@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/bridges/system/IdentityFetcher.js

@@ -1,16 +1,19 @@
 import "../../model/authorization/PermissionActions.js";
 import "@contember/authorization";
-import "../../model/authorization/PermissionContext.js";
-import "../../model/authorization/PermissionsFactory.js";
-import "@contember/schema";
-import "../../model/type/ApiKey.js";
-import "@contember/database";
-import "node:crypto";
 import "../../model/queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../../model/type/ApiKey.js";
 import { PersonByIdentityBatchQuery } from "../../model/queries/person/PersonByIdentityBatchQuery.js";
 import { IdentityQuery } from "../../model/queries/identity/IdentityQuery.js";
+import "../../model/authorization/CustomRolePermissions.js";
+import "../../model/authorization/PermissionContext.js";
+import "../../model/authorization/TargetIdentityPermission.js";
+import "@contember/schema";
+import "node:crypto";
 import "node:assert";
 import "../../model/service/idp/IDPRevalidation.js";
+import "../../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -18,7 +21,6 @@ import "../../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../../model/service/idp/providers/FacebookProvider.js";
 import "../../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;

package/dist/production/src/bridges/system/IdentityFetcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityFetcher.js","sources":["../../../../../../packages/engine-tenant-api/src/bridges/system/IdentityFetcher.ts"],"sourcesContent":["import { Client } from '@contember/database'\nimport { IdentityQuery, PersonByIdentityBatchQuery } from '../../model/index.js'\n\nexport class IdentityFetcher {\n\tconstructor(\n\t\tprivate client: Client,\n\t) {\n\t}\n\n\tpublic async fetchIdentities(ids: string[]): Promise<Identity[]> {\n\t\tconst queryHandler = this.client.createQueryHandler()\n\t\tconst persons = await queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\tconst personIds = new Set(persons.map(it => it.identity_id))\n\t\tconst otherIdentityIds = ids.filter(it => !personIds.has(it))\n\t\tconst otherIdentities = await queryHandler.fetch(new IdentityQuery(otherIdentityIds))\n\n\t\treturn [\n\t\t\t...persons.map(\n\t\t\t\tit =>\n\t\t\t\t\tnew PersonIdentity(it.identity_id, {\n\t\t\t\t\t\tid: it.id,\n\t\t\t\t\t\tname: it.name ?? 'unnamed',\n\t\t\t\t\t}),\n\t\t\t),\n\t\t\t...otherIdentities.map(it => new ApiKeyIdentity(it.id, it.description)),\n\t\t]\n\t}\n}\n\nexport type Identity = PersonIdentity | ApiKeyIdentity\n\nexport class PersonIdentity {\n\tpublic readonly type = 'person' as const\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly person: {\n\t\t\tid: string\n\t\t\tname: string\n\t\t},\n\t) {}\n}\n\nexport class ApiKeyIdentity {\n\tpublic readonly type = 'apiKey' as const\n\n\tconstructor(public readonly identityId: string, public readonly description: string) {}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAGO,MAAM,gBAAgB;AAAA,EAC5B,YACS,QACP;AADO,SAAA,SAAA;AAAA,EAET;AAAA,EAEA,MAAa,gBAAgB,KAAoC;AAChE,UAAM,eAAe,KAAK,OAAO,mBAAA;AACjC,UAAM,UAAU,MAAM,aAAa,MAAM,IAAI,2BAA2B,GAAG,CAAC;AAC5E,UAAM,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAA,OAAM,GAAG,WAAW,CAAC;AAC3D,UAAM,mBAAmB,IAAI,OAAO,CAAA,OAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AAC5D,UAAM,kBAAkB,MAAM,aAAa,MAAM,IAAI,cAAc,gBAAgB,CAAC;AAEpF,WAAO;AAAA,MACN,GAAG,QAAQ;AAAA,QACV,CAAA,OACC,IAAI,eAAe,GAAG,aAAa;AAAA,UAClC,IAAI,GAAG;AAAA,UACP,MAAM,GAAG,QAAQ;AAAA,QAAA,CACjB;AAAA,MAAA;AAAA,MAEH,GAAG,gBAAgB,IAAI,CAAA,OAAM,IAAI,eAAe,GAAG,IAAI,GAAG,WAAW,CAAC;AAAA,IAAA;AAAA,EAExE;AACD;AAIO,MAAM,eAAe;AAAA,EAG3B,YACiB,YACA,QAIf;AALe,SAAA,aAAA;AACA,SAAA,SAAA;AAJjB,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAQpB;AACJ;AAEO,MAAM,eAAe;AAAA,EAG3B,YAA4B,YAAoC,aAAqB;AAAzD,SAAA,aAAA;AAAoC,SAAA,cAAA;AAFhE,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAE+D;AACvF;"}
+{"version":3,"file":"IdentityFetcher.js","sources":["../../../../../../packages/engine-tenant-api/src/bridges/system/IdentityFetcher.ts"],"sourcesContent":["import { Client } from '@contember/database'\nimport { IdentityQuery, PersonByIdentityBatchQuery } from '../../model/index.js'\n\nexport class IdentityFetcher {\n\tconstructor(\n\t\tprivate client: Client,\n\t) {\n\t}\n\n\tpublic async fetchIdentities(ids: string[]): Promise<Identity[]> {\n\t\tconst queryHandler = this.client.createQueryHandler()\n\t\tconst persons = await queryHandler.fetch(new PersonByIdentityBatchQuery(ids))\n\t\tconst personIds = new Set(persons.map(it => it.identity_id))\n\t\tconst otherIdentityIds = ids.filter(it => !personIds.has(it))\n\t\tconst otherIdentities = await queryHandler.fetch(new IdentityQuery(otherIdentityIds))\n\n\t\treturn [\n\t\t\t...persons.map(\n\t\t\t\tit =>\n\t\t\t\t\tnew PersonIdentity(it.identity_id, {\n\t\t\t\t\t\tid: it.id,\n\t\t\t\t\t\tname: it.name ?? 'unnamed',\n\t\t\t\t\t}),\n\t\t\t),\n\t\t\t...otherIdentities.map(it => new ApiKeyIdentity(it.id, it.description)),\n\t\t]\n\t}\n}\n\nexport type Identity = PersonIdentity | ApiKeyIdentity\n\nexport class PersonIdentity {\n\tpublic readonly type = 'person' as const\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly person: {\n\t\t\tid: string\n\t\t\tname: string\n\t\t},\n\t) {}\n}\n\nexport class ApiKeyIdentity {\n\tpublic readonly type = 'apiKey' as const\n\n\tconstructor(public readonly identityId: string, public readonly description: string) {}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAGO,MAAM,gBAAgB;AAAA,EAC5B,YACS,QACP;AADO,SAAA,SAAA;AAAA,EAET;AAAA,EAEA,MAAa,gBAAgB,KAAoC;AAChE,UAAM,eAAe,KAAK,OAAO,mBAAA;AACjC,UAAM,UAAU,MAAM,aAAa,MAAM,IAAI,2BAA2B,GAAG,CAAC;AAC5E,UAAM,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAA,OAAM,GAAG,WAAW,CAAC;AAC3D,UAAM,mBAAmB,IAAI,OAAO,CAAA,OAAM,CAAC,UAAU,IAAI,EAAE,CAAC;AAC5D,UAAM,kBAAkB,MAAM,aAAa,MAAM,IAAI,cAAc,gBAAgB,CAAC;AAEpF,WAAO;AAAA,MACN,GAAG,QAAQ;AAAA,QACV,CAAA,OACC,IAAI,eAAe,GAAG,aAAa;AAAA,UAClC,IAAI,GAAG;AAAA,UACP,MAAM,GAAG,QAAQ;AAAA,QAAA,CACjB;AAAA,MAAA;AAAA,MAEH,GAAG,gBAAgB,IAAI,CAAA,OAAM,IAAI,eAAe,GAAG,IAAI,GAAG,WAAW,CAAC;AAAA,IAAA;AAAA,EAExE;AACD;AAIO,MAAM,eAAe;AAAA,EAG3B,YACiB,YACA,QAIf;AALe,SAAA,aAAA;AACA,SAAA,SAAA;AAJjB,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAQpB;AACJ;AAEO,MAAM,eAAe;AAAA,EAG3B,YAA4B,YAAoC,aAAqB;AAAzD,SAAA,aAAA;AAAoC,SAAA,cAAA;AAFhE,kBAAA,MAAgB,QAAO,QAAA;AAAA,EAE+D;AACvF;"}

package/dist/production/src/migrations/2026-06-18-120000-idp-claim-mapping.cjs

@@ -0,0 +1,10 @@
+"use strict";
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_role_mapped';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_role_mapping_failed';
+`;
+async function _20260618120000idpclaimmapping(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260618120000idpclaimmapping;
+//# sourceMappingURL=2026-06-18-120000-idp-claim-mapping.cjs.map

package/dist/production/src/migrations/2026-06-18-120000-idp-claim-mapping.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-06-18-120000-idp-claim-mapping.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-06-18-120000-idp-claim-mapping.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// A09 — IdP claim mapping. The mapping itself rides inside the existing\n// `identity_provider.configuration` JSONB (`configuration.claimMapping`), so no table or column\n// change is needed. This migration only wires the call sites: the new `idp_role_mapped` audit\n// action emitted when claim-mapping (re)syncs project memberships, and `idp_role_mapping_failed`\n// emitted when a configured mapping failed and was skipped (fail-open).\nconst sql = `\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_role_mapped';\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_role_mapping_failed';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAOA,MAAM,MAAM;AAAA;AAAA;AAAA;AAKZ,eAAA,+BAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-06-18-120000-idp-claim-mapping.js

@@ -0,0 +1,11 @@
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_role_mapped';
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'idp_role_mapping_failed';
+`;
+async function _20260618120000idpclaimmapping(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260618120000idpclaimmapping as default
+};
+//# sourceMappingURL=2026-06-18-120000-idp-claim-mapping.js.map

package/dist/production/src/migrations/2026-06-18-120000-idp-claim-mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-06-18-120000-idp-claim-mapping.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-06-18-120000-idp-claim-mapping.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// A09 — IdP claim mapping. The mapping itself rides inside the existing\n// `identity_provider.configuration` JSONB (`configuration.claimMapping`), so no table or column\n// change is needed. This migration only wires the call sites: the new `idp_role_mapped` audit\n// action emitted when claim-mapping (re)syncs project memberships, and `idp_role_mapping_failed`\n// emitted when a configured mapping failed and was skipped (fail-open).\nconst sql = `\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_role_mapped';\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'idp_role_mapping_failed';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAOA,MAAM,MAAM;AAAA;AAAA;AAAA;AAKZ,eAAA,+BAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-08-03-120000-person-enable-auth-log.cjs

@@ -0,0 +1,9 @@
+"use strict";
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'person_enable';
+`;
+async function _20260803120000personenableauthlog(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260803120000personenableauthlog;
+//# sourceMappingURL=2026-08-03-120000-person-enable-auth-log.cjs.map

package/dist/production/src/migrations/2026-08-03-120000-person-enable-auth-log.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-08-03-120000-person-enable-auth-log.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-08-03-120000-person-enable-auth-log.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// New enum values are added in their own migration so the values are committed\n// before any later migration (or runtime code) inserts rows using them — a new\n// enum value cannot be used in the same transaction that adds it.\nconst sql = `\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'person_enable';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAKA,MAAM,MAAM;AAAA;AAAA;AAIZ,eAAA,mCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-08-03-120000-person-enable-auth-log.js

@@ -0,0 +1,10 @@
+const sql = `
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'person_enable';
+`;
+async function _20260803120000personenableauthlog(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260803120000personenableauthlog as default
+};
+//# sourceMappingURL=2026-08-03-120000-person-enable-auth-log.js.map

package/dist/production/src/migrations/2026-08-03-120000-person-enable-auth-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-08-03-120000-person-enable-auth-log.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-08-03-120000-person-enable-auth-log.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// New enum values are added in their own migration so the values are committed\n// before any later migration (or runtime code) inserts rows using them — a new\n// enum value cannot be used in the same transaction that adds it.\nconst sql = `\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'person_enable';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAKA,MAAM,MAAM;AAAA;AAAA;AAIZ,eAAA,mCAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-08-04-120000-config-panel.cjs

@@ -0,0 +1,11 @@
+"use strict";
+const sql = `
+ALTER TABLE "config"
+	ADD COLUMN "panel_global_roles"  TEXT[] NOT NULL DEFAULT '{super_admin,project_admin}',
+	ADD COLUMN "panel_project_roles" TEXT[] NOT NULL DEFAULT '{admin}';
+`;
+async function _20260804120000configpanel(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260804120000configpanel;
+//# sourceMappingURL=2026-08-04-120000-config-panel.cjs.map

package/dist/production/src/migrations/2026-08-04-120000-config-panel.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-08-04-120000-config-panel.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-08-04-120000-config-panel.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// Who may enter the management panel. Defaults reproduce the pre-config\n// behaviour (super admins and project admins), an empty list means nobody.\nconst sql = `\nALTER TABLE \"config\"\n\tADD COLUMN \"panel_global_roles\"  TEXT[] NOT NULL DEFAULT '{super_admin,project_admin}',\n\tADD COLUMN \"panel_project_roles\" TEXT[] NOT NULL DEFAULT '{admin}';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAIA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAMZ,eAAA,2BAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-08-04-120000-config-panel.js

@@ -0,0 +1,12 @@
+const sql = `
+ALTER TABLE "config"
+	ADD COLUMN "panel_global_roles"  TEXT[] NOT NULL DEFAULT '{super_admin,project_admin}',
+	ADD COLUMN "panel_project_roles" TEXT[] NOT NULL DEFAULT '{admin}';
+`;
+async function _20260804120000configpanel(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260804120000configpanel as default
+};
+//# sourceMappingURL=2026-08-04-120000-config-panel.js.map

package/dist/production/src/migrations/2026-08-04-120000-config-panel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-08-04-120000-config-panel.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-08-04-120000-config-panel.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// Who may enter the management panel. Defaults reproduce the pre-config\n// behaviour (super admins and project admins), an empty list means nobody.\nconst sql = `\nALTER TABLE \"config\"\n\tADD COLUMN \"panel_global_roles\"  TEXT[] NOT NULL DEFAULT '{super_admin,project_admin}',\n\tADD COLUMN \"panel_project_roles\" TEXT[] NOT NULL DEFAULT '{admin}';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAIA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAMZ,eAAA,2BAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-09-04-120000-idp-disable-local-authentication.cjs

