@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/production/src/model/commands/idp/UpdateIdpSessionCommand.js

@@ -1,4 +1,4 @@
-import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+import { Literal, UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
 class UpdateIdpSessionCommand {
   constructor(id, session) {
     this.id = id;
@@ -6,7 +6,8 @@ class UpdateIdpSessionCommand {
   }
   async execute({ db, providers }) {
     const values = {
-      last_validated_at: providers.now()
+      // DB clock, matching ClaimIdpRevalidationCommand's throttle comparison. See CLAUDE.md.
+      last_validated_at: new Literal("now()")
     };
     if (this.session) {
       if (this.session.tokens) {

package/dist/production/src/model/commands/idp/UpdateIdpSessionCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateIdpSessionCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/UpdateIdpSessionCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { QueryBuilder, UpdateBuilder } from '@contember/database'\nimport type { IDPSessionState } from '../../service/idp/index.js'\n\n/**\n * Update a federated session after a successful re-validation: bump `last_validated_at`\n * and persist rotated tokens / refreshed IdP expiry. Pass `session` undefined to only\n * touch `last_validated_at` (e.g. userinfo/introspection methods that don't rotate tokens).\n */\nexport class UpdateIdpSessionCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly session?: IDPSessionState,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst values: QueryBuilder.Values = {\n\t\t\tlast_validated_at: providers.now(),\n\t\t}\n\n\t\tif (this.session) {\n\t\t\tif (this.session.tokens) {\n\t\t\t\tconst { value, version } = await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), 'utf8'))\n\t\t\t\tvalues.tokens = value\n\t\t\t\tvalues.tokens_version = version\n\t\t\t\t// a new token was issued — reset the lifetime reference for the soft-refresh threshold\n\t\t\t\tvalues.token_obtained_at = providers.now()\n\t\t\t}\n\t\t\tif (this.session.sessionId !== undefined) {\n\t\t\t\tvalues.idp_session_id = this.session.sessionId\n\t\t\t}\n\t\t\tif (this.session.expiresAt !== undefined) {\n\t\t\t\tvalues.idp_expires_at = this.session.expiresAt\n\t\t\t}\n\t\t}\n\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('idp_session')\n\t\t\t.values(values)\n\t\t\t.where({ id: this.id })\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AASO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,IACA,SAChB;AAFgB,SAAA,KAAA;AACA,SAAA,UAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,SAA8B;AAAA,MACnC,mBAAmB,UAAU,IAAA;AAAA,IAAI;AAGlC,QAAI,KAAK,SAAS;AACjB,UAAI,KAAK,QAAQ,QAAQ;AACxB,cAAM,EAAE,OAAO,QAAA,IAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,KAAK,UAAU,KAAK,QAAQ,MAAM,GAAG,MAAM,CAAC;AAC3G,eAAO,SAAS;AAChB,eAAO,iBAAiB;AAExB,eAAO,oBAAoB,UAAU,IAAA;AAAA,MACtC;AACA,UAAI,KAAK,QAAQ,cAAc,QAAW;AACzC,eAAO,iBAAiB,KAAK,QAAQ;AAAA,MACtC;AACA,UAAI,KAAK,QAAQ,cAAc,QAAW;AACzC,eAAO,iBAAiB,KAAK,QAAQ;AAAA,MACtC;AAAA,IACD;AAEA,UAAMA,gBAAc,OAAA,EAClB,MAAM,aAAa,EACnB,OAAO,MAAM,EACb,MAAM,EAAE,IAAI,KAAK,IAAI,EACrB,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"UpdateIdpSessionCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/UpdateIdpSessionCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { Literal, QueryBuilder, UpdateBuilder } from '@contember/database'\nimport type { IDPSessionState } from '../../service/idp/index.js'\n\n/**\n * Update a federated session after a successful re-validation: bump `last_validated_at`\n * and persist rotated tokens / refreshed IdP expiry. Pass `session` undefined to only\n * touch `last_validated_at` (e.g. userinfo/introspection methods that don't rotate tokens).\n */\nexport class UpdateIdpSessionCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly session?: IDPSessionState,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst values: QueryBuilder.Values = {\n\t\t\t// DB clock, matching ClaimIdpRevalidationCommand's throttle comparison. See CLAUDE.md.\n\t\t\tlast_validated_at: new Literal('now()'),\n\t\t}\n\n\t\tif (this.session) {\n\t\t\tif (this.session.tokens) {\n\t\t\t\tconst { value, version } = await providers.encrypt(Buffer.from(JSON.stringify(this.session.tokens), 'utf8'))\n\t\t\t\tvalues.tokens = value\n\t\t\t\tvalues.tokens_version = version\n\t\t\t\t// a new token was issued — reset the lifetime reference for the soft-refresh threshold\n\t\t\t\tvalues.token_obtained_at = providers.now()\n\t\t\t}\n\t\t\tif (this.session.sessionId !== undefined) {\n\t\t\t\tvalues.idp_session_id = this.session.sessionId\n\t\t\t}\n\t\t\tif (this.session.expiresAt !== undefined) {\n\t\t\t\tvalues.idp_expires_at = this.session.expiresAt\n\t\t\t}\n\t\t}\n\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('idp_session')\n\t\t\t.values(values)\n\t\t\t.where({ id: this.id })\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AASO,MAAM,wBAAiD;AAAA,EAC7D,YACkB,IACA,SAChB;AAFgB,SAAA,KAAA;AACA,SAAA,UAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,SAA8B;AAAA;AAAA,MAEnC,mBAAmB,IAAI,QAAQ,OAAO;AAAA,IAAA;AAGvC,QAAI,KAAK,SAAS;AACjB,UAAI,KAAK,QAAQ,QAAQ;AACxB,cAAM,EAAE,OAAO,QAAA,IAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,KAAK,UAAU,KAAK,QAAQ,MAAM,GAAG,MAAM,CAAC;AAC3G,eAAO,SAAS;AAChB,eAAO,iBAAiB;AAExB,eAAO,oBAAoB,UAAU,IAAA;AAAA,MACtC;AACA,UAAI,KAAK,QAAQ,cAAc,QAAW;AACzC,eAAO,iBAAiB,KAAK,QAAQ;AAAA,MACtC;AACA,UAAI,KAAK,QAAQ,cAAc,QAAW;AACzC,eAAO,iBAAiB,KAAK,QAAQ;AAAA,MACtC;AAAA,IACD;AAEA,UAAMA,gBAAc,OAAA,EAClB,MAAM,aAAa,EACnB,OAAO,MAAM,EACb,MAAM,EAAE,IAAI,KAAK,IAAI,EACrB,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/commands/membership/{RemoveProjectMembershipsCommand.cjs → RemoveProjectMembershipCommand.cjs}

@@ -16,4 +16,4 @@ class RemoveProjectMembershipCommand {
   }
 }
 exports.RemoveProjectMembershipCommand = RemoveProjectMembershipCommand;
-//# sourceMappingURL=RemoveProjectMembershipsCommand.cjs.map
+//# sourceMappingURL=RemoveProjectMembershipCommand.cjs.map

package/dist/production/src/model/commands/membership/RemoveProjectMembershipCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemoveProjectMembershipCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/production/src/model/commands/membership/{RemoveProjectMembershipsCommand.js → RemoveProjectMembershipCommand.js}

@@ -16,4 +16,4 @@ class RemoveProjectMembershipCommand {
 export {
   RemoveProjectMembershipCommand
 };
-//# sourceMappingURL=RemoveProjectMembershipsCommand.js.map
+//# sourceMappingURL=RemoveProjectMembershipCommand.js.map

package/dist/production/src/model/commands/membership/RemoveProjectMembershipCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RemoveProjectMembershipCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAM,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/commands/membership/UpdateProjectMemberCommand.cjs

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const CreateOrUpdateProjectMembershipCommand = require("./CreateOrUpdateProjectMembershipCommand.cjs");
 const Database = require("@contember/database");
-const RemoveProjectMembershipsCommand = require("./RemoveProjectMembershipsCommand.cjs");
+const RemoveProjectMembershipCommand = require("./RemoveProjectMembershipCommand.cjs");
 const Response = require("../../utils/Response.cjs");
 class UpdateProjectMemberCommand {
   constructor(projectId, identityId, memberships) {
@@ -21,7 +21,7 @@ class UpdateProjectMemberCommand {
     try {
       for (const membershipUpdate of this.memberships) {
         if (membershipUpdate.operation === "remove") {
-          await bus.execute(new RemoveProjectMembershipsCommand.RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role));
+          await bus.execute(new RemoveProjectMembershipCommand.RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role));
         } else {
           await bus.execute(
             new CreateOrUpdateProjectMembershipCommand.CreateOrUpdateProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate)

