAsB,WAAW,QAAQ,cAAc,MAAM,aAAa,MAAM,IAAI;AAC/F,WAAO,EAAE,sBAAsB,MAAM,MAAM,SAAA;AAAA,EAC5C;AAAA,EAEA,MAAc,sBAAsB,WAA4B,QAAmB,YAA2B,IAAkC;AAC/I,QAAI,CAAC,OAAO,OAAO;AAElB;AAAA,IACD;AACA,QAAI;AACH,YAAM,KAAK,WAAW,sBAAsB,WAAW;AAAA,QACtD,OAAO,OAAO;AAAA,QACd;AAAA,QACA,WAAW;AAAA,MAAA,GACT,EAAE,WAAW,MAAM,SAAS,IAAI;AAAA,IACpC,QAAQ;AAAA,IAER;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,qBACb,WACA,QACA,SACA,aAUC;AACD,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,WAAW,OAAO,aAAa,OAAO,KAAK;AAC3G,QAAI,CAAC,OAAO,aAAa;AACxB,aAAO;AAAA,IACR;AAKA,QAAI;AACJ,QAAI,OAAO,kBAAkB,MAAM;AAClC,qBAAe,kBAAkB,OAAO,aAAa;AAAA,IACtD,OAAO;AACN,YAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AAC7F,qBAAe,kBAAkB,OAAO,MAAM,gBAAgB;AAAA,IAC/D;AAOA,QAAI,OAAO,oBAAoB,MAAM;AACpC,UAAI,OAAO,aAAa;AAEvB,eAAO;AAAA,MACR;AAAA,IAED,WAAW,eAAe,GAAG;AAE5B,YAAM,UAAU,WAAW,QAAQ,IAAI,wBAAwB,OAAO,IAAI,YAAY,CAAC;AACvF,aAAO;AAAA,IACR;AAGA,QAAI,WAAW,OAAO,oBAAoB;AAEzC,UAAI,CAAC,MAAM,KAAK,WAAW,iBAAiB,QAAQ,OAAO,GAAG;AAC7D,eAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,WAAW,MAAM,KAAK,WAAW,WAAW,WAAW,MAAM;AACnE,UAAI,CAAC,UAAU;AAKd,eAAO,IAAI,cAAc,qBAAqB,mCAAmC,WAAW;AAAA,MAC7F;AACA,YAAM,cAAc,MAAM,KAAK,kBAAkB,SAAS,WAAW,OAAO,EAAE;AAC9E,aAAO,EAAE,YAAA;AAAA,IACV;AAGA,UAAM,MAAM,MAAM,KAAK,WAAW,WAAW,WAAW,QAAQ,WAAW;AAC3E,UAAM,gBAA+B,EAAE,QAAQ,IAAI,KAAK,WAAW,IAAI,OAAA;AACvE,WAAO,IAAI,cAAc,2BAA2B,8BAA8B;AAAA,MACjF,uBAAuB;AAAA,MACvB;AAAA,MACA,GAAG;AAAA,IAAA,CACH;AAAA,EACF;AAAA,EAEA,MAAM,mBACL,WACA,kBACA,YACA,UACA,aACA,oBACsC;AACtC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,YAAY,mBAAmB,gBAAgB,CAAC;AAElG,QAAI,WAAW,MAAM;AACpB,UAAI,iBAAiB,SAAS,SAAS;AACtC,eAAO,IAAI,cAAc,iBAAiB,qBAAqB,iBAAiB,KAAK,cAAc;AAAA,UAClG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF,WAAW,iBAAiB,SAAS,MAAM;AAC1C,eAAO,IAAI,cAAc,qBAAqB,kBAAkB,iBAAiB,EAAE,cAAc;AAAA,UAChG,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,YAC5C,aAAa,iBAAiB;AAAA,UAAA,CAC9B;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,IAAI,wBAAA;AAAA,IACX;AAEA,UAAM,aAAa,iBAAiB,SAAS,UAAU,iBAAiB,QAAQ,iBAAiB;AACjG,QAAI,OAAO,gBAAgB,MAAM;AAChC,aAAO,IAAI,cAAc,mBAAmB,kBAAkB,OAAO,EAAE,gBAAgB;AAAA,QACtF,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,UAC5C,UAAU,OAAO;AAAA,UACjB,aAAa;AAAA,QAAA,CACb;AAAA,MAAA,CACD;AAAA,IACF;AAEA,UAAM,WAAW,MAAM;AAEvB,UAAM,eAAe,MAAM,KAAK,cAAc,oBAAoB,WAAW,OAAO,aAAa,YAAY,aAAa,kBAAkB;AAC5I,WAAO,IAAI,WAAW;AAAA,MACrB;AAAA,MACA,OAAO;AAAA,MACP,CAAC,eAAe,GAAG,GAAG,IAAI,eAAe,IAAI;AAAA,QAC5C,UAAU,OAAO;AAAA,QACjB,aAAa;AAAA,MAAA,CACb;AAAA,IAAA,CACD;AAAA,EACF;AACD;"}

package/dist/development/src/model/service/SignOutManager.cjs

@@ -7,8 +7,9 @@ const PersonQuery = require("../queries/person/PersonQuery.cjs");
 const IdpSessionByApiKeyQuery = require("../queries/idp/IdpSessionByApiKeyQuery.cjs");
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 const Response = require("../utils/Response.cjs");
 class SignOutManager {

package/dist/development/src/model/service/SignOutManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignOutManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignOutManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ApiKey } from '../type/index.js'\nimport { PersonQuery } from '../queries/index.js'\nimport { IdpSessionByApiKeyQuery } from '../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './idp/IDPHandlerRegistry.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\n\nexport type SignOutErrorCode = 'NOT_A_PERSON' | 'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY'\n\nexport type SignOutResult = {\n\t/** Set when the session was federated via an OIDC IdP that exposes RP-initiated logout. */\n\treadonly logoutUrl: string | null\n\t/** The IdP this session belonged to, for auditing. Null for plain (password) sessions. */\n\treadonly identityProviderId: string | null\n}\n\nexport type SignOutResponse = Response<SignOutResult, SignOutErrorCode>\n\n/**\n * Owns the sign-out flow (extracted from `SignOutMutationResolver`, A10):\n *   - the existing local logout (disable this session, or all of the identity's sessions);\n *   - OIDC Single Logout — when the session was federated and the IdP advertises an\n *     `end_session_endpoint`, build the RP-initiated (front-channel) logout redirect URL the admin\n *     should send the browser to. Legacy IdPs without `end_session_endpoint` (and password\n *     sessions) gracefully fall back to a local-only logout with no `logoutUrl`.\n *\n * Auditing lives at the resolver layer (the manager only returns what happened), matching the\n * existing convention.\n */\nexport class SignOutManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signOut(\n\t\tdb: DatabaseContext,\n\t\tidentityId: string,\n\t\tapiKeyId: string,\n\t\tall: boolean,\n\t): Promise<SignOutResponse> {\n\t\tconst person = await db.queryHandler.fetch(PersonQuery.byIdentity(identityId))\n\t\tif (!person) {\n\t\t\treturn new ResponseError('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKey = await this.apiKeyManager.findApiKey(db, apiKeyId)\n\t\tif (personApiKey?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY',\n\t\t\t\t'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\t// Resolve the RP-initiated logout URL *before* disabling the key — the federated-session row\n\t\t// is removed (FK ON DELETE CASCADE) once the api_key is gone, and we need its id_token.\n\t\tconst logout = await this.resolveOidcLogout(db, apiKeyId)\n\n\t\tif (all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, identityId)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(db, apiKeyId)\n\t\t}\n\n\t\treturn new ResponseOk({\n\t\t\tlogoutUrl: logout?.logoutUrl ?? null,\n\t\t\tidentityProviderId: logout?.identityProviderId ?? null,\n\t\t})\n\t}\n\n\tprivate async resolveOidcLogout(\n\t\tdb: DatabaseContext,\n\t\tapiKeyId: string,\n\t): Promise<{ logoutUrl: string | null; identityProviderId: string } | null> {\n\t\tconst idpSession = await db.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyId, db.providers))\n\t\tif (!idpSession) {\n\t\t\t// not a federated session (password / IdP without revalidation) — local logout only\n\t\t\treturn null\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(idpSession.providerType)\n\t\tif (!handler?.buildLogoutUrl) {\n\t\t\t// provider can't initiate logout at the IdP (e.g. Apple / Facebook) — local logout only\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(idpSession.