@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

package/dist/development/src/model/commands/membership/UpdateProjectMemberCommand.cjs

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const CreateOrUpdateProjectMembershipCommand = require("./CreateOrUpdateProjectMembershipCommand.cjs");
 const Database = require("@contember/database");
-const RemoveProjectMembershipsCommand = require("./RemoveProjectMembershipsCommand.cjs");
+const RemoveProjectMembershipCommand = require("./RemoveProjectMembershipCommand.cjs");
 const Response = require("../../utils/Response.cjs");
 class UpdateProjectMemberCommand {
   constructor(projectId, identityId, memberships) {
@@ -21,7 +21,7 @@ class UpdateProjectMemberCommand {
     try {
       for (const membershipUpdate of this.memberships) {
         if (membershipUpdate.operation === "remove") {
-          await bus.execute(new RemoveProjectMembershipsCommand.RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role));
+          await bus.execute(new RemoveProjectMembershipCommand.RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role));
         } else {
           await bus.execute(
             new CreateOrUpdateProjectMembershipCommand.CreateOrUpdateProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate)

package/dist/development/src/model/commands/membership/UpdateProjectMemberCommand.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectMemberCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/UpdateProjectMemberCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateProjectMemberErrorCode } from '../../../schema/index.js'\nimport { CreateOrUpdateProjectMembershipCommand } from './CreateOrUpdateProjectMembershipCommand.js'\nimport { SelectBuilder } from '@contember/database'\nimport { MembershipUpdateInput } from './types.js'\nimport { RemoveProjectMembershipCommand } from './RemoveProjectMembershipsCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\n\nexport class UpdateProjectMemberCommand implements Command<UpdateProjectMemberResponse> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly identityId: string,\n\t\tprivate readonly memberships: readonly MembershipUpdateInput[],\n\t) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<UpdateProjectMemberResponse> {\n\t\tconst result = await SelectBuilder.create()\n\t\t\t.select('id')\n\t\t\t.from('project_membership')\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new ResponseError('NOT_MEMBER', 'Not a project member')\n\t\t}\n\n\t\ttry {\n\t\t\tfor (const membershipUpdate of this.memberships) {\n\t\t\t\tif (membershipUpdate.operation === 'remove') {\n\t\t\t\t\tawait bus.execute(new RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role))\n\t\t\t\t} else {\n\t\t\t\t\tawait bus.execute(\n\t\t\t\t\t\tnew CreateOrUpdateProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk(null)\n\t\t} catch (e) {\n\t\t\tif (!(e instanceof Error)) {\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tswitch ((e as any).constraint) {\n\t\t\t\tcase 'project_membership_project':\n\t\t\t\t\treturn new ResponseError('PROJECT_NOT_FOUND', 'Project not found')\n\t\t\t\tdefault:\n\t\t\t\t\tthrow e\n\t\t\t}\n\t\t}\n\t}\n}\nexport type UpdateProjectMemberResponse = Response<null, UpdateProjectMemberErrorCode>\n"],"names":["SelectBuilder","ResponseError","RemoveProjectMembershipCommand","CreateOrUpdateProjectMembershipCommand","ResponseOk"],"mappings":";;;;;;AAQO,MAAM,2BAA2E;AAAA,EACvF,YACkB,WACA,YACA,aAChB;AAHgB,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAAiE;AACzF,UAAM,SAAS,MAAMA,uBAAc,SACjC,OAAO,IAAI,EACX,KAAK,oBAAoB,EACzB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,UAAU,EAAE;AACd,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO,IAAIC,SAAAA,cAAc,cAAc,sBAAsB;AAAA,IAC9D;AAEA,QAAI;AACH,iBAAW,oBAAoB,KAAK,aAAa;AAChD,YAAI,iBAAiB,cAAc,UAAU;AAC5C,gBAAM,IAAI,QAAQ,IAAIC,gCAAAA,+BAA+B,KAAK,WAAW,KAAK,YAAY,iBAAiB,IAAI,CAAC;AAAA,QAC7G,OAAO;AACN,gBAAM,IAAI;AAAA,YACT,IAAIC,uCAAAA,uCAAuC,KAAK,WAAW,KAAK,YAAY,gBAAgB;AAAA,UAAA;AAAA,QAE9F;AAAA,MACD;AAEA,aAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC3B,SAAS,GAAG;AACX,UAAI,EAAE,aAAa,QAAQ;AAC1B,cAAM;AAAA,MACP;AACA,cAAS,EAAU,YAAA;AAAA,QAClB,KAAK;AACJ,iBAAO,IAAIH,SAAAA,cAAc,qBAAqB,mBAAmB;AAAA,QAClE;AACC,gBAAM;AAAA,MAAA;AAAA,IAET;AAAA,EACD;AACD;;"}
+{"version":3,"file":"UpdateProjectMemberCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/UpdateProjectMemberCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateProjectMemberErrorCode } from '../../../schema/index.js'\nimport { CreateOrUpdateProjectMembershipCommand } from './CreateOrUpdateProjectMembershipCommand.js'\nimport { SelectBuilder } from '@contember/database'\nimport { MembershipUpdateInput } from './types.js'\nimport { RemoveProjectMembershipCommand } from './RemoveProjectMembershipCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\n\nexport class UpdateProjectMemberCommand implements Command<UpdateProjectMemberResponse> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly identityId: string,\n\t\tprivate readonly memberships: readonly MembershipUpdateInput[],\n\t) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<UpdateProjectMemberResponse> {\n\t\tconst result = await SelectBuilder.create()\n\t\t\t.select('id')\n\t\t\t.from('project_membership')\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new ResponseError('NOT_MEMBER', 'Not a project member')\n\t\t}\n\n\t\ttry {\n\t\t\tfor (const membershipUpdate of this.memberships) {\n\t\t\t\tif (membershipUpdate.operation === 'remove') {\n\t\t\t\t\tawait bus.execute(new RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role))\n\t\t\t\t} else {\n\t\t\t\t\tawait bus.execute(\n\t\t\t\t\t\tnew CreateOrUpdateProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk(null)\n\t\t} catch (e) {\n\t\t\tif (!(e instanceof Error)) {\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tswitch ((e as any).constraint) {\n\t\t\t\tcase 'project_membership_project':\n\t\t\t\t\treturn new ResponseError('PROJECT_NOT_FOUND', 'Project not found')\n\t\t\t\tdefault:\n\t\t\t\t\tthrow e\n\t\t\t}\n\t\t}\n\t}\n}\nexport type UpdateProjectMemberResponse = Response<null, UpdateProjectMemberErrorCode>\n"],"names":["SelectBuilder","ResponseError","RemoveProjectMembershipCommand","CreateOrUpdateProjectMembershipCommand","ResponseOk"],"mappings":";;;;;;AAQO,MAAM,2BAA2E;AAAA,EACvF,YACkB,WACA,YACA,aAChB;AAHgB,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAAiE;AACzF,UAAM,SAAS,MAAMA,uBAAc,SACjC,OAAO,IAAI,EACX,KAAK,oBAAoB,EACzB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,UAAU,EAAE;AACd,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO,IAAIC,SAAAA,cAAc,cAAc,sBAAsB;AAAA,IAC9D;AAEA,QAAI;AACH,iBAAW,oBAAoB,KAAK,aAAa;AAChD,YAAI,iBAAiB,cAAc,UAAU;AAC5C,gBAAM,IAAI,QAAQ,IAAIC,+BAAAA,+BAA+B,KAAK,WAAW,KAAK,YAAY,iBAAiB,IAAI,CAAC;AAAA,QAC7G,OAAO;AACN,gBAAM,IAAI;AAAA,YACT,IAAIC,uCAAAA,uCAAuC,KAAK,WAAW,KAAK,YAAY,gBAAgB;AAAA,UAAA;AAAA,QAE9F;AAAA,MACD;AAEA,aAAO,IAAIC,SAAAA,WAAW,IAAI;AAAA,IAC3B,SAAS,GAAG;AACX,UAAI,EAAE,aAAa,QAAQ;AAC1B,cAAM;AAAA,MACP;AACA,cAAS,EAAU,YAAA;AAAA,QAClB,KAAK;AACJ,iBAAO,IAAIH,SAAAA,cAAc,qBAAqB,mBAAmB;AAAA,QAClE;AACC,gBAAM;AAAA,MAAA;AAAA,IAET;AAAA,EACD;AACD;;"}