package/dist/production/src/model/commands/membership/UpdateProjectMemberCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectMemberCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/UpdateProjectMemberCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateProjectMemberErrorCode } from '../../../schema/index.js'\nimport { CreateOrUpdateProjectMembershipCommand } from './CreateOrUpdateProjectMembershipCommand.js'\nimport { SelectBuilder } from '@contember/database'\nimport { MembershipUpdateInput } from './types.js'\nimport { RemoveProjectMembershipCommand } from './RemoveProjectMembershipsCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\n\nexport class UpdateProjectMemberCommand implements Command<UpdateProjectMemberResponse> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly identityId: string,\n\t\tprivate readonly memberships: readonly MembershipUpdateInput[],\n\t) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<UpdateProjectMemberResponse> {\n\t\tconst result = await SelectBuilder.create()\n\t\t\t.select('id')\n\t\t\t.from('project_membership')\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new ResponseError('NOT_MEMBER', 'Not a project member')\n\t\t}\n\n\t\ttry {\n\t\t\tfor (const membershipUpdate of this.memberships) {\n\t\t\t\tif (membershipUpdate.operation === 'remove') {\n\t\t\t\t\tawait bus.execute(new RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role))\n\t\t\t\t} else {\n\t\t\t\t\tawait bus.execute(\n\t\t\t\t\t\tnew CreateOrUpdateProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk(null)\n\t\t} catch (e) {\n\t\t\tif (!(e instanceof Error)) {\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tswitch ((e as any).constraint) {\n\t\t\t\tcase 'project_membership_project':\n\t\t\t\t\treturn new ResponseError('PROJECT_NOT_FOUND', 'Project not found')\n\t\t\t\tdefault:\n\t\t\t\t\tthrow e\n\t\t\t}\n\t\t}\n\t}\n}\nexport type UpdateProjectMemberResponse = Response<null, UpdateProjectMemberErrorCode>\n"],"names":["SelectBuilder","ResponseError","RemoveProjectMembershipCommand","CreateOrUpdateProjectMembershipCommand","ResponseOk"],"mappings":";;;;;;AAQO,MAAM,2BAA2E;AAAA,EACvF,YACkB,WACA,YACA,aAChB;AAHgB,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAAiE;AACzF,UAAM,SAAS,MAAMA,uBAAc,SACjC,OAAO,IAAI,EACX,KAAK,oBAAoB,EACzB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,UAAU,EAAE;AACd,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO,IAAIC,SAAAA,cAAc,cAAc,sBAAsB;AAAA,IAC9D;AAEA,QAAI;AACH,iBAAW,oBAAoB,KAAK,aAAa;AAChD,YAAI,iBAAiB,cAAc,UAAU;AAC5C,gBAAM,IAAI,QAAQ,IAAIC,gCAAAA,+BAA+B,KAAK,WAAW,KAAK,YAAY,iBAAiB,IAAI,CAAC;AAAA,QAC7G,OAAO;AACN,gBAAM,IAAI;AAAA,YACT,IAAIC,uCAAAA,uCAAuC,KAAK,WAAW,KAAK,YAAY,gBAAgB;AAAA,UAAA;AAAA,QAE9F;AAAA,MACD;AAEA,aAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC3B,SAAS,GAAG;AACX,UAAI,EAAE,aAAa,QAAQ;AAC1B,cAAM;AAAA,MACP;AACA,cAAS,EAAU,YAAA;AAAA,QAClB,KAAK;AACJ,iBAAO,IAAIH,SAAAA,cAAc,qBAAqB,mBAAmB;AAAA,QAClE;AACC,gBAAM;AAAA,MAAA;AAAA,IAET;AAAA,EACD;AACD;;"}
+{"version":3,"file":"UpdateProjectMemberCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/UpdateProjectMemberCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateProjectMemberErrorCode } from '../../../schema/index.js'\nimport { CreateOrUpdateProjectMembershipCommand } from './CreateOrUpdateProjectMembershipCommand.js'\nimport { SelectBuilder } from '@contember/database'\nimport { MembershipUpdateInput } from './types.js'\nimport { RemoveProjectMembershipCommand } from './RemoveProjectMembershipCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\n\nexport class UpdateProjectMemberCommand implements Command<UpdateProjectMemberResponse> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly identityId: string,\n\t\tprivate readonly memberships: readonly MembershipUpdateInput[],\n\t) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<UpdateProjectMemberResponse> {\n\t\tconst result = await SelectBuilder.create()\n\t\t\t.select('id')\n\t\t\t.from('project_membership')\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new ResponseError('NOT_MEMBER', 'Not a project member')\n\t\t}\n\n\t\ttry {\n\t\t\tfor (const membershipUpdate of this.memberships) {\n\t\t\t\tif (membershipUpdate.operation === 'remove') {\n\t\t\t\t\tawait bus.execute(new RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role))\n\t\t\t\t} else {\n\t\t\t\t\tawait bus.execute(\n\t\t\t\t\t\tnew CreateOrUpdateProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk(null)\n\t\t} catch (e) {\n\t\t\tif (!(e instanceof Error)) {\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tswitch ((e as any).constraint) {\n\t\t\t\tcase 'project_membership_project':\n\t\t\t\t\treturn new ResponseError('PROJECT_NOT_FOUND', 'Project not found')\n\t\t\t\tdefault:\n\t\t\t\t\tthrow e\n\t\t\t}\n\t\t}\n\t}\n}\nexport type UpdateProjectMemberResponse = Response<null, UpdateProjectMemberErrorCode>\n"],"names":["SelectBuilder","ResponseError","RemoveProjectMembershipCommand","CreateOrUpdateProjectMembershipCommand","ResponseOk"],"mappings":";;;;;;AAQO,MAAM,2BAA2E;AAAA,EACvF,YACkB,WACA,YACA,aAChB;AAHgB,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAAiE;AACzF,UAAM,SAAS,MAAMA,uBAAc,SACjC,OAAO,IAAI,EACX,KAAK,oBAAoB,EACzB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,UAAU,EAAE;AACd,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO,IAAIC,SAAAA,cAAc,cAAc,sBAAsB;AAAA,IAC9D;AAEA,QAAI;AACH,iBAAW,oBAAoB,KAAK,aAAa;AAChD,YAAI,iBAAiB,cAAc,UAAU;AAC5C,gBAAM,IAAI,QAAQ,IAAIC,+BAAAA,+BAA+B,KAAK,WAAW,KAAK,YAAY,iBAAiB,IAAI,CAAC;AAAA,QAC7G,OAAO;AACN,gBAAM,IAAI;AAAA,YACT,IAAIC,uCAAAA,uCAAuC,KAAK,WAAW,KAAK,YAAY,gBAAgB;AAAA,UAAA;AAAA,QAE9F;AAAA,MACD;AAEA,aAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC3B,SAAS,GAAG;AACX,UAAI,EAAE,aAAa,QAAQ;AAC1B,cAAM;AAAA,MACP;AACA,cAAS,EAAU,YAAA;AAAA,QAClB,KAAK;AACJ,iBAAO,IAAIH,SAAAA,cAAc,qBAAqB,mBAAmB;AAAA,QAClE;AACC,gBAAM;AAAA,MAAA;AAAA,IAET;AAAA,EACD;AACD;;"}

package/dist/production/src/model/commands/membership/UpdateProjectMemberCommand.js

@@ -1,6 +1,6 @@
 import { CreateOrUpdateProjectMembershipCommand } from "./CreateOrUpdateProjectMembershipCommand.js";
 import { SelectBuilder } from "@contember/database";
-import { RemoveProjectMembershipCommand } from "./RemoveProjectMembershipsCommand.js";
+import { RemoveProjectMembershipCommand } from "./RemoveProjectMembershipCommand.js";
 import { ResponseError, ResponseOk } from "../../utils/Response.js";
 class UpdateProjectMemberCommand {
   constructor(projectId, identityId, memberships) {