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config must not break sign-out — degrade to a local-only logout\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tconst idToken = typeof idpSession.session.tokens?.id_token === 'string' ? idpSession.session.tokens.id_token : undefined\n\t\ttry {\n\t\t\tconst logoutUrl = await handler.buildLogoutUrl(config, {\n\t\t\t\tidToken,\n\t\t\t\tpostLogoutRedirectUri: typeof (idpSession.providerConfiguration as { postLogoutRedirectUri?: unknown }).postLogoutRedirectUri === 'string'\n\t\t\t\t\t? (idpSession.providerConfiguration as { postLogoutRedirectUri: string }).postLogoutRedirectUri\n\t\t\t\t\t: undefined,\n\t\t\t})\n\t\t\treturn { logoutUrl, identityProviderId: idpSession.identityProviderId }\n\t\t} catch {\n\t\t\t// discovery / IdP unreachable must not block local sign-out — degrade gracefully\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\t}\n}\n"],"names":["PersonQuery","ResponseError","ApiKey","ResponseOk","IdpSessionByApiKeyQuery"],"mappings":";;;;;;;;;;;;;AA8BO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,IACA,YACA,UACA,KAC2B;AAC3B,UAAM,SAAS,MAAM,GAAG,aAAa,MAAMA,wBAAY,WAAW,UAAU,CAAC;AAC7E,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAIC,SAAAA,cAAc,gBAAgB,4BAA4B;AAAA,IACtE;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,WAAW,IAAI,QAAQ;AACrE,QAAI,cAAc,SAASC,cAAO,KAAK,WAAW;AACjD,aAAO,IAAID,SAAAA;AAAAA,QACV;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AAIA,UAAM,SAAS,MAAM,KAAK,kBAAkB,IAAI,QAAQ;AAExD,QAAI,KAAK;AACR,YAAM,KAAK,cAAc,uBAAuB,IAAI,UAAU;AAAA,IAC/D,OAAO;AACN,YAAM,KAAK,cAAc,cAAc,IAAI,QAAQ;AAAA,IACpD;AAEA,WAAO,IAAIE,SAAAA,WAAW;AAAA,MACrB,WAAW,QAAQ,aAAa;AAAA,MAChC,oBAAoB,QAAQ,sBAAsB;AAAA,IAAA,CAClD;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,IACA,UAC2E;AAC3E,UAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIC,wBAAAA,wBAAwB,UAAU,GAAG,SAAS,CAAC;AAClG,QAAI,CAAC,YAAY;AAEhB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,WAAW,YAAY;AACzE,QAAI,CAAC,SAAS,gBAAgB;AAE7B,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,WAAW,qBAAqB;AAAA,IACxE,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,UAAM,UAAU,OAAO,WAAW,QAAQ,QAAQ,aAAa,WAAW,WAAW,QAAQ,OAAO,WAAW;AAC/G,QAAI;AACH,YAAM,YAAY,MAAM,QAAQ,eAAe,QAAQ;AAAA,QACtD;AAAA,QACA,uBAAuB,OAAQ,WAAW,sBAA8D,0BAA0B,WAC9H,WAAW,sBAA4D,wBACxE;AAAA,MAAA,CACH;AACD,aAAO,EAAE,WAAW,oBAAoB,WAAW,mBAAA;AAAA,IACpD,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAAA,EACD;AACD;;"}
+{"version":3,"file":"SignOutManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignOutManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ApiKey } from '../type/index.js'\nimport { PersonQuery } from '../queries/index.js'\nimport { IdpSessionByApiKeyQuery } from '../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './idp/IDPHandlerRegistry.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\n\nexport type SignOutErrorCode = 'NOT_A_PERSON' | 'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY'\n\nexport type SignOutResult = {\n\t/** Set when the session was federated via an OIDC IdP that exposes RP-initiated logout. */\n\treadonly logoutUrl: string | null\n\t/** The IdP this session belonged to, for auditing. Null for plain (password) sessions. */\n\treadonly identityProviderId: string | null\n}\n\nexport type SignOutResponse = Response<SignOutResult, SignOutErrorCode>\n\n/**\n * Owns the sign-out flow (extracted from `SignOutMutationResolver`, A10):\n *   - the existing local logout (disable this session, or all of the identity's sessions);\n *   - OIDC Single Logout — when the session was federated and the IdP advertises an\n *     `end_session_endpoint`, build the RP-initiated (front-channel) logout redirect URL the admin\n *     should send the browser to. Legacy IdPs without `end_session_endpoint` (and password\n *     sessions) gracefully fall back to a local-only logout with no `logoutUrl`.\n *\n * Auditing lives at the resolver layer (the manager only returns what happened), matching the\n * existing convention.\n */\nexport class SignOutManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signOut(\n\t\tdb: DatabaseContext,\n\t\tidentityId: string,\n\t\tapiKeyId: string,\n\t\tall: boolean,\n\t): Promise<SignOutResponse> {\n\t\tconst person = await db.queryHandler.fetch(PersonQuery.byIdentity(identityId))\n\t\tif (!person) {\n\t\t\treturn new ResponseError('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKey = await this.apiKeyManager.findApiKey(db, apiKeyId)\n\t\tif (personApiKey?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY',\n\t\t\t\t'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\t// Resolve the RP-initiated logout URL *before* disabling the key — the federated-session row\n\t\t// is removed (FK ON DELETE CASCADE) once the api_key is gone, and we need its id_token.\n\t\tconst logout = await this.resolveOidcLogout(db, apiKeyId)\n\n\t\tif (all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, identityId)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(db, apiKeyId)\n\t\t}\n\n\t\treturn new ResponseOk({\n\t\t\tlogoutUrl: logout?.logoutUrl ?? null,\n\t\t\tidentityProviderId: logout?.identityProviderId ?? null,\n\t\t})\n\t}\n\n\tprivate async resolveOidcLogout(\n\t\tdb: DatabaseContext,\n\t\tapiKeyId: string,\n\t): Promise<{ logoutUrl: string | null; identityProviderId: string } | null> {\n\t\tconst idpSession = await db.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyId, db.providers))\n\t\tif (!idpSession) {\n\t\t\t// not a federated session (password / IdP without revalidation) — local logout only\n\t\t\treturn null\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(idpSession.providerType)\n\t\tif (!handler?.buildLogoutUrl) {\n\t\t\t// provider can't initiate logout at the IdP (e.g. Apple / Facebook) — local logout only\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(idpSession.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config must not break sign-out — degrade to a local-only logout\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tconst idToken = typeof idpSession.session.tokens?.id_token === 'string' ? idpSession.session.tokens.id_token : undefined\n\t\ttry {\n\t\t\tconst logoutUrl = await handler.buildLogoutUrl(config, {\n\t\t\t\tidToken,\n\t\t\t\tpostLogoutRedirectUri: typeof (idpSession.providerConfiguration as { postLogoutRedirectUri?: unknown }).postLogoutRedirectUri === 'string'\n\t\t\t\t\t? (idpSession.providerConfiguration as { postLogoutRedirectUri: string }).postLogoutRedirectUri\n\t\t\t\t\t: undefined,\n\t\t\t})\n\t\t\treturn { logoutUrl, identityProviderId: idpSession.identityProviderId }\n\t\t} catch {\n\t\t\t// discovery / IdP unreachable must not block local sign-out — degrade gracefully\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\t}\n}\n"],"names":["PersonQuery","ResponseError","ApiKey","ResponseOk","IdpSessionByApiKeyQuery"],"mappings":";;;;;;;;;;;;;;AA8BO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,IACA,YACA,UACA,KAC2B;AAC3B,UAAM,SAAS,MAAM,GAAG,aAAa,MAAMA,wBAAY,WAAW,UAAU,CAAC;AAC7E,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAIC,SAAAA,cAAc,gBAAgB,4BAA4B;AAAA,IACtE;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,WAAW,IAAI,QAAQ;AACrE,QAAI,cAAc,SAASC,cAAO,KAAK,WAAW;AACjD,aAAO,IAAID,SAAAA;AAAAA,QACV;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AAIA,UAAM,SAAS,MAAM,KAAK,kBAAkB,IAAI,QAAQ;AAExD,QAAI,KAAK;AACR,YAAM,KAAK,cAAc,uBAAuB,IAAI,UAAU;AAAA,IAC/D,OAAO;AACN,YAAM,KAAK,cAAc,cAAc,IAAI,QAAQ;AAAA,IACpD;AAEA,WAAO,IAAIE,SAAAA,WAAW;AAAA,MACrB,WAAW,QAAQ,aAAa;AAAA,MAChC,oBAAoB,QAAQ,sBAAsB;AAAA,IAAA,CAClD;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,IACA,UAC2E;AAC3E,UAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIC,wBAAAA,wBAAwB,UAAU,GAAG,SAAS,CAAC;AAClG,QAAI,CAAC,YAAY;AAEhB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,WAAW,YAAY;AACzE,QAAI,CAAC,SAAS,gBAAgB;AAE7B,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,WAAW,qBAAqB;AAAA,IACxE,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,UAAM,UAAU,OAAO,WAAW,QAAQ,QAAQ,aAAa,WAAW,WAAW,QAAQ,OAAO,WAAW;AAC/G,QAAI;AACH,YAAM,YAAY,MAAM,QAAQ,eAAe,QAAQ;AAAA,QACtD;AAAA,QACA,uBAAuB,OAAQ,WAAW,sBAA8D,0BAA0B,WAC9H,WAAW,sBAA4D,wBACxE;AAAA,MAAA,CACH;AACD,aAAO,EAAE,WAAW,oBAAoB,WAAW,mBAAA;AAAA,IACpD,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAAA,EACD;AACD;;"}

