@contember/engine-tenant-api 2.2.0-alpha.1 → 2.2.0-alpha.10

package/dist/development/src/model/authorization/TargetIdentityPermission.cjs

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+require("../queries/apiKey/ApiKeyQuery.cjs");
+require("@contember/database");
+require("../type/ApiKey.cjs");
+const IdentityHasProjectMembershipsQuery = require("../queries/membership/IdentityHasProjectMembershipsQuery.cjs");
+const IdentityQuery = require("../queries/identity/IdentityQuery.cjs");
+require("./PermissionActions.cjs");
+require("@contember/authorization");
+const Roles = require("./Roles.cjs");
+require("./CustomRolePermissions.cjs");
+require("./PermissionContext.cjs");
+require("@contember/schema");
+const batchQuery = require("../../utils/batchQuery.cjs");
+const projectMembershipPresenceLoader = batchQuery.batchLoader(
+  async (identityIds, db) => await db.queryHandler.fetch(new IdentityHasProjectMembershipsQuery.IdentityHasProjectMembershipsQuery(identityIds)),
+  (identityId, identitiesWithMemberships) => identitiesWithMemberships.has(identityId)
+);
+const targetIdentityLoader = batchQuery.batchLoader(
+  async (identityIds, db) => {
+    const identities = await db.queryHandler.fetch(new IdentityQuery.IdentityQuery(identityIds));
+    return Object.fromEntries(identities.map((identity) => [identity.id, identity]));
+  },
+  (identityId, identities) => identities[identityId]
+);
+const createTargetIdentityPermissionTarget = async (db, identity) => ({
+  id: identity.id,
+  globalRoles: identity.roles,
+  hasProjectMemberships: identity.roles.includes(Roles.TenantRole.SUPER_ADMIN) || identity.roles.includes(Roles.TenantRole.PROJECT_ADMIN) || await db.batchLoad(projectMembershipPresenceLoader, identity.id)
+});
+const createPersonPermissionTarget = async (db, person) => person === null ? null : await createTargetIdentityPermissionTarget(db, { id: person.identity_id, roles: person.roles });
+exports.createPersonPermissionTarget = createPersonPermissionTarget;
+exports.createTargetIdentityPermissionTarget = createTargetIdentityPermissionTarget;
+exports.targetIdentityLoader = targetIdentityLoader;
+//# sourceMappingURL=TargetIdentityPermission.cjs.map

package/dist/development/src/model/authorization/TargetIdentityPermission.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TargetIdentityPermission.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/TargetIdentityPermission.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { IdentityHasProjectMembershipsQuery, IdentityQuery, IdentityQueryResult } from '../queries/index.js'\nimport { TargetIdentityPermissionTarget } from './PermissionActions.js'\nimport { TenantRole } from './Roles.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\n\nconst projectMembershipPresenceLoader = batchLoader<string, ReadonlySet<string>, boolean>(\n\tasync (identityIds, db) => await db.queryHandler.fetch(new IdentityHasProjectMembershipsQuery(identityIds)),\n\t(identityId, identitiesWithMemberships) => identitiesWithMemberships.has(identityId),\n)\n\n/** Batches the identity lookup that precedes a target-identity permission check. */\nexport const targetIdentityLoader = batchLoader<string, Record<string, IdentityQueryResult>, IdentityQueryResult | undefined>(\n\tasync (identityIds, db) => {\n\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(identityIds))\n\t\treturn Object.fromEntries(identities.map(identity => [identity.id, identity]))\n\t},\n\t(identityId, identities) => identities[identityId],\n)\n\nexport const createTargetIdentityPermissionTarget = async (\n\tdb: DatabaseContext,\n\tidentity: { readonly id: string; readonly roles: readonly string[] },\n): Promise<TargetIdentityPermissionTarget> => ({\n\tid: identity.id,\n\tglobalRoles: identity.roles,\n\thasProjectMemberships: identity.roles.includes(TenantRole.SUPER_ADMIN)\n\t\t|| identity.roles.includes(TenantRole.PROJECT_ADMIN)\n\t\t|| await db.batchLoad(projectMembershipPresenceLoader, identity.id),\n})\n\n/** Convenience for the common case where the caller already holds the target's person row. */\nexport const createPersonPermissionTarget = async (\n\tdb: DatabaseContext,\n\tperson: { readonly identity_id: string; readonly roles: readonly string[] } | null,\n): Promise<TargetIdentityPermissionTarget | null> =>\n\tperson === null ? null : await createTargetIdentityPermissionTarget(db, { id: person.identity_id, roles: person.roles })\n"],"names":["batchLoader","IdentityHasProjectMembershipsQuery","IdentityQuery","TenantRole"],"mappings":";;;;;;;;;;;;;;AAMA,MAAM,kCAAkCA,WAAAA;AAAAA,EACvC,OAAO,aAAa,OAAO,MAAM,GAAG,aAAa,MAAM,IAAIC,sEAAmC,WAAW,CAAC;AAAA,EAC1G,CAAC,YAAY,8BAA8B,0BAA0B,IAAI,UAAU;AACpF;AAGO,MAAM,uBAAuBD,WAAAA;AAAAA,EACnC,OAAO,aAAa,OAAO;AAC1B,UAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAIE,cAAAA,cAAc,WAAW,CAAC;AAC7E,WAAO,OAAO,YAAY,WAAW,IAAI,CAAA,aAAY,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AAAA,EAC9E;AAAA,EACA,CAAC,YAAY,eAAe,WAAW,UAAU;AAClD;AAEO,MAAM,uCAAuC,OACnD,IACA,cAC8C;AAAA,EAC9C,IAAI,SAAS;AAAA,EACb,aAAa,SAAS;AAAA,EACtB,uBAAuB,SAAS,MAAM,SAASC,MAAAA,WAAW,WAAW,KACjE,SAAS,MAAM,SAASA,MAAAA,WAAW,aAAa,KAChD,MAAM,GAAG,UAAU,iCAAiC,SAAS,EAAE;AACpE;AAGO,MAAM,+BAA+B,OAC3C,IACA,WAEA,WAAW,OAAO,OAAO,MAAM,qCAAqC,IAAI,EAAE,IAAI,OAAO,aAAa,OAAO,OAAO,OAAO;;;;"}

package/dist/development/src/model/authorization/TargetIdentityPermission.js

@@ -0,0 +1,35 @@
+import "../queries/apiKey/ApiKeyQuery.js";
+import "@contember/database";
+import "../type/ApiKey.js";
+import { IdentityHasProjectMembershipsQuery } from "../queries/membership/IdentityHasProjectMembershipsQuery.js";
+import { IdentityQuery } from "../queries/identity/IdentityQuery.js";
+import "./PermissionActions.js";
+import "@contember/authorization";
+import { TenantRole } from "./Roles.js";
+import "./CustomRolePermissions.js";
+import "./PermissionContext.js";
+import "@contember/schema";
+import { batchLoader } from "../../utils/batchQuery.js";
+const projectMembershipPresenceLoader = batchLoader(
+  async (identityIds, db) => await db.queryHandler.fetch(new IdentityHasProjectMembershipsQuery(identityIds)),
+  (identityId, identitiesWithMemberships) => identitiesWithMemberships.has(identityId)
+);
+const targetIdentityLoader = batchLoader(
+  async (identityIds, db) => {
+    const identities = await db.queryHandler.fetch(new IdentityQuery(identityIds));
+    return Object.fromEntries(identities.map((identity) => [identity.id, identity]));
+  },
+  (identityId, identities) => identities[identityId]
+);
+const createTargetIdentityPermissionTarget = async (db, identity) => ({
+  id: identity.id,
+  globalRoles: identity.roles,
+  hasProjectMemberships: identity.roles.includes(TenantRole.SUPER_ADMIN) || identity.roles.includes(TenantRole.PROJECT_ADMIN) || await db.batchLoad(projectMembershipPresenceLoader, identity.id)
+});
+const createPersonPermissionTarget = async (db, person) => person === null ? null : await createTargetIdentityPermissionTarget(db, { id: person.identity_id, roles: person.roles });
+export {
+  createPersonPermissionTarget,
+  createTargetIdentityPermissionTarget,
+  targetIdentityLoader
+};
+//# sourceMappingURL=TargetIdentityPermission.js.map