package/dist/production/src/model/commands/membership/UpdateProjectMemberCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectMemberCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/UpdateProjectMemberCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateProjectMemberErrorCode } from '../../../schema/index.js'\nimport { CreateOrUpdateProjectMembershipCommand } from './CreateOrUpdateProjectMembershipCommand.js'\nimport { SelectBuilder } from '@contember/database'\nimport { MembershipUpdateInput } from './types.js'\nimport { RemoveProjectMembershipCommand } from './RemoveProjectMembershipsCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\n\nexport class UpdateProjectMemberCommand implements Command<UpdateProjectMemberResponse> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly identityId: string,\n\t\tprivate readonly memberships: readonly MembershipUpdateInput[],\n\t) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<UpdateProjectMemberResponse> {\n\t\tconst result = await SelectBuilder.create()\n\t\t\t.select('id')\n\t\t\t.from('project_membership')\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new ResponseError('NOT_MEMBER', 'Not a project member')\n\t\t}\n\n\t\ttry {\n\t\t\tfor (const membershipUpdate of this.memberships) {\n\t\t\t\tif (membershipUpdate.operation === 'remove') {\n\t\t\t\t\tawait bus.execute(new RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role))\n\t\t\t\t} else {\n\t\t\t\t\tawait bus.execute(\n\t\t\t\t\t\tnew CreateOrUpdateProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk(null)\n\t\t} catch (e) {\n\t\t\tif (!(e instanceof Error)) {\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tswitch ((e as any).constraint) {\n\t\t\t\tcase 'project_membership_project':\n\t\t\t\t\treturn new ResponseError('PROJECT_NOT_FOUND', 'Project not found')\n\t\t\t\tdefault:\n\t\t\t\t\tthrow e\n\t\t\t}\n\t\t}\n\t}\n}\nexport type UpdateProjectMemberResponse = Response<null, UpdateProjectMemberErrorCode>\n"],"names":[],"mappings":";;;;AAQO,MAAM,2BAA2E;AAAA,EACvF,YACkB,WACA,YACA,aAChB;AAHgB,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAAiE;AACzF,UAAM,SAAS,MAAM,cAAc,SACjC,OAAO,IAAI,EACX,KAAK,oBAAoB,EACzB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,UAAU,EAAE;AACd,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO,IAAI,cAAc,cAAc,sBAAsB;AAAA,IAC9D;AAEA,QAAI;AACH,iBAAW,oBAAoB,KAAK,aAAa;AAChD,YAAI,iBAAiB,cAAc,UAAU;AAC5C,gBAAM,IAAI,QAAQ,IAAI,+BAA+B,KAAK,WAAW,KAAK,YAAY,iBAAiB,IAAI,CAAC;AAAA,QAC7G,OAAO;AACN,gBAAM,IAAI;AAAA,YACT,IAAI,uCAAuC,KAAK,WAAW,KAAK,YAAY,gBAAgB;AAAA,UAAA;AAAA,QAE9F;AAAA,MACD;AAEA,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,SAAS,GAAG;AACX,UAAI,EAAE,aAAa,QAAQ;AAC1B,cAAM;AAAA,MACP;AACA,cAAS,EAAU,YAAA;AAAA,QAClB,KAAK;AACJ,iBAAO,IAAI,cAAc,qBAAqB,mBAAmB;AAAA,QAClE;AACC,gBAAM;AAAA,MAAA;AAAA,IAET;AAAA,EACD;AACD;"}
+{"version":3,"file":"UpdateProjectMemberCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/UpdateProjectMemberCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateProjectMemberErrorCode } from '../../../schema/index.js'\nimport { CreateOrUpdateProjectMembershipCommand } from './CreateOrUpdateProjectMembershipCommand.js'\nimport { SelectBuilder } from '@contember/database'\nimport { MembershipUpdateInput } from './types.js'\nimport { RemoveProjectMembershipCommand } from './RemoveProjectMembershipCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\n\nexport class UpdateProjectMemberCommand implements Command<UpdateProjectMemberResponse> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly identityId: string,\n\t\tprivate readonly memberships: readonly MembershipUpdateInput[],\n\t) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<UpdateProjectMemberResponse> {\n\t\tconst result = await SelectBuilder.create()\n\t\t\t.select('id')\n\t\t\t.from('project_membership')\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new ResponseError('NOT_MEMBER', 'Not a project member')\n\t\t}\n\n\t\ttry {\n\t\t\tfor (const membershipUpdate of this.memberships) {\n\t\t\t\tif (membershipUpdate.operation === 'remove') {\n\t\t\t\t\tawait bus.execute(new RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role))\n\t\t\t\t} else {\n\t\t\t\t\tawait bus.execute(\n\t\t\t\t\t\tnew CreateOrUpdateProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk(null)\n\t\t} catch (e) {\n\t\t\tif (!(e instanceof Error)) {\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tswitch ((e as any).constraint) {\n\t\t\t\tcase 'project_membership_project':\n\t\t\t\t\treturn new ResponseError('PROJECT_NOT_FOUND', 'Project not found')\n\t\t\t\tdefault:\n\t\t\t\t\tthrow e\n\t\t\t}\n\t\t}\n\t}\n}\nexport type UpdateProjectMemberResponse = Response<null, UpdateProjectMemberErrorCode>\n"],"names":[],"mappings":";;;;AAQO,MAAM,2BAA2E;AAAA,EACvF,YACkB,WACA,YACA,aAChB;AAHgB,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAAiE;AACzF,UAAM,SAAS,MAAM,cAAc,SACjC,OAAO,IAAI,EACX,KAAK,oBAAoB,EACzB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,UAAU,EAAE;AACd,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO,IAAI,cAAc,cAAc,sBAAsB;AAAA,IAC9D;AAEA,QAAI;AACH,iBAAW,oBAAoB,KAAK,aAAa;AAChD,YAAI,iBAAiB,cAAc,UAAU;AAC5C,gBAAM,IAAI,QAAQ,IAAI,+BAA+B,KAAK,WAAW,KAAK,YAAY,iBAAiB,IAAI,CAAC;AAAA,QAC7G,OAAO;AACN,gBAAM,IAAI;AAAA,YACT,IAAI,uCAAuC,KAAK,WAAW,KAAK,YAAY,gBAAgB;AAAA,UAAA;AAAA,QAE9F;AAAA,MACD;AAEA,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,SAAS,GAAG;AACX,UAAI,EAAE,aAAa,QAAQ;AAC1B,cAAM;AAAA,MACP;AACA,cAAS,EAAU,YAAA;AAAA,QAClB,KAAK;AACJ,iBAAO,IAAI,cAAc,qBAAqB,mBAAmB;AAAA,QAClE;AACC,gBAAM;AAAA,MAAA;AAAA,IAET;AAAA,EACD;AACD;"}

package/dist/production/src/model/commands/person/CreatePersonCommand.cjs

@@ -37,6 +37,7 @@ class CreatePersonCommand {
       disabled_at: null,
       passwordless_enabled: null,
       mfa_grace_until: null,
+      is_in_grace: false,
       email_verified_at: null,
       email_verification_required: emailVerificationRequired
     };

package/dist/production/src/model/commands/person/CreatePersonCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreatePersonCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/CreatePersonCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { PersonRow } from '../../queries/index.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { MaybePassword } from '../../dtos/Password.js'\nimport { normalizeEmail } from '../../utils/email.js'\n\nexport class CreatePersonCommand implements Command<Omit<PersonRow, 'roles'>> {\n\tconstructor(\n\t\tprivate readonly data: {\n\t\t\tidentityId: string\n\t\t\temail?: string\n\t\t\tname?: string\n\t\t\tpassword: MaybePassword\n\t\t\tidpOnly?: boolean\n\t\t\temailVerificationRequired?: boolean\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<Omit<PersonRow, 'roles'>> {\n\t\tconst id = providers.uuid()\n\n\t\tconst password_hash = await this.data.password.getHash(providers)\n\t\tconst email = this.data.email ? normalizeEmail(this.data.email) : null\n\t\tconst name = this.data.name ?? this.data.email?.split('@')[0] ?? null\n\t\tconst emailVerificationRequired = this.data.emailVerificationRequired ?? false\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\temail,\n\t\t\t\tname: name,\n\t\t\t\tpassword_hash,\n\t\t\t\tidentity_id: this.data.identityId,\n\t\t\t\tidp_only: this.data.idpOnly ?? false,\n\t\t\t\temail_verification_required: emailVerificationRequired,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn {\n\t\t\tid,\n\t\t\temail,\n\t\t\tname,\n\t\t\tpassword_hash,\n\t\t\tidentity_id: this.data.identityId,\n\t\t\totp_secret: null,\n\t\t\totp_secret_version: null,\n\t\t\totp_activated_at: null,\n\t\t\totp_pending_secret: null,\n\t\t\totp_pending_version: null,\n\t\t\totp_pending_created_at: null,\n\t\t\temail_otp_enabled: false,\n\t\t\tdisabled_at: null,\n\t\t\tpasswordless_enabled: null,\n\t\t\tmfa_grace_until: null,\n\t\t\temail_verified_at: null,\n\t\t\temail_verification_required: emailVerificationRequired,\n\t\t}\n\t}\n}\n"],"names":["email","normalizeEmail","InsertBuilder"],"mappings":";;;;AAMO,MAAM,oBAAiE;AAAA,EAC7E,YACkB,MAQhB;AARgB,SAAA,OAAA;AAAA,EAQf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA8D;AACjF,UAAM,KAAK,UAAU,KAAA;AAErB,UAAM,gBAAgB,MAAM,KAAK,KAAK,SAAS,QAAQ,SAAS;AAChE,UAAMA,UAAQ,KAAK,KAAK,QAAQC,MAAAA,eAAe,KAAK,KAAK,KAAK,IAAI;AAClE,UAAM,OAAO,KAAK,KAAK,QAAQ,KAAK,KAAK,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AACjE,UAAM,4BAA4B,KAAK,KAAK,6BAA6B;AACzE,UAAMC,SAAAA,cAAc,OAAA,EAClB,KAAK,QAAQ,EACb,OAAO;AAAA,MACP;AAAA,MAAA,OACAF;AAAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,KAAK,KAAK;AAAA,MACvB,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,6BAA6B;AAAA,IAAA,CAC7B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,MACN;AAAA,MAAA,OACAA;AAAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,KAAK,KAAK;AAAA,MACvB,YAAY;AAAA,MACZ,oBAAoB;AAAA,MACpB,kBAAkB;AAAA,MAClB,oBAAoB;AAAA,MACpB,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,mBAAmB;AAAA,MACnB,aAAa;AAAA,MACb,sBAAsB;AAAA,MACtB,iBAAiB;AAAA,MACjB,mBAAmB;AAAA,MACnB,6BAA6B;AAAA,IAAA;AAAA,EAE/B;AACD;;"}
+{"version":3,"file":"CreatePersonCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/CreatePersonCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { PersonRow } from '../../queries/index.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { MaybePassword } from '../../dtos/Password.js'\nimport { normalizeEmail } from '../../utils/email.js'\n\nexport class CreatePersonCommand implements Command<Omit<PersonRow, 'roles'>> {\n\tconstructor(\n\t\tprivate readonly data: {\n\t\t\tidentityId: string\n\t\t\temail?: string\n\t\t\tname?: string\n\t\t\tpassword: MaybePassword\n\t\t\tidpOnly?: boolean\n\t\t\temailVerificationRequired?: boolean\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<Omit<PersonRow, 'roles'>> {\n\t\tconst id = providers.uuid()\n\n\t\tconst password_hash = await this.data.password.getHash(providers)\n\t\tconst email = this.data.email ? normalizeEmail(this.data.email) : null\n\t\tconst name = this.data.name ?? this.data.email?.split('@')[0] ?? null\n\t\tconst emailVerificationRequired = this.data.emailVerificationRequired ?? false\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\temail,\n\t\t\t\tname: name,\n\t\t\t\tpassword_hash,\n\t\t\t\tidentity_id: this.data.identityId,\n\t\t\t\tidp_only: this.data.idpOnly ?? false,\n\t\t\t\temail_verification_required: emailVerificationRequired,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn {\n\t\t\tid,\n\t\t\temail,\n\t\t\tname,\n\t\t\tpassword_hash,\n\t\t\tidentity_id: this.data.identityId,\n\t\t\totp_secret: null,\n\t\t\totp_secret_version: null,\n\t\t\totp_activated_at: null,\n\t\t\totp_pending_secret: null,\n\t\t\totp_pending_version: null,\n\t\t\totp_pending_created_at: null,\n\t\t\temail_otp_enabled: false,\n\t\t\tdisabled_at: null,\n\t\t\tpasswordless_enabled: null,\n\t\t\tmfa_grace_until: null,\n\t\t\tis_in_grace: false,\n\t\t\temail_verified_at: null,\n\t\t\temail_verification_required: emailVerificationRequired,\n\t\t}\n\t}\n}\n"],"names":["email","normalizeEmail","InsertBuilder"],"mappings":";;;;AAMO,MAAM,oBAAiE;AAAA,EAC7E,YACkB,MAQhB;AARgB,SAAA,OAAA;AAAA,EAQf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA8D;AACjF,UAAM,KAAK,UAAU,KAAA;AAErB,UAAM,gBAAgB,MAAM,KAAK,KAAK,SAAS,QAAQ,SAAS;AAChE,UAAMA,UAAQ,KAAK,KAAK,QAAQC,MAAAA,eAAe,KAAK,KAAK,KAAK,IAAI;AAClE,UAAM,OAAO,KAAK,KAAK,QAAQ,KAAK,KAAK,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AACjE,UAAM,4BAA4B,KAAK,KAAK,6BAA6B;AACzE,UAAMC,SAAAA,cAAc,OAAA,EAClB,KAAK,QAAQ,EACb,OAAO;AAAA,MACP;AAAA,MAAA,OACAF;AAAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,KAAK,KAAK;AAAA,MACvB,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,6BAA6B;AAAA,IAAA,CAC7B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,MACN;AAAA,MAAA,OACAA;AAAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,KAAK,KAAK;AAAA,MACvB,YAAY;AAAA,MACZ,oBAAoB;AAAA,MACpB,kBAAkB;AAAA,MAClB,oBAAoB;AAAA,MACpB,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,mBAAmB;AAAA,MACnB,aAAa;AAAA,MACb,sBAAsB;AAAA,MACtB,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,mBAAmB;AAAA,MACnB,6BAA6B;AAAA,IAAA;AAAA,EAE/B;AACD;;"}

