npm - @contember/engine-tenant-api - Versions diffs - 2.2.0-alpha.1 → 2.2.0-alpha.10 - Mend

@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2014) hide show

package/dist/production/src/migrations/snapshot.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"snapshot.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":["createCredentials"],"mappings":";;AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CA+bZ;AAEA,QAAMA,kBAAAA,kBAAkB,SAAS,IAAI;AACtC;;"}
1	+ {"version":3,"file":"snapshot.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout',\n 'idp_role_mapped',\n 'idp_role_mapping_failed',\n 'person_enable',\n 'custom_role_change'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n \"panel_global_roles\" \"text\"[] DEFAULT '{super_admin,project_admin}'::\"text\"[] NOT NULL,\n \"panel_project_roles\" \"text\"[] DEFAULT '{admin}'::\"text\"[] NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"custom_role\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"description\" \"text\",\n \"grants\" \"jsonb\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n CONSTRAINT \"custom_role_grants_check\" CHECK ((\"jsonb_typeof\"(\"grants\") = 'array'::\"text\"))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL,\n \"disable_local_authentication\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"custom_role\"\n ADD CONSTRAINT \"custom_role_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"custom_role\"\n ADD CONSTRAINT \"custom_role_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":["createCredentials"],"mappings":";;AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAmdZ;AAEA,QAAMA,kBAAAA,kBAAkB,SAAS,IAAI;AACtC;;"}

package/dist/production/src/migrations/snapshot.js CHANGED Viewed

@@ -53,7 +53,11 @@ CREATE TYPE "auth_log_type" AS ENUM (
     'unusual_login_detected',
     'step_up_required',
     'idp_logout_initiated',
-    'idp_backchannel_logout'
+    'idp_backchannel_logout',
+    'idp_role_mapped',
+    'idp_role_mapping_failed',
+    'person_enable',
+    'custom_role_change'
 );
 CREATE TYPE "config_policy" AS ENUM (
     'always',
@@ -176,9 +180,20 @@ CREATE TABLE "config" (
     "login_anomaly_history_size" integer DEFAULT 10 NOT NULL,
     "login_anomaly_email_threshold" integer DEFAULT 1 NOT NULL,
     "login_anomaly_step_up_threshold" integer DEFAULT 3 NOT NULL,
+    "panel_global_roles" "text"[] DEFAULT '{super_admin,project_admin}'::"text"[] NOT NULL,
+    "panel_project_roles" "text"[] DEFAULT '{admin}'::"text"[] NOT NULL,
     CONSTRAINT "config_captcha_complete" CHECK ((("captcha_provider" IS NULL) OR (("captcha_secret" IS NOT NULL) AND ("captcha_secret_version" IS NOT NULL)))),
     CONSTRAINT "config_captcha_provider_check" CHECK ((("captcha_provider" IS NULL) OR ("captcha_provider" = ANY (ARRAY['turnstile'::"text", 'hcaptcha'::"text", 'recaptchaV3'::"text"]))))
 );
+CREATE TABLE "custom_role" (
+    "id" "uuid" NOT NULL,
+    "slug" "text" NOT NULL,
+    "description" "text",
+    "grants" "jsonb" NOT NULL,
+    "created_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    "updated_at" timestamp with time zone DEFAULT "now"() NOT NULL,
+    CONSTRAINT "custom_role_grants_check" CHECK (("jsonb_typeof"("grants") = 'array'::"text"))
+);
 CREATE TABLE "identity" (
     "id" "uuid" NOT NULL,
     "parent_id" "uuid",
@@ -196,7 +211,8 @@ CREATE TABLE "identity_provider" (
     "exclusive" boolean DEFAULT false,
     "init_returns_config" boolean DEFAULT false NOT NULL,
     "require_verified_email" boolean DEFAULT false NOT NULL,
-    "assume_email_verified" boolean DEFAULT false NOT NULL
+    "assume_email_verified" boolean DEFAULT false NOT NULL,
+    "disable_local_authentication" boolean DEFAULT false NOT NULL
 );
 CREATE TABLE "idp_session" (
     "id" "uuid" NOT NULL,
@@ -330,6 +346,10 @@ ALTER TABLE ONLY "auth_policy"
     ADD CONSTRAINT "auth_policy_pkey" PRIMARY KEY ("id");
 ALTER TABLE ONLY "config"
     ADD CONSTRAINT "config_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "custom_role"
+    ADD CONSTRAINT "custom_role_pkey" PRIMARY KEY ("id");
+ALTER TABLE ONLY "custom_role"
+    ADD CONSTRAINT "custom_role_slug_key" UNIQUE ("slug");
 ALTER TABLE ONLY "person"
     ADD CONSTRAINT "email_unique" UNIQUE ("email");
 ALTER TABLE ONLY "identity"