package/dist/development/src/model/authorization/TargetIdentityPermission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TargetIdentityPermission.js","sources":["../../../../../../packages/engine-tenant-api/src/model/authorization/TargetIdentityPermission.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { IdentityHasProjectMembershipsQuery, IdentityQuery, IdentityQueryResult } from '../queries/index.js'\nimport { TargetIdentityPermissionTarget } from './PermissionActions.js'\nimport { TenantRole } from './Roles.js'\nimport { batchLoader } from '../../utils/batchQuery.js'\n\nconst projectMembershipPresenceLoader = batchLoader<string, ReadonlySet<string>, boolean>(\n\tasync (identityIds, db) => await db.queryHandler.fetch(new IdentityHasProjectMembershipsQuery(identityIds)),\n\t(identityId, identitiesWithMemberships) => identitiesWithMemberships.has(identityId),\n)\n\n/** Batches the identity lookup that precedes a target-identity permission check. */\nexport const targetIdentityLoader = batchLoader<string, Record<string, IdentityQueryResult>, IdentityQueryResult | undefined>(\n\tasync (identityIds, db) => {\n\t\tconst identities = await db.queryHandler.fetch(new IdentityQuery(identityIds))\n\t\treturn Object.fromEntries(identities.map(identity => [identity.id, identity]))\n\t},\n\t(identityId, identities) => identities[identityId],\n)\n\nexport const createTargetIdentityPermissionTarget = async (\n\tdb: DatabaseContext,\n\tidentity: { readonly id: string; readonly roles: readonly string[] },\n): Promise<TargetIdentityPermissionTarget> => ({\n\tid: identity.id,\n\tglobalRoles: identity.roles,\n\thasProjectMemberships: identity.roles.includes(TenantRole.SUPER_ADMIN)\n\t\t|| identity.roles.includes(TenantRole.PROJECT_ADMIN)\n\t\t|| await db.batchLoad(projectMembershipPresenceLoader, identity.id),\n})\n\n/** Convenience for the common case where the caller already holds the target's person row. */\nexport const createPersonPermissionTarget = async (\n\tdb: DatabaseContext,\n\tperson: { readonly identity_id: string; readonly roles: readonly string[] } | null,\n): Promise<TargetIdentityPermissionTarget | null> =>\n\tperson === null ? null : await createTargetIdentityPermissionTarget(db, { id: person.identity_id, roles: person.roles })\n"],"names":[],"mappings":";;;;;;;;;;;;AAMA,MAAM,kCAAkC;AAAA,EACvC,OAAO,aAAa,OAAO,MAAM,GAAG,aAAa,MAAM,IAAI,mCAAmC,WAAW,CAAC;AAAA,EAC1G,CAAC,YAAY,8BAA8B,0BAA0B,IAAI,UAAU;AACpF;AAGO,MAAM,uBAAuB;AAAA,EACnC,OAAO,aAAa,OAAO;AAC1B,UAAM,aAAa,MAAM,GAAG,aAAa,MAAM,IAAI,cAAc,WAAW,CAAC;AAC7E,WAAO,OAAO,YAAY,WAAW,IAAI,CAAA,aAAY,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;AAAA,EAC9E;AAAA,EACA,CAAC,YAAY,eAAe,WAAW,UAAU;AAClD;AAEO,MAAM,uCAAuC,OACnD,IACA,cAC8C;AAAA,EAC9C,IAAI,SAAS;AAAA,EACb,aAAa,SAAS;AAAA,EACtB,uBAAuB,SAAS,MAAM,SAAS,WAAW,WAAW,KACjE,SAAS,MAAM,SAAS,WAAW,aAAa,KAChD,MAAM,GAAG,UAAU,iCAAiC,SAAS,EAAE;AACpE;AAGO,MAAM,+BAA+B,OAC3C,IACA,WAEA,WAAW,OAAO,OAAO,MAAM,qCAAqC,IAAI,EAAE,IAAI,OAAO,aAAa,OAAO,OAAO,OAAO;"}

package/dist/development/src/model/commands/apiKey/ApiKeyHelper.cjs

@@ -2,8 +2,14 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const ApiKey = require("../../type/ApiKey.cjs");
 const time = require("../../utils/time.cjs");
+const Database = require("@contember/database");
 const DEFAULT_EXPIRATION = 30;
 class ApiKeyHelper {
+  /**
+   * App-clock expiry Date. Kept only for ProlongApiKeyCommand's significance
+   * throttle (a write-rate optimization, not an auth gate). The value actually
+   * stored / compared runs on the DB clock — see {@link getExpirationLiteral}.
+   */
   static getExpiration(providers, type, expiration) {
     switch (type) {
       case ApiKey.ApiKey.Type.PERMANENT:
@@ -14,6 +20,19 @@ class ApiKeyHelper {
         return null;
     }
   }
+  /** Lifetime of a session key in seconds (`expiration` minutes, default 30). */
+  static getSessionExpirationSeconds(expiration) {
+    return (expiration || DEFAULT_EXPIRATION) * 60;
+  }
+  /**
+   * DB-clock expiry expression for issuance: `now() + <lifetime>` evaluated on the
+   * database clock, so the expiry gate (ApiKeyByTokenQuery's `is_expired`) compares
+   * against the same clock and cannot be weakened by app/DB skew. NULL for
+   * non-session keys (they never expire). See engine-tenant-api/CLAUDE.md.
+   */
+  static getExpirationLiteral(type, expiration) {
+    return type === ApiKey.ApiKey.Type.SESSION ? new Database.Literal("now() + make_interval(secs => ?)", [ApiKeyHelper.getSessionExpirationSeconds(expiration)]) : null;
+  }
 }
 exports.ApiKeyHelper = ApiKeyHelper;
 //# sourceMappingURL=ApiKeyHelper.cjs.map

package/dist/development/src/model/commands/apiKey/ApiKeyHelper.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyHelper.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type/index.js'\nimport { Providers } from '../../providers.js'\nimport { plusMinutes } from '../../utils/time.js'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n}\n"],"names":["ApiKey","plusMinutes"],"mappings":";;;;AAIA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA,EACzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAOC,KAAAA,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAKD,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AACD;;"}
+{"version":3,"file":"ApiKeyHelper.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type/index.js'\nimport { Providers } from '../../providers.js'\nimport { plusMinutes } from '../../utils/time.js'\nimport { Literal } from '@contember/database'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\t/**\n\t * App-clock expiry Date. Kept only for ProlongApiKeyCommand's significance\n\t * throttle (a write-rate optimization, not an auth gate). The value actually\n\t * stored / compared runs on the DB clock — see {@link getExpirationLiteral}.\n\t */\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n\n\t/** Lifetime of a session key in seconds (`expiration` minutes, default 30). */\n\tpublic static getSessionExpirationSeconds(expiration?: number | null): number {\n\t\treturn (expiration || DEFAULT_EXPIRATION) * 60\n\t}\n\n\t/**\n\t * DB-clock expiry expression for issuance: `now() + <lifetime>` evaluated on the\n\t * database clock, so the expiry gate (ApiKeyByTokenQuery's `is_expired`) compares\n\t * against the same clock and cannot be weakened by app/DB skew. NULL for\n\t * non-session keys (they never expire). See engine-tenant-api/CLAUDE.md.\n\t */\n\tpublic static getExpirationLiteral(type: ApiKey.Type, expiration?: number | null): Literal | null {\n\t\treturn type === ApiKey.Type.SESSION\n\t\t\t? new Literal('now() + make_interval(secs => ?)', [ApiKeyHelper.getSessionExpirationSeconds(expiration)])\n\t\t\t: null\n\t}\n}\n"],"names":["ApiKey","plusMinutes","Literal"],"mappings":";;;;;AAKA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAKA,OAAAA,OAAO,KAAK;AAChB,eAAOC,KAAAA,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAKD,OAAAA,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AAAA;AAAA,EAGA,OAAc,4BAA4B,YAAoC;AAC7E,YAAQ,cAAc,sBAAsB;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAc,qBAAqB,MAAmB,YAA4C;AACjG,WAAO,SAASA,OAAAA,OAAO,KAAK,UACzB,IAAIE,SAAAA,QAAQ,oCAAoC,CAAC,aAAa,4BAA4B,UAAU,CAAC,CAAC,IACtG;AAAA,EACJ;AACD;;"}

package/dist/development/src/model/commands/apiKey/ApiKeyHelper.js

@@ -1,7 +1,13 @@
 import { ApiKey } from "../../type/ApiKey.js";
 import { plusMinutes } from "../../utils/time.js";
+import { Literal } from "@contember/database";
 const DEFAULT_EXPIRATION = 30;
 class ApiKeyHelper {
+  /**
+   * App-clock expiry Date. Kept only for ProlongApiKeyCommand's significance
+   * throttle (a write-rate optimization, not an auth gate). The value actually
+   * stored / compared runs on the DB clock — see {@link getExpirationLiteral}.
+   */
   static getExpiration(providers, type, expiration) {
     switch (type) {
       case ApiKey.Type.PERMANENT:
@@ -12,6 +18,19 @@ class ApiKeyHelper {
         return null;
     }
   }
+  /** Lifetime of a session key in seconds (`expiration` minutes, default 30). */
+  static getSessionExpirationSeconds(expiration) {
+    return (expiration || DEFAULT_EXPIRATION) * 60;
+  }
+  /**
+   * DB-clock expiry expression for issuance: `now() + <lifetime>` evaluated on the
+   * database clock, so the expiry gate (ApiKeyByTokenQuery's `is_expired`) compares
+   * against the same clock and cannot be weakened by app/DB skew. NULL for
+   * non-session keys (they never expire). See engine-tenant-api/CLAUDE.md.
+   */
+  static getExpirationLiteral(type, expiration) {
+    return type === ApiKey.Type.SESSION ? new Literal("now() + make_interval(secs => ?)", [ApiKeyHelper.getSessionExpirationSeconds(expiration)]) : null;
+  }
 }
 export {
   ApiKeyHelper