@@ -0,0 +1,18 @@
+"use strict";
+const sql = `
+-- When TRUE, a person linked to this identity provider may authenticate ONLY through
+-- it: password sign-in, passwordless sign-in and password-reset mails are refused for
+-- them. The link itself is the marker, so it also covers a person who predates the
+-- provider and got linked by e-mail matching.
+--
+-- Scoped to providers that are currently enabled: disabling the provider restores
+-- local authentication for everyone linked to it, which is the break-glass for an IdP
+-- outage. Defaults to FALSE to preserve existing behavior.
+ALTER TABLE "identity_provider"
+	ADD COLUMN "disable_local_authentication" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260904120000idpdisablelocalauthentication(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260904120000idpdisablelocalauthentication;
+//# sourceMappingURL=2026-09-04-120000-idp-disable-local-authentication.cjs.map

package/dist/production/src/migrations/2026-09-04-120000-idp-disable-local-authentication.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-09-04-120000-idp-disable-local-authentication.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-09-04-120000-idp-disable-local-authentication.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- When TRUE, a person linked to this identity provider may authenticate ONLY through\n-- it: password sign-in, passwordless sign-in and password-reset mails are refused for\n-- them. The link itself is the marker, so it also covers a person who predates the\n-- provider and got linked by e-mail matching.\n--\n-- Scoped to providers that are currently enabled: disabling the provider restores\n-- local authentication for everyone linked to it, which is the break-glass for an IdP\n-- outage. Defaults to FALSE to preserve existing behavior.\nALTER TABLE \"identity_provider\"\n\tADD COLUMN \"disable_local_authentication\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaZ,eAAA,6CAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-09-04-120000-idp-disable-local-authentication.js

@@ -0,0 +1,19 @@
+const sql = `
+-- When TRUE, a person linked to this identity provider may authenticate ONLY through
+-- it: password sign-in, passwordless sign-in and password-reset mails are refused for
+-- them. The link itself is the marker, so it also covers a person who predates the
+-- provider and got linked by e-mail matching.
+--
+-- Scoped to providers that are currently enabled: disabling the provider restores
+-- local authentication for everyone linked to it, which is the break-glass for an IdP
+-- outage. Defaults to FALSE to preserve existing behavior.
+ALTER TABLE "identity_provider"
+	ADD COLUMN "disable_local_authentication" BOOLEAN NOT NULL DEFAULT FALSE;
+`;
+async function _20260904120000idpdisablelocalauthentication(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260904120000idpdisablelocalauthentication as default
+};
+//# sourceMappingURL=2026-09-04-120000-idp-disable-local-authentication.js.map

package/dist/production/src/migrations/2026-09-04-120000-idp-disable-local-authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-09-04-120000-idp-disable-local-authentication.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-09-04-120000-idp-disable-local-authentication.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\nconst sql = `\n-- When TRUE, a person linked to this identity provider may authenticate ONLY through\n-- it: password sign-in, passwordless sign-in and password-reset mails are refused for\n-- them. The link itself is the marker, so it also covers a person who predates the\n-- provider and got linked by e-mail matching.\n--\n-- Scoped to providers that are currently enabled: disabling the provider restores\n-- local authentication for everyone linked to it, which is the break-glass for an IdP\n-- outage. Defaults to FALSE to preserve existing behavior.\nALTER TABLE \"identity_provider\"\n\tADD COLUMN \"disable_local_authentication\" BOOLEAN NOT NULL DEFAULT FALSE;\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAEA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaZ,eAAA,6CAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/2026-09-11-120000-custom-role.cjs

@@ -0,0 +1,18 @@
+"use strict";
+const sql = `
+CREATE TABLE custom_role (
+	id          UUID PRIMARY KEY,
+	slug        TEXT NOT NULL UNIQUE,
+	description TEXT,
+	grants      JSONB NOT NULL CHECK (jsonb_typeof(grants) = 'array'),
+	created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+	updated_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'custom_role_change';
+`;
+async function _20260911120000customrole(builder) {
+  builder.sql(sql);
+}
+module.exports = _20260911120000customrole;
+//# sourceMappingURL=2026-09-11-120000-custom-role.cjs.map

package/dist/production/src/migrations/2026-09-11-120000-custom-role.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-09-11-120000-custom-role.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-09-11-120000-custom-role.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// Custom tenant roles: runtime-defined global roles carrying validated grants.\nconst sql = `\nCREATE TABLE custom_role (\n\tid          UUID PRIMARY KEY,\n\tslug        TEXT NOT NULL UNIQUE,\n\tdescription TEXT,\n\tgrants      JSONB NOT NULL CHECK (jsonb_typeof(grants) = 'array'),\n\tcreated_at  TIMESTAMPTZ NOT NULL DEFAULT now(),\n\tupdated_at  TIMESTAMPTZ NOT NULL DEFAULT now()\n);\n\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'custom_role_change';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":";AAGA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaZ,eAAA,0BAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;;"}

package/dist/production/src/migrations/2026-09-11-120000-custom-role.js

@@ -0,0 +1,19 @@
+const sql = `
+CREATE TABLE custom_role (
+	id          UUID PRIMARY KEY,
+	slug        TEXT NOT NULL UNIQUE,
+	description TEXT,
+	grants      JSONB NOT NULL CHECK (jsonb_typeof(grants) = 'array'),
+	created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
+	updated_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+ALTER TYPE "auth_log_type" ADD VALUE IF NOT EXISTS 'custom_role_change';
+`;
+async function _20260911120000customrole(builder) {
+  builder.sql(sql);
+}
+export {
+  _20260911120000customrole as default
+};
+//# sourceMappingURL=2026-09-11-120000-custom-role.js.map

package/dist/production/src/migrations/2026-09-11-120000-custom-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"2026-09-11-120000-custom-role.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/2026-09-11-120000-custom-role.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\n\n// Custom tenant roles: runtime-defined global roles carrying validated grants.\nconst sql = `\nCREATE TABLE custom_role (\n\tid          UUID PRIMARY KEY,\n\tslug        TEXT NOT NULL UNIQUE,\n\tdescription TEXT,\n\tgrants      JSONB NOT NULL CHECK (jsonb_typeof(grants) = 'array'),\n\tcreated_at  TIMESTAMPTZ NOT NULL DEFAULT now(),\n\tupdated_at  TIMESTAMPTZ NOT NULL DEFAULT now()\n);\n\nALTER TYPE \"auth_log_type\" ADD VALUE IF NOT EXISTS 'custom_role_change';\n`\n\nexport default async function(builder: MigrationBuilder) {\n\tbuilder.sql(sql)\n}\n"],"names":[],"mappings":"AAGA,MAAM,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaZ,eAAA,0BAA8B,SAA2B;AACxD,UAAQ,IAAI,GAAG;AAChB;"}

package/dist/production/src/migrations/runner.cjs

@@ -63,17 +63,25 @@ const _20260526140000IdpSession = require("./2026-05-26-140000-idp-session.cjs")
 const _20260608100000IdpAssumeEmailVerified = require("./2026-06-08-100000-idp-assume-email-verified.cjs");
 const _20260616120000LoginAnomalyDetection = require("./2026-06-16-120000-login-anomaly-detection.cjs");
 const _20260616130000IdpLogout = require("./2026-06-16-130000-idp-logout.cjs");
+const _20260618120000IdpClaimMapping = require("./2026-06-18-120000-idp-claim-mapping.cjs");
+const _20260803120000PersonEnableAuthLog = require("./2026-08-03-120000-person-enable-auth-log.cjs");
+const _20260804120000ConfigPanel = require("./2026-08-04-120000-config-panel.cjs");
+const _20260904120000IdpDisableLocalAuthentication = require("./2026-09-04-120000-idp-disable-local-authentication.cjs");
+const _20260911120000CustomRole = require("./2026-09-11-120000-custom-role.cjs");
 const snapshot = require("./snapshot.cjs");
 require("../model/authorization/PermissionActions.cjs");
 require("@contember/authorization");
+require("../model/queries/apiKey/ApiKeyQuery.cjs");
+require("../model/type/ApiKey.cjs");
+require("../model/authorization/CustomRolePermissions.cjs");
 require("../model/authorization/PermissionContext.cjs");
-require("../model/authorization/PermissionsFactory.cjs");
+require("../model/authorization/TargetIdentityPermission.cjs");
 require("@contember/schema");
-require("../model/type/ApiKey.cjs");
 const token = require("../model/utils/token.cjs");
-require("../model/queries/apiKey/ApiKeyQuery.cjs");
 require("node:assert");
 require("../model/service/idp/IDPRevalidation.cjs");
+require("../model/service/idp/ClaimMapping.cjs");
+require("@contember/schema-utils");
 require("../model/service/idp/providers/AppleProvider.cjs");
 require("openid-client");
 require("@contember/typesafe");
@@ -81,7 +89,6 @@ require("../model/service/idp/providers/OIDCTypes.cjs");
 require("jose");
 require("../model/service/idp/providers/FacebookProvider.cjs");
 require("../model/service/AuthLogService.cjs");
-require("@contember/schema-utils");
 require("otpauth");
 const migrations = {
   "2018-08-02-174310-init": _20180802174310Init,
@@ -144,7 +151,12 @@ const migrations = {
   "2026-05-26-140000-idp-session": _20260526140000IdpSession,
   "2026-06-08-100000-idp-assume-email-verified": _20260608100000IdpAssumeEmailVerified,
   "2026-06-16-120000-login-anomaly-detection": _20260616120000LoginAnomalyDetection,
-  "2026-06-16-130000-idp-logout": _20260616130000IdpLogout
+  "2026-06-16-130000-idp-logout": _20260616130000IdpLogout,
+  "2026-06-18-120000-idp-claim-mapping": _20260618120000IdpClaimMapping,
+  "2026-08-03-120000-person-enable-auth-log": _20260803120000PersonEnableAuthLog,
+  "2026-08-04-120000-config-panel": _20260804120000ConfigPanel,
+  "2026-09-04-120000-idp-disable-local-authentication": _20260904120000IdpDisableLocalAuthentication,
+  "2026-09-11-120000-custom-role": _20260911120000CustomRole
 };
 class TenantMigrationsRunner {
   constructor(db, schema, tenantCredentials, providers) {