package/dist/development/src/model/commands/membership/UpdateProjectMemberCommand.js

@@ -1,6 +1,6 @@
 import { CreateOrUpdateProjectMembershipCommand } from "./CreateOrUpdateProjectMembershipCommand.js";
 import { SelectBuilder } from "@contember/database";
-import { RemoveProjectMembershipCommand } from "./RemoveProjectMembershipsCommand.js";
+import { RemoveProjectMembershipCommand } from "./RemoveProjectMembershipCommand.js";
 import { ResponseError, ResponseOk } from "../../utils/Response.js";
 class UpdateProjectMemberCommand {
   constructor(projectId, identityId, memberships) {

package/dist/development/src/model/commands/membership/UpdateProjectMemberCommand.js.map

@@ -1 +1 @@
-{"version":3,"file":"UpdateProjectMemberCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/UpdateProjectMemberCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateProjectMemberErrorCode } from '../../../schema/index.js'\nimport { CreateOrUpdateProjectMembershipCommand } from './CreateOrUpdateProjectMembershipCommand.js'\nimport { SelectBuilder } from '@contember/database'\nimport { MembershipUpdateInput } from './types.js'\nimport { RemoveProjectMembershipCommand } from './RemoveProjectMembershipsCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\n\nexport class UpdateProjectMemberCommand implements Command<UpdateProjectMemberResponse> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly identityId: string,\n\t\tprivate readonly memberships: readonly MembershipUpdateInput[],\n\t) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<UpdateProjectMemberResponse> {\n\t\tconst result = await SelectBuilder.create()\n\t\t\t.select('id')\n\t\t\t.from('project_membership')\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new ResponseError('NOT_MEMBER', 'Not a project member')\n\t\t}\n\n\t\ttry {\n\t\t\tfor (const membershipUpdate of this.memberships) {\n\t\t\t\tif (membershipUpdate.operation === 'remove') {\n\t\t\t\t\tawait bus.execute(new RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role))\n\t\t\t\t} else {\n\t\t\t\t\tawait bus.execute(\n\t\t\t\t\t\tnew CreateOrUpdateProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk(null)\n\t\t} catch (e) {\n\t\t\tif (!(e instanceof Error)) {\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tswitch ((e as any).constraint) {\n\t\t\t\tcase 'project_membership_project':\n\t\t\t\t\treturn new ResponseError('PROJECT_NOT_FOUND', 'Project not found')\n\t\t\t\tdefault:\n\t\t\t\t\tthrow e\n\t\t\t}\n\t\t}\n\t}\n}\nexport type UpdateProjectMemberResponse = Response<null, UpdateProjectMemberErrorCode>\n"],"names":[],"mappings":";;;;AAQO,MAAM,2BAA2E;AAAA,EACvF,YACkB,WACA,YACA,aAChB;AAHgB,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAAiE;AACzF,UAAM,SAAS,MAAM,cAAc,SACjC,OAAO,IAAI,EACX,KAAK,oBAAoB,EACzB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,UAAU,EAAE;AACd,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO,IAAI,cAAc,cAAc,sBAAsB;AAAA,IAC9D;AAEA,QAAI;AACH,iBAAW,oBAAoB,KAAK,aAAa;AAChD,YAAI,iBAAiB,cAAc,UAAU;AAC5C,gBAAM,IAAI,QAAQ,IAAI,+BAA+B,KAAK,WAAW,KAAK,YAAY,iBAAiB,IAAI,CAAC;AAAA,QAC7G,OAAO;AACN,gBAAM,IAAI;AAAA,YACT,IAAI,uCAAuC,KAAK,WAAW,KAAK,YAAY,gBAAgB;AAAA,UAAA;AAAA,QAE9F;AAAA,MACD;AAEA,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,SAAS,GAAG;AACX,UAAI,EAAE,aAAa,QAAQ;AAC1B,cAAM;AAAA,MACP;AACA,cAAS,EAAU,YAAA;AAAA,QAClB,KAAK;AACJ,iBAAO,IAAI,cAAc,qBAAqB,mBAAmB;AAAA,QAClE;AACC,gBAAM;AAAA,MAAA;AAAA,IAET;AAAA,EACD;AACD;"}