package/dist/development/src/model/commands/apiKey/ApiKeyHelper.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyHelper.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type/index.js'\nimport { Providers } from '../../providers.js'\nimport { plusMinutes } from '../../utils/time.js'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAIA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA,EACzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAK,OAAO,KAAK;AAChB,eAAO,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AACD;"}
+{"version":3,"file":"ApiKeyHelper.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ApiKeyHelper.ts"],"sourcesContent":["import { ApiKey } from '../../type/index.js'\nimport { Providers } from '../../providers.js'\nimport { plusMinutes } from '../../utils/time.js'\nimport { Literal } from '@contember/database'\n\nconst DEFAULT_EXPIRATION = 30\nexport class ApiKeyHelper {\n\t/**\n\t * App-clock expiry Date. Kept only for ProlongApiKeyCommand's significance\n\t * throttle (a write-rate optimization, not an auth gate). The value actually\n\t * stored / compared runs on the DB clock — see {@link getExpirationLiteral}.\n\t */\n\tpublic static getExpiration(providers: Providers, type: ApiKey.Type, expiration?: number | null): Date | null {\n\t\tswitch (type) {\n\t\t\tcase ApiKey.Type.PERMANENT:\n\t\t\t\treturn null\n\n\t\t\tcase ApiKey.Type.SESSION:\n\t\t\t\treturn plusMinutes(providers.now(), expiration || DEFAULT_EXPIRATION)\n\n\t\t\tcase ApiKey.Type.ONE_OFF:\n\t\t\t\treturn null\n\t\t}\n\t}\n\n\t/** Lifetime of a session key in seconds (`expiration` minutes, default 30). */\n\tpublic static getSessionExpirationSeconds(expiration?: number | null): number {\n\t\treturn (expiration || DEFAULT_EXPIRATION) * 60\n\t}\n\n\t/**\n\t * DB-clock expiry expression for issuance: `now() + <lifetime>` evaluated on the\n\t * database clock, so the expiry gate (ApiKeyByTokenQuery's `is_expired`) compares\n\t * against the same clock and cannot be weakened by app/DB skew. NULL for\n\t * non-session keys (they never expire). See engine-tenant-api/CLAUDE.md.\n\t */\n\tpublic static getExpirationLiteral(type: ApiKey.Type, expiration?: number | null): Literal | null {\n\t\treturn type === ApiKey.Type.SESSION\n\t\t\t? new Literal('now() + make_interval(secs => ?)', [ApiKeyHelper.getSessionExpirationSeconds(expiration)])\n\t\t\t: null\n\t}\n}\n"],"names":[],"mappings":";;;AAKA,MAAM,qBAAqB;AACpB,MAAM,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzB,OAAc,cAAc,WAAsB,MAAmB,YAAyC;AAC7G,YAAQ,MAAA;AAAA,MACP,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,MAER,KAAK,OAAO,KAAK;AAChB,eAAO,YAAY,UAAU,IAAA,GAAO,cAAc,kBAAkB;AAAA,MAErE,KAAK,OAAO,KAAK;AAChB,eAAO;AAAA,IAAA;AAAA,EAEV;AAAA;AAAA,EAGA,OAAc,4BAA4B,YAAoC;AAC7E,YAAQ,cAAc,sBAAsB;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAc,qBAAqB,MAAmB,YAA4C;AACjG,WAAO,SAAS,OAAO,KAAK,UACzB,IAAI,QAAQ,oCAAoC,CAAC,aAAa,4BAA4B,UAAU,CAAC,CAAC,IACtG;AAAA,EACJ;AACD;"}

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.cjs

@@ -19,8 +19,9 @@ class CreateApiKeyCommand {
     const args = this.args;
     const sessionPolicy = args.type === ApiKey.ApiKey.Type.SESSION ? {
       issued_at: providers.now(),
+      // display/ordering only, never compared
       idle_timeout: args.idleTimeout ?? null,
-      max_expires_at: args.maxExpiresAt ?? null
+      max_expires_at: args.maxExpirationSeconds != null ? new Database.Literal("now() + make_interval(secs => ?)", [args.maxExpirationSeconds]) : null
     } : { issued_at: null, idle_timeout: null, max_expires_at: null };
     await Database.InsertBuilder.create().into("api_key").values({
       id: apiKeyId,
@@ -28,7 +29,8 @@ class CreateApiKeyCommand {
       type: this.args.type,
       identity_id: this.args.identityId,
       disabled_at: null,
-      expires_at: ApiKeyHelper.ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),
+      // expires_at on the DB clock so the verify gate compares like-for-like.
+      expires_at: ApiKeyHelper.ApiKeyHelper.getExpirationLiteral(this.args.type, this.args.expiration),
       expiration: this.args.expiration || null,
       created_at: providers.now(),
       created_ip: this.args.requestInfo?.ip || null,

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from './ProlongApiKeyCommand.js'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n\t/**\n\t * A19 session-policy snapshot, fixed at sign-in. NULLs preserve today's\n\t * behavior (no idle timeout, no absolute cap on the sliding window).\n\t * `idleTimeout` is a Postgres interval literal (e.g. `'15 minutes'`).\n\t */\n\tidleTimeout?: string | null\n\tmaxExpiresAt?: Date | null\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\t// Session-policy snapshot (A19). Only session keys carry it; permanent/one-off\n\t\t// keys have no session policy → NULL (preserving today's behavior).\n\t\tconst args = this.args\n\t\tconst sessionPolicy = args.type === ApiKey.Type.SESSION\n\t\t\t? {\n\t\t\t\tissued_at: providers.now(),\n\t\t\t\tidle_timeout: args.idleTimeout ?? null,\n\t\t\t\tmax_expires_at: args.maxExpiresAt ?? null,\n\t\t\t}\n\t\t\t: { issued_at: null, idle_timeout: null, max_expires_at: null }\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tcreated_ip: this.args.requestInfo?.ip || null,\n\t\t\t\tcreated_user_agent: this.args.requestInfo?.userAgent || null,\n\t\t\t\ttrust_forwarded_info: this.args.trustForwardedInfo ?? false,\n\t\t\t\tissued_at: sessionPolicy.issued_at,\n\t\t\t\tidle_timeout: sessionPolicy.idle_timeout,\n\t\t\t\tmax_expires_at: sessionPolicy.max_expires_at,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["token","generateToken","computeTokenHash","ApiKey","InsertBuilder","ApiKeyHelper"],"mappings":";;;;;;AAoCO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAIA;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACfA,gBAAQ,MAAMC,MAAAA,cAAc,SAAS;AACrC,kBAAYC,MAAAA,iBAAiBF,OAAK;AAAA,IACnC;AAIA,UAAM,OAAO,KAAK;AAClB,UAAM,gBAAgB,KAAK,SAASG,OAAAA,OAAO,KAAK,UAC7C;AAAA,MACD,WAAW,UAAU,IAAA;AAAA,MACrB,cAAc,KAAK,eAAe;AAAA,MAClC,gBAAgB,KAAK,gBAAgB;AAAA,IAAA,IAEpC,EAAE,WAAW,MAAM,cAAc,MAAM,gBAAgB,KAAA;AAC1D,UAAMC,SAAAA,cAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAYC,aAAAA,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,KAAK,KAAK,aAAa,MAAM;AAAA,MACzC,oBAAoB,KAAK,KAAK,aAAa,aAAa;AAAA,MACxD,sBAAsB,KAAK,KAAK,sBAAsB;AAAA,MACtD,WAAW,cAAc;AAAA,MACzB,cAAc,cAAc;AAAA,MAC5B,gBAAgB,cAAc;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAUL,OAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4BA,QAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAAA;AAAA,EACxD;AACD;;;"}
+{"version":3,"file":"CreateApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from './ProlongApiKeyCommand.js'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n\t/**\n\t * A19 session-policy snapshot, fixed at sign-in. NULLs preserve today's\n\t * behavior (no idle timeout, no absolute cap on the sliding window).\n\t * `idleTimeout` is a Postgres interval literal (e.g. `'15 minutes'`).\n\t */\n\tidleTimeout?: string | null\n\t/**\n\t * Absolute lifetime cap in seconds (A19). Written as `now() + interval` on the DB\n\t * clock so the cap is compared against the same clock. NULL = uncapped.\n\t */\n\tmaxExpirationSeconds?: number | null\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\t// Session-policy snapshot (A19). Only session keys carry it; permanent/one-off\n\t\t// keys have no session policy → NULL (preserving today's behavior).\n\t\tconst args = this.args\n\t\tconst sessionPolicy = args.type === ApiKey.Type.SESSION\n\t\t\t? {\n\t\t\t\tissued_at: providers.now(), // display/ordering only, never compared\n\t\t\t\tidle_timeout: args.idleTimeout ?? null,\n\t\t\t\tmax_expires_at: args.maxExpirationSeconds != null\n\t\t\t\t\t? new Literal('now() + make_interval(secs => ?)', [args.maxExpirationSeconds])\n\t\t\t\t\t: null,\n\t\t\t}\n\t\t\t: { issued_at: null, idle_timeout: null, max_expires_at: null }\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\t// expires_at on the DB clock so the verify gate compares like-for-like.\n\t\t\t\texpires_at: ApiKeyHelper.getExpirationLiteral(this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tcreated_ip: this.args.requestInfo?.ip || null,\n\t\t\t\tcreated_user_agent: this.args.requestInfo?.userAgent || null,\n\t\t\t\ttrust_forwarded_info: this.args.trustForwardedInfo ?? false,\n\t\t\t\tissued_at: sessionPolicy.issued_at,\n\t\t\t\tidle_timeout: sessionPolicy.idle_timeout,\n\t\t\t\tmax_expires_at: sessionPolicy.max_expires_at,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["token","generateToken","computeTokenHash","ApiKey","Literal","InsertBuilder","ApiKeyHelper"],"mappings":";;;;;;AAwCO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAIA;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACfA,gBAAQ,MAAMC,MAAAA,cAAc,SAAS;AACrC,kBAAYC,MAAAA,iBAAiBF,OAAK;AAAA,IACnC;AAIA,UAAM,OAAO,KAAK;AAClB,UAAM,gBAAgB,KAAK,SAASG,OAAAA,OAAO,KAAK,UAC7C;AAAA,MACD,WAAW,UAAU,IAAA;AAAA;AAAA,MACrB,cAAc,KAAK,eAAe;AAAA,MAClC,gBAAgB,KAAK,wBAAwB,OAC1C,IAAIC,iBAAQ,oCAAoC,CAAC,KAAK,oBAAoB,CAAC,IAC3E;AAAA,IAAA,IAEF,EAAE,WAAW,MAAM,cAAc,MAAM,gBAAgB,KAAA;AAC1D,UAAMC,SAAAA,cAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA;AAAA,MAEb,YAAYC,aAAAA,aAAa,qBAAqB,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MAClF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,KAAK,KAAK,aAAa,MAAM;AAAA,MACzC,oBAAoB,KAAK,KAAK,aAAa,aAAa;AAAA,MACxD,sBAAsB,KAAK,KAAK,sBAAsB;AAAA,MACtD,WAAW,cAAc;AAAA,MACzB,cAAc,cAAc;AAAA,MAC5B,gBAAgB,cAAc;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAUN,OAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4BA,QAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAAA;AAAA,EACxD;AACD;;;"}