package/dist/production/src/migrations/runner.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"runner.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/runner.ts"],"sourcesContent":["import { Connection, createDatabaseIfNotExists, DatabaseConfig, EventManager } from '@contember/database'\nimport { TenantMigrationArgs } from './types.js'\nimport { MigrationsRunner as DbMigrationsRunner, SnapshotMigrationResolver } from '@contember/database-migrations'\nimport _20180802174310init from './2018-08-02-174310-init.js'\nimport _20180903140621identityproject from './2018-09-03-140621-identity-project.js'\nimport _20181026165450setupapikey from './2018-10-26-165450-setup-api-key.js'\nimport _20181026175155variables from './2018-10-26-175155-variables.js'\nimport _20190218110949projectslug from './2019-02-18-110949-project-slug.js'\nimport _20190218160155sessionexpiration from './2019-02-18-160155-session-expiration.js'\nimport _20190503163729apikeydisabledat from './2019-05-03-163729-api-key-disabled-at.js'\nimport _20190814153300projectslugunique from './2019-08-14-153300-project-slug-unique.js'\nimport _20190906111000membership from './2019-09-06-111000-membership.js'\nimport _20190906111001dropoldmember from './2019-09-06-111001-drop-old-member.js'\nimport _20200129idenitynote from './2020-01-29-idenity-note.js'\nimport _20200417fixpersonindex from './2020-04-17-fix-person-index.js'\nimport _20200501170000apikeyindex from './2020-05-01-170000-api-key-index.js'\nimport _20200608134000tenantcredentials from './2020-06-08-134000-tenant-credentials.js'\nimport _20200807110000personotp from './2020-08-07-110000-person-otp.js'\nimport _20200817162200mailtemplates from './2020-08-17-162200-mail-templates.js'\nimport _20200821143400personpasswordreset from './2020-08-21-143400-person-password-reset.js'\nimport _20200907094200identityprovider from './2020-09-07-094200-identity-provider.js'\nimport _20210328134000timestamp from './2021-03-28-134000-timestamp.js'\nimport _20210726105000projectconfig from './2021-07-26-105000-project-config.js'\nimport _20210726132000projectsecrets from './2021-07-26-132000-project-secrets.js'\nimport _20210727174000projectaliasindex from './2021-07-27-174000-project-alias-index.js'\nimport _20211124130000personpasswordnull from './2021-11-24-130000-person-password-null.js'\nimport _20211124161500mailtemplateprojectnull from './2021-11-24-161500-mail-template-project-null.js'\nimport _20220104144000personuniqueidentity from './2022-01-04-144000-person-unique-identity.js'\nimport _20220209111800fixcrypted from './2022-02-09-111800-fix-crypted.js'\nimport _20220211153000idpautosignup from './2022-02-11-153000-idp-auto-sign-up.js'\nimport _20220629105000personidp from './2022-06-29-105000-person-idp.js'\nimport _20220707135000personemailoptuniq from './2022-07-07-135000-person-email-opt-uniq.js'\nimport _20220707141000persondisplayname from './2022-07-07-141000-person-display-name.js'\nimport _20220714145000personloginoptions from './2022-07-14-145000-person-login-options.js'\nimport _20221108projectupdatenotification from './2022-11-08-project-update-notification.js'\nimport _20230120135500personemailnormalize from './2023-01-20-135500-person-email-normalize.js'\nimport _20230603104000persondisabled from './2023-06-03-104000-person-disabled.js'\nimport _20230901165000idpreturnconfig from './2023-09-01-165000-idp-return-config.js'\nimport _20240620140000mailreply from './2024-06-20-140000-mail-reply.js'\nimport _20240826120000passwordless from './2024-08-26-120000-passwordless.js'\nimport _20250416180000configup from './2025-04-16-180000-config-up.js'\nimport _20250417160000authlog from './2025-04-17-160000-auth-log.js'\nimport _20260512120000apikeysessiontracking from './2026-05-12-120000-api-key-session-tracking.js'\nimport _20260512130000apikeytrustforwardedinfo from './2026-05-12-130000-api-key-trust-forwarded-info.js'\nimport _20260513120000authlogeventdata from './2026-05-13-120000-auth-log-event-data.js'\nimport _20260513130000antiabuse from './2026-05-13-130000-anti-abuse.js'\nimport _20260514100000authlogadminactions from './2026-05-14-100000-auth-log-admin-actions.js'\nimport _20260515120000configreveallogmethod from './2026-05-15-120000-config-reveal-login-method.js'\nimport _20260521100000personmfa from './2026-05-21-100000-person-mfa.js'\nimport _20260521110000mfafoundation from './2026-05-21-110000-mfa-foundation.js'\nimport _20260521120000emailotp from './2026-05-21-120000-email-otp.js'\nimport _20260521130000apikeysessionpolicy from './2026-05-21-130000-api-key-session-policy.js'\nimport _20260521140000mfagraceduration from './2026-05-21-140000-mfa-grace-duration.js'\nimport _20260521150000emailotpratelimit from './2026-05-21-150000-email-otp-rate-limit.js'\nimport _20260526120000emailverificationtypes from './2026-05-26-120000-email-verification-types.js'\nimport _20260526120010emailverification from './2026-05-26-120010-email-verification.js'\nimport _20260526130000emailchangeverificationconfig from './2026-05-26-130000-email-change-verification-config.js'\nimport _20260526130010idprequireverifiedemail from './2026-05-26-130010-idp-require-verified-email.js'\nimport _20260526130020emailverificationratelimit from './2026-05-26-130020-email-verification-rate-limit.js'\nimport _20260526130030captchaprotectflows from './2026-05-26-130030-captcha-protect-flows.js'\nimport _20260526140000idpsession from './2026-05-26-140000-idp-session.js'\nimport _20260608100000idpassumeemailverified from './2026-06-08-100000-idp-assume-email-verified.js'\nimport _20260616120000loginanomalydetection from './2026-06-16-120000-login-anomaly-detection.js'\nimport _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'\nimport snapshot from './snapshot.js'\nimport { computeTokenHash, Providers } from '../model/index.js'\nimport { Logger } from '@contember/logger'\n\nexport interface TenantCredentials {\n\tloginToken?: string\n\trootEmail?: string\n\trootToken?: string\n\trootTokenHash?: string\n\trootPassword?: string\n\t/**\n\t * Unpersisted root tokens (plain values). When set, these tokens are\n\t * verified at runtime and resolve to a super-admin identity without being\n\t * stored in the database. Useful for easy rotation.\n\t */\n\trootTokens?: readonly string[]\n\t/**\n\t * Unpersisted root token hashes (sha256 hex). Same as {@link rootTokens} but\n\t * the plain token never needs to be passed to the engine.\n\t */\n\trootTokenHashes?: readonly string[]\n}\n\nconst migrations = {\n\t'2018-08-02-174310-init': _20180802174310init,\n\t'2018-09-03-140621-identity-project': _20180903140621identityproject,\n\t'2018-10-26-165450-setup-api-key': _20181026165450setupapikey,\n\t'2018-10-26-175155-variables': _20181026175155variables,\n\t'2019-02-18-110949-project-slug': _20190218110949projectslug,\n\t'2019-02-18-160155-session-expiration': _20190218160155sessionexpiration,\n\t'2019-05-03-163729-api-key-disabled-at': _20190503163729apikeydisabledat,\n\t'2019-08-14-153300-project-slug-unique': _20190814153300projectslugunique,\n\t'2019-09-06-111000-membership': _20190906111000membership,\n\t'2019-09-06-111001-drop-old-member': _20190906111001dropoldmember,\n\t'2020-01-29-idenity-note': _20200129idenitynote,\n\t'2020-04-17-fix-person-index': _20200417fixpersonindex,\n\t'2020-05-01-170000-api-key-index': _20200501170000apikeyindex,\n\t'2020-06-08-134000-tenant-credentials': _20200608134000tenantcredentials,\n\t'2020-08-07-110000-person-otp': _20200807110000personotp,\n\t'2020-08-17-162200-mail-templates': _20200817162200mailtemplates,\n\t'2020-08-21-143400-person-password-reset': _20200821143400personpasswordreset,\n\t'2020-09-07-094200-identity-provider': _20200907094200identityprovider,\n\t'2021-03-28-134000-timestamp': _20210328134000timestamp,\n\t'2021-07-26-105000-project-config': _20210726105000projectconfig,\n\t'2021-07-26-132000-project-secrets': _20210726132000projectsecrets,\n\t'2021-07-27-174000-project-alias-index': _20210727174000projectaliasindex,\n\t'2021-11-24-130000-person-password-null': _20211124130000personpasswordnull,\n\t'2021-11-24-161500-mail-template-project-null': _20211124161500mailtemplateprojectnull,\n\t'2022-01-04-144000-person-unique-identity': _20220104144000personuniqueidentity,\n\t'2022-02-09-111800-fix-crypted': _20220209111800fixcrypted,\n\t'2022-02-11-153000-idp-auto-sign-up': _20220211153000idpautosignup,\n\t'2022-06-29-105000-person-idp': _20220629105000personidp,\n\t'2022-07-07-135000-person-email-opt-uniq': _20220707135000personemailoptuniq,\n\t'2022-07-07-141000-person-display-name': _20220707141000persondisplayname,\n\t'2022-07-14-145000-person-login-options': _20220714145000personloginoptions,\n\t'2022-11-08-project-update-notification': _20221108projectupdatenotification,\n\t'2023-01-20-135500-person-email-normalize': _20230120135500personemailnormalize,\n\t'2023-06-03-104000-person-disabled': _20230603104000persondisabled,\n\t'2023-09-01-165000-idp-return-config': _20230901165000idpreturnconfig,\n\t'2024-06-20-140000-mail-reply': _20240620140000mailreply,\n\t'2024-08-26-120000-passwordless': _20240826120000passwordless,\n\t'2025-04-16-180000-config-up': _20250416180000configup,\n\t'2025-04-17-160000-auth-log': _20250417160000authlog,\n\t'2026-05-12-120000-api-key-session-tracking': _20260512120000apikeysessiontracking,\n\t'2026-05-12-130000-api-key-trust-forwarded-info': _20260512130000apikeytrustforwardedinfo,\n\t'2026-05-13-120000-auth-log-event-data': _20260513120000authlogeventdata,\n\t'2026-05-13-130000-anti-abuse': _20260513130000antiabuse,\n\t'2026-05-14-100000-auth-log-admin-actions': _20260514100000authlogadminactions,\n\t'2026-05-15-120000-config-reveal-login-method': _20260515120000configreveallogmethod,\n\t'2026-05-21-100000-person-mfa': _20260521100000personmfa,\n\t'2026-05-21-110000-mfa-foundation': _20260521110000mfafoundation,\n\t'2026-05-21-120000-email-otp': _20260521120000emailotp,\n\t'2026-05-21-130000-api-key-session-policy': _20260521130000apikeysessionpolicy,\n\t'2026-05-21-140000-mfa-grace-duration': _20260521140000mfagraceduration,\n\t'2026-05-21-150000-email-otp-rate-limit': _20260521150000emailotpratelimit,\n\t'2026-05-26-120000-email-verification-types': _20260526120000emailverificationtypes,\n\t'2026-05-26-120010-email-verification': _20260526120010emailverification,\n\t'2026-05-26-130000-email-change-verification-config': _20260526130000emailchangeverificationconfig,\n\t'2026-05-26-130010-idp-require-verified-email': _20260526130010idprequireverifiedemail,\n\t'2026-05-26-130020-email-verification-rate-limit': _20260526130020emailverificationratelimit,\n\t'2026-05-26-130030-captcha-protect-flows': _20260526130030captchaprotectflows,\n\t'2026-05-26-140000-idp-session': _20260526140000idpsession,\n\t'2026-06-08-100000-idp-assume-email-verified': _20260608100000idpassumeemailverified,\n\t'2026-06-16-120000-login-anomaly-detection': _20260616120000loginanomalydetection,\n\t'2026-06-16-130000-idp-logout': _20260616130000idplogout,\n}\n\nexport class TenantMigrationsRunner {\n\tconstructor(\n\t\tprivate readonly db: DatabaseConfig,\n\t\tprivate readonly schema: string,\n\t\tprivate readonly tenantCredentials: TenantCredentials,\n\t\tprivate readonly providers: Pick<Providers, 'bcrypt' | 'uuid'>,\n\t) {\n\t}\n\n\tpublic async run(logger: Logger): Promise<{ name: string }[]> {\n\t\tawait createDatabaseIfNotExists(this.db, message => typeof message === 'string' ? logger.warn(message) : logger.error(message))\n\t\tconst connection = Connection.createSingle(this.db, err => logger.error(err))\n\t\tconst result = await connection.scope(async connection => {\n\t\t\tconst migrationsResolver = new SnapshotMigrationResolver(snapshot, migrations)\n\n\t\t\tconst innerRunner = new DbMigrationsRunner<TenantMigrationArgs>(connection, this.schema, migrationsResolver)\n\t\t\treturn await innerRunner.migrate(message => logger.warn(message), {\n\t\t\t\tgetCredentials: async () => ({\n\t\t\t\t\tloginTokenHash: this.tenantCredentials.loginToken ? computeTokenHash(this.tenantCredentials.loginToken) : undefined,\n\t\t\t\t\trootTokenHash: this.tenantCredentials.rootTokenHash\n\t\t\t\t\t\t?? (this.tenantCredentials.rootToken ? computeTokenHash(this.tenantCredentials.rootToken) : undefined),\n\t\t\t\t\trootEmail: this.tenantCredentials.rootEmail,\n\t\t\t\t\trootPasswordBcrypted: this.tenantCredentials.rootPassword ? await this.providers.bcrypt(this.tenantCredentials.rootPassword) : undefined,\n\t\t\t\t}),\n\t\t\t\tproviders: this.providers,\n\t\t\t})\n\t\t})\n\t\tawait connection.end()\n\t\treturn result\n\t}\n}\n"],"names":["_20180802174310init","_20180903140621identityproject","_20181026165450setupapikey","_20181026175155variables","_20190218110949projectslug","_20190218160155sessionexpiration","_20190503163729apikeydisabledat","_20190814153300projectslugunique","_20190906111000membership","_20190906111001dropoldmember","_20200129idenitynote","_20200417fixpersonindex","_20200501170000apikeyindex","_20200608134000tenantcredentials","_20200807110000personotp","_20200817162200mailtemplates","_20200821143400personpasswordreset","_20200907094200identityprovider","_20210328134000timestamp","_20210726105000projectconfig","_20210726132000projectsecrets","_20210727174000projectaliasindex","_20211124130000personpasswordnull","_20211124161500mailtemplateprojectnull","_20220104144000personuniqueidentity","_20220209111800fixcrypted","_20220211153000idpautosignup","_20220629105000personidp","_20220707135000personemailoptuniq","_20220707141000persondisplayname","_20220714145000personloginoptions","_20221108projectupdatenotification","_20230120135500personemailnormalize","_20230603104000persondisabled","_20230901165000idpreturnconfig","_20240620140000mailreply","_20240826120000passwordless","_20250416180000configup","_20250417160000authlog","_20260512120000apikeysessiontracking","_20260512130000apikeytrustforwardedinfo","_20260513120000authlogeventdata","_20260513130000antiabuse","_20260514100000authlogadminactions","_20260515120000configreveallogmethod","_20260521100000personmfa","_20260521110000mfafoundation","_20260521120000emailotp","_20260521130000apikeysessionpolicy","_20260521140000mfagraceduration","_20260521150000emailotpratelimit","_20260526120000emailverificationtypes","_20260526120010emailverification","_20260526130000emailchangeverificationconfig","_20260526130010idprequireverifiedemail","_20260526130020emailverificationratelimit","_20260526130030captchaprotectflows","_20260526140000idpsession","_20260608100000idpassumeemailverified","_20260616120000loginanomalydetection","_20260616130000idplogout","createDatabaseIfNotExists","Connection","connection","SnapshotMigrationResolver","DbMigrationsRunner","computeTokenHash"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,MAAM,aAAa;AAAA,EAClB,0BAA0BA;AAAAA,EAC1B,sCAAsCC;AAAAA,EACtC,mCAAmCC;AAAAA,EACnC,+BAA+BC;AAAAA,EAC/B,kCAAkCC;AAAAA,EAClC,wCAAwCC;AAAAA,EACxC,yCAAyCC;AAAAA,EACzC,yCAAyCC;AAAAA,EACzC,gCAAgCC;AAAAA,EAChC,qCAAqCC;AAAAA,EACrC,2BAA2BC;AAAAA,EAC3B,+BAA+BC;AAAAA,EAC/B,mCAAmCC;AAAAA,EACnC,wCAAwCC;AAAAA,EACxC,gCAAgCC;AAAAA,EAChC,oCAAoCC;AAAAA,EACpC,2CAA2CC;AAAAA,EAC3C,uCAAuCC;AAAAA,EACvC,+BAA+BC;AAAAA,EAC/B,oCAAoCC;AAAAA,EACpC,qCAAqCC;AAAAA,EACrC,yCAAyCC;AAAAA,EACzC,0CAA0CC;AAAAA,EAC1C,gDAAgDC;AAAAA,EAChD,4CAA4CC;AAAAA,EAC5C,iCAAiCC;AAAAA,EACjC,sCAAsCC;AAAAA,EACtC,gCAAgCC;AAAAA,EAChC,2CAA2CC;AAAAA,EAC3C,yCAAyCC;AAAAA,EACzC,0CAA0CC;AAAAA,EAC1C,0CAA0CC;AAAAA,EAC1C,4CAA4CC;AAAAA,EAC5C,qCAAqCC;AAAAA,EACrC,uCAAuCC;AAAAA,EACvC,gCAAgCC;AAAAA,EAChC,kCAAkCC;AAAAA,EAClC,+BAA+BC;AAAAA,EAC/B,8BAA8BC;AAAAA,EAC9B,8CAA8CC;AAAAA,EAC9C,kDAAkDC;AAAAA,EAClD,yCAAyCC;AAAAA,EACzC,gCAAgCC;AAAAA,EAChC,4CAA4CC;AAAAA,EAC5C,gDAAgDC;AAAAA,EAChD,gCAAgCC;AAAAA,EAChC,oCAAoCC;AAAAA,EACpC,+BAA+BC;AAAAA,EAC/B,4CAA4CC;AAAAA,EAC5C,wCAAwCC;AAAAA,EACxC,0CAA0CC;AAAAA,EAC1C,8CAA8CC;AAAAA,EAC9C,wCAAwCC;AAAAA,EACxC,sDAAsDC;AAAAA,EACtD,gDAAgDC;AAAAA,EAChD,mDAAmDC;AAAAA,EACnD,2CAA2CC;AAAAA,EAC3C,iCAAiCC;AAAAA,EACjC,+CAA+CC;AAAAA,EAC/C,6CAA6CC;AAAAA,EAC7C,gCAAgCC;AACjC;AAEO,MAAM,uBAAuB;AAAA,EACnC,YACkB,IACA,QACA,mBACA,WAChB;AAJgB,SAAA,KAAA;AACA,SAAA,SAAA;AACA,SAAA,oBAAA;AACA,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,IAAI,QAA6C;AAC7D,UAAMC,SAAAA,0BAA0B,KAAK,IAAI,CAAA,YAAW,OAAO,YAAY,WAAW,OAAO,KAAK,OAAO,IAAI,OAAO,MAAM,OAAO,CAAC;AAC9H,UAAM,aAAaC,SAAAA,WAAW,aAAa,KAAK,IAAI,CAAA,QAAO,OAAO,MAAM,GAAG,CAAC;AAC5E,UAAM,SAAS,MAAM,WAAW,MAAM,OAAMC,gBAAc;AACzD,YAAM,qBAAqB,IAAIC,6CAA0B,UAAU,UAAU;AAE7E,YAAM,cAAc,IAAIC,mBAAAA,iBAAwCF,aAAY,KAAK,QAAQ,kBAAkB;AAC3G,aAAO,MAAM,YAAY,QAAQ,aAAW,OAAO,KAAK,OAAO,GAAG;AAAA,QACjE,gBAAgB,aAAa;AAAA,UAC5B,gBAAgB,KAAK,kBAAkB,aAAaG,MAAAA,iBAAiB,KAAK,kBAAkB,UAAU,IAAI;AAAA,UAC1G,eAAe,KAAK,kBAAkB,kBACjC,KAAK,kBAAkB,YAAYA,MAAAA,iBAAiB,KAAK,kBAAkB,SAAS,IAAI;AAAA,UAC7F,WAAW,KAAK,kBAAkB;AAAA,UAClC,sBAAsB,KAAK,kBAAkB,eAAe,MAAM,KAAK,UAAU,OAAO,KAAK,kBAAkB,YAAY,IAAI;AAAA,QAAA;AAAA,QAEhI,WAAW,KAAK;AAAA,MAAA,CAChB;AAAA,IACF,CAAC;AACD,UAAM,WAAW,IAAA;AACjB,WAAO;AAAA,EACR;AACD;;"}
