npm - @contember/engine-tenant-api - Versions diffs - 2.2.0-alpha.3 → 2.2.0-alpha.5 - Mend

@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1181) hide show

package/dist/development/src/migrations/runner.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runner.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/runner.ts"],"sourcesContent":["import { Connection, createDatabaseIfNotExists, DatabaseConfig, EventManager } from '@contember/database'\nimport { TenantMigrationArgs } from './types.js'\nimport { MigrationsRunner as DbMigrationsRunner, SnapshotMigrationResolver } from '@contember/database-migrations'\nimport _20180802174310init from './2018-08-02-174310-init.js'\nimport _20180903140621identityproject from './2018-09-03-140621-identity-project.js'\nimport _20181026165450setupapikey from './2018-10-26-165450-setup-api-key.js'\nimport _20181026175155variables from './2018-10-26-175155-variables.js'\nimport _20190218110949projectslug from './2019-02-18-110949-project-slug.js'\nimport _20190218160155sessionexpiration from './2019-02-18-160155-session-expiration.js'\nimport _20190503163729apikeydisabledat from './2019-05-03-163729-api-key-disabled-at.js'\nimport _20190814153300projectslugunique from './2019-08-14-153300-project-slug-unique.js'\nimport _20190906111000membership from './2019-09-06-111000-membership.js'\nimport _20190906111001dropoldmember from './2019-09-06-111001-drop-old-member.js'\nimport _20200129idenitynote from './2020-01-29-idenity-note.js'\nimport _20200417fixpersonindex from './2020-04-17-fix-person-index.js'\nimport _20200501170000apikeyindex from './2020-05-01-170000-api-key-index.js'\nimport _20200608134000tenantcredentials from './2020-06-08-134000-tenant-credentials.js'\nimport _20200807110000personotp from './2020-08-07-110000-person-otp.js'\nimport _20200817162200mailtemplates from './2020-08-17-162200-mail-templates.js'\nimport _20200821143400personpasswordreset from './2020-08-21-143400-person-password-reset.js'\nimport _20200907094200identityprovider from './2020-09-07-094200-identity-provider.js'\nimport _20210328134000timestamp from './2021-03-28-134000-timestamp.js'\nimport _20210726105000projectconfig from './2021-07-26-105000-project-config.js'\nimport _20210726132000projectsecrets from './2021-07-26-132000-project-secrets.js'\nimport _20210727174000projectaliasindex from './2021-07-27-174000-project-alias-index.js'\nimport _20211124130000personpasswordnull from './2021-11-24-130000-person-password-null.js'\nimport _20211124161500mailtemplateprojectnull from './2021-11-24-161500-mail-template-project-null.js'\nimport _20220104144000personuniqueidentity from './2022-01-04-144000-person-unique-identity.js'\nimport _20220209111800fixcrypted from './2022-02-09-111800-fix-crypted.js'\nimport _20220211153000idpautosignup from './2022-02-11-153000-idp-auto-sign-up.js'\nimport _20220629105000personidp from './2022-06-29-105000-person-idp.js'\nimport _20220707135000personemailoptuniq from './2022-07-07-135000-person-email-opt-uniq.js'\nimport _20220707141000persondisplayname from './2022-07-07-141000-person-display-name.js'\nimport _20220714145000personloginoptions from './2022-07-14-145000-person-login-options.js'\nimport _20221108projectupdatenotification from './2022-11-08-project-update-notification.js'\nimport _20230120135500personemailnormalize from './2023-01-20-135500-person-email-normalize.js'\nimport _20230603104000persondisabled from './2023-06-03-104000-person-disabled.js'\nimport _20230901165000idpreturnconfig from './2023-09-01-165000-idp-return-config.js'\nimport _20240620140000mailreply from './2024-06-20-140000-mail-reply.js'\nimport _20240826120000passwordless from './2024-08-26-120000-passwordless.js'\nimport _20250416180000configup from './2025-04-16-180000-config-up.js'\nimport _20250417160000authlog from './2025-04-17-160000-auth-log.js'\nimport _20260512120000apikeysessiontracking from './2026-05-12-120000-api-key-session-tracking.js'\nimport _20260512130000apikeytrustforwardedinfo from './2026-05-12-130000-api-key-trust-forwarded-info.js'\nimport _20260513120000authlogeventdata from './2026-05-13-120000-auth-log-event-data.js'\nimport _20260513130000antiabuse from './2026-05-13-130000-anti-abuse.js'\nimport _20260514100000authlogadminactions from './2026-05-14-100000-auth-log-admin-actions.js'\nimport _20260515120000configreveallogmethod from './2026-05-15-120000-config-reveal-login-method.js'\nimport _20260521100000personmfa from './2026-05-21-100000-person-mfa.js'\nimport _20260521110000mfafoundation from './2026-05-21-110000-mfa-foundation.js'\nimport _20260521120000emailotp from './2026-05-21-120000-email-otp.js'\nimport _20260521130000apikeysessionpolicy from './2026-05-21-130000-api-key-session-policy.js'\nimport _20260521140000mfagraceduration from './2026-05-21-140000-mfa-grace-duration.js'\nimport _20260521150000emailotpratelimit from './2026-05-21-150000-email-otp-rate-limit.js'\nimport _20260526120000emailverificationtypes from './2026-05-26-120000-email-verification-types.js'\nimport _20260526120010emailverification from './2026-05-26-120010-email-verification.js'\nimport _20260526130000emailchangeverificationconfig from './2026-05-26-130000-email-change-verification-config.js'\nimport _20260526130010idprequireverifiedemail from './2026-05-26-130010-idp-require-verified-email.js'\nimport _20260526130020emailverificationratelimit from './2026-05-26-130020-email-verification-rate-limit.js'\nimport _20260526130030captchaprotectflows from './2026-05-26-130030-captcha-protect-flows.js'\nimport _20260526140000idpsession from './2026-05-26-140000-idp-session.js'\nimport _20260608100000idpassumeemailverified from './2026-06-08-100000-idp-assume-email-verified.js'\nimport _20260616120000loginanomalydetection from './2026-06-16-120000-login-anomaly-detection.js'\nimport _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'\nimport snapshot from './snapshot.js'\nimport { computeTokenHash, Providers } from '../model/index.js'\nimport { Logger } from '@contember/logger'\n\nexport interface TenantCredentials {\n\tloginToken?: string\n\trootEmail?: string\n\trootToken?: string\n\trootTokenHash?: string\n\trootPassword?: string\n\t/*\n\t Unpersisted root tokens (plain values). When set, these tokens are\n\t * verified at runtime and resolve to a super-admin identity without being\n\t * stored in the database. Useful for easy rotation.