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.js

@@ -1,6 +1,6 @@
 import { ApiKey } from "../../type/ApiKey.js";
 import { ApiKeyHelper } from "./ApiKeyHelper.js";
-import { InsertBuilder as InsertBuilder$1 } from "@contember/database";
+import { Literal, InsertBuilder as InsertBuilder$1 } from "@contember/database";
 import { generateToken, computeTokenHash } from "../../utils/token.js";
 class CreateApiKeyCommand {
   constructor(args) {
@@ -17,8 +17,9 @@ class CreateApiKeyCommand {
     const args = this.args;
     const sessionPolicy = args.type === ApiKey.Type.SESSION ? {
       issued_at: providers.now(),
+      // display/ordering only, never compared
       idle_timeout: args.idleTimeout ?? null,
-      max_expires_at: args.maxExpiresAt ?? null
+      max_expires_at: args.maxExpirationSeconds != null ? new Literal("now() + make_interval(secs => ?)", [args.maxExpirationSeconds]) : null
     } : { issued_at: null, idle_timeout: null, max_expires_at: null };
     await InsertBuilder$1.create().into("api_key").values({
       id: apiKeyId,
@@ -26,7 +27,8 @@ class CreateApiKeyCommand {
       type: this.args.type,
       identity_id: this.args.identityId,
       disabled_at: null,
-      expires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),
+      // expires_at on the DB clock so the verify gate compares like-for-like.
+      expires_at: ApiKeyHelper.getExpirationLiteral(this.args.type, this.args.expiration),
       expiration: this.args.expiration || null,
       created_at: providers.now(),
       created_ip: this.args.requestInfo?.ip || null,

package/dist/development/src/model/commands/apiKey/CreateApiKeyCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { InsertBuilder } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from './ProlongApiKeyCommand.js'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n\t/**\n\t * A19 session-policy snapshot, fixed at sign-in. NULLs preserve today's\n\t * behavior (no idle timeout, no absolute cap on the sliding window).\n\t * `idleTimeout` is a Postgres interval literal (e.g. `'15 minutes'`).\n\t */\n\tidleTimeout?: string | null\n\tmaxExpiresAt?: Date | null\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\t// Session-policy snapshot (A19). Only session keys carry it; permanent/one-off\n\t\t// keys have no session policy → NULL (preserving today's behavior).\n\t\tconst args = this.args\n\t\tconst sessionPolicy = args.type === ApiKey.Type.SESSION\n\t\t\t? {\n\t\t\t\tissued_at: providers.now(),\n\t\t\t\tidle_timeout: args.idleTimeout ?? null,\n\t\t\t\tmax_expires_at: args.maxExpiresAt ?? null,\n\t\t\t}\n\t\t\t: { issued_at: null, idle_timeout: null, max_expires_at: null }\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\texpires_at: ApiKeyHelper.getExpiration(providers, this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tcreated_ip: this.args.requestInfo?.ip || null,\n\t\t\t\tcreated_user_agent: this.args.requestInfo?.userAgent || null,\n\t\t\t\ttrust_forwarded_info: this.args.trustForwardedInfo ?? false,\n\t\t\t\tissued_at: sessionPolicy.issued_at,\n\t\t\t\tidle_timeout: sessionPolicy.idle_timeout,\n\t\t\t\tmax_expires_at: sessionPolicy.max_expires_at,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;;AAoCO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAI;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACf,cAAQ,MAAM,cAAc,SAAS;AACrC,kBAAY,iBAAiB,KAAK;AAAA,IACnC;AAIA,UAAM,OAAO,KAAK;AAClB,UAAM,gBAAgB,KAAK,SAAS,OAAO,KAAK,UAC7C;AAAA,MACD,WAAW,UAAU,IAAA;AAAA,MACrB,cAAc,KAAK,eAAe;AAAA,MAClC,gBAAgB,KAAK,gBAAgB;AAAA,IAAA,IAEpC,EAAE,WAAW,MAAM,cAAc,MAAM,gBAAgB,KAAA;AAC1D,UAAMA,gBAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA,MACb,YAAY,aAAa,cAAc,WAAW,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MACtF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,KAAK,KAAK,aAAa,MAAM;AAAA,MACzC,oBAAoB,KAAK,KAAK,aAAa,aAAa;AAAA,MACxD,sBAAsB,KAAK,KAAK,sBAAsB;AAAA,MACtD,WAAW,cAAc;AAAA,MACzB,cAAc,cAAc;AAAA,MAC5B,gBAAgB,cAAc;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAU,KAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4B,OAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAA;AAAA,EACxD;AACD;"}
+{"version":3,"file":"CreateApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/CreateApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { InsertBuilder, Literal } from '@contember/database'\nimport { computeTokenHash, generateToken, TokenHash } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from './ProlongApiKeyCommand.js'\n\ninterface CreateSessionApiKeyArgs {\n\ttype: ApiKey.Type.SESSION\n\tidentityId: string\n\texpiration?: number\n\ttokenHash?: string\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n\t/**\n\t * A19 session-policy snapshot, fixed at sign-in. NULLs preserve today's\n\t * behavior (no idle timeout, no absolute cap on the sliding window).\n\t * `idleTimeout` is a Postgres interval literal (e.g. `'15 minutes'`).\n\t */\n\tidleTimeout?: string | null\n\t/**\n\t * Absolute lifetime cap in seconds (A19). Written as `now() + interval` on the DB\n\t * clock so the cap is compared against the same clock. NULL = uncapped.\n\t */\n\tmaxExpirationSeconds?: number | null\n}\n\ninterface CreatePermanentApiKeyArgs {\n\ttype: ApiKey.Type.PERMANENT\n\tidentityId: string\n\ttokenHash?: TokenHash\n\texpiration?: undefined\n\trequestInfo?: ApiKeyRequestInfo\n\ttrustForwardedInfo?: boolean\n}\n\nexport type CreateApiKeyArgs =\n\t| CreateSessionApiKeyArgs\n\t| CreatePermanentApiKeyArgs\n\nexport class CreateApiKeyCommand implements Command<CreateApiKeyCommandResult> {\n\tconstructor(private args: CreateApiKeyArgs) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<CreateApiKeyCommandResult> {\n\t\tconst apiKeyId = providers.uuid()\n\t\tlet token\n\t\tlet tokenHash = this.args.tokenHash\n\t\tif (!tokenHash) {\n\t\t\ttoken = await generateToken(providers)\n\t\t\ttokenHash = computeTokenHash(token)\n\t\t}\n\n\t\t// Session-policy snapshot (A19). Only session keys carry it; permanent/one-off\n\t\t// keys have no session policy → NULL (preserving today's behavior).\n\t\tconst args = this.args\n\t\tconst sessionPolicy = args.type === ApiKey.Type.SESSION\n\t\t\t? {\n\t\t\t\tissued_at: providers.now(), // display/ordering only, never compared\n\t\t\t\tidle_timeout: args.idleTimeout ?? null,\n\t\t\t\tmax_expires_at: args.maxExpirationSeconds != null\n\t\t\t\t\t? new Literal('now() + make_interval(secs => ?)', [args.maxExpirationSeconds])\n\t\t\t\t\t: null,\n\t\t\t}\n\t\t\t: { issued_at: null, idle_timeout: null, max_expires_at: null }\n\t\tawait InsertBuilder.create()\n\t\t\t.into('api_key')\n\t\t\t.values({\n\t\t\t\tid: apiKeyId,\n\t\t\t\ttoken_hash: tokenHash,\n\t\t\t\ttype: this.args.type,\n\t\t\t\tidentity_id: this.args.identityId,\n\t\t\t\tdisabled_at: null,\n\t\t\t\t// expires_at on the DB clock so the verify gate compares like-for-like.\n\t\t\t\texpires_at: ApiKeyHelper.getExpirationLiteral(this.args.type, this.args.expiration),\n\t\t\t\texpiration: this.args.expiration || null,\n\t\t\t\tcreated_at: providers.now(),\n\t\t\t\tcreated_ip: this.args.requestInfo?.ip || null,\n\t\t\t\tcreated_user_agent: this.args.requestInfo?.userAgent || null,\n\t\t\t\ttrust_forwarded_info: this.args.trustForwardedInfo ?? false,\n\t\t\t\tissued_at: sessionPolicy.issued_at,\n\t\t\t\tidle_timeout: sessionPolicy.idle_timeout,\n\t\t\t\tmax_expires_at: sessionPolicy.max_expires_at,\n\t\t\t})\n\t\t\t.execute(db)\n\n\t\treturn new CreateApiKeyCommandResult(apiKeyId, token)\n\t}\n}\n\nexport class CreateApiKeyCommandResult {\n\tconstructor(public readonly id: string, public readonly token?: string) {\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;;AAwCO,MAAM,oBAAkE;AAAA,EAC9E,YAAoB,MAAwB;AAAxB,SAAA,OAAA;AAAA,EAAyB;AAAA,EAE7C,MAAM,QAAQ,EAAE,IAAI,aAA+D;AAClF,UAAM,WAAW,UAAU,KAAA;AAC3B,QAAI;AACJ,QAAI,YAAY,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW;AACf,cAAQ,MAAM,cAAc,SAAS;AACrC,kBAAY,iBAAiB,KAAK;AAAA,IACnC;AAIA,UAAM,OAAO,KAAK;AAClB,UAAM,gBAAgB,KAAK,SAAS,OAAO,KAAK,UAC7C;AAAA,MACD,WAAW,UAAU,IAAA;AAAA;AAAA,MACrB,cAAc,KAAK,eAAe;AAAA,MAClC,gBAAgB,KAAK,wBAAwB,OAC1C,IAAI,QAAQ,oCAAoC,CAAC,KAAK,oBAAoB,CAAC,IAC3E;AAAA,IAAA,IAEF,EAAE,WAAW,MAAM,cAAc,MAAM,gBAAgB,KAAA;AAC1D,UAAMA,gBAAc,OAAA,EAClB,KAAK,SAAS,EACd,OAAO;AAAA,MACP,IAAI;AAAA,MACJ,YAAY;AAAA,MACZ,MAAM,KAAK,KAAK;AAAA,MAChB,aAAa,KAAK,KAAK;AAAA,MACvB,aAAa;AAAA;AAAA,MAEb,YAAY,aAAa,qBAAqB,KAAK,KAAK,MAAM,KAAK,KAAK,UAAU;AAAA,MAClF,YAAY,KAAK,KAAK,cAAc;AAAA,MACpC,YAAY,UAAU,IAAA;AAAA,MACtB,YAAY,KAAK,KAAK,aAAa,MAAM;AAAA,MACzC,oBAAoB,KAAK,KAAK,aAAa,aAAa;AAAA,MACxD,sBAAsB,KAAK,KAAK,sBAAsB;AAAA,MACtD,WAAW,cAAc;AAAA,MACzB,cAAc,cAAc;AAAA,MAC5B,gBAAgB,cAAc;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAEZ,WAAO,IAAI,0BAA0B,UAAU,KAAK;AAAA,EACrD;AACD;AAEO,MAAM,0BAA0B;AAAA,EACtC,YAA4B,IAA4B,OAAgB;AAA5C,SAAA,KAAA;AAA4B,SAAA,QAAA;AAAA,EACxD;AACD;"}