package/dist/production/src/migrations/snapshot.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CA+bZ;AAEA,QAAM,kBAAkB,SAAS,IAAI;AACtC;"}
1	+ {"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout',\n 'idp_role_mapped',\n 'idp_role_mapping_failed',\n 'person_enable',\n 'custom_role_change'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n \"panel_global_roles\" \"text\"[] DEFAULT '{super_admin,project_admin}'::\"text\"[] NOT NULL,\n \"panel_project_roles\" \"text\"[] DEFAULT '{admin}'::\"text\"[] NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"custom_role\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"description\" \"text\",\n \"grants\" \"jsonb\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n CONSTRAINT \"custom_role_grants_check\" CHECK ((\"jsonb_typeof\"(\"grants\") = 'array'::\"text\"))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL,\n \"disable_local_authentication\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"custom_role\"\n ADD CONSTRAINT \"custom_role_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"custom_role\"\n ADD CONSTRAINT \"custom_role_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAmdZ;AAEA,QAAM,kBAAkB,SAAS,IAAI;AACtC;"}

package/dist/production/src/model/authorization/CustomRoleAuthorizator.cjs ADDED Viewed

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const authorization = require("@contember/authorization");
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../type/ApiKey.cjs");
+const CustomRolesQuery = require("../queries/customRole/CustomRolesQuery.cjs");
+require("./PermissionActions.cjs");
+const IdentityScope = require("./IdentityScope.cjs");
+const CustomRolePermissions = require("./CustomRolePermissions.cjs");
+require("./PermissionContext.cjs");
+require("./TargetIdentityPermission.cjs");
+require("@contember/schema");
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class CustomRolePermissionCache {
+  constructor(db) {
+    this.db = db;
+    __publicField(this, "loading");
+  }
+  /**
+   * One query, two maps. `projectScoped` holds only the grants that carry their own project
+   * filter, because the scope itself is not passed down to `Permissions.isAllowed`.
+   */
+  load() {
+    this.loading ?? (this.loading = this.db.queryHandler.fetch(new CustomRolesQuery.CustomRolesQuery()).then((rows) => ({
+      global: CustomRolePermissions.buildCustomRolePermissions(rows),
+      projectScoped: CustomRolePermissions.buildCustomRolePermissions(rows, { projectScoped: true })
+    })));
+    return this.loading;
+  }
+}
+const isProjectBoundedScope = (scope) => !(scope instanceof authorization.AuthorizationScope.Global) && !(scope instanceof IdentityScope.IdentityScope);
+class CustomRoleAuthorizator {
+  constructor(inner, db, customRoleCache = new CustomRolePermissionCache(db)) {
+    this.inner = inner;
+    this.customRoleCache = customRoleCache;
+  }
+  /**
+   * Loads the definitions up front so no later check has to query mid-transaction —
+   * that would need a second pooled connection while the first one is pinned. No-op
+   * for identities carrying only built-in roles.
+   */
+  async preload(roles) {
+    if (roles.some((role) => !CustomRolePermissions.BUILTIN_TENANT_ROLES.has(role))) {
+      await this.customRoleCache.load();
+    }
+  }
+  async isAllowed(identity, scope, action) {
+    if (await this.inner.isAllowed(identity, scope, action)) {
+      return true;
+    }
+    const customRoles = identity.roles.filter((role) => !CustomRolePermissions.BUILTIN_TENANT_ROLES.has(role));
+    if (customRoles.length === 0) {
+      return false;
+    }
+    const loaded = await this.customRoleCache.load();
+    const permissions = isProjectBoundedScope(scope) ? loaded.projectScoped : loaded.global;
+    return customRoles.some((role) => permissions.isAllowed(role, action.resource, action.privilege, action.meta));
+  }
+}
+exports.CustomRoleAuthorizator = CustomRoleAuthorizator;
+exports.CustomRolePermissionCache = CustomRolePermissionCache;
+//# sourceMappingURL=CustomRoleAuthorizator.cjs.map