\n\t /\n\trootTokens?: readonly string[]\n\t/\n\t Unpersisted root token hashes (sha256 hex). Same as {@link rootTokens} but\n\t * the plain token never needs to be passed to the engine.\n\t */\n\trootTokenHashes?: readonly string[]\n}\n\nconst migrations = {\n\t'2018-08-02-174310-init': _20180802174310init,\n\t'2018-09-03-140621-identity-project': _20180903140621identityproject,\n\t'2018-10-26-165450-setup-api-key': _20181026165450setupapikey,\n\t'2018-10-26-175155-variables': _20181026175155variables,\n\t'2019-02-18-110949-project-slug': _20190218110949projectslug,\n\t'2019-02-18-160155-session-expiration': _20190218160155sessionexpiration,\n\t'2019-05-03-163729-api-key-disabled-at': _20190503163729apikeydisabledat,\n\t'2019-08-14-153300-project-slug-unique': _20190814153300projectslugunique,\n\t'2019-09-06-111000-membership': _20190906111000membership,\n\t'2019-09-06-111001-drop-old-member': _20190906111001dropoldmember,\n\t'2020-01-29-idenity-note': _20200129idenitynote,\n\t'2020-04-17-fix-person-index': _20200417fixpersonindex,\n\t'2020-05-01-170000-api-key-index': _20200501170000apikeyindex,\n\t'2020-06-08-134000-tenant-credentials': _20200608134000tenantcredentials,\n\t'2020-08-07-110000-person-otp': _20200807110000personotp,\n\t'2020-08-17-162200-mail-templates': _20200817162200mailtemplates,\n\t'2020-08-21-143400-person-password-reset': _20200821143400personpasswordreset,\n\t'2020-09-07-094200-identity-provider': _20200907094200identityprovider,\n\t'2021-03-28-134000-timestamp': _20210328134000timestamp,\n\t'2021-07-26-105000-project-config': _20210726105000projectconfig,\n\t'2021-07-26-132000-project-secrets': _20210726132000projectsecrets,\n\t'2021-07-27-174000-project-alias-index': _20210727174000projectaliasindex,\n\t'2021-11-24-130000-person-password-null': _20211124130000personpasswordnull,\n\t'2021-11-24-161500-mail-template-project-null': _20211124161500mailtemplateprojectnull,\n\t'2022-01-04-144000-person-unique-identity': _20220104144000personuniqueidentity,\n\t'2022-02-09-111800-fix-crypted': _20220209111800fixcrypted,\n\t'2022-02-11-153000-idp-auto-sign-up': _20220211153000idpautosignup,\n\t'2022-06-29-105000-person-idp': _20220629105000personidp,\n\t'2022-07-07-135000-person-email-opt-uniq': _20220707135000personemailoptuniq,\n\t'2022-07-07-141000-person-display-name': _20220707141000persondisplayname,\n\t'2022-07-14-145000-person-login-options': _20220714145000personloginoptions,\n\t'2022-11-08-project-update-notification': _20221108projectupdatenotification,\n\t'2023-01-20-135500-person-email-normalize': _20230120135500personemailnormalize,\n\t'2023-06-03-104000-person-disabled': _20230603104000persondisabled,\n\t'2023-09-01-165000-idp-return-config': _20230901165000idpreturnconfig,\n\t'2024-06-20-140000-mail-reply': _20240620140000mailreply,\n\t'2024-08-26-120000-passwordless': _20240826120000passwordless,\n\t'2025-04-16-180000-config-up': _20250416180000configup,\n\t'2025-04-17-160000-auth-log': _20250417160000authlog,\n\t'2026-05-12-120000-api-key-session-tracking': _20260512120000apikeysessiontracking,\n\t'2026-05-12-130000-api-key-trust-forwarded-info': _20260512130000apikeytrustforwardedinfo,\n\t'2026-05-13-120000-auth-log-event-data': _20260513120000authlogeventdata,\n\t'2026-05-13-130000-anti-abuse': _20260513130000antiabuse,\n\t'2026-05-14-100000-auth-log-admin-actions': _20260514100000authlogadminactions,\n\t'2026-05-15-120000-config-reveal-login-method': _20260515120000configreveallogmethod,\n\t'2026-05-21-100000-person-mfa': _20260521100000personmfa,\n\t'2026-05-21-110000-mfa-foundation': _20260521110000mfafoundation,\n\t'2026-05-21-120000-email-otp': _20260521120000emailotp,\n\t'2026-05-21-130000-api-key-session-policy': _20260521130000apikeysessionpolicy,\n\t'2026-05-21-140000-mfa-grace-duration': _20260521140000mfagraceduration,\n\t'2026-05-21-150000-email-otp-rate-limit': _20260521150000emailotpratelimit,\n\t'2026-05-26-120000-email-verification-types': _20260526120000emailverificationtypes,\n\t'2026-05-26-120010-email-verification': _20260526120010emailverification,\n\t'2026-05-26-130000-email-change-verification-config': _20260526130000emailchangeverificationconfig,\n\t'2026-05-26-130010-idp-require-verified-email': _20260526130010idprequireverifiedemail,\n\t'2026-05-26-130020-email-verification-rate-limit': _20260526130020emailverificationratelimit,\n\t'2026-05-26-130030-captcha-protect-flows': _20260526130030captchaprotectflows,\n\t'2026-05-26-140000-idp-session': _20260526140000idpsession,\n\t'2026-06-08-100000-idp-assume-email-verified': _20260608100000idpassumeemailverified,\n\t'2026-06-16-120000-login-anomaly-detection': _20260616120000loginanomalydetection,\n\t'2026-06-16-130000-idp-logout': _20260616130000idplogout,\n}\n\nexport class TenantMigrationsRunner {\n\tconstructor(\n\t\tprivate readonly db: DatabaseConfig,\n\t\tprivate readonly schema: string,\n\t\tprivate readonly tenantCredentials: TenantCredentials,\n\t\tprivate readonly providers: Pick<Providers, 'bcrypt' \| 'uuid'>,\n\t) {\n\t}\n\n\tpublic async run(logger: Logger): Promise<{ name: string }[]> {\n\t\tawait createDatabaseIfNotExists(this.db, message => typeof message === 'string' ? logger.warn(message) : logger.error(message))\n\t\tconst connection = Connection.createSingle(this.db, err => logger.error(err))\n\t\tconst result = await connection.scope(async connection => {\n\t\t\tconst migrationsResolver = new SnapshotMigrationResolver(snapshot, migrations)\n\n\t\t\tconst innerRunner = new DbMigrationsRunner<TenantMigrationArgs>(connection, this.schema, migrationsResolver)\n\t\t\treturn await innerRunner.migrate(message => logger.warn(message), {\n\t\t\t\tgetCredentials: async () => ({\n\t\t\t\t\tloginTokenHash: this.tenantCredentials.loginToken ? computeTokenHash(this.tenantCredentials.loginToken) : undefined,\n\t\t\t\t\trootTokenHash: this.tenantCredentials.rootTokenHash\n\t\t\t\t\t\t?? (this.tenantCredentials.rootToken ? computeTokenHash(this.tenantCredentials.rootToken) : undefined),\n\t\t\t\t\trootEmail: this.tenantCredentials.rootEmail,\n\t\t\t\t\trootPasswordBcrypted: this.tenantCredentials.rootPassword ? await this.providers.bcrypt(this.tenantCredentials.rootPassword) : undefined,\n\t\t\t\t}),\n\t\t\t\tproviders: this.providers,\n\t\t\t})\n\t\t})\n\t\tawait connection.end()\n\t\treturn result\n\t}\n}\n"],"names":["connection","DbMigrationsRunner"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuFA,MAAM,aAAa;AAAA,EAClB,0BAA0B;AAAA,EAC1B,sCAAsC;AAAA,EACtC,mCAAmC;AAAA,EACnC,+BAA+B;AAAA,EAC/B,kCAAkC;AAAA,EAClC,wCAAwC;AAAA,EACxC,yCAAyC;AAAA,EACzC,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,qCAAqC;AAAA,EACrC,2BAA2B;AAAA,EAC3B,+BAA+B;AAAA,EAC/B,mCAAmC;AAAA,EACnC,wCAAwC;AAAA,EACxC,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,2CAA2C;AAAA,EAC3C,uCAAuC;AAAA,EACvC,+BAA+B;AAAA,EAC/B,oCAAoC;AAAA,EACpC,qCAAqC;AAAA,EACrC,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,gDAAgD;AAAA,EAChD,4CAA4C;AAAA,EAC5C,iCAAiC;AAAA,EACjC,sCAAsC;AAAA,EACtC,gCAAgC;AAAA,EAChC,2CAA2C;AAAA,EAC3C,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,0CAA0C;AAAA,EAC1C,4CAA4C;AAAA,EAC5C,qCAAqC;AAAA,EACrC,uCAAuC;AAAA,EACvC,gCAAgC;AAAA,EAChC,kCAAkC;AAAA,EAClC,+BAA+B;AAAA,EAC/B,8BAA8B;AAAA,EAC9B,8CAA8C;AAAA,EAC9C,kDAAkD;AAAA,EAClD,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,4CAA4C;AAAA,EAC5C,gDAAgD;AAAA,EAChD,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,+BAA+B;AAAA,EAC/B,4CAA4C;AAAA,EAC5C,wCAAwC;AAAA,EACxC,0CAA0C;AAAA,EAC1C,8CAA8C;AAAA,EAC9C,wCAAwC;AAAA,EACxC,sDAAsD;AAAA,EACtD,gDAAgD;AAAA,EAChD,mDAAmD;AAAA,EACnD,2CAA2C;AAAA,EAC3C,iCAAiC;AAAA,EACjC,+CAA+C;AAAA,EAC/C,6CAA6C;AAAA,EAC7C,gCAAgC;AACjC;AAEO,MAAM,uBAAuB;AAAA,EACnC,YACkB,IACA,QACA,mBACA,WAChB;AAJgB,SAAA,KAAA;AACA,SAAA,SAAA;AACA,SAAA,oBAAA;AACA,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,IAAI,QAA6C;AAC7D,UAAM,0BAA0B,KAAK,IAAI,CAAA,YAAW,OAAO,YAAY,WAAW,OAAO,KAAK,OAAO,IAAI,OAAO,MAAM,OAAO,CAAC;AAC9H,UAAM,aAAa,WAAW,aAAa,KAAK,IAAI,CAAA,QAAO,OAAO,MAAM,GAAG,CAAC;AAC5E,UAAM,SAAS,MAAM,WAAW,MAAM,OAAMA,gBAAc;AACzD,YAAM,qBAAqB,IAAI,0BAA0B,UAAU,UAAU;AAE7E,YAAM,cAAc,IAAIC,iBAAwCD,aAAY,KAAK,QAAQ,kBAAkB;AAC3G,aAAO,MAAM,YAAY,QAAQ,aAAW,OAAO,KAAK,OAAO,GAAG;AAAA,QACjE,gBAAgB,aAAa;AAAA,UAC5B,gBAAgB,KAAK,kBAAkB,aAAa,iBAAiB,KAAK,kBAAkB,UAAU,IAAI;AAAA,UAC1G,eAAe,KAAK,kBAAkB,kBACjC,KAAK,kBAAkB,YAAY,iBAAiB,KAAK,kBAAkB,SAAS,IAAI;AAAA,UAC7F,WAAW,KAAK,kBAAkB;AAAA,UAClC,sBAAsB,KAAK,kBAAkB,eAAe,MAAM,KAAK,UAAU,OAAO,KAAK,kBAAkB,YAAY,IAAI;AAAA,QAAA;AAAA,QAEhI,WAAW,KAAK;AAAA,MAAA,CAChB;AAAA,IACF,CAAC;AACD,UAAM,WAAW,IAAA;AACjB,WAAO;AAAA,EACR;AACD;"}
1	+ {"version":3,"file":"runner.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/runner.ts"],"sourcesContent":["import { Connection, createDatabaseIfNotExists, DatabaseConfig, EventManager } from '@contember/database'\nimport { TenantMigrationArgs } from './types.js'\nimport { MigrationsRunner as DbMigrationsRunner, SnapshotMigrationResolver } from '@contember/database-migrations'\nimport _20180802174310init from './2018-08-02-174310-init.js'\nimport _20180903140621identityproject from './2018-09-03-140621-identity-project.js'\nimport _20181026165450setupapikey from './2018-10-26-165450-setup-api-key.js'\nimport _20181026175155variables from './2018-10-26-175155-variables.js'\nimport _20190218110949projectslug from './2019-02-18-110949-project-slug.js'\nimport _20190218160155sessionexpiration from './2019-02-18-160155-session-expiration.js'\nimport _20190503163729apikeydisabledat from './2019-05-03-163729-api-key-disabled-at.js'\nimport _20190814153300projectslugunique from './2019-08-14-153300-project-slug-unique.js'\nimport _20190906111000membership from './2019-09-06-111000-membership.js'\nimport _20190906111001dropoldmember from './2019-09-06-111001-drop-old-member.js'\nimport _20200129idenitynote from './2020-01-29-idenity-note.js'\nimport _20200417fixpersonindex from './2020-04-17-fix-person-index.js'\nimport _20200501170000apikeyindex from './2020-05-01-170000-api-key-index.js'\nimport _20200608134000tenantcredentials from './2020-06-08-134000-tenant-credentials.js'\nimport _20200807110000personotp from './2020-08-07-110000-person-otp.js'\nimport _20200817162200mailtemplates from './2020-08-17-162200-mail-templates.js'\nimport _20200821143400personpasswordreset from './2020-08-21-143400-person-password-reset.js'\nimport _20200907094200identityprovider from './2020-09-07-094200-identity-provider.js'\nimport _20210328134000timestamp from './2021-03-28-134000-timestamp.js'\nimport _20210726105000projectconfig from './2021-07-26-105000-project-config.js'\nimport _20210726132000projectsecrets from './2021-07-26-132000-project-secrets.js'\nimport _20210727174000projectaliasindex from './2021-07-27-174000-project-alias-index.js'\nimport _20211124130000personpasswordnull from './2021-11-24-130000-person-password-null.js'\nimport _20211124161500mailtemplateprojectnull from './2021-11-24-161500-mail-template-project-null.js'\nimport _20220104144000personuniqueidentity from './2022-01-04-144000-person-unique-identity.js'\nimport _20220209111800fixcrypted from './2022-02-09-111800-fix-crypted.js'\nimport _20220211153000idpautosignup from './2022-02-11-153000-idp-auto-sign-up.js'\nimport _20220629105000personidp from './2022-06-29-105000-person-idp.js'\nimport _20220707135000personemailoptuniq from './2022-07-07-135000-person-email-opt-uniq.js'\nimport _20220707141000persondisplayname from './2022-07-07-141000-person-display-name.js'\nimport _20220714145000personloginoptions from './2022-07-14-145000-person-login-options.js'\nimport _20221108projectupdatenotification from './2022-11-08-project-update-notification.js'\nimport _20230120135500personemailnormalize from './2023-01-20-135500-person-email-normalize.js'\nimport _20230603104000persondisabled from './2023-06-03-104000-person-disabled.js'\nimport _20230901165000idpreturnconfig from './2023-09-01-165000-idp-return-config.js'\nimport _20240620140000mailreply from './2024-06-20-140000-mail-reply.js'\nimport _20240826120000passwordless from './2024-08-26-120000-passwordless.js'\nimport _20250416180000configup from './2025-04-16-180000-config-up.js'\nimport _20250417160000authlog from './2025-04-17-160000-auth-log.js'\nimport _20260512120000apikeysessiontracking from './2026-05-12-120000-api-key-session-tracking.js'\nimport _20260512130000apikeytrustforwardedinfo from './2026-05-12-130000-api-key-trust-forwarded-info.js'\nimport _20260513120000authlogeventdata from './2026-05-13-120000-auth-log-event-data.js'\nimport _20260513130000antiabuse from './2026-05-13-130000-anti-abuse.js'\nimport _20260514100000authlogadminactions from './2026-05-14-100000-auth-log-admin-actions.js'\nimport _20260515120000configreveallogmethod from './2026-05-15-120000-config-reveal-login-method.js'\nimport _20260521100000personmfa from './2026-05-21-100000-person-mfa.js'\nimport _20260521110000mfafoundation from './2026-05-21-110000-mfa-foundation.js'\nimport _20260521120000emailotp from './2026-05-21-120000-email-otp.js'\nimport _20260521130000apikeysessionpolicy from './2026-05-21-130000-api-key-session-policy.js'\nimport _20260521140000mfagraceduration from './2026-05-21-140000-mfa-grace-duration.js'\nimport _20260521150000emailotpratelimit from './2026-05-21-150000-email-otp-rate-limit.js'\nimport _20260526120000emailverificationtypes from './2026-05-26-120000-email-verification-types.js'\nimport _20260526120010emailverification from './2026-05-26-120010-email-verification.js'\nimport _20260526130000emailchangeverificationconfig from './2026-05-26-130000-email-change-verification-config.js'\nimport _20260526130010idprequireverifiedemail from './2026-05-26-130010-idp-require-verified-email.js'\nimport _20260526130020emailverificationratelimit from './2026-05-26-130020-email-verification-rate-limit.js'\nimport _20260526130030captchaprotectflows from './2026-05-26-130030-captcha-protect-flows.js'\nimport _20260526140000idpsession from './2026-05-26-140000-idp-session.js'\nimport _20260608100000idpassumeemailverified from './2026-06-08-100000-idp-assume-email-verified.js'\nimport _20260616120000loginanomalydetection from './2026-06-16-120000-login-anomaly-detection.js'\nimport _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'\nimport _20260618120000idpclaimmapping from './2026-06-18-120000-idp-claim-mapping.js'\nimport _20260803120000personenableauthlog from './2026-08-03-120000-person-enable-auth-log.js'\nimport _20260804120000configpanel from './2026-08-04-120000-config-panel.js'\nimport snapshot from './snapshot.js'\nimport { computeTokenHash, Providers } from '../model/index.js'\nimport { Logger } from '@contember/logger'\n\nexport interface TenantCredentials {\n\tloginToken?: string\n\trootEmail?: string\n\trootToken?: string\n\trootTokenHash?: string\n\trootPassword?: string\n\t/*\n\t Unpersisted root tokens (plain values). When set, these tokens are\n\t * verified at runtime and resolve to a super-admin identity without being\n\t * stored in the database. Useful for easy rotation.\n\t /\n\trootTokens?: readonly string[]\n\t/\n\t Unpersisted root token hashes (sha256 hex). Same as {@link rootTokens} but\n\t * the plain token never needs to be passed to the engine.\n\t */\n\trootTokenHashes?: readonly string[]\n}\n\nconst migrations = {\n\t'2018-08-02-174310-init': _20180802174310init,\n\t'2018-09-03-140621-identity-project': _20180903140621identityproject,\n\t'2018-10-26-165450-setup-api-key': _20181026165450setupapikey,\n\t'2018-10-26-175155-variables': _20181026175155variables,\n\t'2019-02-18-110949-project-slug': _20190218110949projectslug,\n\t'2019-02-18-160155-session-expiration': _20190218160155sessionexpiration,\n\t'2019-05-03-163729-api-key-disabled-at': _20190503163729apikeydisabledat,\n\t'2019-08-14-153300-project-slug-unique': _20190814153300projectslugunique,\n\t'2019-09-06-111000-membership': _20190906111000membership,\n\t'2019-09-06-111001-drop-old-member': _20190906111001dropoldmember,\n\t'2020-01-29-idenity-note': _20200129idenitynote,\n\t'2020-04-17-fix-person-index': _20200417fixpersonindex,\n\t'2020-05-01-170000-api-key-index': _20200501170000apikeyindex,\n\t'2020-06-08-134000-tenant-credentials': _20200608134000tenantcredentials,\n\t'2020-08-07-110000-person-otp': _20200807110000personotp,\n\t'2020-08-17-162200-mail-templates': _20200817162200mailtemplates,\n\t'2020-08-21-143400-person-password-reset': _20200821143400personpasswordreset,\n\t'2020-09-07-094200-identity-provider': _20200907094200identityprovider,\n\t'2021-03-28-134000-timestamp': _20210328134000timestamp,\n\t'2021-07-26-105000-project-config': _20210726105000projectconfig,\n\t'2021-07-26-132000-project-secrets': _20210726132000projectsecrets,\n\t'2021-07-27-174000-project-alias-index': _20210727174000projectaliasindex,\n\t'2021-11-24-130000-person-password-null': _20211124130000personpasswordnull,\n\t'2021-11-24-161500-mail-template-project-null': _20211124161500mailtemplateprojectnull,\n\t'2022-01-04-144000-person-unique-identity': _20220104144000personuniqueidentity,\n\t'2022-02-09-111800-fix-crypted': _20220209111800fixcrypted,\n\t'2022-02-11-153000-idp-auto-sign-up': _20220211153000idpautosignup,\n\t'2022-06-29-105000-person-idp': _20220629105000personidp,\n\t'2022-07-07-135000-person-email-opt-uniq': _20220707135000personemailoptuniq,\n\t'2022-07-07-141000-person-display-name': _20220707141000persondisplayname,\n\t'2022-07-14-145000-person-login-options': _20220714145000personloginoptions,\n\t'2022-11-08-project-update-notification': _20221108projectupdatenotification,\n\t'2023-01-20-135500-person-email-normalize': _20230120135500personemailnormalize,\n\t'2023-06-03-104000-person-disabled': _20230603104000persondisabled,\n\t'2023-09-01-165000-idp-return-config': _20230901165000idpreturnconfig,\n\t'2024-06-20-140000-mail-reply': _20240620140000mailreply,\n\t'2024-08-26-120000-passwordless': _20240826120000passwordless,\n\t'2025-04-16-180000-config-up': _20250416180000configup,\n\t'2025-04-17-160000-auth-log': _20250417160000authlog,\n\t'2026-05-12-120000-api-key-session-tracking': _20260512120000apikeysessiontracking,\n\t'2026-05-12-130000-api-key-trust-forwarded-info': _20260512130000apikeytrustforwardedinfo,\n\t'2026-05-13-120000-auth-log-event-data': _20260513120000authlogeventdata,\n\t'2026-05-13-130000-anti-abuse': _20260513130000antiabuse,\n\t'2026-05-14-100000-auth-log-admin-actions': _20260514100000authlogadminactions,\n\t'2026-05-15-120000-config-reveal-login-method': _20260515120000configreveallogmethod,\n\t'2026-05-21-100000-person-mfa': _20260521100000personmfa,\n\t'2026-05-21-110000-mfa-foundation': _20260521110000mfafoundation,\n\t'2026-05-21-120000-email-otp': _20260521120000emailotp,\n\t'2026-05-21-130000-api-key-session-policy': _20260521130000apikeysessionpolicy,\n\t'2026-05-21-140000-mfa-grace-duration': _20260521140000mfagraceduration,\n\t'2026-05-21-150000-email-otp-rate-limit': _20260521150000emailotpratelimit,\n\t'2026-05-26-120000-email-verification-types': _20260526120000emailverificationtypes,\n\t'2026-05-26-120010-email-verification': _20260526120010emailverification,\n\t'2026-05-26-130000-email-change-verification-config': _20260526130000emailchangeverificationconfig,\n\t'2026-05-26-130010-idp-require-verified-email': _20260526130010idprequireverifiedemail,\n\t'2026-05-26-130020-email-verification-rate-limit': _20260526130020emailverificationratelimit,\n\t'2026-05-26-130030-captcha-protect-flows': _20260526130030captchaprotectflows,\n\t'2026-05-26-140000-idp-session': _20260526140000idpsession,\n\t'2026-06-08-100000-idp-assume-email-verified': _20260608100000idpassumeemailverified,\n\t'2026-06-16-120000-login-anomaly-detection': _20260616120000loginanomalydetection,\n\t'2026-06-16-130000-idp-logout': _20260616130000idplogout,\n\t'2026-06-18-120000-idp-claim-mapping': _20260618120000idpclaimmapping,\n\t'2026-08-03-120000-person-enable-auth-log': _20260803120000personenableauthlog,\n\t'2026-08-04-120000-config-panel': _20260804120000configpanel,\n}\n\nexport class TenantMigrationsRunner {\n\tconstructor(\n\t\tprivate readonly db: DatabaseConfig,\n\t\tprivate readonly schema: string,\n\t\tprivate readonly tenantCredentials: TenantCredentials,\n\t\tprivate readonly providers: Pick<Providers, 'bcrypt' \| 'uuid'>,\n\t) {\n\t}\n\n\tpublic async run(logger: Logger): Promise<{ name: string }[]> {\n\t\tawait createDatabaseIfNotExists(this.db, message => typeof message === 'string' ? logger.warn(message) : logger.error(message))\n\t\tconst connection = Connection.createSingle(this.db, err => logger.error(err))\n\t\tconst result = await connection.scope(async connection => {\n\t\t\tconst migrationsResolver = new SnapshotMigrationResolver(snapshot, migrations)\n\n\t\t\tconst innerRunner = new DbMigrationsRunner<TenantMigrationArgs>(connection, this.schema, migrationsResolver)\n\t\t\treturn await innerRunner.migrate(message => logger.warn(message), {\n\t\t\t\tgetCredentials: async () => ({\n\t\t\t\t\tloginTokenHash: this.tenantCredentials.loginToken ? computeTokenHash(this.tenantCredentials.loginToken) : undefined,\n\t\t\t\t\trootTokenHash: this.tenantCredentials.rootTokenHash\n\t\t\t\t\t\t?? (this.tenantCredentials.rootToken ? computeTokenHash(this.tenantCredentials.rootToken) : undefined),\n\t\t\t\t\trootEmail: this.tenantCredentials.rootEmail,\n\t\t\t\t\trootPasswordBcrypted: this.tenantCredentials.rootPassword ? await this.providers.bcrypt(this.tenantCredentials.rootPassword) : undefined,\n\t\t\t\t}),\n\t\t\t\tproviders: this.providers,\n\t\t\t})\n\t\t})\n\t\tawait connection.end()\n\t\treturn result\n\t}\n}\n"],"names":["connection","DbMigrationsRunner"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0FA,MAAM,aAAa;AAAA,EAClB,0BAA0B;AAAA,EAC1B,sCAAsC;AAAA,EACtC,mCAAmC;AAAA,EACnC,+BAA+B;AAAA,EAC/B,kCAAkC;AAAA,EAClC,wCAAwC;AAAA,EACxC,yCAAyC;AAAA,EACzC,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,qCAAqC;AAAA,EACrC,2BAA2B;AAAA,EAC3B,+BAA+B;AAAA,EAC/B,mCAAmC;AAAA,EACnC,wCAAwC;AAAA,EACxC,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,2CAA2C;AAAA,EAC3C,uCAAuC;AAAA,EACvC,+BAA+B;AAAA,EAC/B,oCAAoC;AAAA,EACpC,qCAAqC;AAAA,EACrC,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,gDAAgD;AAAA,EAChD,4CAA4C;AAAA,EAC5C,iCAAiC;AAAA,EACjC,sCAAsC;AAAA,EACtC,gCAAgC;AAAA,EAChC,2CAA2C;AAAA,EAC3C,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,0CAA0C;AAAA,EAC1C,4CAA4C;AAAA,EAC5C,qCAAqC;AAAA,EACrC,uCAAuC;AAAA,EACvC,gCAAgC;AAAA,EAChC,kCAAkC;AAAA,EAClC,+BAA+B;AAAA,EAC/B,8BAA8B;AAAA,EAC9B,8CAA8C;AAAA,EAC9C,kDAAkD;AAAA,EAClD,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,4CAA4C;AAAA,EAC5C,gDAAgD;AAAA,EAChD,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,+BAA+B;AAAA,EAC/B,4CAA4C;AAAA,EAC5C,wCAAwC;AAAA,EACxC,0CAA0C;AAAA,EAC1C,8CAA8C;AAAA,EAC9C,wCAAwC;AAAA,EACxC,sDAAsD;AAAA,EACtD,gDAAgD;AAAA,EAChD,mDAAmD;AAAA,EACnD,2CAA2C;AAAA,EAC3C,iCAAiC;AAAA,EACjC,+CAA+C;AAAA,EAC/C,6CAA6C;AAAA,EAC7C,gCAAgC;AAAA,EAChC,uCAAuC;AAAA,EACvC,4CAA4C;AAAA,EAC5C,kCAAkC;AACnC;AAEO,MAAM,uBAAuB;AAAA,EACnC,YACkB,IACA,QACA,mBACA,WAChB;AAJgB,SAAA,KAAA;AACA,SAAA,SAAA;AACA,SAAA,oBAAA;AACA,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,IAAI,QAA6C;AAC7D,UAAM,0BAA0B,KAAK,IAAI,CAAA,YAAW,OAAO,YAAY,WAAW,OAAO,KAAK,OAAO,IAAI,OAAO,MAAM,OAAO,CAAC;AAC9H,UAAM,aAAa,WAAW,aAAa,KAAK,IAAI,CAAA,QAAO,OAAO,MAAM,GAAG,CAAC;AAC5E,UAAM,SAAS,MAAM,WAAW,MAAM,OAAMA,gBAAc;AACzD,YAAM,qBAAqB,IAAI,0BAA0B,UAAU,UAAU;AAE7E,YAAM,cAAc,IAAIC,iBAAwCD,aAAY,KAAK,QAAQ,kBAAkB;AAC3G,aAAO,MAAM,YAAY,QAAQ,aAAW,OAAO,KAAK,OAAO,GAAG;AAAA,QACjE,gBAAgB,aAAa;AAAA,UAC5B,gBAAgB,KAAK,kBAAkB,aAAa,iBAAiB,KAAK,kBAAkB,UAAU,IAAI;AAAA,UAC1G,eAAe,KAAK,kBAAkB,kBACjC,KAAK,kBAAkB,YAAY,iBAAiB,KAAK,kBAAkB,SAAS,IAAI;AAAA,UAC7F,WAAW,KAAK,kBAAkB;AAAA,UAClC,sBAAsB,KAAK,kBAAkB,eAAe,MAAM,KAAK,UAAU,OAAO,KAAK,kBAAkB,YAAY,IAAI;AAAA,QAAA;AAAA,QAEhI,WAAW,KAAK;AAAA,MAAA,CAChB;AAAA,IACF,CAAC;AACD,UAAM,WAAW,IAAA;AACjB,WAAO;AAAA,EACR;AACD;"}

