@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/model/commands/configuration/UpdateConfigurationCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateConfigurationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// Encrypt captcha secret at rest. Empty string clears the value;\n\t\t// non-empty re-encrypts so we always rotate to the latest key version.\n\t\tlet captchaSecretCol: Buffer | null | undefined\n\t\tlet captchaSecretVersionCol: number | null | undefined\n\t\tif (captcha?.secret !== undefined) {\n\t\t\tif (captcha.secret === '' || captcha.secret === null) {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;AAI9B,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,QAAW;AAClC,UAAI,QAAQ,WAAW,MAAM,QAAQ,WAAW,MAAM;AACrD,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,MAAA;AAAA,IACpF,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;"}
+{"version":3,"file":"UpdateConfigurationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// Null and omission preserve the stored secret; only an empty string clears it.\n\t\tlet captchaSecretCol: Buffer | null | undefined\n\t\tlet captchaSecretVersionCol: number | null | undefined\n\t\tif (captcha?.secret !== undefined && captcha.secret !== null) {\n\t\t\tif (captcha.secret === '') {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t\tpanel_global_roles: this.configuration.panel?.globalRoles ?? undefined,\n\t\t\t\t\tpanel_project_roles: this.configuration.panel?.projectRoles ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;AAG9B,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC7D,UAAI,QAAQ,WAAW,IAAI;AAC1B,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,QACnF,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,qBAAqB,KAAK,cAAc,OAAO,gBAAgB;AAAA,MAAA;AAAA,IAChE,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;"}

package/dist/production/src/model/commands/customRole/CreateCustomRoleCommand.cjs

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class CreateCustomRoleCommand {
+  constructor(values) {
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const now = providers.now();
+    await Database.InsertBuilder.create().into("custom_role").values({
+      id,
+      slug: this.values.slug,
+      description: this.values.description,
+      grants: JSON.stringify(this.values.grants),
+      created_at: now,
+      updated_at: now
+    }).execute(db);
+    return id;
+  }
+}
+exports.CreateCustomRoleCommand = CreateCustomRoleCommand;
+//# sourceMappingURL=CreateCustomRoleCommand.cjs.map

package/dist/production/src/model/commands/customRole/CreateCustomRoleCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateCustomRoleCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/CreateCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\n/** Inserts a new `custom_role` row. Returns the generated id. */\nexport class CreateCustomRoleCommand implements Command<string> {\n\tconstructor(\n\t\tprivate readonly values: {\n\t\t\tslug: string\n\t\t\tdescription: string | null\n\t\t\tgrants: unknown\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst id = providers.uuid()\n\t\tconst now = providers.now()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('custom_role')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tslug: this.values.slug,\n\t\t\t\tdescription: this.values.description,\n\t\t\t\tgrants: JSON.stringify(this.values.grants),\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn id\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,wBAAmD;AAAA,EAC/D,YACkB,QAKhB;AALgB,SAAA,SAAA;AAAA,EAKf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA4C;AAC/D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,MAAM,UAAU,IAAA;AACtB,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,MAAM,KAAK,OAAO;AAAA,MAClB,aAAa,KAAK,OAAO;AAAA,MACzB,QAAQ,KAAK,UAAU,KAAK,OAAO,MAAM;AAAA,MACzC,YAAY;AAAA,MACZ,YAAY;AAAA,IAAA,CACZ,EACA,QAAQ,EAAE;AACZ,WAAO;AAAA,EACR;AACD;;"}

package/dist/production/src/model/commands/customRole/CreateCustomRoleCommand.js

@@ -0,0 +1,23 @@
+import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+class CreateCustomRoleCommand {
+  constructor(values) {
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const id = providers.uuid();
+    const now = providers.now();
+    await InsertBuilder$1.create().into("custom_role").values({
+      id,
+      slug: this.values.slug,
+      description: this.values.description,
+      grants: JSON.stringify(this.values.grants),
+      created_at: now,
+      updated_at: now
+    }).execute(db);
+    return id;
+  }
+}
+export {
+  CreateCustomRoleCommand
+};
+//# sourceMappingURL=CreateCustomRoleCommand.js.map

package/dist/production/src/model/commands/customRole/CreateCustomRoleCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CreateCustomRoleCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/CreateCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\n\n/** Inserts a new `custom_role` row. Returns the generated id. */\nexport class CreateCustomRoleCommand implements Command<string> {\n\tconstructor(\n\t\tprivate readonly values: {\n\t\t\tslug: string\n\t\t\tdescription: string | null\n\t\t\tgrants: unknown\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<string> {\n\t\tconst id = providers.uuid()\n\t\tconst now = providers.now()\n\t\tawait InsertBuilder.create()\n\t\t\t.into('custom_role')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tslug: this.values.slug,\n\t\t\t\tdescription: this.values.description,\n\t\t\t\tgrants: JSON.stringify(this.values.grants),\n\t\t\t\tcreated_at: now,\n\t\t\t\tupdated_at: now,\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn id\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,wBAAmD;AAAA,EAC/D,YACkB,QAKhB;AALgB,SAAA,SAAA;AAAA,EAKf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA4C;AAC/D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,MAAM,UAAU,IAAA;AACtB,UAAMA,gBAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,MAAM,KAAK,OAAO;AAAA,MAClB,aAAa,KAAK,OAAO;AAAA,MACzB,QAAQ,KAAK,UAAU,KAAK,OAAO,MAAM;AAAA,MACzC,YAAY;AAAA,MACZ,YAAY;AAAA,IAAA,CACZ,EACA,QAAQ,EAAE;AACZ,WAAO;AAAA,EACR;AACD;"}

package/dist/production/src/model/commands/customRole/DeleteCustomRoleCommand.cjs