+{"version":3,"file":"runner.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/runner.ts"],"sourcesContent":["import { Connection, createDatabaseIfNotExists, DatabaseConfig, EventManager } from '@contember/database'\nimport { TenantMigrationArgs } from './types.js'\nimport { MigrationsRunner as DbMigrationsRunner, SnapshotMigrationResolver } from '@contember/database-migrations'\nimport _20180802174310init from './2018-08-02-174310-init.js'\nimport _20180903140621identityproject from './2018-09-03-140621-identity-project.js'\nimport _20181026165450setupapikey from './2018-10-26-165450-setup-api-key.js'\nimport _20181026175155variables from './2018-10-26-175155-variables.js'\nimport _20190218110949projectslug from './2019-02-18-110949-project-slug.js'\nimport _20190218160155sessionexpiration from './2019-02-18-160155-session-expiration.js'\nimport _20190503163729apikeydisabledat from './2019-05-03-163729-api-key-disabled-at.js'\nimport _20190814153300projectslugunique from './2019-08-14-153300-project-slug-unique.js'\nimport _20190906111000membership from './2019-09-06-111000-membership.js'\nimport _20190906111001dropoldmember from './2019-09-06-111001-drop-old-member.js'\nimport _20200129idenitynote from './2020-01-29-idenity-note.js'\nimport _20200417fixpersonindex from './2020-04-17-fix-person-index.js'\nimport _20200501170000apikeyindex from './2020-05-01-170000-api-key-index.js'\nimport _20200608134000tenantcredentials from './2020-06-08-134000-tenant-credentials.js'\nimport _20200807110000personotp from './2020-08-07-110000-person-otp.js'\nimport _20200817162200mailtemplates from './2020-08-17-162200-mail-templates.js'\nimport _20200821143400personpasswordreset from './2020-08-21-143400-person-password-reset.js'\nimport _20200907094200identityprovider from './2020-09-07-094200-identity-provider.js'\nimport _20210328134000timestamp from './2021-03-28-134000-timestamp.js'\nimport _20210726105000projectconfig from './2021-07-26-105000-project-config.js'\nimport _20210726132000projectsecrets from './2021-07-26-132000-project-secrets.js'\nimport _20210727174000projectaliasindex from './2021-07-27-174000-project-alias-index.js'\nimport _20211124130000personpasswordnull from './2021-11-24-130000-person-password-null.js'\nimport _20211124161500mailtemplateprojectnull from './2021-11-24-161500-mail-template-project-null.js'\nimport _20220104144000personuniqueidentity from './2022-01-04-144000-person-unique-identity.js'\nimport _20220209111800fixcrypted from './2022-02-09-111800-fix-crypted.js'\nimport _20220211153000idpautosignup from './2022-02-11-153000-idp-auto-sign-up.js'\nimport _20220629105000personidp from './2022-06-29-105000-person-idp.js'\nimport _20220707135000personemailoptuniq from './2022-07-07-135000-person-email-opt-uniq.js'\nimport _20220707141000persondisplayname from './2022-07-07-141000-person-display-name.js'\nimport _20220714145000personloginoptions from './2022-07-14-145000-person-login-options.js'\nimport _20221108projectupdatenotification from './2022-11-08-project-update-notification.js'\nimport _20230120135500personemailnormalize from './2023-01-20-135500-person-email-normalize.js'\nimport _20230603104000persondisabled from './2023-06-03-104000-person-disabled.js'\nimport _20230901165000idpreturnconfig from './2023-09-01-165000-idp-return-config.js'\nimport _20240620140000mailreply from './2024-06-20-140000-mail-reply.js'\nimport _20240826120000passwordless from './2024-08-26-120000-passwordless.js'\nimport _20250416180000configup from './2025-04-16-180000-config-up.js'\nimport _20250417160000authlog from './2025-04-17-160000-auth-log.js'\nimport _20260512120000apikeysessiontracking from './2026-05-12-120000-api-key-session-tracking.js'\nimport _20260512130000apikeytrustforwardedinfo from './2026-05-12-130000-api-key-trust-forwarded-info.js'\nimport _20260513120000authlogeventdata from './2026-05-13-120000-auth-log-event-data.js'\nimport _20260513130000antiabuse from './2026-05-13-130000-anti-abuse.js'\nimport _20260514100000authlogadminactions from './2026-05-14-100000-auth-log-admin-actions.js'\nimport _20260515120000configreveallogmethod from './2026-05-15-120000-config-reveal-login-method.js'\nimport _20260521100000personmfa from './2026-05-21-100000-person-mfa.js'\nimport _20260521110000mfafoundation from './2026-05-21-110000-mfa-foundation.js'\nimport _20260521120000emailotp from './2026-05-21-120000-email-otp.js'\nimport _20260521130000apikeysessionpolicy from './2026-05-21-130000-api-key-session-policy.js'\nimport _20260521140000mfagraceduration from './2026-05-21-140000-mfa-grace-duration.js'\nimport _20260521150000emailotpratelimit from './2026-05-21-150000-email-otp-rate-limit.js'\nimport _20260526120000emailverificationtypes from './2026-05-26-120000-email-verification-types.js'\nimport _20260526120010emailverification from './2026-05-26-120010-email-verification.js'\nimport _20260526130000emailchangeverificationconfig from './2026-05-26-130000-email-change-verification-config.js'\nimport _20260526130010idprequireverifiedemail from './2026-05-26-130010-idp-require-verified-email.js'\nimport _20260526130020emailverificationratelimit from './2026-05-26-130020-email-verification-rate-limit.js'\nimport _20260526130030captchaprotectflows from './2026-05-26-130030-captcha-protect-flows.js'\nimport _20260526140000idpsession from './2026-05-26-140000-idp-session.js'\nimport _20260608100000idpassumeemailverified from './2026-06-08-100000-idp-assume-email-verified.js'\nimport _20260616120000loginanomalydetection from './2026-06-16-120000-login-anomaly-detection.js'\nimport _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'\nimport _20260618120000idpclaimmapping from './2026-06-18-120000-idp-claim-mapping.js'\nimport _20260803120000personenableauthlog from './2026-08-03-120000-person-enable-auth-log.js'\nimport _20260804120000configpanel from './2026-08-04-120000-config-panel.js'\nimport _20260904120000idpdisablelocalauthentication from './2026-09-04-120000-idp-disable-local-authentication.js'\nimport _20260911120000customrole from './2026-09-11-120000-custom-role.js'\nimport snapshot from './snapshot.js'\nimport { computeTokenHash, Providers } from '../model/index.js'\nimport { Logger } from '@contember/logger'\n\nexport interface TenantCredentials {\n\tloginToken?: string\n\trootEmail?: string\n\trootToken?: string\n\trootTokenHash?: string\n\trootPassword?: string\n\t/**\n\t * Unpersisted root tokens (plain values). When set, these tokens are\n\t * verified at runtime and resolve to a super-admin identity without being\n\t * stored in the database. Useful for easy rotation.\n\t */\n\trootTokens?: readonly string[]\n\t/**\n\t * Unpersisted root token hashes (sha256 hex). Same as {@link rootTokens} but\n\t * the plain token never needs to be passed to the engine.\n\t */\n\trootTokenHashes?: readonly string[]\n}\n\nconst migrations = {\n\t'2018-08-02-174310-init': _20180802174310init,\n\t'2018-09-03-140621-identity-project': _20180903140621identityproject,\n\t'2018-10-26-165450-setup-api-key': _20181026165450setupapikey,\n\t'2018-10-26-175155-variables': _20181026175155variables,\n\t'2019-02-18-110949-project-slug': _20190218110949projectslug,\n\t'2019-02-18-160155-session-expiration': _20190218160155sessionexpiration,\n\t'2019-05-03-163729-api-key-disabled-at': _20190503163729apikeydisabledat,\n\t'2019-08-14-153300-project-slug-unique': _20190814153300projectslugunique,\n\t'2019-09-06-111000-membership': _20190906111000membership,\n\t'2019-09-06-111001-drop-old-member': _20190906111001dropoldmember,\n\t'2020-01-29-idenity-note': _20200129idenitynote,\n\t'2020-04-17-fix-person-index': _20200417fixpersonindex,\n\t'2020-05-01-170000-api-key-index': _20200501170000apikeyindex,\n\t'2020-06-08-134000-tenant-credentials': _20200608134000tenantcredentials,\n\t'2020-08-07-110000-person-otp': _20200807110000personotp,\n\t'2020-08-17-162200-mail-templates': _20200817162200mailtemplates,\n\t'2020-08-21-143400-person-password-reset': _20200821143400personpasswordreset,\n\t'2020-09-07-094200-identity-provider': _20200907094200identityprovider,\n\t'2021-03-28-134000-timestamp': _20210328134000timestamp,\n\t'2021-07-26-105000-project-config': _20210726105000projectconfig,\n\t'2021-07-26-132000-project-secrets': _20210726132000projectsecrets,\n\t'2021-07-27-174000-project-alias-index': _20210727174000projectaliasindex,\n\t'2021-11-24-130000-person-password-null': _20211124130000personpasswordnull,\n\t'2021-11-24-161500-mail-template-project-null': _20211124161500mailtemplateprojectnull,\n\t'2022-01-04-144000-person-unique-identity': _20220104144000personuniqueidentity,\n\t'2022-02-09-111800-fix-crypted': _20220209111800fixcrypted,\n\t'2022-02-11-153000-idp-auto-sign-up': _20220211153000idpautosignup,\n\t'2022-06-29-105000-person-idp': _20220629105000personidp,\n\t'2022-07-07-135000-person-email-opt-uniq': _20220707135000personemailoptuniq,\n\t'2022-07-07-141000-person-display-name': _20220707141000persondisplayname,\n\t'2022-07-14-145000-person-login-options': _20220714145000personloginoptions,\n\t'2022-11-08-project-update-notification': _20221108projectupdatenotification,\n\t'2023-01-20-135500-person-email-normalize': _20230120135500personemailnormalize,\n\t'2023-06-03-104000-person-disabled': _20230603104000persondisabled,\n\t'2023-09-01-165000-idp-return-config': _20230901165000idpreturnconfig,\n\t'2024-06-20-140000-mail-reply': _20240620140000mailreply,\n\t'2024-08-26-120000-passwordless': _20240826120000passwordless,\n\t'2025-04-16-180000-config-up': _20250416180000configup,\n\t'2025-04-17-160000-auth-log': _20250417160000authlog,\n\t'2026-05-12-120000-api-key-session-tracking': _20260512120000apikeysessiontracking,\n\t'2026-05-12-130000-api-key-trust-forwarded-info': _20260512130000apikeytrustforwardedinfo,\n\t'2026-05-13-120000-auth-log-event-data': _20260513120000authlogeventdata,\n\t'2026-05-13-130000-anti-abuse': _20260513130000antiabuse,\n\t'2026-05-14-100000-auth-log-admin-actions': _20260514100000authlogadminactions,\n\t'2026-05-15-120000-config-reveal-login-method': _20260515120000configreveallogmethod,\n\t'2026-05-21-100000-person-mfa': _20260521100000personmfa,\n\t'2026-05-21-110000-mfa-foundation': _20260521110000mfafoundation,\n\t'2026-05-21-120000-email-otp': _20260521120000emailotp,\n\t'2026-05-21-130000-api-key-session-policy': _20260521130000apikeysessionpolicy,\n\t'2026-05-21-140000-mfa-grace-duration': _20260521140000mfagraceduration,\n\t'2026-05-21-150000-email-otp-rate-limit': _20260521150000emailotpratelimit,\n\t'2026-05-26-120000-email-verification-types': _20260526120000emailverificationtypes,\n\t'2026-05-26-120010-email-verification': _20260526120010emailverification,\n\t'2026-05-26-130000-email-change-verification-config': _20260526130000emailchangeverificationconfig,\n\t'2026-05-26-130010-idp-require-verified-email': _20260526130010idprequireverifiedemail,\n\t'2026-05-26-130020-email-verification-rate-limit': _20260526130020emailverificationratelimit,\n\t'2026-05-26-130030-captcha-protect-flows': _20260526130030captchaprotectflows,\n\t'2026-05-26-140000-idp-session': _20260526140000idpsession,\n\t'2026-06-08-100000-idp-assume-email-verified': _20260608100000idpassumeemailverified,\n\t'2026-06-16-120000-login-anomaly-detection': _20260616120000loginanomalydetection,\n\t'2026-06-16-130000-idp-logout': _20260616130000idplogout,\n\t'2026-06-18-120000-idp-claim-mapping': _20260618120000idpclaimmapping,\n\t'2026-08-03-120000-person-enable-auth-log': _20260803120000personenableauthlog,\n\t'2026-08-04-120000-config-panel': _20260804120000configpanel,\n\t'2026-09-04-120000-idp-disable-local-authentication': _20260904120000idpdisablelocalauthentication,\n\t'2026-09-11-120000-custom-role': _20260911120000customrole,\n}\n\nexport class TenantMigrationsRunner {\n\tconstructor(\n\t\tprivate readonly db: DatabaseConfig,\n\t\tprivate readonly schema: string,\n\t\tprivate readonly tenantCredentials: TenantCredentials,\n\t\tprivate readonly providers: Pick<Providers, 'bcrypt' | 'uuid'>,\n\t) {\n\t}\n\n\tpublic async run(logger: Logger): Promise<{ name: string }[]> {\n\t\tawait createDatabaseIfNotExists(this.db, message => typeof message === 'string' ? logger.warn(message) : logger.error(message))\n\t\tconst connection = Connection.createSingle(this.db, err => logger.error(err))\n\t\tconst result = await connection.scope(async connection => {\n\t\t\tconst migrationsResolver = new SnapshotMigrationResolver(snapshot, migrations)\n\n\t\t\tconst innerRunner = new DbMigrationsRunner<TenantMigrationArgs>(connection, this.schema, migrationsResolver)\n\t\t\treturn await innerRunner.migrate(message => logger.warn(message), {\n\t\t\t\tgetCredentials: async () => ({\n\t\t\t\t\tloginTokenHash: this.tenantCredentials.loginToken ? computeTokenHash(this.tenantCredentials.loginToken) : undefined,\n\t\t\t\t\trootTokenHash: this.tenantCredentials.rootTokenHash\n\t\t\t\t\t\t?? (this.tenantCredentials.rootToken ? computeTokenHash(this.tenantCredentials.rootToken) : undefined),\n\t\t\t\t\trootEmail: this.tenantCredentials.rootEmail,\n\t\t\t\t\trootPasswordBcrypted: this.tenantCredentials.rootPassword ? await this.providers.bcrypt(this.tenantCredentials.rootPassword) : undefined,\n\t\t\t\t}),\n\t\t\t\tproviders: this.providers,\n\t\t\t})\n\t\t})\n\t\tawait connection.end()\n\t\treturn result\n\t}\n}\n"],"names":["_20180802174310init","_20180903140621identityproject","_20181026165450setupapikey","_20181026175155variables","_20190218110949projectslug","_20190218160155sessionexpiration","_20190503163729apikeydisabledat","_20190814153300projectslugunique","_20190906111000membership","_20190906111001dropoldmember","_20200129idenitynote","_20200417fixpersonindex","_20200501170000apikeyindex","_20200608134000tenantcredentials","_20200807110000personotp","_20200817162200mailtemplates","_20200821143400personpasswordreset","_20200907094200identityprovider","_20210328134000timestamp","_20210726105000projectconfig","_20210726132000projectsecrets","_20210727174000projectaliasindex","_20211124130000personpasswordnull","_20211124161500mailtemplateprojectnull","_20220104144000personuniqueidentity","_20220209111800fixcrypted","_20220211153000idpautosignup","_20220629105000personidp","_20220707135000personemailoptuniq","_20220707141000persondisplayname","_20220714145000personloginoptions","_20221108projectupdatenotification","_20230120135500personemailnormalize","_20230603104000persondisabled","_20230901165000idpreturnconfig","_20240620140000mailreply","_20240826120000passwordless","_20250416180000configup","_20250417160000authlog","_20260512120000apikeysessiontracking","_20260512130000apikeytrustforwardedinfo","_20260513120000authlogeventdata","_20260513130000antiabuse","_20260514100000authlogadminactions","_20260515120000configreveallogmethod","_20260521100000personmfa","_20260521110000mfafoundation","_20260521120000emailotp","_20260521130000apikeysessionpolicy","_20260521140000mfagraceduration","_20260521150000emailotpratelimit","_20260526120000emailverificationtypes","_20260526120010emailverification","_20260526130000emailchangeverificationconfig","_20260526130010idprequireverifiedemail","_20260526130020emailverificationratelimit","_20260526130030captchaprotectflows","_20260526140000idpsession","_20260608100000idpassumeemailverified","_20260616120000loginanomalydetection","_20260616130000idplogout","_20260618120000idpclaimmapping","_20260803120000personenableauthlog","_20260804120000configpanel","_20260904120000idpdisablelocalauthentication","_20260911120000customrole","createDatabaseIfNotExists","Connection","connection","SnapshotMigrationResolver","DbMigrationsRunner","computeTokenHash"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,MAAM,aAAa;AAAA,EAClB,0BAA0BA;AAAAA,EAC1B,sCAAsCC;AAAAA,EACtC,mCAAmCC;AAAAA,EACnC,+BAA+BC;AAAAA,EAC/B,kCAAkCC;AAAAA,EAClC,wCAAwCC;AAAAA,EACxC,yCAAyCC;AAAAA,EACzC,yCAAyCC;AAAAA,EACzC,gCAAgCC;AAAAA,EAChC,qCAAqCC;AAAAA,EACrC,2BAA2BC;AAAAA,EAC3B,+BAA+BC;AAAAA,EAC/B,mCAAmCC;AAAAA,EACnC,wCAAwCC;AAAAA,EACxC,gCAAgCC;AAAAA,EAChC,oCAAoCC;AAAAA,EACpC,2CAA2CC;AAAAA,EAC3C,uCAAuCC;AAAAA,EACvC,+BAA+BC;AAAAA,EAC/B,oCAAoCC;AAAAA,EACpC,qCAAqCC;AAAAA,EACrC,yCAAyCC;AAAAA,EACzC,0CAA0CC;AAAAA,EAC1C,gDAAgDC;AAAAA,EAChD,4CAA4CC;AAAAA,EAC5C,iCAAiCC;AAAAA,EACjC,sCAAsCC;AAAAA,EACtC,gCAAgCC;AAAAA,EAChC,2CAA2CC;AAAAA,EAC3C,yCAAyCC;AAAAA,EACzC,0CAA0CC;AAAAA,EAC1C,0CAA0CC;AAAAA,EAC1C,4CAA4CC;AAAAA,EAC5C,qCAAqCC;AAAAA,EACrC,uCAAuCC;AAAAA,EACvC,gCAAgCC;AAAAA,EAChC,kCAAkCC;AAAAA,EAClC,+BAA+BC;AAAAA,EAC/B,8BAA8BC;AAAAA,EAC9B,8CAA8CC;AAAAA,EAC9C,kDAAkDC;AAAAA,EAClD,yCAAyCC;AAAAA,EACzC,gCAAgCC;AAAAA,EAChC,4CAA4CC;AAAAA,EAC5C,gDAAgDC;AAAAA,EAChD,gCAAgCC;AAAAA,EAChC,oCAAoCC;AAAAA,EACpC,+BAA+BC;AAAAA,EAC/B,4CAA4CC;AAAAA,EAC5C,wCAAwCC;AAAAA,EACxC,0CAA0CC;AAAAA,EAC1C,8CAA8CC;AAAAA,EAC9C,wCAAwCC;AAAAA,EACxC,sDAAsDC;AAAAA,EACtD,gDAAgDC;AAAAA,EAChD,mDAAmDC;AAAAA,EACnD,2CAA2CC;AAAAA,EAC3C,iCAAiCC;AAAAA,EACjC,+CAA+CC;AAAAA,EAC/C,6CAA6CC;AAAAA,EAC7C,gCAAgCC;AAAAA,EAChC,uCAAuCC;AAAAA,EACvC,4CAA4CC;AAAAA,EAC5C,kCAAkCC;AAAAA,EAClC,sDAAsDC;AAAAA,EACtD,iCAAiCC;AAClC;AAEO,MAAM,uBAAuB;AAAA,EACnC,YACkB,IACA,QACA,mBACA,WAChB;AAJgB,SAAA,KAAA;AACA,SAAA,SAAA;AACA,SAAA,oBAAA;AACA,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,IAAI,QAA6C;AAC7D,UAAMC,SAAAA,0BAA0B,KAAK,IAAI,CAAA,YAAW,OAAO,YAAY,WAAW,OAAO,KAAK,OAAO,IAAI,OAAO,MAAM,OAAO,CAAC;AAC9H,UAAM,aAAaC,SAAAA,WAAW,aAAa,KAAK,IAAI,CAAA,QAAO,OAAO,MAAM,GAAG,CAAC;AAC5E,UAAM,SAAS,MAAM,WAAW,MAAM,OAAMC,gBAAc;AACzD,YAAM,qBAAqB,IAAIC,6CAA0B,UAAU,UAAU;AAE7E,YAAM,cAAc,IAAIC,mBAAAA,iBAAwCF,aAAY,KAAK,QAAQ,kBAAkB;AAC3G,aAAO,MAAM,YAAY,QAAQ,aAAW,OAAO,KAAK,OAAO,GAAG;AAAA,QACjE,gBAAgB,aAAa;AAAA,UAC5B,gBAAgB,KAAK,kBAAkB,aAAaG,MAAAA,iBAAiB,KAAK,kBAAkB,UAAU,IAAI;AAAA,UAC1G,eAAe,KAAK,kBAAkB,kBACjC,KAAK,kBAAkB,YAAYA,MAAAA,iBAAiB,KAAK,kBAAkB,SAAS,IAAI;AAAA,UAC7F,WAAW,KAAK,kBAAkB;AAAA,UAClC,sBAAsB,KAAK,kBAAkB,eAAe,MAAM,KAAK,UAAU,OAAO,KAAK,kBAAkB,YAAY,IAAI;AAAA,QAAA;AAAA,QAEhI,WAAW,KAAK;AAAA,MAAA,CAChB;AAAA,IACF,CAAC;AACD,UAAM,WAAW,IAAA;AACjB,WAAO;AAAA,EACR;AACD;;"}