package/dist/production/src/model/commands/person/CreatePersonCommand.js

@@ -35,6 +35,7 @@ class CreatePersonCommand {
       disabled_at: null,
       passwordless_enabled: null,
       mfa_grace_until: null,
+      is_in_grace: false,
       email_verified_at: null,
       email_verification_required: emailVerificationRequired
     };

package/dist/production/src/model/commands/person/CreatePersonCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreatePersonCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/CreatePersonCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { PersonRow } from '../../queries/index.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { MaybePassword } from '../../dtos/Password.js'\nimport { normalizeEmail } from '../../utils/email.js'\n\nexport class CreatePersonCommand implements Command<Omit<PersonRow, 'roles'>> {\n\tconstructor(\n\t\tprivate readonly data: {\n\t\t\tidentityId: string\n\t\t\temail?: string\n\t\t\tname?: string\n\t\t\tpassword: MaybePassword\n\t\t\tidpOnly?: boolean\n\t\t\temailVerificationRequired?: boolean\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<Omit<PersonRow, 'roles'>> {\n\t\tconst id = providers.uuid()\n\n\t\tconst password_hash = await this.data.password.getHash(providers)\n\t\tconst email = this.data.email ? normalizeEmail(this.data.email) : null\n\t\tconst name = this.data.name ?? this.data.email?.split('@')[0] ?? null\n\t\tconst emailVerificationRequired = this.data.emailVerificationRequired ?? false\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\temail,\n\t\t\t\tname: name,\n\t\t\t\tpassword_hash,\n\t\t\t\tidentity_id: this.data.identityId,\n\t\t\t\tidp_only: this.data.idpOnly ?? false,\n\t\t\t\temail_verification_required: emailVerificationRequired,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn {\n\t\t\tid,\n\t\t\temail,\n\t\t\tname,\n\t\t\tpassword_hash,\n\t\t\tidentity_id: this.data.identityId,\n\t\t\totp_secret: null,\n\t\t\totp_secret_version: null,\n\t\t\totp_activated_at: null,\n\t\t\totp_pending_secret: null,\n\t\t\totp_pending_version: null,\n\t\t\totp_pending_created_at: null,\n\t\t\temail_otp_enabled: false,\n\t\t\tdisabled_at: null,\n\t\t\tpasswordless_enabled: null,\n\t\t\tmfa_grace_until: null,\n\t\t\temail_verified_at: null,\n\t\t\temail_verification_required: emailVerificationRequired,\n\t\t}\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;AAMO,MAAM,oBAAiE;AAAA,EAC7E,YACkB,MAQhB;AARgB,SAAA,OAAA;AAAA,EAQf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA8D;AACjF,UAAM,KAAK,UAAU,KAAA;AAErB,UAAM,gBAAgB,MAAM,KAAK,KAAK,SAAS,QAAQ,SAAS;AAChE,UAAM,QAAQ,KAAK,KAAK,QAAQ,eAAe,KAAK,KAAK,KAAK,IAAI;AAClE,UAAM,OAAO,KAAK,KAAK,QAAQ,KAAK,KAAK,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AACjE,UAAM,4BAA4B,KAAK,KAAK,6BAA6B;AACzE,UAAMA,gBAAc,OAAA,EAClB,KAAK,QAAQ,EACb,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,KAAK,KAAK;AAAA,MACvB,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,6BAA6B;AAAA,IAAA,CAC7B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,KAAK,KAAK;AAAA,MACvB,YAAY;AAAA,MACZ,oBAAoB;AAAA,MACpB,kBAAkB;AAAA,MAClB,oBAAoB;AAAA,MACpB,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,mBAAmB;AAAA,MACnB,aAAa;AAAA,MACb,sBAAsB;AAAA,MACtB,iBAAiB;AAAA,MACjB,mBAAmB;AAAA,MACnB,6BAA6B;AAAA,IAAA;AAAA,EAE/B;AACD;"}
+{"version":3,"file":"CreatePersonCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/CreatePersonCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { PersonRow } from '../../queries/index.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { MaybePassword } from '../../dtos/Password.js'\nimport { normalizeEmail } from '../../utils/email.js'\n\nexport class CreatePersonCommand implements Command<Omit<PersonRow, 'roles'>> {\n\tconstructor(\n\t\tprivate readonly data: {\n\t\t\tidentityId: string\n\t\t\temail?: string\n\t\t\tname?: string\n\t\t\tpassword: MaybePassword\n\t\t\tidpOnly?: boolean\n\t\t\temailVerificationRequired?: boolean\n\t\t},\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<Omit<PersonRow, 'roles'>> {\n\t\tconst id = providers.uuid()\n\n\t\tconst password_hash = await this.data.password.getHash(providers)\n\t\tconst email = this.data.email ? normalizeEmail(this.data.email) : null\n\t\tconst name = this.data.name ?? this.data.email?.split('@')[0] ?? null\n\t\tconst emailVerificationRequired = this.data.emailVerificationRequired ?? false\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\temail,\n\t\t\t\tname: name,\n\t\t\t\tpassword_hash,\n\t\t\t\tidentity_id: this.data.identityId,\n\t\t\t\tidp_only: this.data.idpOnly ?? false,\n\t\t\t\temail_verification_required: emailVerificationRequired,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn {\n\t\t\tid,\n\t\t\temail,\n\t\t\tname,\n\t\t\tpassword_hash,\n\t\t\tidentity_id: this.data.identityId,\n\t\t\totp_secret: null,\n\t\t\totp_secret_version: null,\n\t\t\totp_activated_at: null,\n\t\t\totp_pending_secret: null,\n\t\t\totp_pending_version: null,\n\t\t\totp_pending_created_at: null,\n\t\t\temail_otp_enabled: false,\n\t\t\tdisabled_at: null,\n\t\t\tpasswordless_enabled: null,\n\t\t\tmfa_grace_until: null,\n\t\t\tis_in_grace: false,\n\t\t\temail_verified_at: null,\n\t\t\temail_verification_required: emailVerificationRequired,\n\t\t}\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;AAMO,MAAM,oBAAiE;AAAA,EAC7E,YACkB,MAQhB;AARgB,SAAA,OAAA;AAAA,EAQf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA8D;AACjF,UAAM,KAAK,UAAU,KAAA;AAErB,UAAM,gBAAgB,MAAM,KAAK,KAAK,SAAS,QAAQ,SAAS;AAChE,UAAM,QAAQ,KAAK,KAAK,QAAQ,eAAe,KAAK,KAAK,KAAK,IAAI;AAClE,UAAM,OAAO,KAAK,KAAK,QAAQ,KAAK,KAAK,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AACjE,UAAM,4BAA4B,KAAK,KAAK,6BAA6B;AACzE,UAAMA,gBAAc,OAAA,EAClB,KAAK,QAAQ,EACb,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,KAAK,KAAK;AAAA,MACvB,UAAU,KAAK,KAAK,WAAW;AAAA,MAC/B,6BAA6B;AAAA,IAAA,CAC7B,EACA,QAAQ,EAAE;AAEZ,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,aAAa,KAAK,KAAK;AAAA,MACvB,YAAY;AAAA,MACZ,oBAAoB;AAAA,MACpB,kBAAkB;AAAA,MAClB,oBAAoB;AAAA,MACpB,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,mBAAmB;AAAA,MACnB,aAAa;AAAA,MACb,sBAAsB;AAAA,MACtB,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,mBAAmB;AAAA,MACnB,6BAA6B;AAAA,IAAA;AAAA,EAE/B;AACD;"}

package/dist/production/src/model/commands/person/EnablePersonCommand.cjs

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class EnablePersonCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db, providers }) {
+    await Database.UpdateBuilder.create().table("person").values({
+      disabled_at: null
+    }).where({
+      id: this.personId
+    }).execute(db);
+  }
+}
+exports.EnablePersonCommand = EnablePersonCommand;
+//# sourceMappingURL=EnablePersonCommand.cjs.map

package/dist/production/src/model/commands/person/EnablePersonCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnablePersonCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/EnablePersonCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class EnablePersonCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.values({\n\t\t\t\tdisabled_at: null,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.personId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,oBAA6C;AAAA,EACzD,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM,QAAQ,EACd,OAAO;AAAA,MACP,aAAa;AAAA,IAAA,CACb,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/production/src/model/commands/person/EnablePersonCommand.js