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class DeleteCustomRoleCommand {
+  constructor(slug) {
+    this.slug = slug;
+  }
+  async execute({ db }) {
+    const result = await Database.DeleteBuilder.create().from("custom_role").where({ slug: this.slug }).execute(db);
+    return result > 0;
+  }
+}
+exports.DeleteCustomRoleCommand = DeleteCustomRoleCommand;
+//# sourceMappingURL=DeleteCustomRoleCommand.cjs.map

package/dist/production/src/model/commands/customRole/DeleteCustomRoleCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteCustomRoleCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/DeleteCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/**\n * Removes a role definition outright. The slug becomes reusable; the audit log\n * (`custom_role_change`) is what preserves the trace of what it used to grant.\n * Callers must strip the slug from every identity in the same transaction —\n * see `RemoveCustomRoleAssignmentsCommand`.\n */\nexport class DeleteCustomRoleCommand implements Command<boolean> {\n\tconstructor(private readonly slug: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await DeleteBuilder.create()\n\t\t\t.from('custom_role')\n\t\t\t.where({ slug: this.slug })\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AASO,MAAM,wBAAoD;AAAA,EAChE,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAAe;AAAA,EAE5C,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAMA,SAAAA,cAAc,OAAA,EACjC,KAAK,aAAa,EAClB,MAAM,EAAE,MAAM,KAAK,KAAA,CAAM,EACzB,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}

package/dist/production/src/model/commands/customRole/DeleteCustomRoleCommand.js

@@ -0,0 +1,14 @@
+import { DeleteBuilder } from "@contember/database";
+class DeleteCustomRoleCommand {
+  constructor(slug) {
+    this.slug = slug;
+  }
+  async execute({ db }) {
+    const result = await DeleteBuilder.create().from("custom_role").where({ slug: this.slug }).execute(db);
+    return result > 0;
+  }
+}
+export {
+  DeleteCustomRoleCommand
+};
+//# sourceMappingURL=DeleteCustomRoleCommand.js.map

package/dist/production/src/model/commands/customRole/DeleteCustomRoleCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DeleteCustomRoleCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/DeleteCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\n/**\n * Removes a role definition outright. The slug becomes reusable; the audit log\n * (`custom_role_change`) is what preserves the trace of what it used to grant.\n * Callers must strip the slug from every identity in the same transaction —\n * see `RemoveCustomRoleAssignmentsCommand`.\n */\nexport class DeleteCustomRoleCommand implements Command<boolean> {\n\tconstructor(private readonly slug: string) {}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await DeleteBuilder.create()\n\t\t\t.from('custom_role')\n\t\t\t.where({ slug: this.slug })\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":[],"mappings":";AASO,MAAM,wBAAoD;AAAA,EAChE,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAAe;AAAA,EAE5C,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAM,cAAc,OAAA,EACjC,KAAK,aAAa,EAClB,MAAM,EAAE,MAAM,KAAK,KAAA,CAAM,EACzB,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}

package/dist/production/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.cjs

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class RemoveCustomRoleAssignmentsCommand {
+  constructor(slug) {
+    this.slug = slug;
+  }
+  async execute({ db }) {
+    const result = await Database.UpdateBuilder.create().table("identity").where((expr) => expr.raw("roles \\? ?", this.slug)).values({
+      roles: (expr) => expr.raw("roles - ?", this.slug)
+    }).returning("id").execute(db);
+    return result.map((row) => row.id);
+  }
+}
+exports.RemoveCustomRoleAssignmentsCommand = RemoveCustomRoleAssignmentsCommand;
+//# sourceMappingURL=RemoveCustomRoleAssignmentsCommand.cjs.map

package/dist/production/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemoveCustomRoleAssignmentsCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/** Returns the identities the slug was stripped from, so the delete can audit who actually lost it. */\nexport class RemoveCustomRoleAssignmentsCommand implements Command<string[]> {\n\tconstructor(private readonly slug: string) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<string[]> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where(expr => expr.raw('roles \\\\? ?', this.slug))\n\t\t\t.values({\n\t\t\t\troles: expr => expr.raw('roles - ?', this.slug),\n\t\t\t})\n\t\t\t.returning('id')\n\t\t\t.execute(db)\n\t\treturn result.map(row => row.id as string)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAIO,MAAM,mCAAgE;AAAA,EAC5E,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAuC;AACtD,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM,CAAA,SAAQ,KAAK,IAAI,eAAe,KAAK,IAAI,CAAC,EAChD,OAAO;AAAA,MACP,OAAO,CAAA,SAAQ,KAAK,IAAI,aAAa,KAAK,IAAI;AAAA,IAAA,CAC9C,EACA,UAAU,IAAI,EACd,QAAQ,EAAE;AACZ,WAAO,OAAO,IAAI,CAAA,QAAO,IAAI,EAAY;AAAA,EAC1C;AACD;;"}

package/dist/production/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.js

@@ -0,0 +1,16 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class RemoveCustomRoleAssignmentsCommand {
+  constructor(slug) {
+    this.slug = slug;
+  }
+  async execute({ db }) {
+    const result = await UpdateBuilder$1.create().table("identity").where((expr) => expr.raw("roles \\? ?", this.slug)).values({
+      roles: (expr) => expr.raw("roles - ?", this.slug)
+    }).returning("id").execute(db);
+    return result.map((row) => row.id);
+  }
+}
+export {
+  RemoveCustomRoleAssignmentsCommand
+};
+//# sourceMappingURL=RemoveCustomRoleAssignmentsCommand.js.map

package/dist/production/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemoveCustomRoleAssignmentsCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/RemoveCustomRoleAssignmentsCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/** Returns the identities the slug was stripped from, so the delete can audit who actually lost it. */\nexport class RemoveCustomRoleAssignmentsCommand implements Command<string[]> {\n\tconstructor(private readonly slug: string) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<string[]> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where(expr => expr.raw('roles \\\\? ?', this.slug))\n\t\t\t.values({\n\t\t\t\troles: expr => expr.raw('roles - ?', this.slug),\n\t\t\t})\n\t\t\t.returning('id')\n\t\t\t.execute(db)\n\t\treturn result.map(row => row.id as string)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAIO,MAAM,mCAAgE;AAAA,EAC5E,YAA6B,MAAc;AAAd,SAAA,OAAA;AAAA,EAC7B;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAuC;AACtD,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM,CAAA,SAAQ,KAAK,IAAI,eAAe,KAAK,IAAI,CAAC,EAChD,OAAO;AAAA,MACP,OAAO,CAAA,SAAQ,KAAK,IAAI,aAAa,KAAK,IAAI;AAAA,IAAA,CAC9C,EACA,UAAU,IAAI,EACd,QAAQ,EAAE;AACZ,WAAO,OAAO,IAAI,CAAA,QAAO,IAAI,EAAY;AAAA,EAC1C;AACD;"}

package/dist/production/src/model/commands/customRole/UpdateCustomRoleCommand.cjs