package/dist/development/src/model/service/SignOutManager.js

@@ -5,8 +5,9 @@ import { PersonQuery } from "../queries/person/PersonQuery.js";
 import { IdpSessionByApiKeyQuery } from "../queries/idp/IdpSessionByApiKeyQuery.js";
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
 import { ResponseError, ResponseOk } from "../utils/Response.js";
 class SignOutManager {

package/dist/development/src/model/service/SignOutManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignOutManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignOutManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ApiKey } from '../type/index.js'\nimport { PersonQuery } from '../queries/index.js'\nimport { IdpSessionByApiKeyQuery } from '../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './idp/IDPHandlerRegistry.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\n\nexport type SignOutErrorCode = 'NOT_A_PERSON' | 'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY'\n\nexport type SignOutResult = {\n\t/** Set when the session was federated via an OIDC IdP that exposes RP-initiated logout. */\n\treadonly logoutUrl: string | null\n\t/** The IdP this session belonged to, for auditing. Null for plain (password) sessions. */\n\treadonly identityProviderId: string | null\n}\n\nexport type SignOutResponse = Response<SignOutResult, SignOutErrorCode>\n\n/**\n * Owns the sign-out flow (extracted from `SignOutMutationResolver`, A10):\n *   - the existing local logout (disable this session, or all of the identity's sessions);\n *   - OIDC Single Logout — when the session was federated and the IdP advertises an\n *     `end_session_endpoint`, build the RP-initiated (front-channel) logout redirect URL the admin\n *     should send the browser to. Legacy IdPs without `end_session_endpoint` (and password\n *     sessions) gracefully fall back to a local-only logout with no `logoutUrl`.\n *\n * Auditing lives at the resolver layer (the manager only returns what happened), matching the\n * existing convention.\n */\nexport class SignOutManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signOut(\n\t\tdb: DatabaseContext,\n\t\tidentityId: string,\n\t\tapiKeyId: string,\n\t\tall: boolean,\n\t): Promise<SignOutResponse> {\n\t\tconst person = await db.queryHandler.fetch(PersonQuery.byIdentity(identityId))\n\t\tif (!person) {\n\t\t\treturn new ResponseError('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKey = await this.apiKeyManager.findApiKey(db, apiKeyId)\n\t\tif (personApiKey?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY',\n\t\t\t\t'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\t// Resolve the RP-initiated logout URL *before* disabling the key — the federated-session row\n\t\t// is removed (FK ON DELETE CASCADE) once the api_key is gone, and we need its id_token.\n\t\tconst logout = await this.resolveOidcLogout(db, apiKeyId)\n\n\t\tif (all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, identityId)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(db, apiKeyId)\n\t\t}\n\n\t\treturn new ResponseOk({\n\t\t\tlogoutUrl: logout?.logoutUrl ?? null,\n\t\t\tidentityProviderId: logout?.identityProviderId ?? null,\n\t\t})\n\t}\n\n\tprivate async resolveOidcLogout(\n\t\tdb: DatabaseContext,\n\t\tapiKeyId: string,\n\t): Promise<{ logoutUrl: string | null; identityProviderId: string } | null> {\n\t\tconst idpSession = await db.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyId, db.providers))\n\t\tif (!idpSession) {\n\t\t\t// not a federated session (password / IdP without revalidation) — local logout only\n\t\t\treturn null\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(idpSession.providerType)\n\t\tif (!handler?.buildLogoutUrl) {\n\t\t\t// provider can't initiate logout at the IdP (e.g. Apple / Facebook) — local logout only\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(idpSession.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config must not break sign-out — degrade to a local-only logout\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tconst idToken = typeof idpSession.session.tokens?.id_token === 'string' ? idpSession.session.tokens.id_token : undefined\n\t\ttry {\n\t\t\tconst logoutUrl = await handler.buildLogoutUrl(config, {\n\t\t\t\tidToken,\n\t\t\t\tpostLogoutRedirectUri: typeof (idpSession.providerConfiguration as { postLogoutRedirectUri?: unknown }).postLogoutRedirectUri === 'string'\n\t\t\t\t\t? (idpSession.providerConfiguration as { postLogoutRedirectUri: string }).postLogoutRedirectUri\n\t\t\t\t\t: undefined,\n\t\t\t})\n\t\t\treturn { logoutUrl, identityProviderId: idpSession.identityProviderId }\n\t\t} catch {\n\t\t\t// discovery / IdP unreachable must not block local sign-out — degrade gracefully\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;AA8BO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,IACA,YACA,UACA,KAC2B;AAC3B,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,YAAY,WAAW,UAAU,CAAC;AAC7E,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,gBAAgB,4BAA4B;AAAA,IACtE;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,WAAW,IAAI,QAAQ;AACrE,QAAI,cAAc,SAAS,OAAO,KAAK,WAAW;AACjD,aAAO,IAAI;AAAA,QACV;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AAIA,UAAM,SAAS,MAAM,KAAK,kBAAkB,IAAI,QAAQ;AAExD,QAAI,KAAK;AACR,YAAM,KAAK,cAAc,uBAAuB,IAAI,UAAU;AAAA,IAC/D,OAAO;AACN,YAAM,KAAK,cAAc,cAAc,IAAI,QAAQ;AAAA,IACpD;AAEA,WAAO,IAAI,WAAW;AAAA,MACrB,WAAW,QAAQ,aAAa;AAAA,MAChC,oBAAoB,QAAQ,sBAAsB;AAAA,IAAA,CAClD;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,IACA,UAC2E;AAC3E,UAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,wBAAwB,UAAU,GAAG,SAAS,CAAC;AAClG,QAAI,CAAC,YAAY;AAEhB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,WAAW,YAAY;AACzE,QAAI,CAAC,SAAS,gBAAgB;AAE7B,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,WAAW,qBAAqB;AAAA,IACxE,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,UAAM,UAAU,OAAO,WAAW,QAAQ,QAAQ,aAAa,WAAW,WAAW,QAAQ,OAAO,WAAW;AAC/G,QAAI;AACH,YAAM,YAAY,MAAM,QAAQ,eAAe,QAAQ;AAAA,QACtD;AAAA,QACA,uBAAuB,OAAQ,WAAW,sBAA8D,0BAA0B,WAC9H,WAAW,sBAA4D,wBACxE;AAAA,MAAA,CACH;AACD,aAAO,EAAE,WAAW,oBAAoB,WAAW,mBAAA;AAAA,IACpD,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAAA,EACD;AACD;"}