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.cjs

@@ -28,34 +28,33 @@ class ProlongApiKeyCommand {
     }
     const requestIp = this.requestInfo?.ip || null;
     const requestUserAgent = this.requestInfo?.userAgent || null;
-    const updateTracking = this.shouldUpdateTracking(now, requestIp, requestUserAgent);
+    const updateTracking = this.shouldUpdateTracking(now);
     if (!updateExpiration && !updateTracking) {
       return;
     }
     const values = {};
     if (updateExpiration && newExpiration !== null) {
-      values.expires_at = newExpiration;
+      values.expires_at = new Database.Literal('LEAST(now() + make_interval(secs => ?), "max_expires_at")', [
+        ApiKeyHelper.ApiKeyHelper.getSessionExpirationSeconds(this.expiration)
+      ]);
     }
     if (updateTracking) {
       values.last_ip = requestIp;
       values.last_user_agent = requestUserAgent;
-      values.last_used_at = now;
+      values.last_used_at = new Database.Literal("now()");
     }
     const qb = Database.UpdateBuilder.create().table("api_key").where({ id: this.id }).values(values);
     await qb.execute(db);
   }
-  shouldUpdateTracking(now, requestIp, requestUserAgent) {
+  shouldUpdateTracking(now) {
     if (!this.requestInfo) {
       return false;
     }
-    const last = this.tracking;
-    if (!last || last.lastUsedAt === null) {
+    const lastUsedAt = this.tracking?.lastUsedAt;
+    if (!lastUsedAt) {
       return true;
     }
-    if (requestIp !== last.lastIp || requestUserAgent !== last.lastUserAgent) {
-      return true;
-    }
-    return now.getTime() - last.lastUsedAt.getTime() >= PROLONG_THROTTLE_MS;
+    return now.getTime() - lastUsedAt.getTime() >= PROLONG_THROTTLE_MS;
   }
 }
 exports.PROLONG_THROTTLE_MS = PROLONG_THROTTLE_MS;

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProlongApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { QueryBuilder, UpdateBuilder } from '@contember/database'\n\n/**\n * Tracking writes (`last_used_at`) are throttled to at most once per this window, so\n * an idle check must add this slack to avoid prematurely expiring an active session\n * whose `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).\n */\nexport const PROLONG_THROTTLE_MS = 60_000\n\nexport interface ApiKeyRequestInfo {\n\tip?: string\n\tuserAgent?: string\n}\n\nexport interface ApiKeyTrackingState {\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tlastUsedAt: Date | null\n}\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t\tprivate readonly requestInfo?: ApiKeyRequestInfo,\n\t\tprivate readonly tracking?: ApiKeyTrackingState,\n\t\tprivate readonly maxExpiresAt?: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tlet newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\t// A19: clamp the sliding window at the absolute cap snapshotted at sign-in.\n\t\t// NULL maxExpiresAt = today's uncapped sliding window.\n\t\tif (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {\n\t\t\tnewExpiration = this.maxExpiresAt\n\t\t}\n\t\tconst now = providers.now()\n\n\t\tlet updateExpiration = newExpiration !== null\n\t\tif (updateExpiration && this.currentExpiration && newExpiration !== null) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\tupdateExpiration = false\n\t\t\t}\n\t\t}\n\n\t\tconst requestIp = this.requestInfo?.ip || null\n\t\tconst requestUserAgent = this.requestInfo?.userAgent || null\n\t\tconst updateTracking = this.shouldUpdateTracking(now, requestIp, requestUserAgent)\n\n\t\tif (!updateExpiration && !updateTracking) {\n\t\t\treturn\n\t\t}\n\n\t\tconst values: QueryBuilder.Values = {}\n\t\tif (updateExpiration && newExpiration !== null) {\n\t\t\tvalues.expires_at = newExpiration\n\t\t}\n\t\tif (updateTracking) {\n\t\t\tvalues.last_ip = requestIp\n\t\t\tvalues.last_user_agent = requestUserAgent\n\t\t\tvalues.last_used_at = now\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values(values)\n\t\tawait qb.execute(db)\n\t}\n\n\tprivate shouldUpdateTracking(now: Date, requestIp: string | null, requestUserAgent: string | null): boolean {\n\t\tif (!this.requestInfo) {\n\t\t\treturn false\n\t\t}\n\t\tconst last = this.tracking\n\t\tif (!last || last.lastUsedAt === null) {\n\t\t\treturn true\n\t\t}\n\t\tif (requestIp !== last.lastIp || requestUserAgent !== last.lastUserAgent) {\n\t\t\treturn true\n\t\t}\n\t\treturn now.getTime() - last.lastUsedAt.getTime() >= PROLONG_THROTTLE_MS\n\t}\n}\n"],"names":["ApiKeyHelper","UpdateBuilder"],"mappings":";;;;AAUO,MAAM,sBAAsB;AAa5B,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBACA,aACA,UACA,cAChB;AAPgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,cAAA;AACA,SAAA,WAAA;AACA,SAAA,eAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,QAAI,gBAAgBA,aAAAA,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AAGpF,QAAI,kBAAkB,QAAQ,KAAK,gBAAgB,cAAc,YAAY,KAAK,aAAa,WAAW;AACzG,sBAAgB,KAAK;AAAA,IACtB;AACA,UAAM,MAAM,UAAU,IAAA;AAEtB,QAAI,mBAAmB,kBAAkB;AACzC,QAAI,oBAAoB,KAAK,qBAAqB,kBAAkB,MAAM;AACzE,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD,2BAAmB;AAAA,MACpB;AAAA,IACD;AAEA,UAAM,YAAY,KAAK,aAAa,MAAM;AAC1C,UAAM,mBAAmB,KAAK,aAAa,aAAa;AACxD,UAAM,iBAAiB,KAAK,qBAAqB,KAAK,WAAW,gBAAgB;AAEjF,QAAI,CAAC,oBAAoB,CAAC,gBAAgB;AACzC;AAAA,IACD;AAEA,UAAM,SAA8B,CAAA;AACpC,QAAI,oBAAoB,kBAAkB,MAAM;AAC/C,aAAO,aAAa;AAAA,IACrB;AACA,QAAI,gBAAgB;AACnB,aAAO,UAAU;AACjB,aAAO,kBAAkB;AACzB,aAAO,eAAe;AAAA,IACvB;AAEA,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO,MAAM;AACf,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AAAA,EAEQ,qBAAqB,KAAW,WAA0B,kBAA0C;AAC3G,QAAI,CAAC,KAAK,aAAa;AACtB,aAAO;AAAA,IACR;AACA,UAAM,OAAO,KAAK;AAClB,QAAI,CAAC,QAAQ,KAAK,eAAe,MAAM;AACtC,aAAO;AAAA,IACR;AACA,QAAI,cAAc,KAAK,UAAU,qBAAqB,KAAK,eAAe;AACzE,aAAO;AAAA,IACR;AACA,WAAO,IAAI,QAAA,IAAY,KAAK,WAAW,aAAa;AAAA,EACrD;AACD;;;"}
+{"version":3,"file":"ProlongApiKeyCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { Literal, QueryBuilder, UpdateBuilder } from '@contember/database'\n\n/**\n * Tracking writes (`last_ip`, `last_user_agent`, `last_used_at`) are throttled to at most once per\n * this window, even when the IP or User-Agent changes: a key shared by several service replicas\n * alternates between their addresses, and writing every change makes its row a lock hotspot.\n * An idle check must add this slack to avoid prematurely expiring an active session whose\n * `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).\n */\nexport const PROLONG_THROTTLE_MS = 60_000\n\nexport interface ApiKeyRequestInfo {\n\tip?: string\n\tuserAgent?: string\n}\n\nexport interface ApiKeyTrackingState {\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tlastUsedAt: Date | null\n}\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t\tprivate readonly requestInfo?: ApiKeyRequestInfo,\n\t\tprivate readonly tracking?: ApiKeyTrackingState,\n\t\tprivate readonly maxExpiresAt?: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tlet newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\t// A19: clamp the sliding window at the absolute cap snapshotted at sign-in.\n\t\t// NULL maxExpiresAt = today's uncapped sliding window.\n\t\tif (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {\n\t\t\tnewExpiration = this.maxExpiresAt\n\t\t}\n\t\tconst now = providers.now()\n\n\t\tlet updateExpiration = newExpiration !== null\n\t\tif (updateExpiration && this.currentExpiration && newExpiration !== null) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\tupdateExpiration = false\n\t\t\t}\n\t\t}\n\n\t\tconst requestIp = this.requestInfo?.ip || null\n\t\tconst requestUserAgent = this.requestInfo?.userAgent || null\n\t\tconst updateTracking = this.shouldUpdateTracking(now)\n\n\t\tif (!updateExpiration && !updateTracking) {\n\t\t\treturn\n\t\t}\n\n\t\tconst values: QueryBuilder.Values = {}\n\t\tif (updateExpiration && newExpiration !== null) {\n\t\t\t// Write the sliding expiry on the DB clock and clamp to the stored\n\t\t\t// max_expires_at in SQL (LEAST ignores a NULL cap → uncapped window). The JS\n\t\t\t// throttle above only decides *whether* to write; the expiry gate itself is\n\t\t\t// computed on the DB clock. See engine-tenant-api/CLAUDE.md.\n\t\t\tvalues.expires_at = new Literal('LEAST(now() + make_interval(secs => ?), \"max_expires_at\")', [\n\t\t\t\tApiKeyHelper.getSessionExpirationSeconds(this.expiration),\n\t\t\t])\n\t\t}\n\t\tif (updateTracking) {\n\t\t\tvalues.last_ip = requestIp\n\t\t\tvalues.last_user_agent = requestUserAgent\n\t\t\t// last_used_at on the DB clock: it's compared against now() in the idle gate\n\t\t\t// (ApiKeyByTokenQuery's is_idle_expired), so it must be written on the same\n\t\t\t// clock. The app-clock `now` above only drives the write-rate throttle. See CLAUDE.md.\n\t\t\tvalues.last_used_at = new Literal('now()')\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values(values)\n\t\tawait qb.execute(db)\n\t}\n\n\tprivate shouldUpdateTracking(now: Date): boolean {\n\t\tif (!this.requestInfo) {\n\t\t\treturn false\n\t\t}\n\t\tconst lastUsedAt = this.tracking?.lastUsedAt\n\t\tif (!lastUsedAt) {\n\t\t\treturn true\n\t\t}\n\t\treturn now.getTime() - lastUsedAt.getTime() >= PROLONG_THROTTLE_MS\n\t}\n}\n"],"names":["ApiKeyHelper","Literal","UpdateBuilder"],"mappings":";;;;AAYO,MAAM,sBAAsB;AAa5B,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBACA,aACA,UACA,cAChB;AAPgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,cAAA;AACA,SAAA,WAAA;AACA,SAAA,eAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,QAAI,gBAAgBA,aAAAA,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AAGpF,QAAI,kBAAkB,QAAQ,KAAK,gBAAgB,cAAc,YAAY,KAAK,aAAa,WAAW;AACzG,sBAAgB,KAAK;AAAA,IACtB;AACA,UAAM,MAAM,UAAU,IAAA;AAEtB,QAAI,mBAAmB,kBAAkB;AACzC,QAAI,oBAAoB,KAAK,qBAAqB,kBAAkB,MAAM;AACzE,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD,2BAAmB;AAAA,MACpB;AAAA,IACD;AAEA,UAAM,YAAY,KAAK,aAAa,MAAM;AAC1C,UAAM,mBAAmB,KAAK,aAAa,aAAa;AACxD,UAAM,iBAAiB,KAAK,qBAAqB,GAAG;AAEpD,QAAI,CAAC,oBAAoB,CAAC,gBAAgB;AACzC;AAAA,IACD;AAEA,UAAM,SAA8B,CAAA;AACpC,QAAI,oBAAoB,kBAAkB,MAAM;AAK/C,aAAO,aAAa,IAAIC,SAAAA,QAAQ,6DAA6D;AAAA,QAC5FD,0BAAa,4BAA4B,KAAK,UAAU;AAAA,MAAA,CACxD;AAAA,IACF;AACA,QAAI,gBAAgB;AACnB,aAAO,UAAU;AACjB,aAAO,kBAAkB;AAIzB,aAAO,eAAe,IAAIC,SAAAA,QAAQ,OAAO;AAAA,IAC1C;AAEA,UAAM,KAAKC,SAAAA,cAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO,MAAM;AACf,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AAAA,EAEQ,qBAAqB,KAAoB;AAChD,QAAI,CAAC,KAAK,aAAa;AACtB,aAAO;AAAA,IACR;AACA,UAAM,aAAa,KAAK,UAAU;AAClC,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,IAAI,QAAA,IAAY,WAAW,aAAa;AAAA,EAChD;AACD;;;"}