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class UpdateCustomRoleCommand {
+  constructor(slug, values) {
+    this.slug = slug;
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const result = await Database.UpdateBuilder.create().table("custom_role").where({ slug: this.slug }).values({
+      description: this.values.description,
+      grants: this.values.grants === void 0 ? void 0 : JSON.stringify(this.values.grants),
+      updated_at: providers.now()
+    }).execute(db);
+    return result > 0;
+  }
+}
+exports.UpdateCustomRoleCommand = UpdateCustomRoleCommand;
+//# sourceMappingURL=UpdateCustomRoleCommand.cjs.map

package/dist/production/src/model/commands/customRole/UpdateCustomRoleCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateCustomRoleCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/UpdateCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Updates an existing `custom_role` row. Only the supplied fields are written\n * (an `undefined` field is left untouched; an explicit `null` description clears it).\n * `updated_at` is always bumped. Returns whether a row was affected.\n */\nexport class UpdateCustomRoleCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly slug: string,\n\t\tprivate readonly values: {\n\t\t\tdescription?: string | null\n\t\t\tgrants?: unknown\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('custom_role')\n\t\t\t.where({ slug: this.slug })\n\t\t\t.values({\n\t\t\t\tdescription: this.values.description,\n\t\t\t\tgrants: this.values.grants === undefined ? undefined : JSON.stringify(this.values.grants),\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAQO,MAAM,wBAAoD;AAAA,EAChE,YACkB,MACA,QAIhB;AALgB,SAAA,OAAA;AACA,SAAA,SAAA;AAAA,EAIf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,SAAS,MAAMA,SAAAA,cAAc,OAAA,EACjC,MAAM,aAAa,EACnB,MAAM,EAAE,MAAM,KAAK,KAAA,CAAM,EACzB,OAAO;AAAA,MACP,aAAa,KAAK,OAAO;AAAA,MACzB,QAAQ,KAAK,OAAO,WAAW,SAAY,SAAY,KAAK,UAAU,KAAK,OAAO,MAAM;AAAA,MACxF,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}

package/dist/production/src/model/commands/customRole/UpdateCustomRoleCommand.js

@@ -0,0 +1,19 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class UpdateCustomRoleCommand {
+  constructor(slug, values) {
+    this.slug = slug;
+    this.values = values;
+  }
+  async execute({ db, providers }) {
+    const result = await UpdateBuilder$1.create().table("custom_role").where({ slug: this.slug }).values({
+      description: this.values.description,
+      grants: this.values.grants === void 0 ? void 0 : JSON.stringify(this.values.grants),
+      updated_at: providers.now()
+    }).execute(db);
+    return result > 0;
+  }
+}
+export {
+  UpdateCustomRoleCommand
+};
+//# sourceMappingURL=UpdateCustomRoleCommand.js.map

package/dist/production/src/model/commands/customRole/UpdateCustomRoleCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UpdateCustomRoleCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/customRole/UpdateCustomRoleCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/**\n * Updates an existing `custom_role` row. Only the supplied fields are written\n * (an `undefined` field is left untouched; an explicit `null` description clears it).\n * `updated_at` is always bumped. Returns whether a row was affected.\n */\nexport class UpdateCustomRoleCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly slug: string,\n\t\tprivate readonly values: {\n\t\t\tdescription?: string | null\n\t\t\tgrants?: unknown\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('custom_role')\n\t\t\t.where({ slug: this.slug })\n\t\t\t.values({\n\t\t\t\tdescription: this.values.description,\n\t\t\t\tgrants: this.values.grants === undefined ? undefined : JSON.stringify(this.values.grants),\n\t\t\t\tupdated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAQO,MAAM,wBAAoD;AAAA,EAChE,YACkB,MACA,QAIhB;AALgB,SAAA,OAAA;AACA,SAAA,SAAA;AAAA,EAIf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA6C;AAChE,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,aAAa,EACnB,MAAM,EAAE,MAAM,KAAK,KAAA,CAAM,EACzB,OAAO;AAAA,MACP,aAAa,KAAK,OAAO;AAAA,MACzB,QAAQ,KAAK,OAAO,WAAW,SAAY,SAAY,KAAK,UAAU,KAAK,OAAO,MAAM;AAAA,MACxF,YAAY,UAAU,IAAA;AAAA,IAAI,CAC1B,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}

package/dist/production/src/model/commands/identity/PatchIdentityGlobalRoles.cjs

@@ -13,7 +13,7 @@ class PatchIdentityGlobalRoles {
     }).values({
       roles: (it) => it.raw(
         `(
-						SELECT JSONB_AGG(DISTINCT out_role)
+						SELECT COALESCE(JSONB_AGG(DISTINCT out_role), '[]'::jsonb)
 						FROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)
 						WHERE NOT(out_role = ANY (?::text[]))
 					)`,

package/dist/production/src/model/commands/identity/PatchIdentityGlobalRoles.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PatchIdentityGlobalRoles.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT JSONB_AGG(DISTINCT out_role)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}
+{"version":3,"file":"PatchIdentityGlobalRoles.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT COALESCE(JSONB_AGG(DISTINCT out_role), '[]'::jsonb)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;;"}

package/dist/production/src/model/commands/identity/PatchIdentityGlobalRoles.js

@@ -11,7 +11,7 @@ class PatchIdentityGlobalRoles {
     }).values({
       roles: (it) => it.raw(
         `(
-						SELECT JSONB_AGG(DISTINCT out_role)
+						SELECT COALESCE(JSONB_AGG(DISTINCT out_role), '[]'::jsonb)
 						FROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)
 						WHERE NOT(out_role = ANY (?::text[]))
 					)`,

package/dist/production/src/model/commands/identity/PatchIdentityGlobalRoles.js.map