package/dist/development/src/migrations/snapshot.cjs CHANGED Viewed

@@ -54,7 +54,10 @@ CREATE TYPE "auth_log_type" AS ENUM (
     'unusual_login_detected',
     'step_up_required',
     'idp_logout_initiated',
-    'idp_backchannel_logout'
+    'idp_backchannel_logout',
+    'idp_role_mapped',
+    'idp_role_mapping_failed',
+    'person_enable'
 );
 CREATE TYPE "config_policy" AS ENUM (
     'always',
@@ -177,6 +180,8 @@ CREATE TABLE "config" (
     "login_anomaly_history_size" integer DEFAULT 10 NOT NULL,
     "login_anomaly_email_threshold" integer DEFAULT 1 NOT NULL,
     "login_anomaly_step_up_threshold" integer DEFAULT 3 NOT NULL,
+    "panel_global_roles" "text"[] DEFAULT '{super_admin,project_admin}'::"text"[] NOT NULL,
+    "panel_project_roles" "text"[] DEFAULT '{admin}'::"text"[] NOT NULL,
     CONSTRAINT "config_captcha_complete" CHECK ((("captcha_provider" IS NULL) OR (("captcha_secret" IS NOT NULL) AND ("captcha_secret_version" IS NOT NULL)))),
     CONSTRAINT "config_captcha_provider_check" CHECK ((("captcha_provider" IS NULL) OR ("captcha_provider" = ANY (ARRAY['turnstile'::"text", 'hcaptcha'::"text", 'recaptchaV3'::"text"]))))
 );

package/dist/development/src/migrations/snapshot.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"snapshot.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":["createCredentials"],"mappings":";;AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CA+bZ;AAEA,QAAMA,kBAAAA,kBAAkB,SAAS,IAAI;AACtC;;"}
1	+ {"version":3,"file":"snapshot.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout',\n 'idp_role_mapped',\n 'idp_role_mapping_failed',\n 'person_enable'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n \"panel_global_roles\" \"text\"[] DEFAULT '{super_admin,project_admin}'::\"text\"[] NOT NULL,\n \"panel_project_roles\" \"text\"[] DEFAULT '{admin}'::\"text\"[] NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":["createCredentials"],"mappings":";;AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAocZ;AAEA,QAAMA,kBAAAA,kBAAkB,SAAS,IAAI;AACtC;;"}

package/dist/development/src/migrations/snapshot.js CHANGED Viewed

@@ -53,7 +53,10 @@ CREATE TYPE "auth_log_type" AS ENUM (
     'unusual_login_detected',
     'step_up_required',
     'idp_logout_initiated',
-    'idp_backchannel_logout'
+    'idp_backchannel_logout',
+    'idp_role_mapped',
+    'idp_role_mapping_failed',
+    'person_enable'
 );
 CREATE TYPE "config_policy" AS ENUM (
     'always',
@@ -176,6 +179,8 @@ CREATE TABLE "config" (
     "login_anomaly_history_size" integer DEFAULT 10 NOT NULL,
     "login_anomaly_email_threshold" integer DEFAULT 1 NOT NULL,
     "login_anomaly_step_up_threshold" integer DEFAULT 3 NOT NULL,
+    "panel_global_roles" "text"[] DEFAULT '{super_admin,project_admin}'::"text"[] NOT NULL,
+    "panel_project_roles" "text"[] DEFAULT '{admin}'::"text"[] NOT NULL,
     CONSTRAINT "config_captcha_complete" CHECK ((("captcha_provider" IS NULL) OR (("captcha_secret" IS NOT NULL) AND ("captcha_secret_version" IS NOT NULL)))),
     CONSTRAINT "config_captcha_provider_check" CHECK ((("captcha_provider" IS NULL) OR ("captcha_provider" = ANY (ARRAY['turnstile'::"text", 'hcaptcha'::"text", 'recaptchaV3'::"text"]))))
 );

package/dist/development/src/migrations/snapshot.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CA+bZ;AAEA,QAAM,kBAAkB,SAAS,IAAI;AACtC;"}
1	+ {"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout',\n 'idp_role_mapped',\n 'idp_role_mapping_failed',\n 'person_enable'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n \"panel_global_roles\" \"text\"[] DEFAULT '{super_admin,project_admin}'::\"text\"[] NOT NULL,\n \"panel_project_roles\" \"text\"[] DEFAULT '{admin}'::\"text\"[] NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAocZ;AAEA,QAAM,kBAAkB,SAAS,IAAI;AACtC;"}

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.cjs CHANGED Viewed

@@ -10,8 +10,8 @@ class UpdateConfigurationCommand {
     const rl = this.configuration.rateLimits;
     let captchaSecretCol;
     let captchaSecretVersionCol;
-    if (captcha?.secret !== void 0) {
-      if (captcha.secret === "" || captcha.secret === null) {
+    if (captcha?.secret !== void 0 && captcha.secret !== null) {
+      if (captcha.secret === "") {
         captchaSecretCol = null;
         captchaSecretVersionCol = null;
       } else {
@@ -66,7 +66,9 @@ class UpdateConfigurationCommand {
         rate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? void 0,
         rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? void 0,
         rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? void 0,
-        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0
+        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0,
+        panel_global_roles: this.configuration.panel?.globalRoles ?? void 0,
+        panel_project_roles: this.configuration.panel?.projectRoles ?? void 0
       }
     ).execute(db);
     if (!result) {

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UpdateConfigurationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// ~~Encrypt~~ ~~captcha~~ ~~secret~~ at ~~rest.~~ ~~Empty~~ ~~string~~ ~~clears~~ ~~the~~ ~~value;\n\t\t// non-~~empty ~~re-encrypts~~ so ~~we always rotate to the latest key version~~.\n\t\tlet captchaSecretCol: Buffer \| null \| undefined\n\t\tlet captchaSecretVersionCol: number \| null \| undefined\n\t\tif (captcha?.secret !== undefined) {\n\t\t\tif (captcha.secret === '' ~~\|\| captcha.secret === null~~) {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) \| Exclude<ConfigRow[K], IPostgresInterval> \| undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;~~AAI9B~~,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,~~QAAW;AAClC~~,~~UAAI,~~QAAQ,WAAW,MAAM,QAAQ,WAAW,~~MAAM~~;~~AACrD~~,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,MAAA;AAAA,~~IACpF~~,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;;"}
1	+ {"version":3,"file":"UpdateConfigurationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// Null and omission preserve the stored secret; only an empty string clears it.\n\t\tlet captchaSecretCol: Buffer \| null \| undefined\n\t\tlet captchaSecretVersionCol: number \| null \| undefined\n\t\tif (captcha?.secret !== undefined && captcha.secret !== null) {\n\t\t\tif (captcha.secret === '') {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t\tpanel_global_roles: this.configuration.panel?.globalRoles ?? undefined,\n\t\t\t\t\tpanel_project_roles: this.configuration.panel?.projectRoles ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) \| Exclude<ConfigRow[K], IPostgresInterval> \| undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;AAG9B,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC7D,UAAI,QAAQ,WAAW,IAAI;AAC1B,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,uBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,QACnF,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,qBAAqB,KAAK,cAAc,OAAO,gBAAgB;AAAA,MAAA;AAAA,IAChE,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;;"}