@@ -0,0 +1,17 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class EnablePersonCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db, providers }) {
+    await UpdateBuilder$1.create().table("person").values({
+      disabled_at: null
+    }).where({
+      id: this.personId
+    }).execute(db);
+  }
+}
+export {
+  EnablePersonCommand
+};
+//# sourceMappingURL=EnablePersonCommand.js.map

package/dist/production/src/model/commands/person/EnablePersonCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnablePersonCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/EnablePersonCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class EnablePersonCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.values({\n\t\t\t\tdisabled_at: null,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.personId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,oBAA6C;AAAA,EACzD,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,MAAM,QAAQ,EACd,OAAO;AAAA,MACP,aAAa;AAAA,IAAA,CACb,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/commands/person/SetMfaGraceUntilCommand.cjs

@@ -2,13 +2,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
 class SetMfaGraceUntilCommand {
-  constructor(personId, graceUntil) {
+  constructor(personId, graceSeconds) {
     this.personId = personId;
-    this.graceUntil = graceUntil;
+    this.graceSeconds = graceSeconds;
   }
   async execute({ db }) {
     await Database.UpdateBuilder.create().table("person").where({ id: this.personId }).values({
-      mfa_grace_until: this.graceUntil
+      mfa_grace_until: new Database.Literal("now() + make_interval(secs => ?)", [this.graceSeconds])
     }).execute(db);
   }
 }

package/dist/production/src/model/commands/person/SetMfaGraceUntilCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SetMfaGraceUntilCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/SetMfaGraceUntilCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/** Sets `person.mfa_grace_until` (the anchor for the MFA enrollment grace window). */\nexport class SetMfaGraceUntilCommand implements Command<void> {\n\tconstructor(private readonly personId: string, private readonly graceUntil: Date) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.where({ id: this.personId })\n\t\t\t.values({\n\t\t\t\tmfa_grace_until: this.graceUntil,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAIO,MAAM,wBAAiD;AAAA,EAC7D,YAA6B,UAAmC,YAAkB;AAArD,SAAA,WAAA;AAAmC,SAAA,aAAA;AAAA,EAAmB;AAAA,EAEnF,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,uBAAc,SAClB,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,KAAK,SAAA,CAAU,EAC3B,OAAO;AAAA,MACP,iBAAiB,KAAK;AAAA,IAAA,CACtB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"SetMfaGraceUntilCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/SetMfaGraceUntilCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { Literal, UpdateBuilder } from '@contember/database'\n\n/**\n * Opens the MFA enrollment grace window by anchoring `person.mfa_grace_until` to\n * `now() + graceSeconds` on the DATABASE clock, so the gate that reads it back\n * (`PersonRow.is_in_grace`, evaluated against `now()`) can't be weakened by\n * app/DB clock skew or skew between engine instances. See engine-tenant-api/CLAUDE.md.\n */\nexport class SetMfaGraceUntilCommand implements Command<void> {\n\tconstructor(private readonly personId: string, private readonly graceSeconds: number) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.where({ id: this.personId })\n\t\t\t.values({\n\t\t\t\tmfa_grace_until: new Literal('now() + make_interval(secs => ?)', [this.graceSeconds]),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder","Literal"],"mappings":";;;AASO,MAAM,wBAAiD;AAAA,EAC7D,YAA6B,UAAmC,cAAsB;AAAzD,SAAA,WAAA;AAAmC,SAAA,eAAA;AAAA,EAAuB;AAAA,EAEvF,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,uBAAc,SAClB,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,KAAK,SAAA,CAAU,EAC3B,OAAO;AAAA,MACP,iBAAiB,IAAIC,SAAAA,QAAQ,oCAAoC,CAAC,KAAK,YAAY,CAAC;AAAA,IAAA,CACpF,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/production/src/model/commands/person/SetMfaGraceUntilCommand.js

@@ -1,12 +1,12 @@
-import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+import { UpdateBuilder as UpdateBuilder$1, Literal } from "@contember/database";
 class SetMfaGraceUntilCommand {
-  constructor(personId, graceUntil) {
+  constructor(personId, graceSeconds) {
     this.personId = personId;
-    this.graceUntil = graceUntil;
+    this.graceSeconds = graceSeconds;
   }
   async execute({ db }) {
     await UpdateBuilder$1.create().table("person").where({ id: this.personId }).values({
-      mfa_grace_until: this.graceUntil
+      mfa_grace_until: new Literal("now() + make_interval(secs => ?)", [this.graceSeconds])
     }).execute(db);
   }
 }

package/dist/production/src/model/commands/person/SetMfaGraceUntilCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"SetMfaGraceUntilCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/SetMfaGraceUntilCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\n/** Sets `person.mfa_grace_until` (the anchor for the MFA enrollment grace window). */\nexport class SetMfaGraceUntilCommand implements Command<void> {\n\tconstructor(private readonly personId: string, private readonly graceUntil: Date) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.where({ id: this.personId })\n\t\t\t.values({\n\t\t\t\tmfa_grace_until: this.graceUntil,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAIO,MAAM,wBAAiD;AAAA,EAC7D,YAA6B,UAAmC,YAAkB;AAArD,SAAA,WAAA;AAAmC,SAAA,aAAA;AAAA,EAAmB;AAAA,EAEnF,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,gBAAc,SAClB,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,KAAK,SAAA,CAAU,EAC3B,OAAO;AAAA,MACP,iBAAiB,KAAK;AAAA,IAAA,CACtB,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"SetMfaGraceUntilCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/SetMfaGraceUntilCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { Literal, UpdateBuilder } from '@contember/database'\n\n/**\n * Opens the MFA enrollment grace window by anchoring `person.mfa_grace_until` to\n * `now() + graceSeconds` on the DATABASE clock, so the gate that reads it back\n * (`PersonRow.is_in_grace`, evaluated against `now()`) can't be weakened by\n * app/DB clock skew or skew between engine instances. See engine-tenant-api/CLAUDE.md.\n */\nexport class SetMfaGraceUntilCommand implements Command<void> {\n\tconstructor(private readonly personId: string, private readonly graceSeconds: number) {}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.where({ id: this.personId })\n\t\t\t.values({\n\t\t\t\tmfa_grace_until: new Literal('now() + make_interval(secs => ?)', [this.graceSeconds]),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AASO,MAAM,wBAAiD;AAAA,EAC7D,YAA6B,UAAmC,cAAsB;AAAzD,SAAA,WAAA;AAAmC,SAAA,eAAA;AAAA,EAAuB;AAAA,EAEvF,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAMA,gBAAc,SAClB,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,KAAK,SAAA,CAAU,EAC3B,OAAO;AAAA,MACP,iBAAiB,IAAI,QAAQ,oCAAoC,CAAC,KAAK,YAAY,CAAC;AAAA,IAAA,CACpF,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/commands/personToken/ResetPasswordCommand.cjs

@@ -12,10 +12,9 @@ class ResetPasswordCommand {
     this.token = token2;
     this.password = password;
   }
-  async execute({ db, providers, bus }) {
-    const now = providers.now();
+  async execute({ db, bus }) {
     const token$1 = await db.createQueryHandler().fetch(PersonTokenQuery.PersonTokenQuery.byToken(this.token, "password_reset"));
-    const tokenValidationResult = token.validateToken({ entry: token$1, token: this.token, now, validationType: "token" });
+    const tokenValidationResult = token.validateToken({ entry: token$1, token: this.token, validationType: "token" });
     if (!tokenValidationResult.ok) {
       return tokenValidationResult;
     }

package/dist/production/src/model/commands/personToken/ResetPasswordCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand.js'\nimport { Response, ResponseOk } from '../../utils/Response.js'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery.js'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand.js'\nimport { validateToken } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst now = providers.now()\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode = PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":["token","PersonTokenQuery","validateToken","InvalidateTokenCommand","ChangePasswordCommand","ResponseOk"],"mappings":";;;;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6BA,QAAgC,UAAkB;AAAlD,SAAA,QAAAA;AAAgC,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhF,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA4D;AAC1F,UAAM,MAAM,UAAU,IAAA;AACtB,UAAMA,UAAQ,MAAM,GAAG,qBAAqB,MAAMC,iBAAAA,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AACxG,UAAM,wBAAwBC,MAAAA,cAAc,EAAE,OAAOF,SAAO,OAAO,KAAK,OAAO,KAAK,gBAAgB,QAAA,CAAS;AAC7G,QAAI,CAAC,sBAAsB,IAAI;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,IAAI,QAAQ,IAAIG,uBAAAA,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AAC7E,UAAM,IAAI,QAAQ,IAAIC,4CAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAElG,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}
+{"version":3,"file":"ResetPasswordCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand.js'\nimport { Response, ResponseOk } from '../../utils/Response.js'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery.js'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand.js'\nimport { validateToken } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode = PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":["token","PersonTokenQuery","validateToken","InvalidateTokenCommand","ChangePasswordCommand","ResponseOk"],"mappings":";;;;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6BA,QAAgC,UAAkB;AAAlD,SAAA,QAAAA;AAAgC,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhF,MAAM,QAAQ,EAAE,IAAI,OAA4D;AAC/E,UAAMA,UAAQ,MAAM,GAAG,qBAAqB,MAAMC,iBAAAA,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AACxG,UAAM,wBAAwBC,MAAAA,cAAc,EAAE,OAAOF,SAAO,OAAO,KAAK,OAAO,gBAAgB,SAAS;AACxG,QAAI,CAAC,sBAAsB,IAAI;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,IAAI,QAAQ,IAAIG,uBAAAA,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AAC7E,UAAM,IAAI,QAAQ,IAAIC,4CAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAElG,WAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,EAC3B;AACD;;"}