@@ -1 +1 @@
-{"version":3,"file":"PatchIdentityGlobalRoles.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT JSONB_AGG(DISTINCT out_role)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}
+{"version":3,"file":"PatchIdentityGlobalRoles.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/identity/PatchIdentityGlobalRoles.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class PatchIdentityGlobalRoles implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly add: readonly string[],\n\t\tprivate readonly remove: readonly string[],\n\t) {\n\t}\n\n\tpublic async execute({ db, providers }: Command.Args): Promise<boolean> {\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('identity')\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.values({\n\t\t\t\troles: it =>\n\t\t\t\t\tit.raw(\n\t\t\t\t\t\t`(\n\t\t\t\t\t\tSELECT COALESCE(JSONB_AGG(DISTINCT out_role), '[]'::jsonb)\n\t\t\t\t\t\tFROM JSONB_ARRAY_ELEMENTS_TEXT(roles || ?::jsonb) t(out_role)\n\t\t\t\t\t\tWHERE NOT(out_role = ANY (?::text[]))\n\t\t\t\t\t)`,\n\t\t\t\t\t\tJSON.stringify(this.add),\n\t\t\t\t\t\tthis.remove,\n\t\t\t\t\t),\n\t\t\t})\n\t\t\t.execute(db)\n\t\treturn result > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,yBAAqD;AAAA,EACjE,YACkB,IACA,KACA,QAChB;AAHgB,SAAA,KAAA;AACA,SAAA,MAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAa,QAAQ,EAAE,IAAI,aAA6C;AACvE,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,UAAU,EAChB,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,OAAO;AAAA,MACP,OAAO,QACN,GAAG;AAAA,QACF;AAAA;AAAA;AAAA;AAAA;AAAA,QAKA,KAAK,UAAU,KAAK,GAAG;AAAA,QACvB,KAAK;AAAA,MAAA;AAAA,IACN,CACD,EACA,QAAQ,EAAE;AACZ,WAAO,SAAS;AAAA,EACjB;AACD;"}

package/dist/production/src/model/commands/idp/ClaimIdpRevalidationCommand.cjs

@@ -1,18 +1,14 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
 class ClaimIdpRevalidationCommand {
   constructor(id, interval) {
     this.id = id;
     this.interval = interval;
   }
   async execute({ db }) {
-    const result = await db.query(
-      `UPDATE "idp_session"
-			 SET "last_validated_at" = now()
-			 WHERE "id" = ? AND "last_validated_at" <= now() - ?::interval`,
-      [this.id, this.interval]
-    );
-    return (result.rowCount ?? 0) > 0;
+    const qb = Database.UpdateBuilder.create().table("idp_session").where({ id: this.id }).where((expr) => expr.raw('"last_validated_at" <= now() - ?::interval', this.interval)).values({ last_validated_at: (expr) => expr.raw("now()") });
+    return await qb.execute(db) > 0;
   }
 }
 exports.ClaimIdpRevalidationCommand = ClaimIdpRevalidationCommand;

package/dist/production/src/model/commands/idp/ClaimIdpRevalidationCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ClaimIdpRevalidationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\n\n/**\n * Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n *\n * This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await db.query(\n\t\t\t`UPDATE \"idp_session\"\n\t\t\t SET \"last_validated_at\" = now()\n\t\t\t WHERE \"id\" = ? AND \"last_validated_at\" <= now() - ?::interval`,\n\t\t\t[this.id, this.interval],\n\t\t)\n\t\treturn (result.rowCount ?? 0) > 0\n\t}\n}\n"],"names":[],"mappings":";;AAWO,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAM,GAAG;AAAA,MACvB;AAAA;AAAA;AAAA,MAGA,CAAC,KAAK,IAAI,KAAK,QAAQ;AAAA,IAAA;AAExB,YAAQ,OAAO,YAAY,KAAK;AAAA,EACjC;AACD;;"}
+{"version":3,"file":"ClaimIdpRevalidationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { UpdateBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\n\n/**\n * Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n *\n * This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('idp_session')\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.raw('\"last_validated_at\" <= now() - ?::interval', this.interval))\n\t\t\t.values({ last_validated_at: expr => expr.raw('now()') })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAYO,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,aAAa,EACnB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,IAAI,8CAA8C,KAAK,QAAQ,CAAC,EACnF,OAAO,EAAE,mBAAmB,CAAA,SAAQ,KAAK,IAAI,OAAO,GAAG;AAEzD,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;;"}

package/dist/production/src/model/commands/idp/ClaimIdpRevalidationCommand.js

@@ -1,16 +1,12 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
 class ClaimIdpRevalidationCommand {
   constructor(id, interval) {
     this.id = id;
     this.interval = interval;
   }
   async execute({ db }) {
-    const result = await db.query(
-      `UPDATE "idp_session"
-			 SET "last_validated_at" = now()
-			 WHERE "id" = ? AND "last_validated_at" <= now() - ?::interval`,
-      [this.id, this.interval]
-    );
-    return (result.rowCount ?? 0) > 0;
+    const qb = UpdateBuilder$1.create().table("idp_session").where({ id: this.id }).where((expr) => expr.raw('"last_validated_at" <= now() - ?::interval', this.interval)).values({ last_validated_at: (expr) => expr.raw("now()") });
+    return await qb.execute(db) > 0;
   }
 }
 export {

package/dist/production/src/model/commands/idp/ClaimIdpRevalidationCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"ClaimIdpRevalidationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\n\n/**\n * Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n *\n * This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst result = await db.query(\n\t\t\t`UPDATE \"idp_session\"\n\t\t\t SET \"last_validated_at\" = now()\n\t\t\t WHERE \"id\" = ? AND \"last_validated_at\" <= now() - ?::interval`,\n\t\t\t[this.id, this.interval],\n\t\t)\n\t\treturn (result.rowCount ?? 0) > 0\n\t}\n}\n"],"names":[],"mappings":"AAWO,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,SAAS,MAAM,GAAG;AAAA,MACvB;AAAA;AAAA;AAAA,MAGA,CAAC,KAAK,IAAI,KAAK,QAAQ;AAAA,IAAA;AAExB,YAAQ,OAAO,YAAY,KAAK;AAAA,EACjC;AACD;"}
+{"version":3,"file":"ClaimIdpRevalidationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { UpdateBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\n\n/**\n * Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n *\n * This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('idp_session')\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.raw('\"last_validated_at\" <= now() - ?::interval', this.interval))\n\t\t\t.values({ last_validated_at: expr => expr.raw('now()') })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAYO,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,aAAa,EACnB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,IAAI,8CAA8C,KAAK,QAAQ,CAAC,EACnF,OAAO,EAAE,mBAAmB,CAAA,SAAQ,KAAK,IAAI,OAAO,GAAG;AAEzD,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;"}