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.js CHANGED Viewed

@@ -8,8 +8,8 @@ class UpdateConfigurationCommand {
     const rl = this.configuration.rateLimits;
     let captchaSecretCol;
     let captchaSecretVersionCol;
-    if (captcha?.secret !== void 0) {
-      if (captcha.secret === "" || captcha.secret === null) {
+    if (captcha?.secret !== void 0 && captcha.secret !== null) {
+      if (captcha.secret === "") {
         captchaSecretCol = null;
         captchaSecretVersionCol = null;
       } else {
@@ -64,7 +64,9 @@ class UpdateConfigurationCommand {
         rate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? void 0,
         rate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? void 0,
         rate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? void 0,
-        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0
+        rate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? void 0,
+        panel_global_roles: this.configuration.panel?.globalRoles ?? void 0,
+        panel_project_roles: this.configuration.panel?.projectRoles ?? void 0
       }
     ).execute(db);
     if (!result) {

package/dist/development/src/model/commands/configuration/UpdateConfigurationCommand.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UpdateConfigurationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// ~~Encrypt~~ ~~captcha~~ ~~secret~~ at ~~rest.~~ ~~Empty~~ ~~string~~ ~~clears~~ ~~the~~ ~~value;\n\t\t// non-~~empty ~~re-encrypts~~ so ~~we always rotate to the latest key version~~.\n\t\tlet captchaSecretCol: Buffer \| null \| undefined\n\t\tlet captchaSecretVersionCol: number \| null \| undefined\n\t\tif (captcha?.secret !== undefined) {\n\t\t\tif (captcha.secret === '' ~~\|\| captcha.secret === null~~) {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) \| Exclude<ConfigRow[K], IPostgresInterval> \| undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;~~AAI9B~~,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,~~QAAW;AAClC~~,~~UAAI,~~QAAQ,WAAW,MAAM,QAAQ,WAAW,~~MAAM~~;~~AACrD~~,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,MAAA;AAAA,~~IACpF~~,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;"}
1	+ {"version":3,"file":"UpdateConfigurationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/configuration/UpdateConfigurationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { ConfigInput } from '../../../schema/index.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { ConfigRow } from '../../type/Config.js'\nimport { IPostgresInterval } from 'postgres-interval'\n\nexport class UpdateConfigurationCommand implements Command<void> {\n\tconstructor(\n\t\tprivate readonly configuration: ConfigInput,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst captcha = this.configuration.captcha\n\t\tconst rl = this.configuration.rateLimits\n\n\t\t// Null and omission preserve the stored secret; only an empty string clears it.\n\t\tlet captchaSecretCol: Buffer \| null \| undefined\n\t\tlet captchaSecretVersionCol: number \| null \| undefined\n\t\tif (captcha?.secret !== undefined && captcha.secret !== null) {\n\t\t\tif (captcha.secret === '') {\n\t\t\t\tcaptchaSecretCol = null\n\t\t\t\tcaptchaSecretVersionCol = null\n\t\t\t} else {\n\t\t\t\tconst encrypted = await providers.encrypt(Buffer.from(captcha.secret, 'utf8'))\n\t\t\t\tcaptchaSecretCol = encrypted.value\n\t\t\t\tcaptchaSecretVersionCol = encrypted.version\n\t\t\t}\n\t\t}\n\n\t\tconst result = await UpdateBuilder.create()\n\t\t\t.table('config')\n\t\t\t.where({ id: 'singleton' })\n\t\t\t.values(\n\t\t\t\t{\n\t\t\t\t\tpasswordless_enabled: this.configuration.passwordless?.enabled ?? undefined,\n\t\t\t\t\tsignup_require_email_verification: this.configuration.signup?.requireEmailVerification ?? undefined,\n\t\t\t\t\trequire_email_change_verification: this.configuration.emailChange?.requireVerification ?? undefined,\n\t\t\t\t\tpasswordless_url: this.configuration.passwordless?.url,\n\t\t\t\t\tpasswordless_expiration: this.configuration.passwordless?.expiration ?? undefined,\n\t\t\t\t\tpassword_min_length: this.configuration.password?.minLength ?? undefined,\n\t\t\t\t\tpassword_require_uppercase: this.configuration.password?.requireUppercase ?? undefined,\n\t\t\t\t\tpassword_require_lowercase: this.configuration.password?.requireLowercase ?? undefined,\n\t\t\t\t\tpassword_require_digit: this.configuration.password?.requireDigit ?? undefined,\n\t\t\t\t\tpassword_require_special: this.configuration.password?.requireSpecial ?? undefined,\n\t\t\t\t\tpassword_pattern: this.configuration.password?.pattern,\n\t\t\t\t\tpassword_check_blacklist: this.configuration.password?.checkBlacklist ?? undefined,\n\t\t\t\t\tpassword_check_hibp: this.configuration.password?.checkHibp ?? undefined,\n\t\t\t\t\tlogin_base_backoff: this.configuration.login?.baseBackoff ?? undefined,\n\t\t\t\t\tlogin_max_backoff: this.configuration.login?.maxBackoff ?? undefined,\n\t\t\t\t\tlogin_attempt_window: this.configuration.login?.attemptWindow ?? undefined,\n\t\t\t\t\tlogin_reveal_user_exits: this.configuration.login?.revealUserExists ?? undefined,\n\t\t\t\t\tlogin_reveal_login_method: this.configuration.login?.revealLoginMethod ?? undefined,\n\t\t\t\t\tlogin_default_token_expiration: this.configuration.login?.defaultTokenExpiration ?? undefined,\n\t\t\t\t\tlogin_max_token_expiration: this.configuration.login?.maxTokenExpiration,\n\t\t\t\t\tlogin_mfa_grace_duration: this.configuration.login?.mfaGraceDuration ?? undefined,\n\t\t\t\t\tlogin_anomaly_detection_enabled: this.configuration.login?.anomalyDetection?.enabled ?? undefined,\n\t\t\t\t\tlogin_anomaly_history_size: this.configuration.login?.anomalyDetection?.historySize ?? undefined,\n\t\t\t\t\tlogin_anomaly_email_threshold: this.configuration.login?.anomalyDetection?.emailThreshold ?? undefined,\n\t\t\t\t\tlogin_anomaly_step_up_threshold: this.configuration.login?.anomalyDetection?.stepUpThreshold ?? undefined,\n\t\t\t\t\tcaptcha_provider: captcha?.provider !== undefined ? captcha.provider : undefined,\n\t\t\t\t\tcaptcha_secret: captchaSecretCol,\n\t\t\t\t\tcaptcha_secret_version: captchaSecretVersionCol,\n\t\t\t\t\tcaptcha_threshold: captcha?.threshold !== undefined ? captcha.threshold : undefined,\n\t\t\t\t\tcaptcha_protect_sign_up: captcha?.protect?.signUp ?? undefined,\n\t\t\t\t\tcaptcha_protect_password_reset: captcha?.protect?.passwordReset ?? undefined,\n\t\t\t\t\tcaptcha_protect_passwordless_init: captcha?.protect?.passwordlessInit ?? undefined,\n\t\t\t\t\tcaptcha_protect_email_verification: captcha?.protect?.emailVerification ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_limit: rl?.signUpPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_sign_up_per_ip_window: rl?.signUpPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_limit: rl?.loginPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_login_per_ip_window: rl?.loginPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_limit: rl?.passwordResetPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_password_reset_per_ip_window: rl?.passwordResetPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_limit: rl?.passwordlessInitPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_passwordless_init_per_ip_window: rl?.passwordlessInitPerIp?.window ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_limit: rl?.emailOtpPerPerson?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_otp_per_person_window: rl?.emailOtpPerPerson?.window ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_limit: rl?.emailVerificationPerIp?.limit ?? undefined,\n\t\t\t\t\trate_limit_email_verification_per_ip_window: rl?.emailVerificationPerIp?.window ?? undefined,\n\t\t\t\t\tpanel_global_roles: this.configuration.panel?.globalRoles ?? undefined,\n\t\t\t\t\tpanel_project_roles: this.configuration.panel?.projectRoles ?? undefined,\n\t\t\t\t} satisfies {\n\t\t\t\t\t[K in keyof ConfigRow]: (IPostgresInterval extends ConfigRow[K] ? string : never) \| Exclude<ConfigRow[K], IPostgresInterval> \| undefined\n\t\t\t\t},\n\t\t\t)\n\t\t\t.execute(db)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAMO,MAAM,2BAAoD;AAAA,EAChE,YACkB,eAChB;AADgB,SAAA,gBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,UAAU,KAAK,cAAc;AACnC,UAAM,KAAK,KAAK,cAAc;AAG9B,QAAI;AACJ,QAAI;AACJ,QAAI,SAAS,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC7D,UAAI,QAAQ,WAAW,IAAI;AAC1B,2BAAmB;AACnB,kCAA0B;AAAA,MAC3B,OAAO;AACN,cAAM,YAAY,MAAM,UAAU,QAAQ,OAAO,KAAK,QAAQ,QAAQ,MAAM,CAAC;AAC7E,2BAAmB,UAAU;AAC7B,kCAA0B,UAAU;AAAA,MACrC;AAAA,IACD;AAEA,UAAM,SAAS,MAAMA,gBAAc,OAAA,EACjC,MAAM,QAAQ,EACd,MAAM,EAAE,IAAI,YAAA,CAAa,EACzB;AAAA,MACA;AAAA,QACC,sBAAsB,KAAK,cAAc,cAAc,WAAW;AAAA,QAClE,mCAAmC,KAAK,cAAc,QAAQ,4BAA4B;AAAA,QAC1F,mCAAmC,KAAK,cAAc,aAAa,uBAAuB;AAAA,QAC1F,kBAAkB,KAAK,cAAc,cAAc;AAAA,QACnD,yBAAyB,KAAK,cAAc,cAAc,cAAc;AAAA,QACxE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,4BAA4B,KAAK,cAAc,UAAU,oBAAoB;AAAA,QAC7E,wBAAwB,KAAK,cAAc,UAAU,gBAAgB;AAAA,QACrE,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,kBAAkB,KAAK,cAAc,UAAU;AAAA,QAC/C,0BAA0B,KAAK,cAAc,UAAU,kBAAkB;AAAA,QACzE,qBAAqB,KAAK,cAAc,UAAU,aAAa;AAAA,QAC/D,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,mBAAmB,KAAK,cAAc,OAAO,cAAc;AAAA,QAC3D,sBAAsB,KAAK,cAAc,OAAO,iBAAiB;AAAA,QACjE,yBAAyB,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACvE,2BAA2B,KAAK,cAAc,OAAO,qBAAqB;AAAA,QAC1E,gCAAgC,KAAK,cAAc,OAAO,0BAA0B;AAAA,QACpF,4BAA4B,KAAK,cAAc,OAAO;AAAA,QACtD,0BAA0B,KAAK,cAAc,OAAO,oBAAoB;AAAA,QACxE,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,WAAW;AAAA,QACxF,4BAA4B,KAAK,cAAc,OAAO,kBAAkB,eAAe;AAAA,QACvF,+BAA+B,KAAK,cAAc,OAAO,kBAAkB,kBAAkB;AAAA,QAC7F,iCAAiC,KAAK,cAAc,OAAO,kBAAkB,mBAAmB;AAAA,QAChG,kBAAkB,SAAS,aAAa,SAAY,QAAQ,WAAW;AAAA,QACvE,gBAAgB;AAAA,QAChB,wBAAwB;AAAA,QACxB,mBAAmB,SAAS,cAAc,SAAY,QAAQ,YAAY;AAAA,QAC1E,yBAAyB,SAAS,SAAS,UAAU;AAAA,QACrD,gCAAgC,SAAS,SAAS,iBAAiB;AAAA,QACnE,mCAAmC,SAAS,SAAS,oBAAoB;AAAA,QACzE,oCAAoC,SAAS,SAAS,qBAAqB;AAAA,QAC3E,iCAAiC,IAAI,aAAa,SAAS;AAAA,QAC3D,kCAAkC,IAAI,aAAa,UAAU;AAAA,QAC7D,+BAA+B,IAAI,YAAY,SAAS;AAAA,QACxD,gCAAgC,IAAI,YAAY,UAAU;AAAA,QAC1D,wCAAwC,IAAI,oBAAoB,SAAS;AAAA,QACzE,yCAAyC,IAAI,oBAAoB,UAAU;AAAA,QAC3E,2CAA2C,IAAI,uBAAuB,SAAS;AAAA,QAC/E,4CAA4C,IAAI,uBAAuB,UAAU;AAAA,QACjF,uCAAuC,IAAI,mBAAmB,SAAS;AAAA,QACvE,wCAAwC,IAAI,mBAAmB,UAAU;AAAA,QACzE,4CAA4C,IAAI,wBAAwB,SAAS;AAAA,QACjF,6CAA6C,IAAI,wBAAwB,UAAU;AAAA,QACnF,oBAAoB,KAAK,cAAc,OAAO,eAAe;AAAA,QAC7D,qBAAqB,KAAK,cAAc,OAAO,gBAAgB;AAAA,MAAA;AAAA,IAChE,EAIA,QAAQ,EAAE;AACZ,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAAA,EACD;AACD;"}