+{"version":3,"file":"SignOutManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignOutManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ApiKey } from '../type/index.js'\nimport { PersonQuery } from '../queries/index.js'\nimport { IdpSessionByApiKeyQuery } from '../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './idp/IDPHandlerRegistry.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\n\nexport type SignOutErrorCode = 'NOT_A_PERSON' | 'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY'\n\nexport type SignOutResult = {\n\t/** Set when the session was federated via an OIDC IdP that exposes RP-initiated logout. */\n\treadonly logoutUrl: string | null\n\t/** The IdP this session belonged to, for auditing. Null for plain (password) sessions. */\n\treadonly identityProviderId: string | null\n}\n\nexport type SignOutResponse = Response<SignOutResult, SignOutErrorCode>\n\n/**\n * Owns the sign-out flow (extracted from `SignOutMutationResolver`, A10):\n *   - the existing local logout (disable this session, or all of the identity's sessions);\n *   - OIDC Single Logout — when the session was federated and the IdP advertises an\n *     `end_session_endpoint`, build the RP-initiated (front-channel) logout redirect URL the admin\n *     should send the browser to. Legacy IdPs without `end_session_endpoint` (and password\n *     sessions) gracefully fall back to a local-only logout with no `logoutUrl`.\n *\n * Auditing lives at the resolver layer (the manager only returns what happened), matching the\n * existing convention.\n */\nexport class SignOutManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signOut(\n\t\tdb: DatabaseContext,\n\t\tidentityId: string,\n\t\tapiKeyId: string,\n\t\tall: boolean,\n\t): Promise<SignOutResponse> {\n\t\tconst person = await db.queryHandler.fetch(PersonQuery.byIdentity(identityId))\n\t\tif (!person) {\n\t\t\treturn new ResponseError('NOT_A_PERSON', 'Only a person can sign out')\n\t\t}\n\n\t\tconst personApiKey = await this.apiKeyManager.findApiKey(db, apiKeyId)\n\t\tif (personApiKey?.type === ApiKey.Type.PERMANENT) {\n\t\t\treturn new ResponseError(\n\t\t\t\t'NOT_POSSIBLE_SIGN_OUT_WITH_PERMANENT_API_KEY',\n\t\t\t\t'Only session API keys can be used for person sign out.',\n\t\t\t)\n\t\t}\n\n\t\t// Resolve the RP-initiated logout URL *before* disabling the key — the federated-session row\n\t\t// is removed (FK ON DELETE CASCADE) once the api_key is gone, and we need its id_token.\n\t\tconst logout = await this.resolveOidcLogout(db, apiKeyId)\n\n\t\tif (all) {\n\t\t\tawait this.apiKeyManager.disableIdentityApiKeys(db, identityId)\n\t\t} else {\n\t\t\tawait this.apiKeyManager.disableApiKey(db, apiKeyId)\n\t\t}\n\n\t\treturn new ResponseOk({\n\t\t\tlogoutUrl: logout?.logoutUrl ?? null,\n\t\t\tidentityProviderId: logout?.identityProviderId ?? null,\n\t\t})\n\t}\n\n\tprivate async resolveOidcLogout(\n\t\tdb: DatabaseContext,\n\t\tapiKeyId: string,\n\t): Promise<{ logoutUrl: string | null; identityProviderId: string } | null> {\n\t\tconst idpSession = await db.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyId, db.providers))\n\t\tif (!idpSession) {\n\t\t\t// not a federated session (password / IdP without revalidation) — local logout only\n\t\t\treturn null\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(idpSession.providerType)\n\t\tif (!handler?.buildLogoutUrl) {\n\t\t\t// provider can't initiate logout at the IdP (e.g. Apple / Facebook) — local logout only\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(idpSession.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config must not break sign-out — degrade to a local-only logout\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\n\t\tconst idToken = typeof idpSession.session.tokens?.id_token === 'string' ? idpSession.session.tokens.id_token : undefined\n\t\ttry {\n\t\t\tconst logoutUrl = await handler.buildLogoutUrl(config, {\n\t\t\t\tidToken,\n\t\t\t\tpostLogoutRedirectUri: typeof (idpSession.providerConfiguration as { postLogoutRedirectUri?: unknown }).postLogoutRedirectUri === 'string'\n\t\t\t\t\t? (idpSession.providerConfiguration as { postLogoutRedirectUri: string }).postLogoutRedirectUri\n\t\t\t\t\t: undefined,\n\t\t\t})\n\t\t\treturn { logoutUrl, identityProviderId: idpSession.identityProviderId }\n\t\t} catch {\n\t\t\t// discovery / IdP unreachable must not block local sign-out — degrade gracefully\n\t\t\treturn { logoutUrl: null, identityProviderId: idpSession.identityProviderId }\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AA8BO,MAAM,eAAe;AAAA,EAC3B,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QACL,IACA,YACA,UACA,KAC2B;AAC3B,UAAM,SAAS,MAAM,GAAG,aAAa,MAAM,YAAY,WAAW,UAAU,CAAC;AAC7E,QAAI,CAAC,QAAQ;AACZ,aAAO,IAAI,cAAc,gBAAgB,4BAA4B;AAAA,IACtE;AAEA,UAAM,eAAe,MAAM,KAAK,cAAc,WAAW,IAAI,QAAQ;AACrE,QAAI,cAAc,SAAS,OAAO,KAAK,WAAW;AACjD,aAAO,IAAI;AAAA,QACV;AAAA,QACA;AAAA,MAAA;AAAA,IAEF;AAIA,UAAM,SAAS,MAAM,KAAK,kBAAkB,IAAI,QAAQ;AAExD,QAAI,KAAK;AACR,YAAM,KAAK,cAAc,uBAAuB,IAAI,UAAU;AAAA,IAC/D,OAAO;AACN,YAAM,KAAK,cAAc,cAAc,IAAI,QAAQ;AAAA,IACpD;AAEA,WAAO,IAAI,WAAW;AAAA,MACrB,WAAW,QAAQ,aAAa;AAAA,MAChC,oBAAoB,QAAQ,sBAAsB;AAAA,IAAA,CAClD;AAAA,EACF;AAAA,EAEA,MAAc,kBACb,IACA,UAC2E;AAC3E,UAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,wBAAwB,UAAU,GAAG,SAAS,CAAC;AAClG,QAAI,CAAC,YAAY;AAEhB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,WAAW,YAAY;AACzE,QAAI,CAAC,SAAS,gBAAgB;AAE7B,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,WAAW,qBAAqB;AAAA,IACxE,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAEA,UAAM,UAAU,OAAO,WAAW,QAAQ,QAAQ,aAAa,WAAW,WAAW,QAAQ,OAAO,WAAW;AAC/G,QAAI;AACH,YAAM,YAAY,MAAM,QAAQ,eAAe,QAAQ;AAAA,QACtD;AAAA,QACA,uBAAuB,OAAQ,WAAW,sBAA8D,0BAA0B,WAC9H,WAAW,sBAA4D,wBACxE;AAAA,MAAA,CACH;AACD,aAAO,EAAE,WAAW,oBAAoB,WAAW,mBAAA;AAAA,IACpD,QAAQ;AAEP,aAAO,EAAE,WAAW,MAAM,oBAAoB,WAAW,mBAAA;AAAA,IAC1D;AAAA,EACD;AACD;"}

package/dist/development/src/model/service/SignUpManager.cjs

@@ -9,14 +9,18 @@ const CreateIdentityCommand = require("../commands/identity/CreateIdentityComman
 require("../authorization/PermissionActions.cjs");
 require("@contember/authorization");
 const Roles = require("../authorization/Roles.cjs");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+const email = require("../utils/email.cjs");
+require("../authorization/CustomRolePermissions.cjs");
 require("../authorization/PermissionContext.cjs");
-require("../authorization/PermissionsFactory.cjs");
+require("../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-const email = require("../utils/email.cjs");
+const GlobalRoleValidator = require("./GlobalRoleValidator.cjs");
 class SignUpManager {
-  constructor(emailValidator, passwordStrengthValidator) {
+  constructor(emailValidator, passwordStrengthValidator, globalRoleValidator = new GlobalRoleValidator.GlobalRoleValidator()) {
     this.emailValidator = emailValidator;
     this.passwordStrengthValidator = passwordStrengthValidator;
+    this.globalRoleValidator = globalRoleValidator;
   }
   async signUp(dbContext, args) {
     const { email: email$1, password, roles = [], config } = args;
@@ -41,11 +45,15 @@ class SignUpManager {
       }
     }
     const emailVerificationRequired = config.signup.requireEmailVerification;
-    const person = await dbContext.transaction(async (db) => {
+    return await dbContext.transaction(async (db) => {
+      const invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles);
+      if (invalidRole !== null) {
+        return new Response.ResponseError("INVALID_ROLE", `Role ${invalidRole} is not valid or globally assignable`);
+      }
       const identityId = await db.commandBus.execute(new CreateIdentityCommand.CreateIdentityCommand([...roles, Roles.TenantRole.PERSON]));
-      return await db.commandBus.execute(new CreatePersonCommand.CreatePersonCommand({ identityId, email: email$1, password, emailVerificationRequired }));
-    });
-    return new Response.ResponseOk(new SignUpResult(person, emailVerificationRequired));
+      const person = await db.commandBus.execute(new CreatePersonCommand.CreatePersonCommand({ identityId, email: email$1, password, emailVerificationRequired }));
+      return new Response.ResponseOk(new SignUpResult(person, emailVerificationRequired));
+    }, { isolation: "readCommitted" });
   }
 }
 class SignUpResult {