+{"version":3,"file":"UpdateProjectMemberCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/membership/UpdateProjectMemberCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateProjectMemberErrorCode } from '../../../schema/index.js'\nimport { CreateOrUpdateProjectMembershipCommand } from './CreateOrUpdateProjectMembershipCommand.js'\nimport { SelectBuilder } from '@contember/database'\nimport { MembershipUpdateInput } from './types.js'\nimport { RemoveProjectMembershipCommand } from './RemoveProjectMembershipCommand.js'\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\n\nexport class UpdateProjectMemberCommand implements Command<UpdateProjectMemberResponse> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly identityId: string,\n\t\tprivate readonly memberships: readonly MembershipUpdateInput[],\n\t) {}\n\n\tasync execute({ db, bus, providers }: Command.Args): Promise<UpdateProjectMemberResponse> {\n\t\tconst result = await SelectBuilder.create()\n\t\t\t.select('id')\n\t\t\t.from('project_membership')\n\t\t\t.where({\n\t\t\t\tproject_id: this.projectId,\n\t\t\t\tidentity_id: this.identityId,\n\t\t\t})\n\t\t\t.getResult(db)\n\t\tif (result.length === 0) {\n\t\t\treturn new ResponseError('NOT_MEMBER', 'Not a project member')\n\t\t}\n\n\t\ttry {\n\t\t\tfor (const membershipUpdate of this.memberships) {\n\t\t\t\tif (membershipUpdate.operation === 'remove') {\n\t\t\t\t\tawait bus.execute(new RemoveProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate.role))\n\t\t\t\t} else {\n\t\t\t\t\tawait bus.execute(\n\t\t\t\t\t\tnew CreateOrUpdateProjectMembershipCommand(this.projectId, this.identityId, membershipUpdate),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk(null)\n\t\t} catch (e) {\n\t\t\tif (!(e instanceof Error)) {\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tswitch ((e as any).constraint) {\n\t\t\t\tcase 'project_membership_project':\n\t\t\t\t\treturn new ResponseError('PROJECT_NOT_FOUND', 'Project not found')\n\t\t\t\tdefault:\n\t\t\t\t\tthrow e\n\t\t\t}\n\t\t}\n\t}\n}\nexport type UpdateProjectMemberResponse = Response<null, UpdateProjectMemberErrorCode>\n"],"names":[],"mappings":";;;;AAQO,MAAM,2BAA2E;AAAA,EACvF,YACkB,WACA,YACA,aAChB;AAHgB,SAAA,YAAA;AACA,SAAA,aAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,QAAQ,EAAE,IAAI,KAAK,aAAiE;AACzF,UAAM,SAAS,MAAM,cAAc,SACjC,OAAO,IAAI,EACX,KAAK,oBAAoB,EACzB,MAAM;AAAA,MACN,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,IAAA,CAClB,EACA,UAAU,EAAE;AACd,QAAI,OAAO,WAAW,GAAG;AACxB,aAAO,IAAI,cAAc,cAAc,sBAAsB;AAAA,IAC9D;AAEA,QAAI;AACH,iBAAW,oBAAoB,KAAK,aAAa;AAChD,YAAI,iBAAiB,cAAc,UAAU;AAC5C,gBAAM,IAAI,QAAQ,IAAI,+BAA+B,KAAK,WAAW,KAAK,YAAY,iBAAiB,IAAI,CAAC;AAAA,QAC7G,OAAO;AACN,gBAAM,IAAI;AAAA,YACT,IAAI,uCAAuC,KAAK,WAAW,KAAK,YAAY,gBAAgB;AAAA,UAAA;AAAA,QAE9F;AAAA,MACD;AAEA,aAAO,IAAI,WAAW,IAAI;AAAA,IAC3B,SAAS,GAAG;AACX,UAAI,EAAE,aAAa,QAAQ;AAC1B,cAAM;AAAA,MACP;AACA,cAAS,EAAU,YAAA;AAAA,QAClB,KAAK;AACJ,iBAAO,IAAI,cAAc,qBAAqB,mBAAmB;AAAA,QAClE;AACC,gBAAM;AAAA,MAAA;AAAA,IAET;AAAA,EACD;AACD;"}

package/dist/development/src/model/commands/person/EnablePersonCommand.cjs

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class EnablePersonCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db, providers }) {
+    await Database.UpdateBuilder.create().table("person").values({
+      disabled_at: null
+    }).where({
+      id: this.personId
+    }).execute(db);
+  }
+}
+exports.EnablePersonCommand = EnablePersonCommand;
+//# sourceMappingURL=EnablePersonCommand.cjs.map

package/dist/development/src/model/commands/person/EnablePersonCommand.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnablePersonCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/EnablePersonCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class EnablePersonCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.values({\n\t\t\t\tdisabled_at: null,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.personId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAGO,MAAM,oBAA6C;AAAA,EACzD,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM,QAAQ,EACd,OAAO;AAAA,MACP,aAAa;AAAA,IAAA,CACb,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/development/src/model/commands/person/EnablePersonCommand.js