package/dist/production/src/migrations/runner.js

@@ -61,17 +61,25 @@ import _20260526140000idpsession from "./2026-05-26-140000-idp-session.js";
 import _20260608100000idpassumeemailverified from "./2026-06-08-100000-idp-assume-email-verified.js";
 import _20260616120000loginanomalydetection from "./2026-06-16-120000-login-anomaly-detection.js";
 import _20260616130000idplogout from "./2026-06-16-130000-idp-logout.js";
+import _20260618120000idpclaimmapping from "./2026-06-18-120000-idp-claim-mapping.js";
+import _20260803120000personenableauthlog from "./2026-08-03-120000-person-enable-auth-log.js";
+import _20260804120000configpanel from "./2026-08-04-120000-config-panel.js";
+import _20260904120000idpdisablelocalauthentication from "./2026-09-04-120000-idp-disable-local-authentication.js";
+import _20260911120000customrole from "./2026-09-11-120000-custom-role.js";
 import snapshot from "./snapshot.js";
 import "../model/authorization/PermissionActions.js";
 import "@contember/authorization";
+import "../model/queries/apiKey/ApiKeyQuery.js";
+import "../model/type/ApiKey.js";
+import "../model/authorization/CustomRolePermissions.js";
 import "../model/authorization/PermissionContext.js";
-import "../model/authorization/PermissionsFactory.js";
+import "../model/authorization/TargetIdentityPermission.js";
 import "@contember/schema";
-import "../model/type/ApiKey.js";
 import { computeTokenHash } from "../model/utils/token.js";
-import "../model/queries/apiKey/ApiKeyQuery.js";
 import "node:assert";
 import "../model/service/idp/IDPRevalidation.js";
+import "../model/service/idp/ClaimMapping.js";
+import "@contember/schema-utils";
 import "../model/service/idp/providers/AppleProvider.js";
 import "openid-client";
 import "@contember/typesafe";
@@ -79,7 +87,6 @@ import "../model/service/idp/providers/OIDCTypes.js";
 import "jose";
 import "../model/service/idp/providers/FacebookProvider.js";
 import "../model/service/AuthLogService.js";
-import "@contember/schema-utils";
 import "otpauth";
 const migrations = {
   "2018-08-02-174310-init": _20180802174310init,
@@ -142,7 +149,12 @@ const migrations = {
   "2026-05-26-140000-idp-session": _20260526140000idpsession,
   "2026-06-08-100000-idp-assume-email-verified": _20260608100000idpassumeemailverified,
   "2026-06-16-120000-login-anomaly-detection": _20260616120000loginanomalydetection,
-  "2026-06-16-130000-idp-logout": _20260616130000idplogout
+  "2026-06-16-130000-idp-logout": _20260616130000idplogout,
+  "2026-06-18-120000-idp-claim-mapping": _20260618120000idpclaimmapping,
+  "2026-08-03-120000-person-enable-auth-log": _20260803120000personenableauthlog,
+  "2026-08-04-120000-config-panel": _20260804120000configpanel,
+  "2026-09-04-120000-idp-disable-local-authentication": _20260904120000idpdisablelocalauthentication,
+  "2026-09-11-120000-custom-role": _20260911120000customrole
 };
 class TenantMigrationsRunner {
   constructor(db, schema, tenantCredentials, providers) {