package/dist/production/src/model/authorization/CustomRoleAuthorizator.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"CustomRoleAuthorizator.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/CustomRoleAuthorizator.ts"],"sourcesContent":["import { AuthorizationScope, Authorizator, Permissions } from '@contember/authorization'\nimport { DatabaseContext } from '../utils/index.js'\nimport { CustomRolesQuery } from '../queries/index.js'\nimport { Identity } from './Identity.js'\nimport { IdentityScope } from './IdentityScope.js'\nimport { buildCustomRolePermissions, BUILTIN_TENANT_ROLES } from './CustomRolePermissions.js'\n\nexport class CustomRolePermissionCache {\n\tprivate loading: Promise<{ readonly global: Permissions; readonly projectScoped: Permissions }> | undefined\n\n\tconstructor(private readonly db: DatabaseContext) {}\n\n\t/**\n\t * One query, two maps. `projectScoped` holds only the grants that carry their own project\n\t * filter, because the scope itself is not passed down to `Permissions.isAllowed`.\n\t */\n\tload(): Promise<{ readonly global: Permissions; readonly projectScoped: Permissions }> {\n\t\tthis.loading ??= this.db.queryHandler.fetch(new CustomRolesQuery()).then(rows => ({\n\t\t\tglobal: buildCustomRolePermissions(rows),\n\t\t\tprojectScoped: buildCustomRolePermissions(rows, { projectScoped: true }),\n\t\t}))\n\t\treturn this.loading\n\t}\n}\n\n/**\n * Which scopes bound a check to one project. `Global` is unbounded and `IdentityScope` only *widens*\n * (it adds `self` when the target is the caller), so neither constrains what a grant may reach —\n * everything else is treated as project-bounded, so a scope kind added later fails closed rather\n * than letting a tenant-global grant answer for every project.\n */\nconst isProjectBoundedScope = (scope: AuthorizationScope<Identity>): boolean =>\n\t!(scope instanceof AuthorizationScope.Global) && !(scope instanceof IdentityScope)\n\nexport class CustomRoleAuthorizator implements Authorizator<Identity> {\n\tconstructor(\n\t\tprivate readonly inner: Authorizator<Identity>,\n\t\tdb: DatabaseContext,\n\t\tpublic readonly customRoleCache = new CustomRolePermissionCache(db),\n\t) {\n\t}\n\n\t/**\n\t * Loads the definitions up front so no later check has to query mid-transaction —\n\t * that would need a second pooled connection while the first one is pinned. No-op\n\t * for identities carrying only built-in roles.