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.js

@@ -1,5 +1,5 @@
 import { ApiKeyHelper } from "./ApiKeyHelper.js";
-import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+import { Literal, UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
 const PROLONG_THROTTLE_MS = 6e4;
 class ProlongApiKeyCommand {
   constructor(id, type, expiration, currentExpiration, requestInfo, tracking, maxExpiresAt) {
@@ -26,34 +26,33 @@ class ProlongApiKeyCommand {
     }
     const requestIp = this.requestInfo?.ip || null;
     const requestUserAgent = this.requestInfo?.userAgent || null;
-    const updateTracking = this.shouldUpdateTracking(now, requestIp, requestUserAgent);
+    const updateTracking = this.shouldUpdateTracking(now);
     if (!updateExpiration && !updateTracking) {
       return;
     }
     const values = {};
     if (updateExpiration && newExpiration !== null) {
-      values.expires_at = newExpiration;
+      values.expires_at = new Literal('LEAST(now() + make_interval(secs => ?), "max_expires_at")', [
+        ApiKeyHelper.getSessionExpirationSeconds(this.expiration)
+      ]);
     }
     if (updateTracking) {
       values.last_ip = requestIp;
       values.last_user_agent = requestUserAgent;
-      values.last_used_at = now;
+      values.last_used_at = new Literal("now()");
     }
     const qb = UpdateBuilder$1.create().table("api_key").where({ id: this.id }).values(values);
     await qb.execute(db);
   }
-  shouldUpdateTracking(now, requestIp, requestUserAgent) {
+  shouldUpdateTracking(now) {
     if (!this.requestInfo) {
       return false;
     }
-    const last = this.tracking;
-    if (!last || last.lastUsedAt === null) {
+    const lastUsedAt = this.tracking?.lastUsedAt;
+    if (!lastUsedAt) {
       return true;
     }
-    if (requestIp !== last.lastIp || requestUserAgent !== last.lastUserAgent) {
-      return true;
-    }
-    return now.getTime() - last.lastUsedAt.getTime() >= PROLONG_THROTTLE_MS;
+    return now.getTime() - lastUsedAt.getTime() >= PROLONG_THROTTLE_MS;
   }
 }
 export {