package/dist/production/src/model/commands/personToken/ResetPasswordCommand.js

@@ -10,10 +10,9 @@ class ResetPasswordCommand {
     this.token = token;
     this.password = password;
   }
-  async execute({ db, providers, bus }) {
-    const now = providers.now();
+  async execute({ db, bus }) {
     const token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, "password_reset"));
-    const tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: "token" });
+    const tokenValidationResult = validateToken({ entry: token, token: this.token, validationType: "token" });
     if (!tokenValidationResult.ok) {
       return tokenValidationResult;
     }

package/dist/production/src/model/commands/personToken/ResetPasswordCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"ResetPasswordCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand.js'\nimport { Response, ResponseOk } from '../../utils/Response.js'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery.js'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand.js'\nimport { validateToken } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, providers, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst now = providers.now()\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, now, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode = PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":[],"mappings":";;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6B,OAAgC,UAAkB;AAAlD,SAAA,QAAA;AAAgC,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhF,MAAM,QAAQ,EAAE,IAAI,WAAW,OAA4D;AAC1F,UAAM,MAAM,UAAU,IAAA;AACtB,UAAM,QAAQ,MAAM,GAAG,qBAAqB,MAAM,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AACxG,UAAM,wBAAwB,cAAc,EAAE,OAAO,OAAO,OAAO,KAAK,OAAO,KAAK,gBAAgB,QAAA,CAAS;AAC7G,QAAI,CAAC,sBAAsB,IAAI;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,IAAI,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AAC7E,UAAM,IAAI,QAAQ,IAAI,sBAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAElG,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}
+{"version":3,"file":"ResetPasswordCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/ResetPasswordCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ChangePasswordCommand } from '../person/ChangePasswordCommand.js'\nimport { Response, ResponseOk } from '../../utils/Response.js'\nimport { PersonTokenQuery } from '../../queries/personToken/PersonTokenQuery.js'\nimport { InvalidateTokenCommand } from './InvalidateTokenCommand.js'\nimport { validateToken } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\n\nexport class ResetPasswordCommand implements Command<ResetPasswordCommandResponse> {\n\tconstructor(private readonly token: string, private readonly password: string) {}\n\n\tasync execute({ db, bus }: Command.Args): Promise<ResetPasswordCommandResponse> {\n\t\tconst token = await db.createQueryHandler().fetch(PersonTokenQuery.byToken(this.token, 'password_reset'))\n\t\tconst tokenValidationResult = validateToken({ entry: token, token: this.token, validationType: 'token' })\n\t\tif (!tokenValidationResult.ok) {\n\t\t\treturn tokenValidationResult\n\t\t}\n\t\tawait bus.execute(new InvalidateTokenCommand(tokenValidationResult.result.id))\n\t\tawait bus.execute(new ChangePasswordCommand(tokenValidationResult.result.person_id, this.password))\n\n\t\treturn new ResponseOk(null)\n\t}\n}\nexport type ResetPasswordCommandErrorCode = PersonToken.TokenValidationError\n\nexport type ResetPasswordCommandResponse = Response<null, PersonToken.TokenValidationError>\n"],"names":[],"mappings":";;;;;;;AAQO,MAAM,qBAAsE;AAAA,EAClF,YAA6B,OAAgC,UAAkB;AAAlD,SAAA,QAAA;AAAgC,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhF,MAAM,QAAQ,EAAE,IAAI,OAA4D;AAC/E,UAAM,QAAQ,MAAM,GAAG,qBAAqB,MAAM,iBAAiB,QAAQ,KAAK,OAAO,gBAAgB,CAAC;AACxG,UAAM,wBAAwB,cAAc,EAAE,OAAO,OAAO,OAAO,KAAK,OAAO,gBAAgB,SAAS;AACxG,QAAI,CAAC,sBAAsB,IAAI;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,IAAI,QAAQ,IAAI,uBAAuB,sBAAsB,OAAO,EAAE,CAAC;AAC7E,UAAM,IAAI,QAAQ,IAAI,sBAAsB,sBAAsB,OAAO,WAAW,KAAK,QAAQ,CAAC;AAElG,WAAO,IAAI,WAAW,IAAI;AAAA,EAC3B;AACD;"}

package/dist/production/src/model/commands/personToken/SaveEmailOtpTokenCommand.cjs

@@ -12,20 +12,20 @@ class SaveEmailOtpTokenCommand {
   }
   async execute({ db, providers }) {
     const id = providers.uuid();
-    const expiresAt = time.plusMinutes(providers.now(), this.expirationMinutes);
     const tokenHash = token.computeTokenHash(await token.generateToken(providers));
     const otpHash = token.computeTokenHash(this.code);
     await Database.InsertBuilder.create().into("person_token").values({
       id,
       token_hash: tokenHash,
       person_id: this.personId,
-      expires_at: expiresAt,
+      // expires_at on the DATABASE clock — see SavePersonTokenCommand / CLAUDE.md.
+      expires_at: new Database.Literal("now() + make_interval(secs => ?)", [this.expirationMinutes * 60]),
       created_at: providers.now(),
       used_at: null,
       type: "mfa_email_otp",
       otp_hash: otpHash
     }).execute(db);
-    return { id, expiresAt };
+    return { id, expiresAt: time.plusMinutes(providers.now(), this.expirationMinutes) };
   }
 }
 exports.SaveEmailOtpTokenCommand = SaveEmailOtpTokenCommand;

package/dist/production/src/model/commands/personToken/SaveEmailOtpTokenCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SaveEmailOtpTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SaveEmailOtpTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\n\n/**\n * Creates an `mfa_email_otp` person_token carrying a 6-digit code in `otp_hash`.\n *\n * Unlike the passwordless flow there is no magic-link step, so the code itself is\n * the only secret — it is validated via {@link validateToken}'s `'otp'` path. The\n * `token_hash` column is NOT NULL and UNIQUE, so we still fill it with a random,\n * never-used token hash to satisfy the schema.\n */\nexport class SaveEmailOtpTokenCommand implements Command<SaveEmailOtpTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly code: string,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SaveEmailOtpTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tconst tokenHash: TokenHash = computeTokenHash(await generateToken(providers))\n\t\tconst otpHash = computeTokenHash(this.code)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: 'mfa_email_otp',\n\t\t\t\totp_hash: otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SaveEmailOtpTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n"],"names":["plusMinutes","computeTokenHash","generateToken","InsertBuilder"],"mappings":";;;;;;AAaO,MAAM,yBAA6E;AAAA,EACzF,YACkB,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAqE;AACxF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAYA,KAAAA,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAM,YAAuBC,MAAAA,iBAAiB,MAAMC,MAAAA,cAAc,SAAS,CAAC;AAC5E,UAAM,UAAUD,MAAAA,iBAAiB,KAAK,IAAI;AAC1C,UAAME,SAAAA,cAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"SaveEmailOtpTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SaveEmailOtpTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\n\n/**\n * Creates an `mfa_email_otp` person_token carrying a 6-digit code in `otp_hash`.\n *\n * Unlike the passwordless flow there is no magic-link step, so the code itself is\n * the only secret — it is validated via {@link validateToken}'s `'otp'` path. The\n * `token_hash` column is NOT NULL and UNIQUE, so we still fill it with a random,\n * never-used token hash to satisfy the schema.\n */\nexport class SaveEmailOtpTokenCommand implements Command<SaveEmailOtpTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly code: string,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SaveEmailOtpTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst tokenHash: TokenHash = computeTokenHash(await generateToken(providers))\n\t\tconst otpHash = computeTokenHash(this.code)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\t// expires_at on the DATABASE clock — see SavePersonTokenCommand / CLAUDE.md.\n\t\t\t\texpires_at: new Literal('now() + make_interval(secs => ?)', [this.expirationMinutes * 60]),\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: 'mfa_email_otp',\n\t\t\t\totp_hash: otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\t// Display-only approximation; the DB-clock `expires_at` column is authoritative.\n\t\treturn { id, expiresAt: plusMinutes(providers.now(), this.expirationMinutes) }\n\t}\n}\n\nnamespace SaveEmailOtpTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n"],"names":["computeTokenHash","generateToken","InsertBuilder","Literal","plusMinutes"],"mappings":";;;;;;AAaO,MAAM,yBAA6E;AAAA,EACzF,YACkB,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAqE;AACxF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAuBA,MAAAA,iBAAiB,MAAMC,MAAAA,cAAc,SAAS,CAAC;AAC5E,UAAM,UAAUD,MAAAA,iBAAiB,KAAK,IAAI;AAC1C,UAAME,SAAAA,cAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY;AAAA,MACZ,WAAW,KAAK;AAAA;AAAA,MAEhB,YAAY,IAAIC,SAAAA,QAAQ,oCAAoC,CAAC,KAAK,oBAAoB,EAAE,CAAC;AAAA,MACzF,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV,EACA,QAAQ,EAAE;AAGZ,WAAO,EAAE,IAAI,WAAWC,KAAAA,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB,EAAA;AAAA,EAC5E;AACD;;"}

package/dist/production/src/model/commands/personToken/SaveEmailOtpTokenCommand.js