\n\t */\n\tasync preload(roles: readonly string[]): Promise<void> {\n\t\tif (roles.some(role => !BUILTIN_TENANT_ROLES.has(role))) {\n\t\t\tawait this.customRoleCache.load()\n\t\t}\n\t}\n\n\tasync isAllowed(\n\t\tidentity: Identity,\n\t\tscope: Parameters<Authorizator<Identity>['isAllowed']>[1],\n\t\taction: Authorizator.Action,\n\t): Promise<boolean> {\n\t\tif (await this.inner.isAllowed(identity, scope, action)) {\n\t\t\treturn true\n\t\t}\n\t\tconst customRoles = identity.roles.filter(role => !BUILTIN_TENANT_ROLES.has(role))\n\t\tif (customRoles.length === 0) {\n\t\t\treturn false\n\t\t}\n\t\t// `Permissions.isAllowed` takes no scope, so a grant answering a project-bounded check would\n\t\t// answer it for every project. Only grants carrying their own project filter get to try.\n\t\tconst loaded = await this.customRoleCache.load()\n\t\tconst permissions = isProjectBoundedScope(scope) ? loaded.projectScoped : loaded.global\n\t\treturn customRoles.some(role => permissions.isAllowed(role, action.resource, action.privilege, action.meta))\n\t}\n}\n"],"names":["CustomRolesQuery","buildCustomRolePermissions","AuthorizationScope","IdentityScope","BUILTIN_TENANT_ROLES"],"mappings":";;;;;;;;;;;;;;;;AAOO,MAAM,0BAA0B;AAAA,EAGtC,YAA6B,IAAqB;AAArB,SAAA,KAAA;AAF7B,kBAAA,MAAQ,SAAA;AAAA,EAE2C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnD,OAAuF;AACtF,SAAK,YAAL,KAAK,UAAY,KAAK,GAAG,aAAa,MAAM,IAAIA,iBAAAA,iBAAA,CAAkB,EAAE,KAAK,CAAA,UAAS;AAAA,MACjF,QAAQC,sBAAAA,2BAA2B,IAAI;AAAA,MACvC,eAAeA,sBAAAA,2BAA2B,MAAM,EAAE,eAAe,MAAM;AAAA,IAAA,EACtE;AACF,WAAO,KAAK;AAAA,EACb;AACD;AAQA,MAAM,wBAAwB,CAAC,UAC9B,EAAE,iBAAiBC,cAAAA,mBAAmB,WAAW,EAAE,iBAAiBC;AAE9D,MAAM,uBAAyD;AAAA,EACrE,YACkB,OACjB,IACgB,kBAAkB,IAAI,0BAA0B,EAAE,GACjE;AAHgB,SAAA,QAAA;AAED,SAAA,kBAAA;AAAA,EAEjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,QAAQ,OAAyC;AACtD,QAAI,MAAM,KAAK,CAAA,SAAQ,CAACC,sBAAAA,qBAAqB,IAAI,IAAI,CAAC,GAAG;AACxD,YAAM,KAAK,gBAAgB,KAAA;AAAA,IAC5B;AAAA,EACD;AAAA,EAEA,MAAM,UACL,UACA,OACA,QACmB;AACnB,QAAI,MAAM,KAAK,MAAM,UAAU,UAAU,OAAO,MAAM,GAAG;AACxD,aAAO;AAAA,IACR;AACA,UAAM,cAAc,SAAS,MAAM,OAAO,UAAQ,CAACA,sBAAAA,qBAAqB,IAAI,IAAI,CAAC;AACjF,QAAI,YAAY,WAAW,GAAG;AAC7B,aAAO;AAAA,IACR;AAGA,UAAM,SAAS,MAAM,KAAK,gBAAgB,KAAA;AAC1C,UAAM,cAAc,sBAAsB,KAAK,IAAI,OAAO,gBAAgB,OAAO;AACjF,WAAO,YAAY,KAAK,CAAA,SAAQ,YAAY,UAAU,MAAM,OAAO,UAAU,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAC5G;AACD;;;"}