@@ -0,0 +1,17 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
+class EnablePersonCommand {
+  constructor(personId) {
+    this.personId = personId;
+  }
+  async execute({ db, providers }) {
+    await UpdateBuilder$1.create().table("person").values({
+      disabled_at: null
+    }).where({
+      id: this.personId
+    }).execute(db);
+  }
+}
+export {
+  EnablePersonCommand
+};
+//# sourceMappingURL=EnablePersonCommand.js.map

package/dist/development/src/model/commands/person/EnablePersonCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnablePersonCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/EnablePersonCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class EnablePersonCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.values({\n\t\t\t\tdisabled_at: null,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.personId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,oBAA6C;AAAA,EACzD,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,MAAM,QAAQ,EACd,OAAO;AAAA,MACP,aAAa;AAAA,IAAA,CACb,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/development/src/model/queries/configuration/ConfigurationQuery.cjs

@@ -87,6 +87,10 @@ class ConfigurationQuery extends Database.DatabaseQuery {
           limit: result.rate_limit_email_verification_per_ip_limit,
           window: result.rate_limit_email_verification_per_ip_window
         }
+      },
+      panel: {
+        globalRoles: result.panel_global_roles,
+        projectRoles: result.panel_project_roles
       }
     };
   }

package/dist/development/src/model/queries/configuration/ConfigurationQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config.js'\nimport { Providers } from '../../providers.js'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tconstructor(private readonly providers: Providers) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\tconst captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === 'number'\n\t\t\t? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString('utf8')\n\t\t\t: null\n\n\t\treturn {\n\t\t\tsignup: {\n\t\t\t\trequireEmailVerification: result.signup_require_email_verification,\n\t\t\t},\n\t\t\temailChange: {\n\t\t\t\trequireVerification: result.require_email_change_verification,\n\t\t\t},\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t\tcheckHibp: result.password_check_hibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\trevealLoginMethod: result.login_reveal_login_method,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t\tmfaGraceDuration: result.login_mfa_grace_duration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: result.login_anomaly_detection_enabled,\n\t\t\t\t\thistorySize: result.login_anomaly_history_size,\n\t\t\t\t\temailThreshold: result.login_anomaly_email_threshold,\n\t\t\t\t\tstepUpThreshold: result.login_anomaly_step_up_threshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: result.captcha_provider,\n\t\t\t\tthreshold: result.captcha_threshold,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: result.captcha_protect_sign_up,\n\t\t\t\t\tpasswordReset: result.captcha_protect_password_reset,\n\t\t\t\t\tpasswordlessInit: result.captcha_protect_passwordless_init,\n\t\t\t\t\temailVerification: result.captcha_protect_email_verification,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptchaSecret,\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_sign_up_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_sign_up_per_ip_window,\n\t\t\t\t},\n\t\t\t\tloginPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_login_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_login_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordResetPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_password_reset_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_password_reset_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordlessInitPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_passwordless_init_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_passwordless_init_per_ip_window,\n\t\t\t\t},\n\t\t\t\temailOtpPerPerson: {\n\t\t\t\t\tlimit: result.rate_limit_email_otp_per_person_limit,\n\t\t\t\t\twindow: result.rate_limit_email_otp_per_person_window,\n\t\t\t\t},\n\t\t\t\temailVerificationPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_email_verification_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_email_verification_per_ip_window,\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal"],"mappings":";;;AAIO,MAAM,2BAA2BA,SAAAA,cAAsB;AAAA,EAC7D,YAA6B,WAAsB;AAClD,UAAA;AAD4B,SAAA,YAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAIC,SAAAA,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,UAAM,gBAAgB,OAAO,kBAAkB,OAAO,OAAO,2BAA2B,YACpF,MAAM,KAAK,UAAU,QAAQ,OAAO,gBAAgB,OAAO,sBAAsB,GAAG,MAAM,SAAS,MAAM,IAC1G;AAEH,WAAO;AAAA,MACN,QAAQ;AAAA,QACP,0BAA0B,OAAO;AAAA,MAAA;AAAA,MAElC,aAAa;AAAA,QACZ,qBAAqB,OAAO;AAAA,MAAA;AAAA,MAE7B,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,QACvB,WAAW,OAAO;AAAA,MAAA;AAAA,MAEnB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,mBAAmB,OAAO;AAAA,QAC1B,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,QAC3B,kBAAkB,OAAO;AAAA,QACzB,kBAAkB;AAAA,UACjB,SAAS,OAAO;AAAA,UAChB,aAAa,OAAO;AAAA,UACpB,gBAAgB,OAAO;AAAA,UACvB,iBAAiB,OAAO;AAAA,QAAA;AAAA,MACzB;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,eAAe,OAAO;AAAA,UACtB,kBAAkB,OAAO;AAAA,UACzB,mBAAmB,OAAO;AAAA,QAAA;AAAA,MAC3B;AAAA,MAED;AAAA,MACA,YAAY;AAAA,QACX,aAAa;AAAA,UACZ,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,YAAY;AAAA,UACX,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,oBAAoB;AAAA,UACnB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,uBAAuB;AAAA,UACtB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,mBAAmB;AAAA,UAClB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,wBAAwB;AAAA,UACvB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,MAChB;AAAA,IACD;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"ConfigurationQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config.js'\nimport { Providers } from '../../providers.js'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tconstructor(private readonly providers: Providers) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\tconst captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === 'number'\n\t\t\t? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString('utf8')\n\t\t\t: null\n\n\t\treturn {\n\t\t\tsignup: {\n\t\t\t\trequireEmailVerification: result.signup_require_email_verification,\n\t\t\t},\n\t\t\temailChange: {\n\t\t\t\trequireVerification: result.require_email_change_verification,\n\t\t\t},\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t\tcheckHibp: result.password_check_hibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\trevealLoginMethod: result.login_reveal_login_method,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t\tmfaGraceDuration: result.login_mfa_grace_duration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: result.login_anomaly_detection_enabled,\n\t\t\t\t\thistorySize: result.login_anomaly_history_size,\n\t\t\t\t\temailThreshold: result.login_anomaly_email_threshold,\n\t\t\t\t\tstepUpThreshold: result.login_anomaly_step_up_threshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: result.captcha_provider,\n\t\t\t\tthreshold: result.captcha_threshold,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: result.captcha_protect_sign_up,\n\t\t\t\t\tpasswordReset: result.captcha_protect_password_reset,\n\t\t\t\t\tpasswordlessInit: result.captcha_protect_passwordless_init,\n\t\t\t\t\temailVerification: result.captcha_protect_email_verification,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptchaSecret,\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_sign_up_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_sign_up_per_ip_window,\n\t\t\t\t},\n\t\t\t\tloginPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_login_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_login_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordResetPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_password_reset_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_password_reset_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordlessInitPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_passwordless_init_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_passwordless_init_per_ip_window,\n\t\t\t\t},\n\t\t\t\temailOtpPerPerson: {\n\t\t\t\t\tlimit: result.rate_limit_email_otp_per_person_limit,\n\t\t\t\t\twindow: result.rate_limit_email_otp_per_person_window,\n\t\t\t\t},\n\t\t\t\temailVerificationPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_email_verification_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_email_verification_per_ip_window,\n\t\t\t\t},\n\t\t\t},\n\t\t\tpanel: {\n\t\t\t\tglobalRoles: result.panel_global_roles,\n\t\t\t\tprojectRoles: result.panel_project_roles,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal"],"mappings":";;;AAIO,MAAM,2BAA2BA,SAAAA,cAAsB;AAAA,EAC7D,YAA6B,WAAsB;AAClD,UAAA;AAD4B,SAAA,YAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAIC,SAAAA,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,UAAM,gBAAgB,OAAO,kBAAkB,OAAO,OAAO,2BAA2B,YACpF,MAAM,KAAK,UAAU,QAAQ,OAAO,gBAAgB,OAAO,sBAAsB,GAAG,MAAM,SAAS,MAAM,IAC1G;AAEH,WAAO;AAAA,MACN,QAAQ;AAAA,QACP,0BAA0B,OAAO;AAAA,MAAA;AAAA,MAElC,aAAa;AAAA,QACZ,qBAAqB,OAAO;AAAA,MAAA;AAAA,MAE7B,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,QACvB,WAAW,OAAO;AAAA,MAAA;AAAA,MAEnB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,mBAAmB,OAAO;AAAA,QAC1B,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,QAC3B,kBAAkB,OAAO;AAAA,QACzB,kBAAkB;AAAA,UACjB,SAAS,OAAO;AAAA,UAChB,aAAa,OAAO;AAAA,UACpB,gBAAgB,OAAO;AAAA,UACvB,iBAAiB,OAAO;AAAA,QAAA;AAAA,MACzB;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,eAAe,OAAO;AAAA,UACtB,kBAAkB,OAAO;AAAA,UACzB,mBAAmB,OAAO;AAAA,QAAA;AAAA,MAC3B;AAAA,MAED;AAAA,MACA,YAAY;AAAA,QACX,aAAa;AAAA,UACZ,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,YAAY;AAAA,UACX,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,oBAAoB;AAAA,UACnB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,uBAAuB;AAAA,UACtB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,mBAAmB;AAAA,UAClB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,wBAAwB;AAAA,UACvB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,MAChB;AAAA,MAED,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,cAAc,OAAO;AAAA,MAAA;AAAA,IACtB;AAAA,EAEF;AACD;;"}

package/dist/development/src/model/queries/configuration/ConfigurationQuery.js

@@ -85,6 +85,10 @@ class ConfigurationQuery extends DatabaseQuery {
           limit: result.rate_limit_email_verification_per_ip_limit,
           window: result.rate_limit_email_verification_per_ip_window
         }
+      },
+      panel: {
+        globalRoles: result.panel_global_roles,
+        projectRoles: result.panel_project_roles
       }
     };
   }