@@ -1,4 +1,4 @@
-import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+import { InsertBuilder as InsertBuilder$1, Literal } from "@contember/database";
 import { plusMinutes } from "../../utils/time.js";
 import "../../type/ApiKey.js";
 import { computeTokenHash, generateToken } from "../../utils/token.js";
@@ -10,20 +10,20 @@ class SaveEmailOtpTokenCommand {
   }
   async execute({ db, providers }) {
     const id = providers.uuid();
-    const expiresAt = plusMinutes(providers.now(), this.expirationMinutes);
     const tokenHash = computeTokenHash(await generateToken(providers));
     const otpHash = computeTokenHash(this.code);
     await InsertBuilder$1.create().into("person_token").values({
       id,
       token_hash: tokenHash,
       person_id: this.personId,
-      expires_at: expiresAt,
+      // expires_at on the DATABASE clock — see SavePersonTokenCommand / CLAUDE.md.
+      expires_at: new Literal("now() + make_interval(secs => ?)", [this.expirationMinutes * 60]),
       created_at: providers.now(),
       used_at: null,
       type: "mfa_email_otp",
       otp_hash: otpHash
     }).execute(db);
-    return { id, expiresAt };
+    return { id, expiresAt: plusMinutes(providers.now(), this.expirationMinutes) };
   }
 }
 export {

package/dist/production/src/model/commands/personToken/SaveEmailOtpTokenCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"SaveEmailOtpTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SaveEmailOtpTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\n\n/**\n * Creates an `mfa_email_otp` person_token carrying a 6-digit code in `otp_hash`.\n *\n * Unlike the passwordless flow there is no magic-link step, so the code itself is\n * the only secret — it is validated via {@link validateToken}'s `'otp'` path. The\n * `token_hash` column is NOT NULL and UNIQUE, so we still fill it with a random,\n * never-used token hash to satisfy the schema.\n */\nexport class SaveEmailOtpTokenCommand implements Command<SaveEmailOtpTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly code: string,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SaveEmailOtpTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tconst tokenHash: TokenHash = computeTokenHash(await generateToken(providers))\n\t\tconst otpHash = computeTokenHash(this.code)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: 'mfa_email_otp',\n\t\t\t\totp_hash: otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SaveEmailOtpTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;;AAaO,MAAM,yBAA6E;AAAA,EACzF,YACkB,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAqE;AACxF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAY,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAM,YAAuB,iBAAiB,MAAM,cAAc,SAAS,CAAC;AAC5E,UAAM,UAAU,iBAAiB,KAAK,IAAI;AAC1C,UAAMA,gBAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"SaveEmailOtpTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SaveEmailOtpTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\n\n/**\n * Creates an `mfa_email_otp` person_token carrying a 6-digit code in `otp_hash`.\n *\n * Unlike the passwordless flow there is no magic-link step, so the code itself is\n * the only secret — it is validated via {@link validateToken}'s `'otp'` path. The\n * `token_hash` column is NOT NULL and UNIQUE, so we still fill it with a random,\n * never-used token hash to satisfy the schema.\n */\nexport class SaveEmailOtpTokenCommand implements Command<SaveEmailOtpTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly code: string,\n\t\tprivate readonly expirationMinutes: number,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SaveEmailOtpTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst tokenHash: TokenHash = computeTokenHash(await generateToken(providers))\n\t\tconst otpHash = computeTokenHash(this.code)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\t// expires_at on the DATABASE clock — see SavePersonTokenCommand / CLAUDE.md.\n\t\t\t\texpires_at: new Literal('now() + make_interval(secs => ?)', [this.expirationMinutes * 60]),\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: 'mfa_email_otp',\n\t\t\t\totp_hash: otpHash,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\t// Display-only approximation; the DB-clock `expires_at` column is authoritative.\n\t\treturn { id, expiresAt: plusMinutes(providers.now(), this.expirationMinutes) }\n\t}\n}\n\nnamespace SaveEmailOtpTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;;AAaO,MAAM,yBAA6E;AAAA,EACzF,YACkB,UACA,MACA,mBAChB;AAHgB,SAAA,WAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAqE;AACxF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAuB,iBAAiB,MAAM,cAAc,SAAS,CAAC;AAC5E,UAAM,UAAU,iBAAiB,KAAK,IAAI;AAC1C,UAAMA,gBAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY;AAAA,MACZ,WAAW,KAAK;AAAA;AAAA,MAEhB,YAAY,IAAI,QAAQ,oCAAoC,CAAC,KAAK,oBAAoB,EAAE,CAAC;AAAA,MACzF,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM;AAAA,MACN,UAAU;AAAA,IAAA,CACV,EACA,QAAQ,EAAE;AAGZ,WAAO,EAAE,IAAI,WAAW,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB,EAAA;AAAA,EAC5E;AACD;"}

package/dist/production/src/model/commands/personToken/SavePersonTokenCommand.cjs

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
-const time = require("../../utils/time.cjs");
+const exceptions = require("../../../exceptions.cjs");
 class SavePersonTokenCommand {
   constructor(personId, tokenHash, type, expirationMinutes, meta = null) {
     this.personId = personId;
@@ -12,18 +12,24 @@ class SavePersonTokenCommand {
   }
   async execute({ db, providers }) {
     const id = providers.uuid();
-    const expiresAt = time.plusMinutes(providers.now(), this.expirationMinutes);
-    await Database.InsertBuilder.create().into("person_token").values({
+    const result = await Database.InsertBuilder.create().into("person_token").values({
       id,
       token_hash: this.tokenHash,
+      // expires_at is computed on the DATABASE clock so the expiry gate
+      // (PersonTokenQuery's `is_expired`, evaluated against NOW()) can never be
+      // weakened by app/DB clock skew. created_at stays on the app clock — it is
+      // display/ordering only, never compared. See engine-tenant-api/CLAUDE.md.
       person_id: this.personId,
-      expires_at: expiresAt,
+      expires_at: new Database.Literal("now() + make_interval(secs => ?)", [this.expirationMinutes * 60]),
       created_at: providers.now(),
       used_at: null,
       type: this.type,
       meta: this.meta
-    }).execute(db);
-    return { id, expiresAt };
+    }).returning("expires_at").execute(db);
+    if (result.length !== 1) {
+      throw new exceptions.ImplementationException();
+    }
+    return { id, expiresAt: result[0].expires_at };
   }
 }
 exports.SavePersonTokenCommand = SavePersonTokenCommand;

package/dist/production/src/model/commands/personToken/SavePersonTokenCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"SavePersonTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { TokenHash } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\nimport { JSONValue } from '@contember/schema'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t\tprivate readonly meta: JSONValue | null = null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t\tmeta: this.meta,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["plusMinutes","InsertBuilder"],"mappings":";;;;AAOA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBACA,OAAyB,MACzC;AALgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AACA,SAAA,OAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAYA,KAAAA,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAMC,SAAAA,cAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,IAAA,CACX,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;;"}
+{"version":3,"file":"SavePersonTokenCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { TokenHash } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\nimport { JSONValue } from '@contember/schema'\nimport { ImplementationException } from '../../../exceptions.js'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t\tprivate readonly meta: JSONValue | null = null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst result = await InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\t// expires_at is computed on the DATABASE clock so the expiry gate\n\t\t\t\t// (PersonTokenQuery's `is_expired`, evaluated against NOW()) can never be\n\t\t\t\t// weakened by app/DB clock skew. created_at stays on the app clock — it is\n\t\t\t\t// display/ordering only, never compared. See engine-tenant-api/CLAUDE.md.\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: new Literal('now() + make_interval(secs => ?)', [this.expirationMinutes * 60]),\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t\tmeta: this.meta,\n\t\t\t})\n\t\t\t.returning<{ expires_at: Date }>('expires_at')\n\t\t\t.execute(db)\n\t\tif (result.length !== 1) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\treturn { id, expiresAt: result[0].expires_at }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["InsertBuilder","Literal","ImplementationException"],"mappings":";;;;AAOA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBACA,OAAyB,MACzC;AALgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AACA,SAAA,OAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjB,WAAW,KAAK;AAAA,MAChB,YAAY,IAAIC,SAAAA,QAAQ,oCAAoC,CAAC,KAAK,oBAAoB,EAAE,CAAC;AAAA,MACzF,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,IAAA,CACX,EACA,UAAgC,YAAY,EAC5C,QAAQ,EAAE;AACZ,QAAI,OAAO,WAAW,GAAG;AACxB,YAAM,IAAIC,WAAAA,wBAAA;AAAA,IACX;AACA,WAAO,EAAE,IAAI,WAAW,OAAO,CAAC,EAAE,WAAA;AAAA,EACnC;AACD;;"}