package/dist/development/src/model/commands/membership/{RemoveProjectMembershipsCommand.cjs → RemoveProjectMembershipCommand.cjs} RENAMED Viewed

@@ -16,4 +16,4 @@ class RemoveProjectMembershipCommand {
   }
 }
 exports.RemoveProjectMembershipCommand = RemoveProjectMembershipCommand;
-//# sourceMappingURL=RemoveProjectMembershipsCommand.cjs.map
+//# sourceMappingURL=RemoveProjectMembershipCommand.cjs.map

package/dist/development/src/model/commands/membership/RemoveProjectMembershipCommand.cjs.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"RemoveProjectMembershipCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["DeleteBuilder"],"mappings":";;;AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/membership/{RemoveProjectMembershipsCommand.js → RemoveProjectMembershipCommand.js} RENAMED Viewed

@@ -16,4 +16,4 @@ class RemoveProjectMembershipCommand {
 export {
   RemoveProjectMembershipCommand
 };
-//# sourceMappingURL=RemoveProjectMembershipsCommand.js.map
+//# sourceMappingURL=RemoveProjectMembershipCommand.js.map

package/dist/development/src/model/commands/membership/RemoveProjectMembershipCommand.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"RemoveProjectMembershipCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/RemoveProjectMembershipCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { DeleteBuilder } from '@contember/database'\n\nexport class RemoveProjectMembershipCommand implements Command<void> {\n\tconstructor(private readonly projectId: string, private readonly identityId: string, private readonly role: string) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<void> {\n\t\tawait DeleteBuilder.create()\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t\trole: this.role,\n\t\t\t})\n\t\t\t.from('project_membership')\n\t\t\t.execute(db)\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,+BAAwD;AAAA,EACpE,YAA6B,WAAoC,YAAqC,MAAc;AAAvF,SAAA,YAAA;AAAoC,SAAA,aAAA;AAAqC,SAAA,OAAA;AAAA,EAAe;AAAA,EAErH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAA0C;AAClE,UAAM,cAAc,OAAA,EAClB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,MAAM,KAAK;AAAA,IAAA,CACX,EACA,KAAK,oBAAoB,EACzB,QAAQ,EAAE;AAAA,EACb;AACD;"}