package/dist/development/src/model/service/SignUpManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands/index.js'\nimport { PersonRow } from '../queries/index.js'\nimport { SignUpErrorCode, SignUpRecommendedAction, WeakPasswordReason } from '../../schema/index.js'\nimport { TenantRole } from '../authorization/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { MaybePassword } from '../dtos/index.js'\nimport { EmailValidator } from './EmailValidator.js'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator.js'\nimport { validateEmail as isEmailFormatValid } from '../utils/email.js'\nimport { Config } from '../type/Config.js'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n\tconfig: Config\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, args: SignUpUser): Promise<SignUpResponse> {\n\t\tconst { email, password, roles = [], config } = args\n\n\t\tif (!isEmailFormatValid(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\n\t\tconst existingPerson = await this.emailValidator.findExistingPerson(dbContext, email)\n\t\tif (existingPerson !== null) {\n\t\t\tconst exposeMethod = config.login.revealUserExists && config.login.revealLoginMethod\n\t\t\tconst recommendedAction: SignUpRecommendedAction | undefined = exposeMethod\n\t\t\t\t? (existingPerson.password_hash ? 'SIGN_IN' : 'RESET_PASSWORD')\n\t\t\t\t: undefined\n\t\t\treturn new ResponseError(\n\t\t\t\t'EMAIL_ALREADY_EXISTS',\n\t\t\t\t`User with email ${email} already exists`,\n\t\t\t\trecommendedAction ? { recommendedAction } : undefined,\n\t\t\t)\n\t\t}\n\n\t\tconst plainPassword = password.getPlain()\n\n\t\tif (plainPassword) {\n\t\t\tconst passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')\n\t\t\tif (!passwordVerifyResult.ok) {\n\t\t\t\treturn passwordVerifyResult\n\t\t\t}\n\t\t}\n\n\t\t// Freeze the requirement onto the person at sign-up time. Flipping the\n\t\t// tenant-wide flag later must not retroactively lock out accounts that\n\t\t// were created while verification was optional.\n\t\tconst emailVerificationRequired = config.signup.requireEmailVerification\n\n\t\tconst person = await dbContext.transaction(async db => {\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\treturn await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password, emailVerificationRequired }))\n\t\t})\n\t\treturn new ResponseOk(new SignUpResult(person, emailVerificationRequired))\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(\n\t\tpublic readonly person: Omit<PersonRow, 'roles'>,\n\t\tpublic readonly emailVerificationRequired: boolean = false,\n\t) {}\n}\n\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n\trecommendedAction?: SignUpRecommendedAction\n}>\n"],"names":["email","isEmailFormatValid","ResponseError","CreateIdentityCommand","TenantRole","CreatePersonCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;AAoBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBACA,2BAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EAElB;AAAA,EAEA,MAAM,OAAO,WAA4B,MAA2C;AACnF,UAAM,EAAA,OAAEA,SAAO,UAAU,QAAQ,CAAA,GAAI,WAAW;AAEhD,QAAI,CAACC,MAAAA,cAAmBD,QAAM,KAAA,CAAM,GAAG;AACtC,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe,mBAAmB,WAAWF,OAAK;AACpF,QAAI,mBAAmB,MAAM;AAC5B,YAAM,eAAe,OAAO,MAAM,oBAAoB,OAAO,MAAM;AACnE,YAAM,oBAAyD,eAC3D,eAAe,gBAAgB,YAAY,mBAC5C;AACH,aAAO,IAAIE,SAAAA;AAAAA,QACV;AAAA,QACA,mBAAmBF,OAAK;AAAA,QACxB,oBAAoB,EAAE,sBAAsB;AAAA,MAAA;AAAA,IAE9C;AAEA,UAAM,gBAAgB,SAAS,SAAA;AAE/B,QAAI,eAAe;AAClB,YAAM,uBAAuB,MAAM,KAAK,0BAA0B,OAAO,eAAe,OAAO,UAAU,UAAU;AACnH,UAAI,CAAC,qBAAqB,IAAI;AAC7B,eAAO;AAAA,MACR;AAAA,IACD;AAKA,UAAM,4BAA4B,OAAO,OAAO;AAEhD,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,OAAM;AACtD,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIG,4CAAsB,CAAC,GAAG,OAAOC,iBAAW,MAAM,CAAC,CAAC;AACvG,aAAO,MAAM,GAAG,WAAW,QAAQ,IAAIC,oBAAAA,oBAAoB,EAAE,mBAAYL,SAAO,UAAU,0BAAA,CAA2B,CAAC;AAAA,IACvH,CAAC;AACD,WAAO,IAAIM,SAAAA,WAAW,IAAI,aAAa,QAAQ,yBAAyB,CAAC;AAAA,EAC1E;AACD;AAEO,MAAM,aAAa;AAAA,EACzB,YACiB,QACA,4BAAqC,OACpD;AAFe,SAAA,SAAA;AACA,SAAA,4BAAA;AAAA,EACd;AACJ;;;"}
+{"version":3,"file":"SignUpManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands/index.js'\nimport { PersonRow } from '../queries/index.js'\nimport { SignUpErrorCode, SignUpRecommendedAction, WeakPasswordReason } from '../../schema/index.js'\nimport { TenantRole } from '../authorization/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { MaybePassword } from '../dtos/index.js'\nimport { EmailValidator } from './EmailValidator.js'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator.js'\nimport { validateEmail as isEmailFormatValid } from '../utils/email.js'\nimport { Config } from '../type/Config.js'\nimport { GlobalRoleValidator } from './GlobalRoleValidator.js'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n\tconfig: Config\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t\tprivate readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, args: SignUpUser): Promise<SignUpResponse> {\n\t\tconst { email, password, roles = [], config } = args\n\n\t\tif (!isEmailFormatValid(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\n\t\tconst existingPerson = await this.emailValidator.findExistingPerson(dbContext, email)\n\t\tif (existingPerson !== null) {\n\t\t\tconst exposeMethod = config.login.revealUserExists && config.login.revealLoginMethod\n\t\t\tconst recommendedAction: SignUpRecommendedAction | undefined = exposeMethod\n\t\t\t\t? (existingPerson.password_hash ? 'SIGN_IN' : 'RESET_PASSWORD')\n\t\t\t\t: undefined\n\t\t\treturn new ResponseError(\n\t\t\t\t'EMAIL_ALREADY_EXISTS',\n\t\t\t\t`User with email ${email} already exists`,\n\t\t\t\trecommendedAction ? { recommendedAction } : undefined,\n\t\t\t)\n\t\t}\n\n\t\tconst plainPassword = password.getPlain()\n\n\t\tif (plainPassword) {\n\t\t\tconst passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')\n\t\t\tif (!passwordVerifyResult.ok) {\n\t\t\t\treturn passwordVerifyResult\n\t\t\t}\n\t\t}\n\n\t\t// Freeze the requirement onto the person at sign-up time. Flipping the\n\t\t// tenant-wide flag later must not retroactively lock out accounts that\n\t\t// were created while verification was optional.\n\t\tconst emailVerificationRequired = config.signup.requireEmailVerification\n\n\t\t// Validating inside the transaction holds the FOR SHARE lock on the custom roles until the\n\t\t// identity is written, so a concurrent deleteCustomRole cannot leave it a dangling slug.\n\t\treturn await dbContext.transaction(async (db): Promise<SignUpResponse> => {\n\t\t\tconst invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles)\n\t\t\tif (invalidRole !