package/dist/production/src/model/commands/personToken/SavePersonTokenCommand.js

@@ -1,5 +1,5 @@
-import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
-import { plusMinutes } from "../../utils/time.js";
+import { InsertBuilder as InsertBuilder$1, Literal } from "@contember/database";
+import { ImplementationException } from "../../../exceptions.js";
 class SavePersonTokenCommand {
   constructor(personId, tokenHash, type, expirationMinutes, meta = null) {
     this.personId = personId;
@@ -10,18 +10,24 @@ class SavePersonTokenCommand {
   }
   async execute({ db, providers }) {
     const id = providers.uuid();
-    const expiresAt = plusMinutes(providers.now(), this.expirationMinutes);
-    await InsertBuilder$1.create().into("person_token").values({
+    const result = await InsertBuilder$1.create().into("person_token").values({
       id,
       token_hash: this.tokenHash,
+      // expires_at is computed on the DATABASE clock so the expiry gate
+      // (PersonTokenQuery's `is_expired`, evaluated against NOW()) can never be
+      // weakened by app/DB clock skew. created_at stays on the app clock — it is
+      // display/ordering only, never compared. See engine-tenant-api/CLAUDE.md.
       person_id: this.personId,
-      expires_at: expiresAt,
+      expires_at: new Literal("now() + make_interval(secs => ?)", [this.expirationMinutes * 60]),
       created_at: providers.now(),
       used_at: null,
       type: this.type,
       meta: this.meta
-    }).execute(db);
-    return { id, expiresAt };
+    }).returning("expires_at").execute(db);
+    if (result.length !== 1) {
+      throw new ImplementationException();
+    }
+    return { id, expiresAt: result[0].expires_at };
   }
 }
 export {

package/dist/production/src/model/commands/personToken/SavePersonTokenCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"SavePersonTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { plusMinutes } from '../../utils/time.js'\nimport { TokenHash } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\nimport { JSONValue } from '@contember/schema'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t\tprivate readonly meta: JSONValue | null = null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst expiresAt = plusMinutes(providers.now(), this.expirationMinutes)\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: expiresAt,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t\tmeta: this.meta,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn { id, expiresAt }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["InsertBuilder"],"mappings":";;AAOA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBACA,OAAyB,MACzC;AALgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AACA,SAAA,OAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,YAAY,YAAY,UAAU,IAAA,GAAO,KAAK,iBAAiB;AACrE,UAAMA,gBAAc,OAAA,EAClB,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA,MACjB,WAAW,KAAK;AAAA,MAChB,YAAY;AAAA,MACZ,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,IAAA,CACX,EACA,QAAQ,EAAE;AAEZ,WAAO,EAAE,IAAI,UAAA;AAAA,EACd;AACD;"}
+{"version":3,"file":"SavePersonTokenCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/personToken/SavePersonTokenCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { TokenHash } from '../../utils/index.js'\nimport { PersonToken } from '../../type/index.js'\nimport { JSONValue } from '@contember/schema'\nimport { ImplementationException } from '../../../exceptions.js'\n\nclass SavePersonTokenCommand implements Command<SavePersonTokenCommand.Result> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t\tprivate readonly tokenHash: TokenHash,\n\t\tprivate readonly type: PersonToken.Type,\n\t\tprivate readonly expirationMinutes: number,\n\t\tprivate readonly meta: JSONValue | null = null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<SavePersonTokenCommand.Result> {\n\t\tconst id = providers.uuid()\n\t\tconst result = await InsertBuilder.create()\n\t\t\t.into('person_token')\n\t\t\t.values({\n\t\t\t\tid: id,\n\t\t\t\ttoken_hash: this.tokenHash,\n\t\t\t\t// expires_at is computed on the DATABASE clock so the expiry gate\n\t\t\t\t// (PersonTokenQuery's `is_expired`, evaluated against NOW()) can never be\n\t\t\t\t// weakened by app/DB clock skew. created_at stays on the app clock — it is\n\t\t\t\t// display/ordering only, never compared. See engine-tenant-api/CLAUDE.md.\n\t\t\t\tperson_id: this.personId,\n\t\t\t\texpires_at: new Literal('now() + make_interval(secs => ?)', [this.expirationMinutes * 60]),\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tused_at: null,\n\t\t\t\ttype: this.type,\n\t\t\t\tmeta: this.meta,\n\t\t\t})\n\t\t\t.returning<{ expires_at: Date }>('expires_at')\n\t\t\t.execute(db)\n\t\tif (result.length !== 1) {\n\t\t\tthrow new ImplementationException()\n\t\t}\n\t\treturn { id, expiresAt: result[0].expires_at }\n\t}\n}\n\nnamespace SavePersonTokenCommand {\n\texport interface Result {\n\t\tid: string\n\t\texpiresAt: Date\n\t}\n}\n\nexport { SavePersonTokenCommand }\n"],"names":["InsertBuilder"],"mappings":";;AAOA,MAAM,uBAAyE;AAAA,EAC9E,YACkB,UACA,WACA,MACA,mBACA,OAAyB,MACzC;AALgB,SAAA,WAAA;AACA,SAAA,YAAA;AACA,SAAA,OAAA;AACA,SAAA,oBAAA;AACA,SAAA,OAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAAmE;AACtF,UAAM,KAAK,UAAU,KAAA;AACrB,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,KAAK,cAAc,EACnB,OAAO;AAAA,MACP;AAAA,MACA,YAAY,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,MAKjB,WAAW,KAAK;AAAA,MAChB,YAAY,IAAI,QAAQ,oCAAoC,CAAC,KAAK,oBAAoB,EAAE,CAAC;AAAA,MACzF,YAAY,UAAU,IAAA;AAAA,MACtB,SAAS;AAAA,MACT,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,IAAA,CACX,EACA,UAAgC,YAAY,EAC5C,QAAQ,EAAE;AACZ,QAAI,OAAO,WAAW,GAAG;AACxB,YAAM,IAAI,wBAAA;AAAA,IACX;AACA,WAAO,EAAE,IAAI,WAAW,OAAO,CAAC,EAAE,WAAA;AAAA,EACnC;AACD;"}

package/dist/production/src/model/commands/rateLimit/RecordRateLimitEventCommand.cjs

@@ -10,8 +10,7 @@ class RecordRateLimitEventCommand {
     await Database.InsertBuilder.create().into("rate_limit_event").values({
       id: providers.uuid(),
       scope: this.scope,
-      key_hash: this.keyHash,
-      occurred_at: providers.now()
+      key_hash: this.keyHash
     }).execute(db);
   }
 }

package/dist/production/src/model/commands/rateLimit/RecordRateLimitEventCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"RecordRateLimitEventCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/rateLimit/RecordRateLimitEventCommand.ts"],"sourcesContent":["import { InsertBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RecordRateLimitEventCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('rate_limit_event')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tscope: this.scope,\n\t\t\t\tkey_hash: this.keyHash,\n\t\t\t\toccurred_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,4BAAqD;AAAA,EACjE,YACkB,OACA,SAChB;AAFgB,SAAA,QAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,kBAAkB,EACvB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf,aAAa,UAAU,IAAA;AAAA,IAAI,CAC3B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"RecordRateLimitEventCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/rateLimit/RecordRateLimitEventCommand.ts"],"sourcesContent":["import { InsertBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RecordRateLimitEventCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\t// occurred_at is left to its DB default (NOW()) so every rate-limit\n\t\t// timestamp is on the database clock — the same clock the window is counted\n\t\t// against (see RateLimitCountQuery). Never stamp it from the app clock.\n\t\tawait InsertBuilder.create()\n\t\t\t.into('rate_limit_event')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tscope: this.scope,\n\t\t\t\tkey_hash: this.keyHash,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,4BAAqD;AAAA,EACjE,YACkB,OACA,SAChB;AAFgB,SAAA,QAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAI7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,kBAAkB,EACvB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,IAAA,CACf,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/production/src/model/commands/rateLimit/RecordRateLimitEventCommand.js

@@ -8,8 +8,7 @@ class RecordRateLimitEventCommand {
     await InsertBuilder$1.create().into("rate_limit_event").values({
       id: providers.uuid(),
       scope: this.scope,
-      key_hash: this.keyHash,
-      occurred_at: providers.now()
+      key_hash: this.keyHash
     }).execute(db);
   }
 }

package/dist/production/src/model/commands/rateLimit/RecordRateLimitEventCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"RecordRateLimitEventCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/rateLimit/RecordRateLimitEventCommand.ts"],"sourcesContent":["import { InsertBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RecordRateLimitEventCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('rate_limit_event')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tscope: this.scope,\n\t\t\t\tkey_hash: this.keyHash,\n\t\t\t\toccurred_at: providers.now(),\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,4BAAqD;AAAA,EACjE,YACkB,OACA,SAChB;AAFgB,SAAA,QAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,KAAK,kBAAkB,EACvB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,MACf,aAAa,UAAU,IAAA;AAAA,IAAI,CAC3B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"RecordRateLimitEventCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/rateLimit/RecordRateLimitEventCommand.ts"],"sourcesContent":["import { InsertBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\nimport { RateLimitScope } from '../../type/RateLimit.js'\n\nexport class RecordRateLimitEventCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly scope: RateLimitScope,\n\t\tprivate readonly keyHash: Buffer,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\t// occurred_at is left to its DB default (NOW()) so every rate-limit\n\t\t// timestamp is on the database clock — the same clock the window is counted\n\t\t// against (see RateLimitCountQuery). Never stamp it from the app clock.\n\t\tawait InsertBuilder.create()\n\t\t\t.into('rate_limit_event')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tscope: this.scope,\n\t\t\t\tkey_hash: this.keyHash,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,4BAAqD;AAAA,EACjE,YACkB,OACA,SAChB;AAFgB,SAAA,QAAA;AACA,SAAA,UAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAI7D,UAAMA,gBAAc,OAAA,EAClB,KAAK,kBAAkB,EACvB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,UAAU,KAAK;AAAA,IAAA,CACf,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}