package/dist/production/src/migrations/runner.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/runner.ts"],"sourcesContent":["import { Connection, createDatabaseIfNotExists, DatabaseConfig, EventManager } from '@contember/database'\nimport { TenantMigrationArgs } from './types.js'\nimport { MigrationsRunner as DbMigrationsRunner, SnapshotMigrationResolver } from '@contember/database-migrations'\nimport _20180802174310init from './2018-08-02-174310-init.js'\nimport _20180903140621identityproject from './2018-09-03-140621-identity-project.js'\nimport _20181026165450setupapikey from './2018-10-26-165450-setup-api-key.js'\nimport _20181026175155variables from './2018-10-26-175155-variables.js'\nimport _20190218110949projectslug from './2019-02-18-110949-project-slug.js'\nimport _20190218160155sessionexpiration from './2019-02-18-160155-session-expiration.js'\nimport _20190503163729apikeydisabledat from './2019-05-03-163729-api-key-disabled-at.js'\nimport _20190814153300projectslugunique from './2019-08-14-153300-project-slug-unique.js'\nimport _20190906111000membership from './2019-09-06-111000-membership.js'\nimport _20190906111001dropoldmember from './2019-09-06-111001-drop-old-member.js'\nimport _20200129idenitynote from './2020-01-29-idenity-note.js'\nimport _20200417fixpersonindex from './2020-04-17-fix-person-index.js'\nimport _20200501170000apikeyindex from './2020-05-01-170000-api-key-index.js'\nimport _20200608134000tenantcredentials from './2020-06-08-134000-tenant-credentials.js'\nimport _20200807110000personotp from './2020-08-07-110000-person-otp.js'\nimport _20200817162200mailtemplates from './2020-08-17-162200-mail-templates.js'\nimport _20200821143400personpasswordreset from './2020-08-21-143400-person-password-reset.js'\nimport _20200907094200identityprovider from './2020-09-07-094200-identity-provider.js'\nimport _20210328134000timestamp from './2021-03-28-134000-timestamp.js'\nimport _20210726105000projectconfig from './2021-07-26-105000-project-config.js'\nimport _20210726132000projectsecrets from './2021-07-26-132000-project-secrets.js'\nimport _20210727174000projectaliasindex from './2021-07-27-174000-project-alias-index.js'\nimport _20211124130000personpasswordnull from './2021-11-24-130000-person-password-null.js'\nimport _20211124161500mailtemplateprojectnull from './2021-11-24-161500-mail-template-project-null.js'\nimport _20220104144000personuniqueidentity from './2022-01-04-144000-person-unique-identity.js'\nimport _20220209111800fixcrypted from './2022-02-09-111800-fix-crypted.js'\nimport _20220211153000idpautosignup from './2022-02-11-153000-idp-auto-sign-up.js'\nimport _20220629105000personidp from './2022-06-29-105000-person-idp.js'\nimport _20220707135000personemailoptuniq from './2022-07-07-135000-person-email-opt-uniq.js'\nimport _20220707141000persondisplayname from './2022-07-07-141000-person-display-name.js'\nimport _20220714145000personloginoptions from './2022-07-14-145000-person-login-options.js'\nimport _20221108projectupdatenotification from './2022-11-08-project-update-notification.js'\nimport _20230120135500personemailnormalize from './2023-01-20-135500-person-email-normalize.js'\nimport _20230603104000persondisabled from './2023-06-03-104000-person-disabled.js'\nimport _20230901165000idpreturnconfig from './2023-09-01-165000-idp-return-config.js'\nimport _20240620140000mailreply from './2024-06-20-140000-mail-reply.js'\nimport _20240826120000passwordless from './2024-08-26-120000-passwordless.js'\nimport _20250416180000configup from './2025-04-16-180000-config-up.js'\nimport _20250417160000authlog from './2025-04-17-160000-auth-log.js'\nimport _20260512120000apikeysessiontracking from './2026-05-12-120000-api-key-session-tracking.js'\nimport _20260512130000apikeytrustforwardedinfo from './2026-05-12-130000-api-key-trust-forwarded-info.js'\nimport _20260513120000authlogeventdata from './2026-05-13-120000-auth-log-event-data.js'\nimport _20260513130000antiabuse from './2026-05-13-130000-anti-abuse.js'\nimport _20260514100000authlogadminactions from './2026-05-14-100000-auth-log-admin-actions.js'\nimport _20260515120000configreveallogmethod from './2026-05-15-120000-config-reveal-login-method.js'\nimport _20260521100000personmfa from './2026-05-21-100000-person-mfa.js'\nimport _20260521110000mfafoundation from './2026-05-21-110000-mfa-foundation.js'\nimport _20260521120000emailotp from './2026-05-21-120000-email-otp.js'\nimport _20260521130000apikeysessionpolicy from './2026-05-21-130000-api-key-session-policy.js'\nimport _20260521140000mfagraceduration from './2026-05-21-140000-mfa-grace-duration.js'\nimport _20260521150000emailotpratelimit from './2026-05-21-150000-email-otp-rate-limit.js'\nimport _20260526120000emailverificationtypes from './2026-05-26-120000-email-verification-types.js'\nimport _20260526120010emailverification from './2026-05-26-120010-email-verification.js'\nimport _20260526130000emailchangeverificationconfig from './2026-05-26-130000-email-change-verification-config.js'\nimport _20260526130010idprequireverifiedemail from './2026-05-26-130010-idp-require-verified-email.js'\nimport _20260526130020emailverificationratelimit from './2026-05-26-130020-email-verification-rate-limit.js'\nimport _20260526130030captchaprotectflows from './2026-05-26-130030-captcha-protect-flows.js'\nimport _20260526140000idpsession from './2026-05-26-140000-idp-session.js'\nimport _20260608100000idpassumeemailverified from './2026-06-08-100000-idp-assume-email-verified.js'\nimport _20260616120000loginanomalydetection from './2026-06-16-120000-login-anomaly-detection.js'\nimport _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'\nimport snapshot from './snapshot.js'\nimport { computeTokenHash, Providers } from '../model/index.js'\nimport { Logger } from '@contember/logger'\n\nexport interface TenantCredentials {\n\tloginToken?: string\n\trootEmail?: string\n\trootToken?: string\n\trootTokenHash?: string\n\trootPassword?: string\n\t/**\n\t * Unpersisted root tokens (plain values). When set, these tokens are\n\t * verified at runtime and resolve to a super-admin identity without being\n\t * stored in the database. Useful for easy rotation.\n\t */\n\trootTokens?: readonly string[]\n\t/**\n\t * Unpersisted root token hashes (sha256 hex). Same as {@link rootTokens} but\n\t * the plain token never needs to be passed to the engine.\n\t */\n\trootTokenHashes?: readonly string[]\n}\n\nconst migrations = {\n\t'2018-08-02-174310-init': _20180802174310init,\n\t'2018-09-03-140621-identity-project': _20180903140621identityproject,\n\t'2018-10-26-165450-setup-api-key': _20181026165450setupapikey,\n\t'2018-10-26-175155-variables': _20181026175155variables,\n\t'2019-02-18-110949-project-slug': _20190218110949projectslug,\n\t'2019-02-18-160155-session-expiration': _20190218160155sessionexpiration,\n\t'2019-05-03-163729-api-key-disabled-at': _20190503163729apikeydisabledat,\n\t'2019-08-14-153300-project-slug-unique': _20190814153300projectslugunique,\n\t'2019-09-06-111000-membership': _20190906111000membership,\n\t'2019-09-06-111001-drop-old-member': _20190906111001dropoldmember,\n\t'2020-01-29-idenity-note': _20200129idenitynote,\n\t'2020-04-17-fix-person-index': _20200417fixpersonindex,\n\t'2020-05-01-170000-api-key-index': _20200501170000apikeyindex,\n\t'2020-06-08-134000-tenant-credentials': _20200608134000tenantcredentials,\n\t'2020-08-07-110000-person-otp': _20200807110000personotp,\n\t'2020-08-17-162200-mail-templates': _20200817162200mailtemplates,\n\t'2020-08-21-143400-person-password-reset': _20200821143400personpasswordreset,\n\t'2020-09-07-094200-identity-provider': _20200907094200identityprovider,\n\t'2021-03-28-134000-timestamp': _20210328134000timestamp,\n\t'2021-07-26-105000-project-config': _20210726105000projectconfig,\n\t'2021-07-26-132000-project-secrets': _20210726132000projectsecrets,\n\t'2021-07-27-174000-project-alias-index': _20210727174000projectaliasindex,\n\t'2021-11-24-130000-person-password-null': _20211124130000personpasswordnull,\n\t'2021-11-24-161500-mail-template-project-null': _20211124161500mailtemplateprojectnull,\n\t'2022-01-04-144000-person-unique-identity': _20220104144000personuniqueidentity,\n\t'2022-02-09-111800-fix-crypted': _20220209111800fixcrypted,\n\t'2022-02-11-153000-idp-auto-sign-up': _20220211153000idpautosignup,\n\t'2022-06-29-105000-person-idp': _20220629105000personidp,\n\t'2022-07-07-135000-person-email-opt-uniq': _20220707135000personemailoptuniq,\n\t'2022-07-07-141000-person-display-name': _20220707141000persondisplayname,\n\t'2022-07-14-145000-person-login-options': _20220714145000personloginoptions,\n\t'2022-11-08-project-update-notification': _20221108projectupdatenotification,\n\t'2023-01-20-135500-person-email-normalize': _20230120135500personemailnormalize,\n\t'2023-06-03-104000-person-disabled': _20230603104000persondisabled,\n\t'2023-09-01-165000-idp-return-config': _20230901165000idpreturnconfig,\n\t'2024-06-20-140000-mail-reply': _20240620140000mailreply,\n\t'2024-08-26-120000-passwordless': _20240826120000passwordless,\n\t'2025-04-16-180000-config-up': _20250416180000configup,\n\t'2025-04-17-160000-auth-log': _20250417160000authlog,\n\t'2026-05-12-120000-api-key-session-tracking': _20260512120000apikeysessiontracking,\n\t'2026-05-12-130000-api-key-trust-forwarded-info': _20260512130000apikeytrustforwardedinfo,\n\t'2026-05-13-120000-auth-log-event-data': _20260513120000authlogeventdata,\n\t'2026-05-13-130000-anti-abuse': _20260513130000antiabuse,\n\t'2026-05-14-100000-auth-log-admin-actions': _20260514100000authlogadminactions,\n\t'2026-05-15-120000-config-reveal-login-method': _20260515120000configreveallogmethod,\n\t'2026-05-21-100000-person-mfa': _20260521100000personmfa,\n\t'2026-05-21-110000-mfa-foundation': _20260521110000mfafoundation,\n\t'2026-05-21-120000-email-otp': _20260521120000emailotp,\n\t'2026-05-21-130000-api-key-session-policy': _20260521130000apikeysessionpolicy,\n\t'2026-05-21-140000-mfa-grace-duration': _20260521140000mfagraceduration,\n\t'2026-05-21-150000-email-otp-rate-limit': _20260521150000emailotpratelimit,\n\t'2026-05-26-120000-email-verification-types': _20260526120000emailverificationtypes,\n\t'2026-05-26-120010-email-verification': _20260526120010emailverification,\n\t'2026-05-26-130000-email-change-verification-config': _20260526130000emailchangeverificationconfig,\n\t'2026-05-26-130010-idp-require-verified-email': _20260526130010idprequireverifiedemail,\n\t'2026-05-26-130020-email-verification-rate-limit': _20260526130020emailverificationratelimit,\n\t'2026-05-26-130030-captcha-protect-flows': _20260526130030captchaprotectflows,\n\t'2026-05-26-140000-idp-session': _20260526140000idpsession,\n\t'2026-06-08-100000-idp-assume-email-verified': _20260608100000idpassumeemailverified,\n\t'2026-06-16-120000-login-anomaly-detection': _20260616120000loginanomalydetection,\n\t'2026-06-16-130000-idp-logout': _20260616130000idplogout,\n}\n\nexport class TenantMigrationsRunner {\n\tconstructor(\n\t\tprivate readonly db: DatabaseConfig,\n\t\tprivate readonly schema: string,\n\t\tprivate readonly tenantCredentials: TenantCredentials,\n\t\tprivate readonly providers: Pick<Providers, 'bcrypt' | 'uuid'>,\n\t) {\n\t}\n\n\tpublic async run(logger: Logger): Promise<{ name: string }[]> {\n\t\tawait createDatabaseIfNotExists(this.db, message => typeof message === 'string' ? logger.warn(message) : logger.error(message))\n\t\tconst connection = Connection.createSingle(this.db, err => logger.error(err))\n\t\tconst result = await connection.scope(async connection => {\n\t\t\tconst migrationsResolver = new SnapshotMigrationResolver(snapshot, migrations)\n\n\t\t\tconst innerRunner = new DbMigrationsRunner<TenantMigrationArgs>(connection, this.schema, migrationsResolver)\n\t\t\treturn await innerRunner.migrate(message => logger.warn(message), {\n\t\t\t\tgetCredentials: async () => ({\n\t\t\t\t\tloginTokenHash: this.tenantCredentials.loginToken ? computeTokenHash(this.tenantCredentials.loginToken) : undefined,\n\t\t\t\t\trootTokenHash: this.tenantCredentials.rootTokenHash\n\t\t\t\t\t\t?? (this.tenantCredentials.rootToken ? computeTokenHash(this.tenantCredentials.rootToken) : undefined),\n\t\t\t\t\trootEmail: this.tenantCredentials.rootEmail,\n\t\t\t\t\trootPasswordBcrypted: this.tenantCredentials.rootPassword ? await this.providers.bcrypt(this.tenantCredentials.rootPassword) : undefined,\n\t\t\t\t}),\n\t\t\t\tproviders: this.providers,\n\t\t\t})\n\t\t})\n\t\tawait connection.end()\n\t\treturn result\n\t}\n}\n"],"names":["connection","DbMigrationsRunner"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,MAAM,aAAa;AAAA,EAClB,0BAA0B;AAAA,EAC1B,sCAAsC;AAAA,EACtC,mCAAmC;AAAA,EACnC,+BAA+B;AAAA,EAC/B,kCAAkC;AAAA,EAClC,wCAAwC;AAAA,EACxC,yCAAyC;AAAA,EACzC,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,qCAAqC;AAAA,EACrC,2BAA2B;AAAA,EAC3B,+BAA+B;AAAA,EAC/B,mCAAmC;AAAA,EACnC,wCAAwC;AAAA,EACxC,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,2CAA2C;AAAA,EAC3C,uCAAuC;AAAA,EACvC,+BAA+B;AAAA,EAC/B,oCAAoC;AAAA,EACpC,qCAAqC;AAAA,EACrC,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,gDAAgD;AAAA,EAChD,4CAA4C;AAAA,EAC5C,iCAAiC;AAAA,EACjC,sCAAsC;AAAA,EACtC,gCAAgC;AAAA,EAChC,2CAA2C;AAAA,EAC3C,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,0CAA0C;AAAA,EAC1C,4CAA4C;AAAA,EAC5C,qCAAqC;AAAA,EACrC,uCAAuC;AAAA,EACvC,gCAAgC;AAAA,EAChC,kCAAkC;AAAA,EAClC,+BAA+B;AAAA,EAC/B,8BAA8B;AAAA,EAC9B,8CAA8C;AAAA,EAC9C,kDAAkD;AAAA,EAClD,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,4CAA4C;AAAA,EAC5C,gDAAgD;AAAA,EAChD,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,+BAA+B;AAAA,EAC/B,4CAA4C;AAAA,EAC5C,wCAAwC;AAAA,EACxC,0CAA0C;AAAA,EAC1C,8CAA8C;AAAA,EAC9C,wCAAwC;AAAA,EACxC,sDAAsD;AAAA,EACtD,gDAAgD;AAAA,EAChD,mDAAmD;AAAA,EACnD,2CAA2C;AAAA,EAC3C,iCAAiC;AAAA,EACjC,+CAA+C;AAAA,EAC/C,6CAA6C;AAAA,EAC7C,gCAAgC;AACjC;AAEO,MAAM,uBAAuB;AAAA,EACnC,YACkB,IACA,QACA,mBACA,WAChB;AAJgB,SAAA,KAAA;AACA,SAAA,SAAA;AACA,SAAA,oBAAA;AACA,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,IAAI,QAA6C;AAC7D,UAAM,0BAA0B,KAAK,IAAI,CAAA,YAAW,OAAO,YAAY,WAAW,OAAO,KAAK,OAAO,IAAI,OAAO,MAAM,OAAO,CAAC;AAC9H,UAAM,aAAa,WAAW,aAAa,KAAK,IAAI,CAAA,QAAO,OAAO,MAAM,GAAG,CAAC;AAC5E,UAAM,SAAS,MAAM,WAAW,MAAM,OAAMA,gBAAc;AACzD,YAAM,qBAAqB,IAAI,0BAA0B,UAAU,UAAU;AAE7E,YAAM,cAAc,IAAIC,iBAAwCD,aAAY,KAAK,QAAQ,kBAAkB;AAC3G,aAAO,MAAM,YAAY,QAAQ,aAAW,OAAO,KAAK,OAAO,GAAG;AAAA,QACjE,gBAAgB,aAAa;AAAA,UAC5B,gBAAgB,KAAK,kBAAkB,aAAa,iBAAiB,KAAK,kBAAkB,UAAU,IAAI;AAAA,UAC1G,eAAe,KAAK,kBAAkB,kBACjC,KAAK,kBAAkB,YAAY,iBAAiB,KAAK,kBAAkB,SAAS,IAAI;AAAA,UAC7F,WAAW,KAAK,kBAAkB;AAAA,UAClC,sBAAsB,KAAK,kBAAkB,eAAe,MAAM,KAAK,UAAU,OAAO,KAAK,kBAAkB,YAAY,IAAI;AAAA,QAAA;AAAA,QAEhI,WAAW,KAAK;AAAA,MAAA,CAChB;AAAA,IACF,CAAC;AACD,UAAM,WAAW,IAAA;AACjB,WAAO;AAAA,EACR;AACD;"}