package/dist/production/src/model/authorization/CustomRoleAuthorizator.js ADDED Viewed

@@ -0,0 +1,65 @@
+import { AuthorizationScope } from "@contember/authorization";
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../type/ApiKey.js";
+import { CustomRolesQuery } from "../queries/customRole/CustomRolesQuery.js";
+import "./PermissionActions.js";
+import { IdentityScope } from "./IdentityScope.js";
+import { BUILTIN_TENANT_ROLES, buildCustomRolePermissions } from "./CustomRolePermissions.js";
+import "./PermissionContext.js";
+import "./TargetIdentityPermission.js";
+import "@contember/schema";
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
+class CustomRolePermissionCache {
+  constructor(db) {
+    this.db = db;
+    __publicField(this, "loading");
+  }
+  /**
+   * One query, two maps. `projectScoped` holds only the grants that carry their own project
+   * filter, because the scope itself is not passed down to `Permissions.isAllowed`.
+   */
+  load() {
+    this.loading ?? (this.loading = this.db.queryHandler.fetch(new CustomRolesQuery()).then((rows) => ({
+      global: buildCustomRolePermissions(rows),
+      projectScoped: buildCustomRolePermissions(rows, { projectScoped: true })
+    })));
+    return this.loading;
+  }
+}
+const isProjectBoundedScope = (scope) => !(scope instanceof AuthorizationScope.Global) && !(scope instanceof IdentityScope);
+class CustomRoleAuthorizator {
+  constructor(inner, db, customRoleCache = new CustomRolePermissionCache(db)) {
+    this.inner = inner;
+    this.customRoleCache = customRoleCache;
+  }
+  /**
+   * Loads the definitions up front so no later check has to query mid-transaction —
+   * that would need a second pooled connection while the first one is pinned. No-op
+   * for identities carrying only built-in roles.
+   */
+  async preload(roles) {
+    if (roles.some((role) => !BUILTIN_TENANT_ROLES.has(role))) {
+      await this.customRoleCache.load();
+    }
+  }
+  async isAllowed(identity, scope, action) {
+    if (await this.inner.isAllowed(identity, scope, action)) {
+      return true;
+    }
+    const customRoles = identity.roles.filter((role) => !BUILTIN_TENANT_ROLES.has(role));
+    if (customRoles.length === 0) {
+      return false;
+    }
+    const loaded = await this.customRoleCache.load();
+    const permissions = isProjectBoundedScope(scope) ? loaded.projectScoped : loaded.global;
+    return customRoles.some((role) => permissions.isAllowed(role, action.resource, action.privilege, action.meta));
+  }
+}
+export {
+  CustomRoleAuthorizator,
+  CustomRolePermissionCache
+};
+//# sourceMappingURL=CustomRoleAuthorizator.js.map