== null) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${invalidRole} is not valid or globally assignable`)\n\t\t\t}\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\tconst person = await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password, emailVerificationRequired }))\n\t\t\treturn new ResponseOk(new SignUpResult(person, emailVerificationRequired))\n\t\t}, { isolation: 'readCommitted' })\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(\n\t\tpublic readonly person: Omit<PersonRow, 'roles'>,\n\t\tpublic readonly emailVerificationRequired: boolean = false,\n\t) {}\n}\n\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n\trecommendedAction?: SignUpRecommendedAction\n}>\n"],"names":["GlobalRoleValidator","email","isEmailFormatValid","ResponseError","CreateIdentityCommand","TenantRole","CreatePersonCommand","ResponseOk"],"mappings":";;;;;;;;;;;;;;;;;;AAqBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBACA,2BACA,sBAA2C,IAAIA,oBAAAA,uBAC/D;AAHgB,SAAA,iBAAA;AACA,SAAA,4BAAA;AACA,SAAA,sBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,OAAO,WAA4B,MAA2C;AACnF,UAAM,EAAA,OAAEC,SAAO,UAAU,QAAQ,CAAA,GAAI,WAAW;AAEhD,QAAI,CAACC,MAAAA,cAAmBD,QAAM,KAAA,CAAM,GAAG;AACtC,aAAO,IAAIE,SAAAA,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe,mBAAmB,WAAWF,OAAK;AACpF,QAAI,mBAAmB,MAAM;AAC5B,YAAM,eAAe,OAAO,MAAM,oBAAoB,OAAO,MAAM;AACnE,YAAM,oBAAyD,eAC3D,eAAe,gBAAgB,YAAY,mBAC5C;AACH,aAAO,IAAIE,SAAAA;AAAAA,QACV;AAAA,QACA,mBAAmBF,OAAK;AAAA,QACxB,oBAAoB,EAAE,sBAAsB;AAAA,MAAA;AAAA,IAE9C;AAEA,UAAM,gBAAgB,SAAS,SAAA;AAE/B,QAAI,eAAe;AAClB,YAAM,uBAAuB,MAAM,KAAK,0BAA0B,OAAO,eAAe,OAAO,UAAU,UAAU;AACnH,UAAI,CAAC,qBAAqB,IAAI;AAC7B,eAAO;AAAA,MACR;AAAA,IACD;AAKA,UAAM,4BAA4B,OAAO,OAAO;AAIhD,WAAO,MAAM,UAAU,YAAY,OAAO,OAAgC;AACzE,YAAM,cAAc,MAAM,KAAK,oBAAoB,gBAAgB,IAAI,KAAK;AAC5E,UAAI,gBAAgB,MAAM;AACzB,eAAO,IAAIE,SAAAA,cAAc,gBAAgB,QAAQ,WAAW,sCAAsC;AAAA,MACnG;AACA,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIC,4CAAsB,CAAC,GAAG,OAAOC,iBAAW,MAAM,CAAC,CAAC;AACvG,YAAM,SAAS,MAAM,GAAG,WAAW,QAAQ,IAAIC,wCAAoB,EAAE,YAAA,OAAYL,SAAO,UAAU,0BAAA,CAA2B,CAAC;AAC9H,aAAO,IAAIM,SAAAA,WAAW,IAAI,aAAa,QAAQ,yBAAyB,CAAC;AAAA,IAC1E,GAAG,EAAE,WAAW,iBAAiB;AAAA,EAClC;AACD;AAEO,MAAM,aAAa;AAAA,EACzB,YACiB,QACA,4BAAqC,OACpD;AAFe,SAAA,SAAA;AACA,SAAA,4BAAA;AAAA,EACd;AACJ;;;"}

package/dist/development/src/model/service/SignUpManager.js

@@ -7,14 +7,18 @@ import { CreateIdentityCommand } from "../commands/identity/CreateIdentityComman
 import "../authorization/PermissionActions.js";
 import "@contember/authorization";
 import { TenantRole } from "../authorization/Roles.js";
+import "../queries/apiKey/ApiKeyQuery.js";
+import { validateEmail } from "../utils/email.js";
+import "../authorization/CustomRolePermissions.js";
 import "../authorization/PermissionContext.js";
-import "../authorization/PermissionsFactory.js";
+import "../authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import { validateEmail } from "../utils/email.js";
+import { GlobalRoleValidator } from "./GlobalRoleValidator.js";
 class SignUpManager {
-  constructor(emailValidator, passwordStrengthValidator) {
+  constructor(emailValidator, passwordStrengthValidator, globalRoleValidator = new GlobalRoleValidator()) {
     this.emailValidator = emailValidator;
     this.passwordStrengthValidator = passwordStrengthValidator;
+    this.globalRoleValidator = globalRoleValidator;
   }
   async signUp(dbContext, args) {
     const { email, password, roles = [], config } = args;
@@ -39,11 +43,15 @@ class SignUpManager {
       }
     }
     const emailVerificationRequired = config.signup.requireEmailVerification;
-    const person = await dbContext.transaction(async (db) => {
+    return await dbContext.transaction(async (db) => {
+      const invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles);
+      if (invalidRole !== null) {
+        return new ResponseError("INVALID_ROLE", `Role ${invalidRole} is not valid or globally assignable`);
+      }
       const identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]));
-      return await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password, emailVerificationRequired }));
-    });
-    return new ResponseOk(new SignUpResult(person, emailVerificationRequired));
+      const person = await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password, emailVerificationRequired }));
+      return new ResponseOk(new SignUpResult(person, emailVerificationRequired));
+    }, { isolation: "readCommitted" });
   }
 }
 class SignUpResult {

package/dist/development/src/model/service/SignUpManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignUpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands/index.js'\nimport { PersonRow } from '../queries/index.js'\nimport { SignUpErrorCode, SignUpRecommendedAction, WeakPasswordReason } from '../../schema/index.js'\nimport { TenantRole } from '../authorization/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { MaybePassword } from '../dtos/index.js'\nimport { EmailValidator } from './EmailValidator.js'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator.js'\nimport { validateEmail as isEmailFormatValid } from '../utils/email.js'\nimport { Config } from '../type/Config.js'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n\tconfig: Config\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, args: SignUpUser): Promise<SignUpResponse> {\n\t\tconst { email, password, roles = [], config } = args\n\n\t\tif (!isEmailFormatValid(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\n\t\tconst existingPerson = await this.emailValidator.findExistingPerson(dbContext, email)\n\t\tif (existingPerson !== null) {\n\t\t\tconst exposeMethod = config.login.revealUserExists && config.login.revealLoginMethod\n\t\t\tconst recommendedAction: SignUpRecommendedAction | undefined = exposeMethod\n\t\t\t\t? (existingPerson.password_hash ? 'SIGN_IN' : 'RESET_PASSWORD')\n\t\t\t\t: undefined\n\t\t\treturn new ResponseError(\n\t\t\t\t'EMAIL_ALREADY_EXISTS',\n\t\t\t\t`User with email ${email} already exists`,\n\t\t\t\trecommendedAction ? { recommendedAction } : undefined,\n\t\t\t)\n\t\t}\n\n\t\tconst plainPassword = password.getPlain()\n\n\t\tif (plainPassword) {\n\t\t\tconst passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')\n\t\t\tif (!passwordVerifyResult.ok) {\n\t\t\t\treturn passwordVerifyResult\n\t\t\t}\n\t\t}\n\n\t\t// Freeze the requirement onto the person at sign-up time. Flipping the\n\t\t// tenant-wide flag later must not retroactively lock out accounts that\n\t\t// were created while verification was optional.\n\t\tconst emailVerificationRequired = config.signup.requireEmailVerification\n\n\t\tconst person = await dbContext.transaction(async db => {\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\treturn await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password, emailVerificationRequired }))\n\t\t})\n\t\treturn new ResponseOk(new SignUpResult(person, emailVerificationRequired))\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(\n\t\tpublic readonly person: Omit<PersonRow, 'roles'>,\n\t\tpublic readonly emailVerificationRequired: boolean = false,\n\t) {}\n}\n\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n\trecommendedAction?: SignUpRecommendedAction\n}>\n"],"names":["isEmailFormatValid"],"mappings":";;;;;;;;;;;;;AAoBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBACA,2BAChB;AAFgB,SAAA,iBAAA;AACA,SAAA,4BAAA;AAAA,EAElB;AAAA,EAEA,MAAM,OAAO,WAA4B,MAA2C;AACnF,UAAM,EAAE,OAAO,UAAU,QAAQ,CAAA,GAAI,WAAW;AAEhD,QAAI,CAACA,cAAmB,MAAM,KAAA,CAAM,GAAG;AACtC,aAAO,IAAI,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe,mBAAmB,WAAW,KAAK;AACpF,QAAI,mBAAmB,MAAM;AAC5B,YAAM,eAAe,OAAO,MAAM,oBAAoB,OAAO,MAAM;AACnE,YAAM,oBAAyD,eAC3D,eAAe,gBAAgB,YAAY,mBAC5C;AACH,aAAO,IAAI;AAAA,QACV;AAAA,QACA,mBAAmB,KAAK;AAAA,QACxB,oBAAoB,EAAE,sBAAsB;AAAA,MAAA;AAAA,IAE9C;AAEA,UAAM,gBAAgB,SAAS,SAAA;AAE/B,QAAI,eAAe;AAClB,YAAM,uBAAuB,MAAM,KAAK,0BAA0B,OAAO,eAAe,OAAO,UAAU,UAAU;AACnH,UAAI,CAAC,qBAAqB,IAAI;AAC7B,eAAO;AAAA,MACR;AAAA,IACD;AAKA,UAAM,4BAA4B,OAAO,OAAO;AAEhD,UAAM,SAAS,MAAM,UAAU,YAAY,OAAM,OAAM;AACtD,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAI,sBAAsB,CAAC,GAAG,OAAO,WAAW,MAAM,CAAC,CAAC;AACvG,aAAO,MAAM,GAAG,WAAW,QAAQ,IAAI,oBAAoB,EAAE,YAAY,OAAO,UAAU,0BAAA,CAA2B,CAAC;AAAA,IACvH,CAAC;AACD,WAAO,IAAI,WAAW,IAAI,aAAa,QAAQ,yBAAyB,CAAC;AAAA,EAC1E;AACD;AAEO,MAAM,aAAa;AAAA,EACzB,YACiB,QACA,4BAAqC,OACpD;AAFe,SAAA,SAAA;AACA,SAAA,4BAAA;AAAA,EACd;AACJ;"}