+{"version":3,"file":"runner.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/runner.ts"],"sourcesContent":["import { Connection, createDatabaseIfNotExists, DatabaseConfig, EventManager } from '@contember/database'\nimport { TenantMigrationArgs } from './types.js'\nimport { MigrationsRunner as DbMigrationsRunner, SnapshotMigrationResolver } from '@contember/database-migrations'\nimport _20180802174310init from './2018-08-02-174310-init.js'\nimport _20180903140621identityproject from './2018-09-03-140621-identity-project.js'\nimport _20181026165450setupapikey from './2018-10-26-165450-setup-api-key.js'\nimport _20181026175155variables from './2018-10-26-175155-variables.js'\nimport _20190218110949projectslug from './2019-02-18-110949-project-slug.js'\nimport _20190218160155sessionexpiration from './2019-02-18-160155-session-expiration.js'\nimport _20190503163729apikeydisabledat from './2019-05-03-163729-api-key-disabled-at.js'\nimport _20190814153300projectslugunique from './2019-08-14-153300-project-slug-unique.js'\nimport _20190906111000membership from './2019-09-06-111000-membership.js'\nimport _20190906111001dropoldmember from './2019-09-06-111001-drop-old-member.js'\nimport _20200129idenitynote from './2020-01-29-idenity-note.js'\nimport _20200417fixpersonindex from './2020-04-17-fix-person-index.js'\nimport _20200501170000apikeyindex from './2020-05-01-170000-api-key-index.js'\nimport _20200608134000tenantcredentials from './2020-06-08-134000-tenant-credentials.js'\nimport _20200807110000personotp from './2020-08-07-110000-person-otp.js'\nimport _20200817162200mailtemplates from './2020-08-17-162200-mail-templates.js'\nimport _20200821143400personpasswordreset from './2020-08-21-143400-person-password-reset.js'\nimport _20200907094200identityprovider from './2020-09-07-094200-identity-provider.js'\nimport _20210328134000timestamp from './2021-03-28-134000-timestamp.js'\nimport _20210726105000projectconfig from './2021-07-26-105000-project-config.js'\nimport _20210726132000projectsecrets from './2021-07-26-132000-project-secrets.js'\nimport _20210727174000projectaliasindex from './2021-07-27-174000-project-alias-index.js'\nimport _20211124130000personpasswordnull from './2021-11-24-130000-person-password-null.js'\nimport _20211124161500mailtemplateprojectnull from './2021-11-24-161500-mail-template-project-null.js'\nimport _20220104144000personuniqueidentity from './2022-01-04-144000-person-unique-identity.js'\nimport _20220209111800fixcrypted from './2022-02-09-111800-fix-crypted.js'\nimport _20220211153000idpautosignup from './2022-02-11-153000-idp-auto-sign-up.js'\nimport _20220629105000personidp from './2022-06-29-105000-person-idp.js'\nimport _20220707135000personemailoptuniq from './2022-07-07-135000-person-email-opt-uniq.js'\nimport _20220707141000persondisplayname from './2022-07-07-141000-person-display-name.js'\nimport _20220714145000personloginoptions from './2022-07-14-145000-person-login-options.js'\nimport _20221108projectupdatenotification from './2022-11-08-project-update-notification.js'\nimport _20230120135500personemailnormalize from './2023-01-20-135500-person-email-normalize.js'\nimport _20230603104000persondisabled from './2023-06-03-104000-person-disabled.js'\nimport _20230901165000idpreturnconfig from './2023-09-01-165000-idp-return-config.js'\nimport _20240620140000mailreply from './2024-06-20-140000-mail-reply.js'\nimport _20240826120000passwordless from './2024-08-26-120000-passwordless.js'\nimport _20250416180000configup from './2025-04-16-180000-config-up.js'\nimport _20250417160000authlog from './2025-04-17-160000-auth-log.js'\nimport _20260512120000apikeysessiontracking from './2026-05-12-120000-api-key-session-tracking.js'\nimport _20260512130000apikeytrustforwardedinfo from './2026-05-12-130000-api-key-trust-forwarded-info.js'\nimport _20260513120000authlogeventdata from './2026-05-13-120000-auth-log-event-data.js'\nimport _20260513130000antiabuse from './2026-05-13-130000-anti-abuse.js'\nimport _20260514100000authlogadminactions from './2026-05-14-100000-auth-log-admin-actions.js'\nimport _20260515120000configreveallogmethod from './2026-05-15-120000-config-reveal-login-method.js'\nimport _20260521100000personmfa from './2026-05-21-100000-person-mfa.js'\nimport _20260521110000mfafoundation from './2026-05-21-110000-mfa-foundation.js'\nimport _20260521120000emailotp from './2026-05-21-120000-email-otp.js'\nimport _20260521130000apikeysessionpolicy from './2026-05-21-130000-api-key-session-policy.js'\nimport _20260521140000mfagraceduration from './2026-05-21-140000-mfa-grace-duration.js'\nimport _20260521150000emailotpratelimit from './2026-05-21-150000-email-otp-rate-limit.js'\nimport _20260526120000emailverificationtypes from './2026-05-26-120000-email-verification-types.js'\nimport _20260526120010emailverification from './2026-05-26-120010-email-verification.js'\nimport _20260526130000emailchangeverificationconfig from './2026-05-26-130000-email-change-verification-config.js'\nimport _20260526130010idprequireverifiedemail from './2026-05-26-130010-idp-require-verified-email.js'\nimport _20260526130020emailverificationratelimit from './2026-05-26-130020-email-verification-rate-limit.js'\nimport _20260526130030captchaprotectflows from './2026-05-26-130030-captcha-protect-flows.js'\nimport _20260526140000idpsession from './2026-05-26-140000-idp-session.js'\nimport _20260608100000idpassumeemailverified from './2026-06-08-100000-idp-assume-email-verified.js'\nimport _20260616120000loginanomalydetection from './2026-06-16-120000-login-anomaly-detection.js'\nimport _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'\nimport _20260618120000idpclaimmapping from './2026-06-18-120000-idp-claim-mapping.js'\nimport _20260803120000personenableauthlog from './2026-08-03-120000-person-enable-auth-log.js'\nimport _20260804120000configpanel from './2026-08-04-120000-config-panel.js'\nimport _20260904120000idpdisablelocalauthentication from './2026-09-04-120000-idp-disable-local-authentication.js'\nimport _20260911120000customrole from './2026-09-11-120000-custom-role.js'\nimport snapshot from './snapshot.js'\nimport { computeTokenHash, Providers } from '../model/index.js'\nimport { Logger } from '@contember/logger'\n\nexport interface TenantCredentials {\n\tloginToken?: string\n\trootEmail?: string\n\trootToken?: string\n\trootTokenHash?: string\n\trootPassword?: string\n\t/**\n\t * Unpersisted root tokens (plain values). When set, these tokens are\n\t * verified at runtime and resolve to a super-admin identity without being\n\t * stored in the database. Useful for easy rotation.\n\t */\n\trootTokens?: readonly string[]\n\t/**\n\t * Unpersisted root token hashes (sha256 hex). Same as {@link rootTokens} but\n\t * the plain token never needs to be passed to the engine.\n\t */\n\trootTokenHashes?: readonly string[]\n}\n\nconst migrations = {\n\t'2018-08-02-174310-init': _20180802174310init,\n\t'2018-09-03-140621-identity-project': _20180903140621identityproject,\n\t'2018-10-26-165450-setup-api-key': _20181026165450setupapikey,\n\t'2018-10-26-175155-variables': _20181026175155variables,\n\t'2019-02-18-110949-project-slug': _20190218110949projectslug,\n\t'2019-02-18-160155-session-expiration': _20190218160155sessionexpiration,\n\t'2019-05-03-163729-api-key-disabled-at': _20190503163729apikeydisabledat,\n\t'2019-08-14-153300-project-slug-unique': _20190814153300projectslugunique,\n\t'2019-09-06-111000-membership': _20190906111000membership,\n\t'2019-09-06-111001-drop-old-member': _20190906111001dropoldmember,\n\t'2020-01-29-idenity-note': _20200129idenitynote,\n\t'2020-04-17-fix-person-index': _20200417fixpersonindex,\n\t'2020-05-01-170000-api-key-index': _20200501170000apikeyindex,\n\t'2020-06-08-134000-tenant-credentials': _20200608134000tenantcredentials,\n\t'2020-08-07-110000-person-otp': _20200807110000personotp,\n\t'2020-08-17-162200-mail-templates': _20200817162200mailtemplates,\n\t'2020-08-21-143400-person-password-reset': _20200821143400personpasswordreset,\n\t'2020-09-07-094200-identity-provider': _20200907094200identityprovider,\n\t'2021-03-28-134000-timestamp': _20210328134000timestamp,\n\t'2021-07-26-105000-project-config': _20210726105000projectconfig,\n\t'2021-07-26-132000-project-secrets': _20210726132000projectsecrets,\n\t'2021-07-27-174000-project-alias-index': _20210727174000projectaliasindex,\n\t'2021-11-24-130000-person-password-null': _20211124130000personpasswordnull,\n\t'2021-11-24-161500-mail-template-project-null': _20211124161500mailtemplateprojectnull,\n\t'2022-01-04-144000-person-unique-identity': _20220104144000personuniqueidentity,\n\t'2022-02-09-111800-fix-crypted': _20220209111800fixcrypted,\n\t'2022-02-11-153000-idp-auto-sign-up': _20220211153000idpautosignup,\n\t'2022-06-29-105000-person-idp': _20220629105000personidp,\n\t'2022-07-07-135000-person-email-opt-uniq': _20220707135000personemailoptuniq,\n\t'2022-07-07-141000-person-display-name': _20220707141000persondisplayname,\n\t'2022-07-14-145000-person-login-options': _20220714145000personloginoptions,\n\t'2022-11-08-project-update-notification': _20221108projectupdatenotification,\n\t'2023-01-20-135500-person-email-normalize': _20230120135500personemailnormalize,\n\t'2023-06-03-104000-person-disabled': _20230603104000persondisabled,\n\t'2023-09-01-165000-idp-return-config': _20230901165000idpreturnconfig,\n\t'2024-06-20-140000-mail-reply': _20240620140000mailreply,\n\t'2024-08-26-120000-passwordless': _20240826120000passwordless,\n\t'2025-04-16-180000-config-up': _20250416180000configup,\n\t'2025-04-17-160000-auth-log': _20250417160000authlog,\n\t'2026-05-12-120000-api-key-session-tracking': _20260512120000apikeysessiontracking,\n\t'2026-05-12-130000-api-key-trust-forwarded-info': _20260512130000apikeytrustforwardedinfo,\n\t'2026-05-13-120000-auth-log-event-data': _20260513120000authlogeventdata,\n\t'2026-05-13-130000-anti-abuse': _20260513130000antiabuse,\n\t'2026-05-14-100000-auth-log-admin-actions': _20260514100000authlogadminactions,\n\t'2026-05-15-120000-config-reveal-login-method': _20260515120000configreveallogmethod,\n\t'2026-05-21-100000-person-mfa': _20260521100000personmfa,\n\t'2026-05-21-110000-mfa-foundation': _20260521110000mfafoundation,\n\t'2026-05-21-120000-email-otp': _20260521120000emailotp,\n\t'2026-05-21-130000-api-key-session-policy': _20260521130000apikeysessionpolicy,\n\t'2026-05-21-140000-mfa-grace-duration': _20260521140000mfagraceduration,\n\t'2026-05-21-150000-email-otp-rate-limit': _20260521150000emailotpratelimit,\n\t'2026-05-26-120000-email-verification-types': _20260526120000emailverificationtypes,\n\t'2026-05-26-120010-email-verification': _20260526120010emailverification,\n\t'2026-05-26-130000-email-change-verification-config': _20260526130000emailchangeverificationconfig,\n\t'2026-05-26-130010-idp-require-verified-email': _20260526130010idprequireverifiedemail,\n\t'2026-05-26-130020-email-verification-rate-limit': _20260526130020emailverificationratelimit,\n\t'2026-05-26-130030-captcha-protect-flows': _20260526130030captchaprotectflows,\n\t'2026-05-26-140000-idp-session': _20260526140000idpsession,\n\t'2026-06-08-100000-idp-assume-email-verified': _20260608100000idpassumeemailverified,\n\t'2026-06-16-120000-login-anomaly-detection': _20260616120000loginanomalydetection,\n\t'2026-06-16-130000-idp-logout': _20260616130000idplogout,\n\t'2026-06-18-120000-idp-claim-mapping': _20260618120000idpclaimmapping,\n\t'2026-08-03-120000-person-enable-auth-log': _20260803120000personenableauthlog,\n\t'2026-08-04-120000-config-panel': _20260804120000configpanel,\n\t'2026-09-04-120000-idp-disable-local-authentication': _20260904120000idpdisablelocalauthentication,\n\t'2026-09-11-120000-custom-role': _20260911120000customrole,\n}\n\nexport class TenantMigrationsRunner {\n\tconstructor(\n\t\tprivate readonly db: DatabaseConfig,\n\t\tprivate readonly schema: string,\n\t\tprivate readonly tenantCredentials: TenantCredentials,\n\t\tprivate readonly providers: Pick<Providers, 'bcrypt' | 'uuid'>,\n\t) {\n\t}\n\n\tpublic async run(logger: Logger): Promise<{ name: string }[]> {\n\t\tawait createDatabaseIfNotExists(this.db, message => typeof message === 'string' ? logger.warn(message) : logger.error(message))\n\t\tconst connection = Connection.createSingle(this.db, err => logger.error(err))\n\t\tconst result = await connection.scope(async connection => {\n\t\t\tconst migrationsResolver = new SnapshotMigrationResolver(snapshot, migrations)\n\n\t\t\tconst innerRunner = new DbMigrationsRunner<TenantMigrationArgs>(connection, this.schema, migrationsResolver)\n\t\t\treturn await innerRunner.migrate(message => logger.warn(message), {\n\t\t\t\tgetCredentials: async () => ({\n\t\t\t\t\tloginTokenHash: this.tenantCredentials.loginToken ? computeTokenHash(this.tenantCredentials.loginToken) : undefined,\n\t\t\t\t\trootTokenHash: this.tenantCredentials.rootTokenHash\n\t\t\t\t\t\t?? (this.tenantCredentials.rootToken ? computeTokenHash(this.tenantCredentials.rootToken) : undefined),\n\t\t\t\t\trootEmail: this.tenantCredentials.rootEmail,\n\t\t\t\t\trootPasswordBcrypted: this.tenantCredentials.rootPassword ? await this.providers.bcrypt(this.tenantCredentials.rootPassword) : undefined,\n\t\t\t\t}),\n\t\t\t\tproviders: this.providers,\n\t\t\t})\n\t\t})\n\t\tawait connection.end()\n\t\treturn result\n\t}\n}\n"],"names":["connection","DbMigrationsRunner"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,MAAM,aAAa;AAAA,EAClB,0BAA0B;AAAA,EAC1B,sCAAsC;AAAA,EACtC,mCAAmC;AAAA,EACnC,+BAA+B;AAAA,EAC/B,kCAAkC;AAAA,EAClC,wCAAwC;AAAA,EACxC,yCAAyC;AAAA,EACzC,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,qCAAqC;AAAA,EACrC,2BAA2B;AAAA,EAC3B,+BAA+B;AAAA,EAC/B,mCAAmC;AAAA,EACnC,wCAAwC;AAAA,EACxC,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,2CAA2C;AAAA,EAC3C,uCAAuC;AAAA,EACvC,+BAA+B;AAAA,EAC/B,oCAAoC;AAAA,EACpC,qCAAqC;AAAA,EACrC,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,gDAAgD;AAAA,EAChD,4CAA4C;AAAA,EAC5C,iCAAiC;AAAA,EACjC,sCAAsC;AAAA,EACtC,gCAAgC;AAAA,EAChC,2CAA2C;AAAA,EAC3C,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,0CAA0C;AAAA,EAC1C,4CAA4C;AAAA,EAC5C,qCAAqC;AAAA,EACrC,uCAAuC;AAAA,EACvC,gCAAgC;AAAA,EAChC,kCAAkC;AAAA,EAClC,+BAA+B;AAAA,EAC/B,8BAA8B;AAAA,EAC9B,8CAA8C;AAAA,EAC9C,kDAAkD;AAAA,EAClD,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,4CAA4C;AAAA,EAC5C,gDAAgD;AAAA,EAChD,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,+BAA+B;AAAA,EAC/B,4CAA4C;AAAA,EAC5C,wCAAwC;AAAA,EACxC,0CAA0C;AAAA,EAC1C,8CAA8C;AAAA,EAC9C,wCAAwC;AAAA,EACxC,sDAAsD;AAAA,EACtD,gDAAgD;AAAA,EAChD,mDAAmD;AAAA,EACnD,2CAA2C;AAAA,EAC3C,iCAAiC;AAAA,EACjC,+CAA+C;AAAA,EAC/C,6CAA6C;AAAA,EAC7C,gCAAgC;AAAA,EAChC,uCAAuC;AAAA,EACvC,4CAA4C;AAAA,EAC5C,kCAAkC;AAAA,EAClC,sDAAsD;AAAA,EACtD,iCAAiC;AAClC;AAEO,MAAM,uBAAuB;AAAA,EACnC,YACkB,IACA,QACA,mBACA,WAChB;AAJgB,SAAA,KAAA;AACA,SAAA,SAAA;AACA,SAAA,oBAAA;AACA,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,IAAI,QAA6C;AAC7D,UAAM,0BAA0B,KAAK,IAAI,CAAA,YAAW,OAAO,YAAY,WAAW,OAAO,KAAK,OAAO,IAAI,OAAO,MAAM,OAAO,CAAC;AAC9H,UAAM,aAAa,WAAW,aAAa,KAAK,IAAI,CAAA,QAAO,OAAO,MAAM,GAAG,CAAC;AAC5E,UAAM,SAAS,MAAM,WAAW,MAAM,OAAMA,gBAAc;AACzD,YAAM,qBAAqB,IAAI,0BAA0B,UAAU,UAAU;AAE7E,YAAM,cAAc,IAAIC,iBAAwCD,aAAY,KAAK,QAAQ,kBAAkB;AAC3G,aAAO,MAAM,YAAY,QAAQ,aAAW,OAAO,KAAK,OAAO,GAAG;AAAA,QACjE,gBAAgB,aAAa;AAAA,UAC5B,gBAAgB,KAAK,kBAAkB,aAAa,iBAAiB,KAAK,kBAAkB,UAAU,IAAI;AAAA,UAC1G,eAAe,KAAK,kBAAkB,kBACjC,KAAK,kBAAkB,YAAY,iBAAiB,KAAK,kBAAkB,SAAS,IAAI;AAAA,UAC7F,WAAW,KAAK,kBAAkB;AAAA,UAClC,sBAAsB,KAAK,kBAAkB,eAAe,MAAM,KAAK,UAAU,OAAO,KAAK,kBAAkB,YAAY,IAAI;AAAA,QAAA;AAAA,QAEhI,WAAW,KAAK;AAAA,MAAA,CAChB;AAAA,IACF,CAAC;AACD,UAAM,WAAW,IAAA;AACjB,WAAO;AAAA,EACR;AACD;"}