package/dist/production/src/model/authorization/CustomRoleAuthorizator.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"CustomRoleAuthorizator.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/CustomRoleAuthorizator.ts"],"sourcesContent":["import { AuthorizationScope, Authorizator, Permissions } from '@contember/authorization'\nimport { DatabaseContext } from '../utils/index.js'\nimport { CustomRolesQuery } from '../queries/index.js'\nimport { Identity } from './Identity.js'\nimport { IdentityScope } from './IdentityScope.js'\nimport { buildCustomRolePermissions, BUILTIN_TENANT_ROLES } from './CustomRolePermissions.js'\n\nexport class CustomRolePermissionCache {\n\tprivate loading: Promise<{ readonly global: Permissions; readonly projectScoped: Permissions }> | undefined\n\n\tconstructor(private readonly db: DatabaseContext) {}\n\n\t/**\n\t * One query, two maps. `projectScoped` holds only the grants that carry their own project\n\t * filter, because the scope itself is not passed down to `Permissions.isAllowed`.\n\t */\n\tload(): Promise<{ readonly global: Permissions; readonly projectScoped: Permissions }> {\n\t\tthis.loading ??= this.db.queryHandler.fetch(new CustomRolesQuery()).then(rows => ({\n\t\t\tglobal: buildCustomRolePermissions(rows),\n\t\t\tprojectScoped: buildCustomRolePermissions(rows, { projectScoped: true }),\n\t\t}))\n\t\treturn this.loading\n\t}\n}\n\n/**\n * Which scopes bound a check to one project. `Global` is unbounded and `IdentityScope` only *widens*\n * (it adds `self` when the target is the caller), so neither constrains what a grant may reach —\n * everything else is treated as project-bounded, so a scope kind added later fails closed rather\n * than letting a tenant-global grant answer for every project.\n */\nconst isProjectBoundedScope = (scope: AuthorizationScope<Identity>): boolean =>\n\t!(scope instanceof AuthorizationScope.Global) && !(scope instanceof IdentityScope)\n\nexport class CustomRoleAuthorizator implements Authorizator<Identity> {\n\tconstructor(\n\t\tprivate readonly inner: Authorizator<Identity>,\n\t\tdb: DatabaseContext,\n\t\tpublic readonly customRoleCache = new CustomRolePermissionCache(db),\n\t) {\n\t}\n\n\t/**\n\t * Loads the definitions up front so no later check has to query mid-transaction —\n\t * that would need a second pooled connection while the first one is pinned. No-op\n\t * for identities carrying only built-in roles.\n\t */\n\tasync preload(roles: readonly string[]): Promise<void> {\n\t\tif (roles.some(role => !BUILTIN_TENANT_ROLES.has(role))) {\n\t\t\tawait this.customRoleCache.load()\n\t\t}\n\t}\n\n\tasync isAllowed(\n\t\tidentity: Identity,\n\t\tscope: Parameters<Authorizator<Identity>['isAllowed']>[1],\n\t\taction: Authorizator.Action,\n\t): Promise<boolean> {\n\t\tif (await this.inner.isAllowed(identity, scope, action)) {\n\t\t\treturn true\n\t\t}\n\t\tconst customRoles = identity.roles.filter(role => !BUILTIN_TENANT_ROLES.has(role))\n\t\tif (customRoles.length === 0) {\n\t\t\treturn false\n\t\t}\n\t\t// `Permissions.isAllowed` takes no scope, so a grant answering a project-bounded check would\n\t\t// answer it for every project. Only grants carrying their own project filter get to try.\n\t\tconst loaded = await this.customRoleCache.load()\n\t\tconst permissions = isProjectBoundedScope(scope) ? loaded.projectScoped : loaded.global\n\t\treturn customRoles.some(role => permissions.isAllowed(role, action.resource, action.privilege, action.meta))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;AAOO,MAAM,0BAA0B;AAAA,EAGtC,YAA6B,IAAqB;AAArB,SAAA,KAAA;AAF7B,kBAAA,MAAQ,SAAA;AAAA,EAE2C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMnD,OAAuF;AACtF,SAAK,YAAL,KAAK,UAAY,KAAK,GAAG,aAAa,MAAM,IAAI,iBAAA,CAAkB,EAAE,KAAK,CAAA,UAAS;AAAA,MACjF,QAAQ,2BAA2B,IAAI;AAAA,MACvC,eAAe,2BAA2B,MAAM,EAAE,eAAe,MAAM;AAAA,IAAA,EACtE;AACF,WAAO,KAAK;AAAA,EACb;AACD;AAQA,MAAM,wBAAwB,CAAC,UAC9B,EAAE,iBAAiB,mBAAmB,WAAW,EAAE,iBAAiB;AAE9D,MAAM,uBAAyD;AAAA,EACrE,YACkB,OACjB,IACgB,kBAAkB,IAAI,0BAA0B,EAAE,GACjE;AAHgB,SAAA,QAAA;AAED,SAAA,kBAAA;AAAA,EAEjB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,QAAQ,OAAyC;AACtD,QAAI,MAAM,KAAK,CAAA,SAAQ,CAAC,qBAAqB,IAAI,IAAI,CAAC,GAAG;AACxD,YAAM,KAAK,gBAAgB,KAAA;AAAA,IAC5B;AAAA,EACD;AAAA,EAEA,MAAM,UACL,UACA,OACA,QACmB;AACnB,QAAI,MAAM,KAAK,MAAM,UAAU,UAAU,OAAO,MAAM,GAAG;AACxD,aAAO;AAAA,IACR;AACA,UAAM,cAAc,SAAS,MAAM,OAAO,UAAQ,CAAC,qBAAqB,IAAI,IAAI,CAAC;AACjF,QAAI,YAAY,WAAW,GAAG;AAC7B,aAAO;AAAA,IACR;AAGA,UAAM,SAAS,MAAM,KAAK,gBAAgB,KAAA;AAC1C,UAAM,cAAc,sBAAsB,KAAK,IAAI,OAAO,gBAAgB,OAAO;AACjF,WAAO,YAAY,KAAK,CAAA,SAAQ,YAAY,UAAU,MAAM,OAAO,UAAU,OAAO,WAAW,OAAO,IAAI,CAAC;AAAA,EAC5G;AACD;"}