+{"version":3,"file":"SignUpManager.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/SignUpManager.ts"],"sourcesContent":["import { CreateIdentityCommand, CreatePersonCommand } from '../commands/index.js'\nimport { PersonRow } from '../queries/index.js'\nimport { SignUpErrorCode, SignUpRecommendedAction, WeakPasswordReason } from '../../schema/index.js'\nimport { TenantRole } from '../authorization/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { MaybePassword } from '../dtos/index.js'\nimport { EmailValidator } from './EmailValidator.js'\nimport { PasswordStrengthValidator } from './PasswordStrengthValidator.js'\nimport { validateEmail as isEmailFormatValid } from '../utils/email.js'\nimport { Config } from '../type/Config.js'\nimport { GlobalRoleValidator } from './GlobalRoleValidator.js'\n\ntype SignUpUser = {\n\temail: string\n\tname?: string\n\tpassword: MaybePassword\n\troles?: readonly string[]\n\tconfig: Config\n}\n\nexport class SignUpManager {\n\tconstructor(\n\t\tprivate readonly emailValidator: EmailValidator,\n\t\tprivate readonly passwordStrengthValidator: PasswordStrengthValidator,\n\t\tprivate readonly globalRoleValidator: GlobalRoleValidator = new GlobalRoleValidator(),\n\t) {\n\t}\n\n\tasync signUp(dbContext: DatabaseContext, args: SignUpUser): Promise<SignUpResponse> {\n\t\tconst { email, password, roles = [], config } = args\n\n\t\tif (!isEmailFormatValid(email.trim())) {\n\t\t\treturn new ResponseError('INVALID_EMAIL_FORMAT', 'E-mail address is not in a valid format')\n\t\t}\n\n\t\tconst existingPerson = await this.emailValidator.findExistingPerson(dbContext, email)\n\t\tif (existingPerson !== null) {\n\t\t\tconst exposeMethod = config.login.revealUserExists && config.login.revealLoginMethod\n\t\t\tconst recommendedAction: SignUpRecommendedAction | undefined = exposeMethod\n\t\t\t\t? (existingPerson.password_hash ? 'SIGN_IN' : 'RESET_PASSWORD')\n\t\t\t\t: undefined\n\t\t\treturn new ResponseError(\n\t\t\t\t'EMAIL_ALREADY_EXISTS',\n\t\t\t\t`User with email ${email} already exists`,\n\t\t\t\trecommendedAction ? { recommendedAction } : undefined,\n\t\t\t)\n\t\t}\n\n\t\tconst plainPassword = password.getPlain()\n\n\t\tif (plainPassword) {\n\t\t\tconst passwordVerifyResult = await this.passwordStrengthValidator.verify(plainPassword, config.password, 'TOO_WEAK')\n\t\t\tif (!passwordVerifyResult.ok) {\n\t\t\t\treturn passwordVerifyResult\n\t\t\t}\n\t\t}\n\n\t\t// Freeze the requirement onto the person at sign-up time. Flipping the\n\t\t// tenant-wide flag later must not retroactively lock out accounts that\n\t\t// were created while verification was optional.\n\t\tconst emailVerificationRequired = config.signup.requireEmailVerification\n\n\t\t// Validating inside the transaction holds the FOR SHARE lock on the custom roles until the\n\t\t// identity is written, so a concurrent deleteCustomRole cannot leave it a dangling slug.\n\t\treturn await dbContext.transaction(async (db): Promise<SignUpResponse> => {\n\t\t\tconst invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles)\n\t\t\tif (invalidRole !== null) {\n\t\t\t\treturn new ResponseError('INVALID_ROLE', `Role ${invalidRole} is not valid or globally assignable`)\n\t\t\t}\n\t\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand([...roles, TenantRole.PERSON]))\n\t\t\tconst person = await db.commandBus.execute(new CreatePersonCommand({ identityId, email, password, emailVerificationRequired }))\n\t\t\treturn new ResponseOk(new SignUpResult(person, emailVerificationRequired))\n\t\t}, { isolation: 'readCommitted' })\n\t}\n}\n\nexport class SignUpResult {\n\tconstructor(\n\t\tpublic readonly person: Omit<PersonRow, 'roles'>,\n\t\tpublic readonly emailVerificationRequired: boolean = false,\n\t) {}\n}\n\nexport type SignUpResponse = Response<SignUpResult, SignUpErrorCode, {\n\tweakPasswordReasons?: WeakPasswordReason[]\n\trecommendedAction?: SignUpRecommendedAction\n}>\n"],"names":["isEmailFormatValid"],"mappings":";;;;;;;;;;;;;;;;AAqBO,MAAM,cAAc;AAAA,EAC1B,YACkB,gBACA,2BACA,sBAA2C,IAAI,uBAC/D;AAHgB,SAAA,iBAAA;AACA,SAAA,4BAAA;AACA,SAAA,sBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,OAAO,WAA4B,MAA2C;AACnF,UAAM,EAAE,OAAO,UAAU,QAAQ,CAAA,GAAI,WAAW;AAEhD,QAAI,CAACA,cAAmB,MAAM,KAAA,CAAM,GAAG;AACtC,aAAO,IAAI,cAAc,wBAAwB,yCAAyC;AAAA,IAC3F;AAEA,UAAM,iBAAiB,MAAM,KAAK,eAAe,mBAAmB,WAAW,KAAK;AACpF,QAAI,mBAAmB,MAAM;AAC5B,YAAM,eAAe,OAAO,MAAM,oBAAoB,OAAO,MAAM;AACnE,YAAM,oBAAyD,eAC3D,eAAe,gBAAgB,YAAY,mBAC5C;AACH,aAAO,IAAI;AAAA,QACV;AAAA,QACA,mBAAmB,KAAK;AAAA,QACxB,oBAAoB,EAAE,sBAAsB;AAAA,MAAA;AAAA,IAE9C;AAEA,UAAM,gBAAgB,SAAS,SAAA;AAE/B,QAAI,eAAe;AAClB,YAAM,uBAAuB,MAAM,KAAK,0BAA0B,OAAO,eAAe,OAAO,UAAU,UAAU;AACnH,UAAI,CAAC,qBAAqB,IAAI;AAC7B,eAAO;AAAA,MACR;AAAA,IACD;AAKA,UAAM,4BAA4B,OAAO,OAAO;AAIhD,WAAO,MAAM,UAAU,YAAY,OAAO,OAAgC;AACzE,YAAM,cAAc,MAAM,KAAK,oBAAoB,gBAAgB,IAAI,KAAK;AAC5E,UAAI,gBAAgB,MAAM;AACzB,eAAO,IAAI,cAAc,gBAAgB,QAAQ,WAAW,sCAAsC;AAAA,MACnG;AACA,YAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAI,sBAAsB,CAAC,GAAG,OAAO,WAAW,MAAM,CAAC,CAAC;AACvG,YAAM,SAAS,MAAM,GAAG,WAAW,QAAQ,IAAI,oBAAoB,EAAE,YAAY,OAAO,UAAU,0BAAA,CAA2B,CAAC;AAC9H,aAAO,IAAI,WAAW,IAAI,aAAa,QAAQ,yBAAyB,CAAC;AAAA,IAC1E,GAAG,EAAE,WAAW,iBAAiB;AAAA,EAClC;AACD;AAEO,MAAM,aAAa;AAAA,EACzB,YACiB,QACA,4BAAqC,OACpD;AAFe,SAAA,SAAA;AACA,SAAA,4BAAA;AAAA,EACd;AACJ;"}

package/dist/development/src/model/service/apiKey/ApiKeyManager.cjs

@@ -15,85 +15,85 @@ const ConfigurationQuery = require("../../queries/configuration/ConfigurationQue
 const IdentityQuery = require("../../queries/identity/IdentityQuery.cjs");
 require("../../authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../../authorization/CustomRolePermissions.cjs");
 require("../../authorization/PermissionContext.cjs");
-require("../../authorization/PermissionsFactory.cjs");
+require("../../authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
 const interval = require("../../utils/interval.cjs");
 const UnpersistedApiKeyManager = require("./UnpersistedApiKeyManager.cjs");
+const GlobalRoleValidator = require("../GlobalRoleValidator.cjs");
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
 class ApiKeyManager {
-  constructor(apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager = new UnpersistedApiKeyManager.UnpersistedApiKeyManager(), idpSessionRevalidator) {
+  constructor(apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager = new UnpersistedApiKeyManager.UnpersistedApiKeyManager(), idpSessionRevalidator, globalRoleValidator = new GlobalRoleValidator.GlobalRoleValidator()) {
     this.apiKeyService = apiKeyService;
     this.authPolicyResolver = authPolicyResolver;
     this.authLogService = authLogService;
     this.unpersistedApiKeyManager = unpersistedApiKeyManager;
     this.idpSessionRevalidator = idpSessionRevalidator;
+    this.globalRoleValidator = globalRoleValidator;
   }
   async verifyAndProlong(dbContext, readDbContext, token, requestInfo, forwardedInfo) {
     const unpersistedResult = this.unpersistedApiKeyManager.verify(token);