package/dist/development/src/model/commands/apiKey/ProlongApiKeyCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProlongApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { QueryBuilder, UpdateBuilder } from '@contember/database'\n\n/**\n * Tracking writes (`last_used_at`) are throttled to at most once per this window, so\n * an idle check must add this slack to avoid prematurely expiring an active session\n * whose `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).\n */\nexport const PROLONG_THROTTLE_MS = 60_000\n\nexport interface ApiKeyRequestInfo {\n\tip?: string\n\tuserAgent?: string\n}\n\nexport interface ApiKeyTrackingState {\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tlastUsedAt: Date | null\n}\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t\tprivate readonly requestInfo?: ApiKeyRequestInfo,\n\t\tprivate readonly tracking?: ApiKeyTrackingState,\n\t\tprivate readonly maxExpiresAt?: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tlet newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\t// A19: clamp the sliding window at the absolute cap snapshotted at sign-in.\n\t\t// NULL maxExpiresAt = today's uncapped sliding window.\n\t\tif (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {\n\t\t\tnewExpiration = this.maxExpiresAt\n\t\t}\n\t\tconst now = providers.now()\n\n\t\tlet updateExpiration = newExpiration !== null\n\t\tif (updateExpiration && this.currentExpiration && newExpiration !== null) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\tupdateExpiration = false\n\t\t\t}\n\t\t}\n\n\t\tconst requestIp = this.requestInfo?.ip || null\n\t\tconst requestUserAgent = this.requestInfo?.userAgent || null\n\t\tconst updateTracking = this.shouldUpdateTracking(now, requestIp, requestUserAgent)\n\n\t\tif (!updateExpiration && !updateTracking) {\n\t\t\treturn\n\t\t}\n\n\t\tconst values: QueryBuilder.Values = {}\n\t\tif (updateExpiration && newExpiration !== null) {\n\t\t\tvalues.expires_at = newExpiration\n\t\t}\n\t\tif (updateTracking) {\n\t\t\tvalues.last_ip = requestIp\n\t\t\tvalues.last_user_agent = requestUserAgent\n\t\t\tvalues.last_used_at = now\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values(values)\n\t\tawait qb.execute(db)\n\t}\n\n\tprivate shouldUpdateTracking(now: Date, requestIp: string | null, requestUserAgent: string | null): boolean {\n\t\tif (!this.requestInfo) {\n\t\t\treturn false\n\t\t}\n\t\tconst last = this.tracking\n\t\tif (!last || last.lastUsedAt === null) {\n\t\t\treturn true\n\t\t}\n\t\tif (requestIp !== last.lastIp || requestUserAgent !== last.lastUserAgent) {\n\t\t\treturn true\n\t\t}\n\t\treturn now.getTime() - last.lastUsedAt.getTime() >= PROLONG_THROTTLE_MS\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAUO,MAAM,sBAAsB;AAa5B,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBACA,aACA,UACA,cAChB;AAPgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,cAAA;AACA,SAAA,WAAA;AACA,SAAA,eAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,QAAI,gBAAgB,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AAGpF,QAAI,kBAAkB,QAAQ,KAAK,gBAAgB,cAAc,YAAY,KAAK,aAAa,WAAW;AACzG,sBAAgB,KAAK;AAAA,IACtB;AACA,UAAM,MAAM,UAAU,IAAA;AAEtB,QAAI,mBAAmB,kBAAkB;AACzC,QAAI,oBAAoB,KAAK,qBAAqB,kBAAkB,MAAM;AACzE,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD,2BAAmB;AAAA,MACpB;AAAA,IACD;AAEA,UAAM,YAAY,KAAK,aAAa,MAAM;AAC1C,UAAM,mBAAmB,KAAK,aAAa,aAAa;AACxD,UAAM,iBAAiB,KAAK,qBAAqB,KAAK,WAAW,gBAAgB;AAEjF,QAAI,CAAC,oBAAoB,CAAC,gBAAgB;AACzC;AAAA,IACD;AAEA,UAAM,SAA8B,CAAA;AACpC,QAAI,oBAAoB,kBAAkB,MAAM;AAC/C,aAAO,aAAa;AAAA,IACrB;AACA,QAAI,gBAAgB;AACnB,aAAO,UAAU;AACjB,aAAO,kBAAkB;AACzB,aAAO,eAAe;AAAA,IACvB;AAEA,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO,MAAM;AACf,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AAAA,EAEQ,qBAAqB,KAAW,WAA0B,kBAA0C;AAC3G,QAAI,CAAC,KAAK,aAAa;AACtB,aAAO;AAAA,IACR;AACA,UAAM,OAAO,KAAK;AAClB,QAAI,CAAC,QAAQ,KAAK,eAAe,MAAM;AACtC,aAAO;AAAA,IACR;AACA,QAAI,cAAc,KAAK,UAAU,qBAAqB,KAAK,eAAe;AACzE,aAAO;AAAA,IACR;AACA,WAAO,IAAI,QAAA,IAAY,KAAK,WAAW,aAAa;AAAA,EACrD;AACD;"}
+{"version":3,"file":"ProlongApiKeyCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/apiKey/ProlongApiKeyCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ApiKey } from '../../type/index.js'\nimport { ApiKeyHelper } from './ApiKeyHelper.js'\nimport { Literal, QueryBuilder, UpdateBuilder } from '@contember/database'\n\n/**\n * Tracking writes (`last_ip`, `last_user_agent`, `last_used_at`) are throttled to at most once per\n * this window, even when the IP or User-Agent changes: a key shared by several service replicas\n * alternates between their addresses, and writing every change makes its row a lock hotspot.\n * An idle check must add this slack to avoid prematurely expiring an active session whose\n * `last_used_at` is intentionally stale (see {@link ApiKeyManager.verifyAndProlong}).\n */\nexport const PROLONG_THROTTLE_MS = 60_000\n\nexport interface ApiKeyRequestInfo {\n\tip?: string\n\tuserAgent?: string\n}\n\nexport interface ApiKeyTrackingState {\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tlastUsedAt: Date | null\n}\n\nexport class ProlongApiKeyCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly type: ApiKey.Type,\n\t\tprivate readonly expiration: number | null,\n\t\tprivate readonly currentExpiration: Date | null,\n\t\tprivate readonly requestInfo?: ApiKeyRequestInfo,\n\t\tprivate readonly tracking?: ApiKeyTrackingState,\n\t\tprivate readonly maxExpiresAt?: Date | null,\n\t) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tlet newExpiration = ApiKeyHelper.getExpiration(providers, this.type, this.expiration)\n\t\t// A19: clamp the sliding window at the absolute cap snapshotted at sign-in.\n\t\t// NULL maxExpiresAt = today's uncapped sliding window.\n\t\tif (newExpiration !== null && this.maxExpiresAt && newExpiration.getTime() > this.maxExpiresAt.getTime()) {\n\t\t\tnewExpiration = this.maxExpiresAt\n\t\t}\n\t\tconst now = providers.now()\n\n\t\tlet updateExpiration = newExpiration !== null\n\t\tif (updateExpiration && this.currentExpiration && newExpiration !== null) {\n\t\t\tconst prolongMs = newExpiration.getTime() - this.currentExpiration.getTime()\n\t\t\tif (prolongMs > 0 && prolongMs < PROLONG_THROTTLE_MS) {\n\t\t\t\tupdateExpiration = false\n\t\t\t}\n\t\t}\n\n\t\tconst requestIp = this.requestInfo?.ip || null\n\t\tconst requestUserAgent = this.requestInfo?.userAgent || null\n\t\tconst updateTracking = this.shouldUpdateTracking(now)\n\n\t\tif (!updateExpiration && !updateTracking) {\n\t\t\treturn\n\t\t}\n\n\t\tconst values: QueryBuilder.Values = {}\n\t\tif (updateExpiration && newExpiration !== null) {\n\t\t\t// Write the sliding expiry on the DB clock and clamp to the stored\n\t\t\t// max_expires_at in SQL (LEAST ignores a NULL cap → uncapped window). The JS\n\t\t\t// throttle above only decides *whether* to write; the expiry gate itself is\n\t\t\t// computed on the DB clock. See engine-tenant-api/CLAUDE.md.\n\t\t\tvalues.expires_at = new Literal('LEAST(now() + make_interval(secs => ?), \"max_expires_at\")', [\n\t\t\t\tApiKeyHelper.getSessionExpirationSeconds(this.expiration),\n\t\t\t])\n\t\t}\n\t\tif (updateTracking) {\n\t\t\tvalues.last_ip = requestIp\n\t\t\tvalues.last_user_agent = requestUserAgent\n\t\t\t// last_used_at on the DB clock: it's compared against now() in the idle gate\n\t\t\t// (ApiKeyByTokenQuery's is_idle_expired), so it must be written on the same\n\t\t\t// clock. The app-clock `now` above only drives the write-rate throttle. See CLAUDE.md.\n\t\t\tvalues.last_used_at = new Literal('now()')\n\t\t}\n\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('api_key')\n\t\t\t.where({ id: this.id })\n\t\t\t.values(values)\n\t\tawait qb.execute(db)\n\t}\n\n\tprivate shouldUpdateTracking(now: Date): boolean {\n\t\tif (!this.requestInfo) {\n\t\t\treturn false\n\t\t}\n\t\tconst lastUsedAt = this.tracking?.lastUsedAt\n\t\tif (!lastUsedAt) {\n\t\t\treturn true\n\t\t}\n\t\treturn now.getTime() - lastUsedAt.getTime() >= PROLONG_THROTTLE_MS\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;AAYO,MAAM,sBAAsB;AAa5B,MAAM,qBAA8C;AAAA,EAC1D,YACkB,IACA,MACA,YACA,mBACA,aACA,UACA,cAChB;AAPgB,SAAA,KAAA;AACA,SAAA,OAAA;AACA,SAAA,aAAA;AACA,SAAA,oBAAA;AACA,SAAA,cAAA;AACA,SAAA,WAAA;AACA,SAAA,eAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,QAAI,gBAAgB,aAAa,cAAc,WAAW,KAAK,MAAM,KAAK,UAAU;AAGpF,QAAI,kBAAkB,QAAQ,KAAK,gBAAgB,cAAc,YAAY,KAAK,aAAa,WAAW;AACzG,sBAAgB,KAAK;AAAA,IACtB;AACA,UAAM,MAAM,UAAU,IAAA;AAEtB,QAAI,mBAAmB,kBAAkB;AACzC,QAAI,oBAAoB,KAAK,qBAAqB,kBAAkB,MAAM;AACzE,YAAM,YAAY,cAAc,QAAA,IAAY,KAAK,kBAAkB,QAAA;AACnE,UAAI,YAAY,KAAK,YAAY,qBAAqB;AACrD,2BAAmB;AAAA,MACpB;AAAA,IACD;AAEA,UAAM,YAAY,KAAK,aAAa,MAAM;AAC1C,UAAM,mBAAmB,KAAK,aAAa,aAAa;AACxD,UAAM,iBAAiB,KAAK,qBAAqB,GAAG;AAEpD,QAAI,CAAC,oBAAoB,CAAC,gBAAgB;AACzC;AAAA,IACD;AAEA,UAAM,SAA8B,CAAA;AACpC,QAAI,oBAAoB,kBAAkB,MAAM;AAK/C,aAAO,aAAa,IAAI,QAAQ,6DAA6D;AAAA,QAC5F,aAAa,4BAA4B,KAAK,UAAU;AAAA,MAAA,CACxD;AAAA,IACF;AACA,QAAI,gBAAgB;AACnB,aAAO,UAAU;AACjB,aAAO,kBAAkB;AAIzB,aAAO,eAAe,IAAI,QAAQ,OAAO;AAAA,IAC1C;AAEA,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,SAAS,EACf,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,OAAO,MAAM;AACf,UAAM,GAAG,QAAQ,EAAE;AAAA,EACpB;AAAA,EAEQ,qBAAqB,KAAoB;AAChD,QAAI,CAAC,KAAK,aAAa;AACtB,aAAO;AAAA,IACR;AACA,UAAM,aAAa,KAAK,UAAU;AAClC,QAAI,CAAC,YAAY;AAChB,aAAO;AAAA,IACR;AACA,WAAO,IAAI,QAAA,IAAY,WAAW,aAAa;AAAA,EAChD;AACD;"}