package/dist/development/src/model/queries/configuration/ConfigurationQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config.js'\nimport { Providers } from '../../providers.js'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tconstructor(private readonly providers: Providers) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\tconst captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === 'number'\n\t\t\t? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString('utf8')\n\t\t\t: null\n\n\t\treturn {\n\t\t\tsignup: {\n\t\t\t\trequireEmailVerification: result.signup_require_email_verification,\n\t\t\t},\n\t\t\temailChange: {\n\t\t\t\trequireVerification: result.require_email_change_verification,\n\t\t\t},\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t\tcheckHibp: result.password_check_hibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\trevealLoginMethod: result.login_reveal_login_method,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t\tmfaGraceDuration: result.login_mfa_grace_duration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: result.login_anomaly_detection_enabled,\n\t\t\t\t\thistorySize: result.login_anomaly_history_size,\n\t\t\t\t\temailThreshold: result.login_anomaly_email_threshold,\n\t\t\t\t\tstepUpThreshold: result.login_anomaly_step_up_threshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: result.captcha_provider,\n\t\t\t\tthreshold: result.captcha_threshold,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: result.captcha_protect_sign_up,\n\t\t\t\t\tpasswordReset: result.captcha_protect_password_reset,\n\t\t\t\t\tpasswordlessInit: result.captcha_protect_passwordless_init,\n\t\t\t\t\temailVerification: result.captcha_protect_email_verification,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptchaSecret,\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_sign_up_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_sign_up_per_ip_window,\n\t\t\t\t},\n\t\t\t\tloginPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_login_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_login_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordResetPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_password_reset_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_password_reset_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordlessInitPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_passwordless_init_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_passwordless_init_per_ip_window,\n\t\t\t\t},\n\t\t\t\temailOtpPerPerson: {\n\t\t\t\t\tlimit: result.rate_limit_email_otp_per_person_limit,\n\t\t\t\t\twindow: result.rate_limit_email_otp_per_person_window,\n\t\t\t\t},\n\t\t\t\temailVerificationPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_email_verification_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_email_verification_per_ip_window,\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,2BAA2B,cAAsB;AAAA,EAC7D,YAA6B,WAAsB;AAClD,UAAA;AAD4B,SAAA,YAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAI,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,UAAM,gBAAgB,OAAO,kBAAkB,OAAO,OAAO,2BAA2B,YACpF,MAAM,KAAK,UAAU,QAAQ,OAAO,gBAAgB,OAAO,sBAAsB,GAAG,MAAM,SAAS,MAAM,IAC1G;AAEH,WAAO;AAAA,MACN,QAAQ;AAAA,QACP,0BAA0B,OAAO;AAAA,MAAA;AAAA,MAElC,aAAa;AAAA,QACZ,qBAAqB,OAAO;AAAA,MAAA;AAAA,MAE7B,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,QACvB,WAAW,OAAO;AAAA,MAAA;AAAA,MAEnB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,mBAAmB,OAAO;AAAA,QAC1B,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,QAC3B,kBAAkB,OAAO;AAAA,QACzB,kBAAkB;AAAA,UACjB,SAAS,OAAO;AAAA,UAChB,aAAa,OAAO;AAAA,UACpB,gBAAgB,OAAO;AAAA,UACvB,iBAAiB,OAAO;AAAA,QAAA;AAAA,MACzB;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,eAAe,OAAO;AAAA,UACtB,kBAAkB,OAAO;AAAA,UACzB,mBAAmB,OAAO;AAAA,QAAA;AAAA,MAC3B;AAAA,MAED;AAAA,MACA,YAAY;AAAA,QACX,aAAa;AAAA,UACZ,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,YAAY;AAAA,UACX,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,oBAAoB;AAAA,UACnB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,uBAAuB;AAAA,UACtB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,mBAAmB;AAAA,UAClB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,wBAAwB;AAAA,UACvB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,MAChB;AAAA,IACD;AAAA,EAEF;AACD;"}
+{"version":3,"file":"ConfigurationQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config.js'\nimport { Providers } from '../../providers.js'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tconstructor(private readonly providers: Providers) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\tconst captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === 'number'\n\t\t\t? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString('utf8')\n\t\t\t: null\n\n\t\treturn {\n\t\t\tsignup: {\n\t\t\t\trequireEmailVerification: result.signup_require_email_verification,\n\t\t\t},\n\t\t\temailChange: {\n\t\t\t\trequireVerification: result.require_email_change_verification,\n\t\t\t},\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t\tcheckHibp: result.password_check_hibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\trevealLoginMethod: result.login_reveal_login_method,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t\tmfaGraceDuration: result.login_mfa_grace_duration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: result.login_anomaly_detection_enabled,\n\t\t\t\t\thistorySize: result.login_anomaly_history_size,\n\t\t\t\t\temailThreshold: result.login_anomaly_email_threshold,\n\t\t\t\t\tstepUpThreshold: result.login_anomaly_step_up_threshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: result.captcha_provider,\n\t\t\t\tthreshold: result.captcha_threshold,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: result.captcha_protect_sign_up,\n\t\t\t\t\tpasswordReset: result.captcha_protect_password_reset,\n\t\t\t\t\tpasswordlessInit: result.captcha_protect_passwordless_init,\n\t\t\t\t\temailVerification: result.captcha_protect_email_verification,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptchaSecret,\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_sign_up_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_sign_up_per_ip_window,\n\t\t\t\t},\n\t\t\t\tloginPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_login_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_login_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordResetPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_password_reset_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_password_reset_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordlessInitPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_passwordless_init_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_passwordless_init_per_ip_window,\n\t\t\t\t},\n\t\t\t\temailOtpPerPerson: {\n\t\t\t\t\tlimit: result.rate_limit_email_otp_per_person_limit,\n\t\t\t\t\twindow: result.rate_limit_email_otp_per_person_window,\n\t\t\t\t},\n\t\t\t\temailVerificationPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_email_verification_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_email_verification_per_ip_window,\n\t\t\t\t},\n\t\t\t},\n\t\t\tpanel: {\n\t\t\t\tglobalRoles: result.panel_global_roles,\n\t\t\t\tprojectRoles: result.panel_project_roles,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,2BAA2B,cAAsB;AAAA,EAC7D,YAA6B,WAAsB;AAClD,UAAA;AAD4B,SAAA,YAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAI,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,UAAM,gBAAgB,OAAO,kBAAkB,OAAO,OAAO,2BAA2B,YACpF,MAAM,KAAK,UAAU,QAAQ,OAAO,gBAAgB,OAAO,sBAAsB,GAAG,MAAM,SAAS,MAAM,IAC1G;AAEH,WAAO;AAAA,MACN,QAAQ;AAAA,QACP,0BAA0B,OAAO;AAAA,MAAA;AAAA,MAElC,aAAa;AAAA,QACZ,qBAAqB,OAAO;AAAA,MAAA;AAAA,MAE7B,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,QACvB,WAAW,OAAO;AAAA,MAAA;AAAA,MAEnB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,mBAAmB,OAAO;AAAA,QAC1B,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,QAC3B,kBAAkB,OAAO;AAAA,QACzB,kBAAkB;AAAA,UACjB,SAAS,OAAO;AAAA,UAChB,aAAa,OAAO;AAAA,UACpB,gBAAgB,OAAO;AAAA,UACvB,iBAAiB,OAAO;AAAA,QAAA;AAAA,MACzB;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,eAAe,OAAO;AAAA,UACtB,kBAAkB,OAAO;AAAA,UACzB,mBAAmB,OAAO;AAAA,QAAA;AAAA,MAC3B;AAAA,MAED;AAAA,MACA,YAAY;AAAA,QACX,aAAa;AAAA,UACZ,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,YAAY;AAAA,UACX,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,oBAAoB;AAAA,UACnB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,uBAAuB;AAAA,UACtB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,mBAAmB;AAAA,UAClB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,wBAAwB;AAAA,UACvB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,MAChB;AAAA,MAED,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,cAAc,OAAO;AAAA,MAAA;AAAA,IACtB;AAAA,EAEF;AACD;"}