package/dist/production/src/migrations/snapshot.cjs

@@ -54,7 +54,11 @@ CREATE TYPE "auth_log_type" AS ENUM (
     'unusual_login_detected',
     'step_up_required',
     'idp_logout_initiated',
-    'idp_backchannel_logout'
+    'idp_backchannel_logout',
+    'idp_role_mapped',
+    'idp_role_mapping_failed',
+    'person_enable',
+    'custom_role_change'
 );
 CREATE TYPE "config_policy" AS ENUM (
     'always',
@@ -177,9 +181,20 @@ CREATE TABLE "config" (
     "login_anomaly_history_size" integer DEFAULT 10 NOT NULL,
     "login_anomaly_email_threshold" integer DEFAULT 1 NOT NULL,
     "login_anomaly_step_up_threshold" integer DEFAULT 3 NOT NULL,
+    "panel_global_roles" "text"[] DEFAULT '{super_admin,project_admin}'::"text"[] NOT NULL,
+    "panel_project_roles" "text"[] DEFAULT '{admin}'::"text"[] NOT NULL,
     CONSTRAINT "config_captcha_complete" CHECK ((("captcha_provider" IS NULL) OR (("captcha_secret" IS NOT NULL) AND ("captcha_secret_version" IS NOT NULL)))),
     CONSTRAINT "config_captcha_provider_check" CHECK ((("captcha_provider" IS NULL) OR ("captcha_provider" = ANY (ARRAY['turnstile'::"text", 'hcaptcha'::"text", 'recaptchaV3'::"text"]))))
 );
+CREATE TABLE "custom_role" (
+    "id" "uuid" NOT NULL,
+    "slug" "text" NOT NULL,
+    "description" "text",
+    "grants" "jsonb" NOT NULL,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "updated_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    CONSTRAINT "custom_role_grants_check" CHECK (("jsonb_typeof"("grants") = 'array'::"text"))
+);
 CREATE TABLE "identity" (
     "id" "uuid" NOT NULL,
     "parent_id" "uuid",
@@ -197,7 +212,8 @@ CREATE TABLE "identity_provider" (
     "exclusive" boolean DEFAULT false,
     "init_returns_config" boolean DEFAULT false NOT NULL,
     "require_verified_email" boolean DEFAULT false NOT NULL,
-    "assume_email_verified" boolean DEFAULT false NOT NULL
+    "assume_email_verified" boolean DEFAULT false NOT NULL,
+    "disable_local_authentication" boolean DEFAULT false NOT NULL
 );
 CREATE TABLE "idp_session" (
     "id" "uuid" NOT NULL,
@@ -331,6 +347,10 @@ ALTER TABLE ONLY "auth_policy"
     ADD CONSTRAINT "auth_policy_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "config"
     ADD CONSTRAINT "config_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "custom_role"
+    ADD CONSTRAINT "custom_role_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "custom_role"
+    ADD CONSTRAINT "custom_role_slug_key" UNIQUE ("slug");
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "email_unique" UNIQUE ("email");
 ALTER TABLE ONLY "identity"