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"CreateAuthLogEntryCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { AuthActionType } from '../../type/AuthLog.js'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t\ttarget_person_id: this.data.targetPersonId,\n\t\t\t\tevent_data: this.data.eventData,\n\t\t\t\tgeo_country: this.data.geoCountry,\n\t\t\t\tdevice_fingerprint: this.data.deviceFingerprint,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\t/** The identity that initiated the action. Omit (→ NULL) when there is no acting identity, e.g. an IdP-initiated back-channel logout. */\n\t\tinvokedById?: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t\ttargetPersonId?: string\n\t\teventData?: JSONValue\n\t\t/** A03: country derived from the trusted reverse-proxy geo header, when present. */\n\t\tgeoCountry?: string\n\t\t/** A03: hash of the client user-agent (never the raw UA). */\n\t\tdeviceFingerprint?: string\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,MAChC,kBAAkB,KAAK,KAAK;AAAA,MAC5B,YAAY,KAAK,KAAK;AAAA,MACtB,aAAa,KAAK,KAAK;AAAA,MACvB,oBAAoB,KAAK,KAAK;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
+{"version":3,"file":"CreateAuthLogEntryCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { AuthActionType } from '../../type/AuthLog.js'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t\ttarget_person_id: this.data.targetPersonId,\n\t\t\t\tevent_data: this.data.eventData,\n\t\t\t\tgeo_country: this.data.geoCountry,\n\t\t\t\tdevice_fingerprint: this.data.deviceFingerprint,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\t/** The identity that initiated the action. Omit (→ NULL) when there is no acting identity, e.g. an IdP-initiated back-channel logout. */\n\t\tinvokedById?: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\t/** A `person_token` id (password reset, e-mail verification, passwordless). FK-checked, so never an `api_key` id: put that in `eventData`. */\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t\ttargetPersonId?: string\n\t\teventData?: JSONValue\n\t\t/** A03: country derived from the trusted reverse-proxy geo header, when present. */\n\t\tgeoCountry?: string\n\t\t/** A03: hash of the client user-agent (never the raw UA). */\n\t\tdeviceFingerprint?: string\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,MAChC,kBAAkB,KAAK,KAAK;AAAA,MAC5B,YAAY,KAAK,KAAK;AAAA,MACtB,aAAa,KAAK,KAAK;AAAA,MACvB,oBAAoB,KAAK,KAAK;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/authLog/CreateAuthLogEntryCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"CreateAuthLogEntryCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { AuthActionType } from '../../type/AuthLog.js'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t\ttarget_person_id: this.data.targetPersonId,\n\t\t\t\tevent_data: this.data.eventData,\n\t\t\t\tgeo_country: this.data.geoCountry,\n\t\t\t\tdevice_fingerprint: this.data.deviceFingerprint,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\t/** The identity that initiated the action. Omit (→ NULL) when there is no acting identity, e.g. an IdP-initiated back-channel logout. */\n\t\tinvokedById?: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t\ttargetPersonId?: string\n\t\teventData?: JSONValue\n\t\t/** A03: country derived from the trusted reverse-proxy geo header, when present. */\n\t\tgeoCountry?: string\n\t\t/** A03: hash of the client user-agent (never the raw UA). */\n\t\tdeviceFingerprint?: string\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,MAChC,kBAAkB,KAAK,KAAK;AAAA,MAC5B,YAAY,KAAK,KAAK;AAAA,MACtB,aAAa,KAAK,KAAK;AAAA,MACvB,oBAAoB,KAAK,KAAK;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
+{"version":3,"file":"CreateAuthLogEntryCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/authLog/CreateAuthLogEntryCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { AuthActionType } from '../../type/AuthLog.js'\nimport { InsertBuilder } from '@contember/database'\nimport { JSONValue } from '@contember/schema'\n\nexport class CreateAuthLogEntryCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly data: CreateAuthLogEntryCommand.Entry,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait InsertBuilder.create()\n\t\t\t.into('person_auth_log')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tinvoked_by_id: this.data.invokedById,\n\t\t\t\tperson_id: this.data.personId,\n\t\t\t\tperson_input_identifier: this.data.personInputIdentifier,\n\t\t\t\tperson_token_id: this.data.personTokenId,\n\t\t\t\ttype: this.data.type,\n\t\t\t\tsuccess: this.data.success,\n\t\t\t\terror_code: this.data.errorCode,\n\t\t\t\terror_message: this.data.errorMessage,\n\t\t\t\tip_address: this.data.ipAddress,\n\t\t\t\tuser_agent: this.data.userAgent,\n\t\t\t\tidentity_provider_id: this.data.identityProviderId,\n\t\t\t\tmetadata: this.data.metadata ?? {},\n\t\t\t\ttarget_person_id: this.data.targetPersonId,\n\t\t\t\tevent_data: this.data.eventData,\n\t\t\t\tgeo_country: this.data.geoCountry,\n\t\t\t\tdevice_fingerprint: this.data.deviceFingerprint,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nnamespace CreateAuthLogEntryCommand {\n\texport type Entry = {\n\t\ttype: AuthActionType\n\t\t/** The identity that initiated the action. Omit (→ NULL) when there is no acting identity, e.g. an IdP-initiated back-channel logout. */\n\t\tinvokedById?: string\n\t\tpersonInputIdentifier?: string\n\t\tpersonId?: string\n\t\t/** A `person_token` id (password reset, e-mail verification, passwordless). FK-checked, so never an `api_key` id: put that in `eventData`. */\n\t\tpersonTokenId?: string\n\t\tsuccess: boolean\n\t\terrorCode?: string\n\t\terrorMessage?: string\n\t\tipAddress?: string\n\t\tuserAgent?: string\n\t\tidentityProviderId?: string\n\t\tmetadata?: JSONValue\n\t\ttargetPersonId?: string\n\t\teventData?: JSONValue\n\t\t/** A03: country derived from the trusted reverse-proxy geo header, when present. */\n\t\tgeoCountry?: string\n\t\t/** A03: hash of the client user-agent (never the raw UA). */\n\t\tdeviceFingerprint?: string\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAKO,MAAM,0BAAmD;AAAA,EAC/D,YACkB,MAChB;AADgB,SAAA,OAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,KAAK,iBAAiB,EACtB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd,eAAe,KAAK,KAAK;AAAA,MACzB,WAAW,KAAK,KAAK;AAAA,MACrB,yBAAyB,KAAK,KAAK;AAAA,MACnC,iBAAiB,KAAK,KAAK;AAAA,MAC3B,MAAM,KAAK,KAAK;AAAA,MAChB,SAAS,KAAK,KAAK;AAAA,MACnB,YAAY,KAAK,KAAK;AAAA,MACtB,eAAe,KAAK,KAAK;AAAA,MACzB,YAAY,KAAK,KAAK;AAAA,MACtB,YAAY,KAAK,KAAK;AAAA,MACtB,sBAAsB,KAAK,KAAK;AAAA,MAChC,UAAU,KAAK,KAAK,YAAY,CAAA;AAAA,MAChC,kBAAkB,KAAK,KAAK;AAAA,MAC5B,YAAY,KAAK,KAAK;AAAA,MACtB,aAAa,KAAK,KAAK;AAAA,MACvB,oBAAoB,KAAK,KAAK;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.cjs

@@ -10,8 +10,8 @@ class UpdateConfigurationCommand {
     const rl = this.configuration.rateLimits;
     let captchaSecretCol;
     let captchaSecretVersionCol;
-    if (captcha?.secret !== void 0) {
-      if (captcha.secret === "" || captcha.secret === null) {
+    if (captcha?.secret !== void 0 && captcha.secret !== null) {
+      if (captcha.secret === "") {
         captchaSecretCol = null;
         captchaSecretVersionCol = null;
       } else {
@@ -66,7 +66,9 @@ class UpdateConfigurationCommand {
         rate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? void 0,
         rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? void 0,
         rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? void 0,
-        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0
+        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0,
+        panel_global_roles: this.configuration.panel?.globalRoles ?? void 0,
+        panel_project_roles: this.configuration.panel?.projectRoles ?? void 0
       }
     ).execute(db);
     if (!result) {

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateConfigurationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// Encrypt captcha secret at rest. Empty string clears the value;\n\t\t// non-empty re-encrypts so we always rotate to the latest key version.\n\t\tlet captchaSecretCol: Buffer | null | undefined\n\t\tlet captchaSecretVersionCol: number | null | undefined\n\t\tif (captcha?.secret !== undefined) {\n\t\t\tif (captcha.secret === '' || captcha.secret === null) {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;AAI9B,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,QAAW;AAClC,UAAI,QAAQ,WAAW,MAAM,QAAQ,WAAW,MAAM;AACrD,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,MAAA;AAAA,IACpF,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;;"}
+{"version":3,"file":"UpdateConfigurationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// Null and omission preserve the stored secret; only an empty string clears it.\n\t\tlet captchaSecretCol: Buffer | null | undefined\n\t\tlet captchaSecretVersionCol: number | null | undefined\n\t\tif (captcha?.secret !== undefined && captcha.secret !== null) {\n\t\t\tif (captcha.secret === '') {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t\tpanel_global_roles: this.configuration.panel?.globalRoles ?? undefined,\n\t\t\t\t\tpanel_project_roles: this.configuration.panel?.projectRoles ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) | Exclude<ConfigRow[K], IPostgresInterval> | undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;AAG9B,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC7D,UAAI,QAAQ,WAAW,IAAI;AAC1B,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,QACnF,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,qBAAqB,KAAK,cAAc,OAAO,gBAAgB;AAAA,MAAA;AAAA,IAChE,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;;"}

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.js

@@ -8,8 +8,8 @@ class UpdateConfigurationCommand {
     const rl = this.configuration.rateLimits;
     let captchaSecretCol;
     let captchaSecretVersionCol;
-    if (captcha?.secret !== void 0) {
-      if (captcha.secret === "" || captcha.secret === null) {
+    if (captcha?.secret !== void 0 && captcha.secret !== null) {
+      if (captcha.secret === "") {
         captchaSecretCol = null;
         captchaSecretVersionCol = null;
       } else {
@@ -64,7 +64,9 @@ class UpdateConfigurationCommand {
         rate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? void 0,
         rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? void 0,
         rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? void 0,
-        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0
+        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0,
+        panel_global_roles: this.configuration.panel?.globalRoles ?? void 0,
+        panel_project_roles: this.configuration.panel?.projectRoles ?? void 0
       }
     ).execute(db);
     if (!result) {