package/dist/development/src/model/queries/membership/ProjectMembersQuery.cjs

@@ -29,7 +29,7 @@ class ProjectMembersQuery extends Database.DatabaseQuery {
         return qb.where((it) => it.not((it2) => it2.exists(personQuery)));
       }
       return qb;
-    }).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
+    }).orderBy(["identity", "id"]).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
   }
 }
 exports.ProjectMembersQuery = ProjectMembersQuery;

package/dist/development/src/model/queries/membership/ProjectMembersQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["DatabaseQuery","SelectBuilder","ImplementationException","qb","it"],"mappings":";;;;AAIO,MAAM,4BAA4BA,SAAAA,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAMC,SAAAA,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAIC,WAAAA,wBAAA;AAAA,MACX;AAEA,YAAM,cAAcD,SAAAA,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAE,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;;"}
+{"version":3,"file":"ProjectMembersQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.orderBy(['identity', 'id'])\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["DatabaseQuery","SelectBuilder","ImplementationException","qb","it"],"mappings":";;;;AAIO,MAAM,4BAA4BA,SAAAA,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAMC,SAAAA,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAIC,WAAAA,wBAAA;AAAA,MACX;AAEA,YAAM,cAAcD,SAAAA,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAE,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,QAAQ,CAAC,YAAY,IAAI,CAAC,EAC1B,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;;"}

package/dist/development/src/model/queries/membership/ProjectMembersQuery.js

@@ -27,7 +27,7 @@ class ProjectMembersQuery extends DatabaseQuery {
         return qb.where((it) => it.not((it2) => it2.exists(personQuery)));
       }
       return qb;
-    }).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
+    }).orderBy(["identity", "id"]).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
   }
 }
 export {

package/dist/development/src/model/queries/membership/ProjectMembersQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["qb","it"],"mappings":";;AAIO,MAAM,4BAA4B,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAM,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAI,wBAAA;AAAA,MACX;AAEA,YAAM,cAAc,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAA,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;"}
+{"version":3,"file":"ProjectMembersQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.orderBy(['identity', 'id'])\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["qb","it"],"mappings":";;AAIO,MAAM,4BAA4B,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAM,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAI,wBAAA;AAAA,MACX;AAEA,YAAM,cAAc,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAA,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,QAAQ,CAAC,YAAY,IAAI,CAAC,EAC1B,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;"}

package/dist/development/src/model/queries/person/PersonQueryBuilderFactory.cjs

@@ -8,7 +8,7 @@ class PersonQueryBuilderFactory {
    * and the `identity` join that the full builder needs only for `roles`.
    */
   static createPersonListQueryBuilder() {
-    return Database.SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
+    return Database.SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).select(["person", "disabled_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
   }
   static createPersonQueryBuilder() {
     return Database.SelectBuilder.create().select(["person", "id"]).select(["person", "password_hash"]).select(["person_mfa", "totp_secret"], "otp_secret").select(["person_mfa", "totp_secret_version"], "otp_secret_version").select(["person_mfa", "totp_activated_at"], "otp_activated_at").select(["person_mfa", "totp_pending_secret"], "otp_pending_secret").select(["person_mfa", "totp_pending_version"], "otp_pending_version").select(["person_mfa", "totp_pending_created_at"], "otp_pending_created_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person", "disabled_at"]).select(["person", "passwordless_enabled"]).select(["person", "mfa_grace_until"]).select(["person", "email_verified_at"]).select(["person", "email_verification_required"]).select(["identity", "roles"]).from("person").join("identity", "identity", (expr) => expr.columnsEq(["identity", "id"], ["person", "identity_id"])).leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));

package/dist/development/src/model/queries/person/PersonQueryBuilderFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryBuilderFactory.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAA,SAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;;"}
+{"version":3,"file":"PersonQueryBuilderFactory.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,CAAA,SAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;;"}

package/dist/development/src/model/queries/person/PersonQueryBuilderFactory.js

@@ -6,7 +6,7 @@ class PersonQueryBuilderFactory {
    * and the `identity` join that the full builder needs only for `roles`.
    */
   static createPersonListQueryBuilder() {
-    return SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
+    return SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).select(["person", "disabled_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
   }
   static createPersonQueryBuilder() {
     return SelectBuilder.create().select(["person", "id"]).select(["person", "password_hash"]).select(["person_mfa", "totp_secret"], "otp_secret").select(["person_mfa", "totp_secret_version"], "otp_secret_version").select(["person_mfa", "totp_activated_at"], "otp_activated_at").select(["person_mfa", "totp_pending_secret"], "otp_pending_secret").select(["person_mfa", "totp_pending_version"], "otp_pending_version").select(["person_mfa", "totp_pending_created_at"], "otp_pending_created_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person", "disabled_at"]).select(["person", "passwordless_enabled"]).select(["person", "mfa_grace_until"]).select(["person", "email_verified_at"]).select(["person", "email_verification_required"]).select(["identity", "roles"]).from("person").join("identity", "identity", (expr) => expr.columnsEq(["identity", "id"], ["person", "identity_id"])).leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));