package/dist/production/src/model/commands/idp/CreateIdpCommand.cjs

@@ -6,7 +6,12 @@ class CreateIdpCommand {
     this.data = data;
   }
   async execute({ db, providers }) {
-    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data;
+    const {
+      configuration,
+      options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
+      slug,
+      type
+    } = this.data;
     await Database.InsertBuilder.create().into("identity_provider").values({
       id: providers.uuid(),
       configuration,
@@ -16,7 +21,8 @@ class CreateIdpCommand {
       exclusive,
       init_returns_config: initReturnsConfig,
       require_verified_email: requireVerifiedEmail,
-      assume_email_verified: assumeEmailVerified
+      assume_email_verified: assumeEmailVerified,
+      disable_local_authentication: disableLocalAuthentication
     }).execute(db);
   }
 }

package/dist/production/src/model/commands/idp/CreateIdpCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,EAAE,eAAe,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,oBAAA,GAAuB,MAAM,KAAA,IAAS,KAAK;AAC7I,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,IAAA,CACvB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"CreateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst {\n\t\t\tconfiguration,\n\t\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },\n\t\t\tslug,\n\t\t\ttype,\n\t\t} = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t\tdisable_local_authentication: disableLocalAuthentication,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM;AAAA,MACL;AAAA,MACA,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,2BAAA;AAAA,MAChG;AAAA,MACA;AAAA,IAAA,IACG,KAAK;AACT,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,MACvB,8BAA8B;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/production/src/model/commands/idp/CreateIdpCommand.js

@@ -4,7 +4,12 @@ class CreateIdpCommand {
     this.data = data;
   }
   async execute({ db, providers }) {
-    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data;
+    const {
+      configuration,
+      options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
+      slug,
+      type
+    } = this.data;
     await InsertBuilder$1.create().into("identity_provider").values({
       id: providers.uuid(),
       configuration,
@@ -14,7 +19,8 @@ class CreateIdpCommand {
       exclusive,
       init_returns_config: initReturnsConfig,
       require_verified_email: requireVerifiedEmail,
-      assume_email_verified: assumeEmailVerified
+      assume_email_verified: assumeEmailVerified,
+      disable_local_authentication: disableLocalAuthentication
     }).execute(db);
   }
 }

package/dist/production/src/model/commands/idp/CreateIdpCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,EAAE,eAAe,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,oBAAA,GAAuB,MAAM,KAAA,IAAS,KAAK;AAC7I,UAAMA,gBAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,IAAA,CACvB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"CreateIdpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst {\n\t\t\tconfiguration,\n\t\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },\n\t\t\tslug,\n\t\t\ttype,\n\t\t} = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t\tdisable_local_authentication: disableLocalAuthentication,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM;AAAA,MACL;AAAA,MACA,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,2BAAA;AAAA,MAChG;AAAA,MACA;AAAA,IAAA,IACG,KAAK;AACT,UAAMA,gBAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,MACvB,8BAA8B;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/commands/idp/CreateIdpSessionCommand.cjs

@@ -19,7 +19,10 @@ class CreateIdpSessionCommand {
       tokens_version: tokens?.version ?? null,
       idp_expires_at: this.session.expiresAt ?? null,
       token_obtained_at: providers.now(),
-      last_validated_at: providers.now()
+      // last_validated_at is written on the DB clock to match the throttle
+      // comparison in ClaimIdpRevalidationCommand (`last_validated_at <= now() -
+      // interval`), so revalidation timing can't be skewed. See CLAUDE.md.
+      last_validated_at: new Database.Literal("now()")
     }).execute(db);
   }
 }

package/dist/production/src/model/commands/idp/CreateIdpSessionCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdpSessionCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpSessionCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport type { IDPSessionState } from '../../service/idp/index.js'\n\n/**\n * Persist the federated-session state for a freshly created session API key, so it can be\n * re-validated against the IdP later. The `tokens` blob is encrypted at rest via\n * `providers.encrypt` (same pattern as project secrets).\n */\nexport class CreateIdpSessionCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly apiKeyId: string,\n\t\tprivate readonly identityProviderId: string,\n\t\tprivate readonly session: IDPSessionState,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst id = providers.uuid()\n\t\tconst tokens = this.session.tokens\n\t\t\t? await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), 'utf8'))\n\t\t\t: null\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('idp_session')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tapi_key_id: this.apiKeyId,\n\t\t\t\tidentity_provider_id: this.identityProviderId,\n\t\t\t\tidp_session_id: this.session.sessionId ?? null,\n\t\t\t\ttokens: tokens?.value ?? null,\n\t\t\t\ttokens_version: tokens?.version ?? null,\n\t\t\t\tidp_expires_at: this.session.expiresAt ?? null,\n\t\t\t\ttoken_obtained_at: providers.now(),\n\t\t\t\tlast_validated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AASO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,UACA,oBACA,SAChB;AAHgB,SAAA,WAAA;AACA,SAAA,qBAAA;AACA,SAAA,UAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,KAAK,QAAQ,SACzB,MAAM,UAAU,QAAQ,OAAO,KAAK,KAAK,UAAU,KAAK,QAAQ,MAAM,GAAG,MAAM,CAAC,IAChF;AAEH,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,sBAAsB,KAAK;AAAA,MAC3B,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,QAAQ,QAAQ,SAAS;AAAA,MACzB,gBAAgB,QAAQ,WAAW;AAAA,MACnC,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,mBAAmB,UAAU,IAAA;AAAA,MAC7B,mBAAmB,UAAU,IAAA;AAAA,IAAI,CACjC,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"CreateIdpSessionCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpSessionCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport type { IDPSessionState } from '../../service/idp/index.js'\n\n/**\n * Persist the federated-session state for a freshly created session API key, so it can be\n * re-validated against the IdP later. The `tokens` blob is encrypted at rest via\n * `providers.encrypt` (same pattern as project secrets).\n */\nexport class CreateIdpSessionCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly apiKeyId: string,\n\t\tprivate readonly identityProviderId: string,\n\t\tprivate readonly session: IDPSessionState,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst id = providers.uuid()\n\t\tconst tokens = this.session.tokens\n\t\t\t? await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), 'utf8'))\n\t\t\t: null\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('idp_session')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tapi_key_id: this.apiKeyId,\n\t\t\t\tidentity_provider_id: this.identityProviderId,\n\t\t\t\tidp_session_id: this.session.sessionId ?? null,\n\t\t\t\ttokens: tokens?.value ?? null,\n\t\t\t\ttokens_version: tokens?.version ?? null,\n\t\t\t\tidp_expires_at: this.session.expiresAt ?? null,\n\t\t\t\ttoken_obtained_at: providers.now(),\n\t\t\t\t// last_validated_at is written on the DB clock to match the throttle\n\t\t\t\t// comparison in ClaimIdpRevalidationCommand (`last_validated_at <= now() -\n\t\t\t\t// interval`), so revalidation timing can't be skewed. See CLAUDE.md.\n\t\t\t\tlast_validated_at: new Literal('now()'),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder","Literal"],"mappings":";;;AASO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,UACA,oBACA,SAChB;AAHgB,SAAA,WAAA;AACA,SAAA,qBAAA;AACA,SAAA,UAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,KAAK,QAAQ,SACzB,MAAM,UAAU,QAAQ,OAAO,KAAK,KAAK,UAAU,KAAK,QAAQ,MAAM,GAAG,MAAM,CAAC,IAChF;AAEH,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,sBAAsB,KAAK;AAAA,MAC3B,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,QAAQ,QAAQ,SAAS;AAAA,MACzB,gBAAgB,QAAQ,WAAW;AAAA,MACnC,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,mBAAmB,UAAU,IAAA;AAAA;AAAA;AAAA;AAAA,MAI7B,mBAAmB,IAAIC,SAAAA,QAAQ,OAAO;AAAA,IAAA,CACtC,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/production/src/model/commands/idp/CreateIdpSessionCommand.js