     if (unpersistedResult !== null) {
       return new Response.ResponseOk(unpersistedResult);
     }
-    const apiKeyRow = await readDbContext.queryHandler.fetch(new ApiKeyQuery.ApiKeyByTokenQuery(token));
-    if (apiKeyRow === null) {
+    const fetchedApiKey = await this.fetchApiKeyByToken(dbContext, readDbContext, token);
+    if (fetchedApiKey === null) {
       return new Response.ResponseError("not_found", "API key was not found");
     }
+    const apiKeyRow = fetchedApiKey.row;
     if (apiKeyRow.disabled_at !== null) {
       return new Response.ResponseError(
         "disabled",
         `API key was disabled at ${apiKeyRow.disabled_at.toISOString()}`
       );
     }
-    const now = dbContext.providers.now();
-    if (apiKeyRow.expires_at !== null && apiKeyRow.expires_at <= now) {
-      return new Response.ResponseError("disabled", `API key expired at ${apiKeyRow.expires_at.toISOString()}`);
+    if (apiKeyRow.is_expired) {
+      return new Response.ResponseError("disabled", `API key expired at ${apiKeyRow.expires_at?.toISOString()}`);
     }
-    if (apiKeyRow.max_expires_at !== null && apiKeyRow.max_expires_at <= now) {
+    if (apiKeyRow.is_max_expired) {
       await dbContext.commandBus.execute(new DisableApiKeyCommand.DisableApiKeyCommand(apiKeyRow.id));
       return new Response.ResponseError(
         "disabled",
-        `API key reached its maximum lifetime at ${apiKeyRow.max_expires_at.toISOString()}`
+        `API key reached its maximum lifetime at ${apiKeyRow.max_expires_at?.toISOString()}`
       );
     }
-    if (apiKeyRow.idle_timeout !== null && apiKeyRow.last_used_at !== null) {
-      const idleMs = interval.intervalToSeconds(apiKeyRow.idle_timeout) * 1e3;
-      if (now.getTime() - apiKeyRow.last_used_at.getTime() > idleMs + ProlongApiKeyCommand.PROLONG_THROTTLE_MS) {
-        await dbContext.commandBus.execute(new DisableApiKeyCommand.DisableApiKeyCommand(apiKeyRow.id));
-        try {
-          await this.authLogService.logSessionEvent(dbContext, {
-            type: "session_expired_idle",
-            identityId: apiKeyRow.identity_id,
-            personId: apiKeyRow.person_id,
-            ipAddress: requestInfo?.ip,
-            userAgent: requestInfo?.userAgent,
-            success: false,
-            eventData: {
-              lastUsedAt: apiKeyRow.last_used_at?.toISOString() ?? null,
-              idleTimeout: String(apiKeyRow.idle_timeout)
-            }
-          });
-        } catch {
-        }
-        return new Response.ResponseError(
-          "disabled",
-          `API key was idle since ${apiKeyRow.last_used_at.toISOString()} and exceeded the idle timeout`
-        );
+    if (apiKeyRow.is_idle_expired) {
+      await dbContext.commandBus.execute(new DisableApiKeyCommand.DisableApiKeyCommand(apiKeyRow.id));
+      try {
+        await this.authLogService.logSessionEvent(dbContext, {
+          type: "session_expired_idle",
+          identityId: apiKeyRow.identity_id,
+          personId: apiKeyRow.person_id,
+          ipAddress: requestInfo?.ip,
+          userAgent: requestInfo?.userAgent,
+          success: false,
+          eventData: {
+            lastUsedAt: apiKeyRow.last_used_at?.toISOString() ?? null,
+            idleTimeout: String(apiKeyRow.idle_timeout)
+          }
+        });
+      } catch {
       }
+      return new Response.ResponseError(
+        "disabled",
+        `API key was idle since ${apiKeyRow.last_used_at?.toISOString()} and exceeded the idle timeout`
+      );
     }
     const effectiveInfo = apiKeyRow.trust_forwarded_info && forwardedInfo ? {
       ip: forwardedInfo.ip ?? requestInfo?.ip,
       userAgent: forwardedInfo.userAgent ?? requestInfo?.userAgent
     } : requestInfo;
     if (this.idpSessionRevalidator) {
-      const outcome = await this.idpSessionRevalidator.revalidate(dbContext, readDbContext, apiKeyRow, effectiveInfo);
+      const outcome = await this.idpSessionRevalidator.revalidate(dbContext, fetchedApiKey.sourceDbContext, apiKeyRow, effectiveInfo);
       if (outcome === "revoked") {
         return new Response.ResponseError("disabled", "IdP session was revoked");
       }
     }
-    setImmediate(async () => {
-      await dbContext.commandBus.execute(
+    setImmediate(() => {
+      dbContext.commandBus.execute(
         new ProlongApiKeyCommand.ProlongApiKeyCommand(
           apiKeyRow.id,
           apiKeyRow.type,
@@ -107,7 +107,8 @@ class ApiKeyManager {
           },
           apiKeyRow.max_expires_at
         )
-      );
+      ).catch(() => {
+      });
     });
     return new Response.ResponseOk(
       new VerifyResult(
@@ -119,6 +120,18 @@ class ApiKeyManager {
       )
     );
   }
+  async fetchApiKeyByToken(dbContext, readDbContext, token) {
+    const query = new ApiKeyQuery.ApiKeyByTokenQuery(token);
+    const replicaRow = await readDbContext.queryHandler.fetch(query);
+    if (replicaRow !== null) {
+      return { row: replicaRow, sourceDbContext: readDbContext };
+    }
+    if (readDbContext.client.connection === dbContext.client.connection) {
+      return null;
+    }
+    const primaryRow = await dbContext.queryHandler.fetch(query);
+    return primaryRow !== null ? { row: primaryRow, sourceDbContext: dbContext } : null;
+  }
   async createSessionApiKey(dbContext, identityId, expiration, requestInfo, trustForwardedInfo) {
     const { token } = await this.createSessionApiKeyWithId(dbContext, identityId, expiration, requestInfo, trustForwardedInfo);
     return token;
@@ -139,8 +152,7 @@ class ApiKeyManager {
     if (policy.tokenExpiration) {
       expirationCapped = Math.min(expirationCapped, interval.intervalToSeconds(policy.tokenExpiration) / 60);
     }
-    const issuedAt = dbContext.providers.now();
-    const maxExpiresAt = policy.tokenExpiration ? new Date(issuedAt.getTime() + interval.intervalToSeconds(policy.tokenExpiration) * 1e3) : null;
+    const maxExpirationSeconds = policy.tokenExpiration ? interval.intervalToSeconds(policy.tokenExpiration) : null;
     const command = new CreateApiKeyCommand.CreateApiKeyCommand({
       type: ApiKey.ApiKey.Type.SESSION,
       identityId,
@@ -148,7 +160,7 @@ class ApiKeyManager {
       requestInfo,
       trustForwardedInfo,
       idleTimeout: policy.idleTimeout ? interval.intervalToPostgres(policy.idleTimeout) : null,
-      maxExpiresAt
+      maxExpirationSeconds
     });
     const { id, token } = await dbContext.commandBus.execute(command);
     assert(token !== void 0);
@@ -189,8 +201,12 @@ class ApiKeyManager {
   }
   async createGlobalPermanentApiKey(dbContext, description, roles, tokenHash, trustForwardedInfo) {
     return await dbContext.transaction(async (db) => {
+      const invalidRole = await this.globalRoleValidator.findInvalidRole(db, roles);
+      if (invalidRole !== null) {
+        return new Response.ResponseError("INVALID_ROLE", `Role ${invalidRole} is not valid or globally assignable`);
+      }
       return await this.apiKeyService.createPermanentApiKey(db, description, roles, tokenHash, trustForwardedInfo);
-    });
+    }, { isolation: "readCommitted" });
   }
   async createProjectPermanentApiKey(dbContext, projectId, memberships, description, tokenHash, trustForwardedInfo) {
     return await dbContext.transaction(async (db) => {