@@ -1,4 +1,4 @@
-import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+import { InsertBuilder as InsertBuilder$1, Literal } from "@contember/database";
 class CreateIdpSessionCommand {
   constructor(apiKeyId, identityProviderId, session) {
     this.apiKeyId = apiKeyId;
@@ -17,7 +17,10 @@ class CreateIdpSessionCommand {
       tokens_version: tokens?.version ?? null,
       idp_expires_at: this.session.expiresAt ?? null,
       token_obtained_at: providers.now(),
-      last_validated_at: providers.now()
+      // last_validated_at is written on the DB clock to match the throttle
+      // comparison in ClaimIdpRevalidationCommand (`last_validated_at <= now() -
+      // interval`), so revalidation timing can't be skewed. See CLAUDE.md.
+      last_validated_at: new Literal("now()")
     }).execute(db);
   }
 }

package/dist/production/src/model/commands/idp/CreateIdpSessionCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateIdpSessionCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpSessionCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport type { IDPSessionState } from '../../service/idp/index.js'\n\n/**\n * Persist the federated-session state for a freshly created session API key, so it can be\n * re-validated against the IdP later. The `tokens` blob is encrypted at rest via\n * `providers.encrypt` (same pattern as project secrets).\n */\nexport class CreateIdpSessionCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly apiKeyId: string,\n\t\tprivate readonly identityProviderId: string,\n\t\tprivate readonly session: IDPSessionState,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst id = providers.uuid()\n\t\tconst tokens = this.session.tokens\n\t\t\t? await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), 'utf8'))\n\t\t\t: null\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('idp_session')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tapi_key_id: this.apiKeyId,\n\t\t\t\tidentity_provider_id: this.identityProviderId,\n\t\t\t\tidp_session_id: this.session.sessionId ?? null,\n\t\t\t\ttokens: tokens?.value ?? null,\n\t\t\t\ttokens_version: tokens?.version ?? null,\n\t\t\t\tidp_expires_at: this.session.expiresAt ?? null,\n\t\t\t\ttoken_obtained_at: providers.now(),\n\t\t\t\tlast_validated_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AASO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,UACA,oBACA,SAChB;AAHgB,SAAA,WAAA;AACA,SAAA,qBAAA;AACA,SAAA,UAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,KAAK,QAAQ,SACzB,MAAM,UAAU,QAAQ,OAAO,KAAK,KAAK,UAAU,KAAK,QAAQ,MAAM,GAAG,MAAM,CAAC,IAChF;AAEH,UAAMA,gBAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,sBAAsB,KAAK;AAAA,MAC3B,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,QAAQ,QAAQ,SAAS;AAAA,MACzB,gBAAgB,QAAQ,WAAW;AAAA,MACnC,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,mBAAmB,UAAU,IAAA;AAAA,MAC7B,mBAAmB,UAAU,IAAA;AAAA,IAAI,CACjC,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"CreateIdpSessionCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpSessionCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport type { IDPSessionState } from '../../service/idp/index.js'\n\n/**\n * Persist the federated-session state for a freshly created session API key, so it can be\n * re-validated against the IdP later. The `tokens` blob is encrypted at rest via\n * `providers.encrypt` (same pattern as project secrets).\n */\nexport class CreateIdpSessionCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly apiKeyId: string,\n\t\tprivate readonly identityProviderId: string,\n\t\tprivate readonly session: IDPSessionState,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst id = providers.uuid()\n\t\tconst tokens = this.session.tokens\n\t\t\t? await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), 'utf8'))\n\t\t\t: null\n\n\t\tawait InsertBuilder.create()\n\t\t\t.into('idp_session')\n\t\t\t.values({\n\t\t\t\tid,\n\t\t\t\tapi_key_id: this.apiKeyId,\n\t\t\t\tidentity_provider_id: this.identityProviderId,\n\t\t\t\tidp_session_id: this.session.sessionId ?? null,\n\t\t\t\ttokens: tokens?.value ?? null,\n\t\t\t\ttokens_version: tokens?.version ?? null,\n\t\t\t\tidp_expires_at: this.session.expiresAt ?? null,\n\t\t\t\ttoken_obtained_at: providers.now(),\n\t\t\t\t// last_validated_at is written on the DB clock to match the throttle\n\t\t\t\t// comparison in ClaimIdpRevalidationCommand (`last_validated_at <= now() -\n\t\t\t\t// interval`), so revalidation timing can't be skewed. See CLAUDE.md.\n\t\t\t\tlast_validated_at: new Literal('now()'),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AASO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,UACA,oBACA,SAChB;AAHgB,SAAA,WAAA;AACA,SAAA,qBAAA;AACA,SAAA,UAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,KAAK,QAAQ,SACzB,MAAM,UAAU,QAAQ,OAAO,KAAK,KAAK,UAAU,KAAK,QAAQ,MAAM,GAAG,MAAM,CAAC,IAChF;AAEH,UAAMA,gBAAc,OAAA,EAClB,KAAK,aAAa,EAClB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,sBAAsB,KAAK;AAAA,MAC3B,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,QAAQ,QAAQ,SAAS;AAAA,MACzB,gBAAgB,QAAQ,WAAW;AAAA,MACnC,gBAAgB,KAAK,QAAQ,aAAa;AAAA,MAC1C,mBAAmB,UAAU,IAAA;AAAA;AAAA;AAAA;AAAA,MAI7B,mBAAmB,IAAI,QAAQ,OAAO;AAAA,IAAA,CACtC,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/commands/idp/UpdateIdpCommand.cjs

@@ -7,14 +7,18 @@ class UpdateIdpCommand {
     this.data = data;
   }
   async execute({ db }) {
-    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified } = {} } = this.data;
+    const {
+      configuration,
+      options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication } = {}
+    } = this.data;
     await Database.UpdateBuilder.create().table("identity_provider").values({
       configuration,
       auto_sign_up: autoSignUp,
       exclusive,
       init_returns_config: initReturnsConfig,
       require_verified_email: requireVerifiedEmail,
-      assume_email_verified: assumeEmailVerified
+      assume_email_verified: assumeEmailVerified,
+      disable_local_authentication: disableLocalAuthentication
     }).where({
       id: this.id
     }).execute(db);

package/dist/production/src/model/commands/idp/UpdateIdpCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/UpdateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class UpdateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate id: string,\n\t\tprivate data: UpdateIdpData,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified } = {} } = this.data\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('identity_provider')\n\t\t\t.values({\n\t\t\t\tconfiguration,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nexport type UpdateIdpData = {\n\toptions?: Partial<IdentityProviderData['options']>\n\tconfiguration?: IdentityProviderData['configuration']\n\ttype?: string\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,IACA,MACP;AAFO,SAAA,KAAA;AACA,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,EAAE,eAAe,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,oBAAA,IAAwB,GAAC,IAAM,KAAK;AACtI,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM,mBAAmB,EACzB,OAAO;AAAA,MACP;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,IAAA,CACvB,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"UpdateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/UpdateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class UpdateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate id: string,\n\t\tprivate data: UpdateIdpData,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst {\n\t\t\tconfiguration,\n\t\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication } = {},\n\t\t} = this.data\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('identity_provider')\n\t\t\t.values({\n\t\t\t\tconfiguration,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t\tdisable_local_authentication: disableLocalAuthentication,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nexport type UpdateIdpData = {\n\toptions?: Partial<IdentityProviderData['options']>\n\tconfiguration?: IdentityProviderData['configuration']\n\ttype?: string\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,IACA,MACP;AAFO,SAAA,KAAA;AACA,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM;AAAA,MACL;AAAA,MACA,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,+BAA+B,CAAA;AAAA,IAAC,IAC7H,KAAK;AACT,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM,mBAAmB,EACzB,OAAO;AAAA,MACP;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,MACvB,8BAA8B;AAAA,IAAA,CAC9B,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/production/src/model/commands/idp/UpdateIdpCommand.js

@@ -5,14 +5,18 @@ class UpdateIdpCommand {
     this.data = data;
   }
   async execute({ db }) {
-    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified } = {} } = this.data;
+    const {
+      configuration,
+      options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication } = {}
+    } = this.data;
     await UpdateBuilder$1.create().table("identity_provider").values({
       configuration,
       auto_sign_up: autoSignUp,
       exclusive,
       init_returns_config: initReturnsConfig,
       require_verified_email: requireVerifiedEmail,
-      assume_email_verified: assumeEmailVerified
+      assume_email_verified: assumeEmailVerified,
+      disable_local_authentication: disableLocalAuthentication
     }).where({
       id: this.id
     }).execute(db);

package/dist/production/src/model/commands/idp/UpdateIdpCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateIdpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/UpdateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class UpdateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate id: string,\n\t\tprivate data: UpdateIdpData,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified } = {} } = this.data\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('identity_provider')\n\t\t\t.values({\n\t\t\t\tconfiguration,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nexport type UpdateIdpData = {\n\toptions?: Partial<IdentityProviderData['options']>\n\tconfiguration?: IdentityProviderData['configuration']\n\ttype?: string\n}\n"],"names":["UpdateBuilder"],"mappings":";AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,IACA,MACP;AAFO,SAAA,KAAA;AACA,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,EAAE,eAAe,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,oBAAA,IAAwB,GAAC,IAAM,KAAK;AACtI,UAAMA,gBAAc,OAAA,EAClB,MAAM,mBAAmB,EACzB,OAAO;AAAA,MACP;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,IAAA,CACvB,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"UpdateIdpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/UpdateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class UpdateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate id: string,\n\t\tprivate data: UpdateIdpData,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst {\n\t\t\tconfiguration,\n\t\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication } = {},\n\t\t} = this.data\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('identity_provider')\n\t\t\t.values({\n\t\t\t\tconfiguration,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t\tdisable_local_authentication: disableLocalAuthentication,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nexport type UpdateIdpData = {\n\toptions?: Partial<IdentityProviderData['options']>\n\tconfiguration?: IdentityProviderData['configuration']\n\ttype?: string\n}\n"],"names":["UpdateBuilder"],"mappings":";AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,IACA,MACP;AAFO,SAAA,KAAA;AACA,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM;AAAA,MACL;AAAA,MACA,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,+BAA+B,CAAA;AAAA,IAAC,IAC7H,KAAK;AACT,UAAMA,gBAAc,OAAA,EAClB,MAAM,mBAAmB,EACzB,OAAO;AAAA,MACP;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,MACvB,8BAA8B;AAAA,IAAA,CAC9B,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/commands/idp/UpdateIdpSessionCommand.cjs

@@ -8,7 +8,8 @@ class UpdateIdpSessionCommand {
   }
   async execute({ db, providers }) {
     const values = {
-      last_validated_at: providers.now()
+      // DB clock, matching ClaimIdpRevalidationCommand's throttle comparison. See CLAUDE.md.
+      last_validated_at: new Database.Literal("now()")
     };
     if (this.session) {
       if (this.session.tokens) {

package/dist/production/src/model/commands/idp/UpdateIdpSessionCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateIdpSessionCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/UpdateIdpSessionCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { QueryBuilder, UpdateBuilder } from '@contember/database'\nimport type { IDPSessionState } from '../../service/idp/index.js'\n\n/**\n * Update a federated session after a successful re-validation: bump `last_validated_at`\n * and persist rotated tokens / refreshed IdP expiry. Pass `session` undefined to only\n * touch `last_validated_at` (e.g. userinfo/introspection methods that don't rotate tokens).\n */\nexport class UpdateIdpSessionCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly session?: IDPSessionState,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst values: QueryBuilder.Values = {\n\t\t\tlast_validated_at: providers.now(),\n\t\t}\n\n\t\tif (this.session) {\n\t\t\tif (this.session.tokens) {\n\t\t\t\tconst { value, version } = await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), 'utf8'))\n\t\t\t\tvalues.tokens = value\n\t\t\t\tvalues.tokens_version = version\n\t\t\t\t// a new token was issued — reset the lifetime reference for the soft-refresh threshold\n\t\t\t\tvalues.token_obtained_at = providers.now()\n\t\t\t}\n\t\t\tif (this.session.sessionId !== undefined) {\n\t\t\t\tvalues.idp_session_id = this.session.sessionId\n\t\t\t}\n\t\t\tif (this.session.expiresAt !== undefined) {\n\t\t\t\tvalues.idp_expires_at = this.session.expiresAt\n\t\t\t}\n\t\t}\n\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('idp_session')\n\t\t\t.values(values)\n\t\t\t.where({ id: this.id })\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AASO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,IACA,SAChB;AAFgB,SAAA,KAAA;AACA,SAAA,UAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,SAA8B;AAAA,MACnC,mBAAmB,UAAU,IAAA;AAAA,IAAI;AAGlC,QAAI,KAAK,SAAS;AACjB,UAAI,KAAK,QAAQ,QAAQ;AACxB,cAAM,EAAE,OAAO,QAAA,IAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,KAAK,UAAU,KAAK,QAAQ,MAAM,GAAG,MAAM,CAAC;AAC3G,eAAO,SAAS;AAChB,eAAO,iBAAiB;AAExB,eAAO,oBAAoB,UAAU,IAAA;AAAA,MACtC;AACA,UAAI,KAAK,QAAQ,cAAc,QAAW;AACzC,eAAO,iBAAiB,KAAK,QAAQ;AAAA,MACtC;AACA,UAAI,KAAK,QAAQ,cAAc,QAAW;AACzC,eAAO,iBAAiB,KAAK,QAAQ;AAAA,MACtC;AAAA,IACD;AAEA,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM,aAAa,EACnB,OAAO,MAAM,EACb,MAAM,EAAE,IAAI,KAAK,IAAI,EACrB,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"UpdateIdpSessionCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/UpdateIdpSessionCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { Literal, QueryBuilder, UpdateBuilder } from '@contember/database'\nimport type { IDPSessionState } from '../../service/idp/index.js'\n\n/**\n * Update a federated session after a successful re-validation: bump `last_validated_at`\n * and persist rotated tokens / refreshed IdP expiry. Pass `session` undefined to only\n * touch `last_validated_at` (e.g. userinfo/introspection methods that don't rotate tokens).\n */\nexport class UpdateIdpSessionCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly session?: IDPSessionState,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst values: QueryBuilder.Values = {\n\t\t\t// DB clock, matching ClaimIdpRevalidationCommand's throttle comparison. See CLAUDE.md.\n\t\t\tlast_validated_at: new Literal('now()'),\n\t\t}\n\n\t\tif (this.session) {\n\t\t\tif (this.session.tokens) {\n\t\t\t\tconst { value, version } = await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), 'utf8'))\n\t\t\t\tvalues.tokens = value\n\t\t\t\tvalues.tokens_version = version\n\t\t\t\t// a new token was issued — reset the lifetime reference for the soft-refresh threshold\n\t\t\t\tvalues.token_obtained_at = providers.now()\n\t\t\t}\n\t\t\tif (this.session.sessionId !== undefined) {\n\t\t\t\tvalues.idp_session_id = this.session.sessionId\n\t\t\t}\n\t\t\tif (this.session.expiresAt !== undefined) {\n\t\t\t\tvalues.idp_expires_at = this.session.expiresAt\n\t\t\t}\n\t\t}\n\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('idp_session')\n\t\t\t.values(values)\n\t\t\t.where({ id: this.id })\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["Literal","UpdateBuilder"],"mappings":";;;AASO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,IACA,SAChB;AAFgB,SAAA,KAAA;AACA,SAAA,UAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,SAA8B;AAAA;AAAA,MAEnC,mBAAmB,IAAIA,SAAAA,QAAQ,OAAO;AAAA,IAAA;AAGvC,QAAI,KAAK,SAAS;AACjB,UAAI,KAAK,QAAQ,QAAQ;AACxB,cAAM,EAAE,OAAO,QAAA,IAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,KAAK,UAAU,KAAK,QAAQ,MAAM,GAAG,MAAM,CAAC;AAC3G,eAAO,SAAS;AAChB,eAAO,iBAAiB;AAExB,eAAO,oBAAoB,UAAU,IAAA;AAAA,MACtC;AACA,UAAI,KAAK,QAAQ,cAAc,QAAW;AACzC,eAAO,iBAAiB,KAAK,QAAQ;AAAA,MACtC;AACA,UAAI,KAAK,QAAQ,cAAc,QAAW;AACzC,eAAO,iBAAiB,KAAK,QAAQ;AAAA,MACtC;AAAA,IACD;AAEA,UAAMC,SAAAA,cAAc,OAAA,EAClB,MAAM,aAAa,EACnB,OAAO,MAAM,EACb,MAAM,EAAE,IAAI,KAAK,IAAI,EACrB,QAAQ,EAAE;AAAA,EACb;AACD;;"}