package/dist/development/src/model/queries/person/PersonQueryBuilderFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryBuilderFactory.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAA,SAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;"}
+{"version":3,"file":"PersonQueryBuilderFactory.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,CAAA,SAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;"}

package/dist/development/src/model/service/AuthLogService.cjs

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const CreateAuthLogEntryCommand = require("../commands/authLog/CreateAuthLogEntryCommand.cjs");
+const UnpersistedApiKeyManager = require("./apiKey/UnpersistedApiKeyManager.cjs");
+const invokedBy = (identityId) => UnpersistedApiKeyManager.isUnpersistedIdentityId(identityId) ? { metadata: { invokedByUnpersistedIdentityId: identityId } } : { invokedById: identityId };
 class AuthLogService {
   async logAuthAction(db, ctx, data) {
     const dataContainer = data.response.ok ? data.response.result ?? {} : data.response.metadata ?? {};
@@ -13,12 +15,14 @@ class AuthLogService {
     if (ctx.forwarderUserAgent !== void 0) {
       metadata.forwarderUserAgent = ctx.forwarderUserAgent;
     }
+    const invoker = invokedBy(ctx.identityId);
+    Object.assign(metadata, invoker.metadata);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
         success: data.response.ok,
         personInputIdentifier: data.personInput ?? authData?.data?.personInput,
         personId: data.personId ?? authData?.data?.personId,
-        invokedById: ctx.identityId,
+        invokedById: invoker.invokedById,
         type: data.type,
         identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
         errorCode: data.response.ok ? null : data.response.error,
@@ -40,10 +44,12 @@ class AuthLogService {
    * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
    */
   async logSessionEvent(db, entry) {
+    const invoker = invokedBy(entry.identityId);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
         type: entry.type,
-        invokedById: entry.identityId,
+        invokedById: invoker.invokedById,
+        metadata: invoker.metadata,
         personId: entry.personId ?? void 0,
         success: entry.success,
         ipAddress: entry.ipAddress,

package/dist/development/src/model/service/AuthLogService.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: ctx.identityId,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: entry.identityId,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["CreateAuthLogEntryCommand","AuthLogService"],"mappings":";;;AAMA,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AAEA,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,IAAI;AAAA,QACjB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUC,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;;"}
+{"version":3,"file":"AuthLogService.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\nimport { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'\n\n/**\n * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a\n * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort\n * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is\n * still recorded, just not as a reference.\n */\nconst invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>\n\tisUnpersistedIdentityId(identityId)\n\t\t? { metadata: { invokedByUnpersistedIdentityId: identityId } }\n\t\t: { invokedById: identityId }\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\t\tconst invoker = invokedBy(ctx.identityId)\n\t\tObject.assign(metadata, invoker.metadata)\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tconst invoker = invokedBy(entry.identityId)\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\tmetadata: invoker.metadata,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["isUnpersistedIdentityId","CreateAuthLogEntryCommand","AuthLogService"],"mappings":";;;;AAaA,MAAM,YAAY,CAAC,eAClBA,iDAAwB,UAAU,IAC/B,EAAE,UAAU,EAAE,gCAAgC,WAAA,EAAW,IACzD,EAAE,aAAa,WAAA;AAEnB,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AACA,UAAM,UAAU,UAAU,IAAI,UAAU;AACxC,WAAO,OAAO,UAAU,QAAQ,QAAQ;AAExC,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIC,oDAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,QAAQ;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,UAAU,UAAU,MAAM,UAAU;AAC1C,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,UAAU,QAAQ;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUC,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;;"}

package/dist/development/src/model/service/AuthLogService.js

@@ -1,4 +1,6 @@
 import { CreateAuthLogEntryCommand } from "../commands/authLog/CreateAuthLogEntryCommand.js";
+import { isUnpersistedIdentityId } from "./apiKey/UnpersistedApiKeyManager.js";
+const invokedBy = (identityId) => isUnpersistedIdentityId(identityId) ? { metadata: { invokedByUnpersistedIdentityId: identityId } } : { invokedById: identityId };
 class AuthLogService {
   async logAuthAction(db, ctx, data) {
     const dataContainer = data.response.ok ? data.response.result ?? {} : data.response.metadata ?? {};
@@ -11,12 +13,14 @@ class AuthLogService {
     if (ctx.forwarderUserAgent !== void 0) {
       metadata.forwarderUserAgent = ctx.forwarderUserAgent;
     }
+    const invoker = invokedBy(ctx.identityId);
+    Object.assign(metadata, invoker.metadata);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand({
         success: data.response.ok,
         personInputIdentifier: data.personInput ?? authData?.data?.personInput,
         personId: data.personId ?? authData?.data?.personId,
-        invokedById: ctx.identityId,
+        invokedById: invoker.invokedById,
         type: data.type,
         identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
         errorCode: data.response.ok ? null : data.response.error,
@@ -38,10 +42,12 @@ class AuthLogService {
    * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
    */
   async logSessionEvent(db, entry) {
+    const invoker = invokedBy(entry.identityId);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand({
         type: entry.type,
-        invokedById: entry.identityId,
+        invokedById: invoker.invokedById,
+        metadata: invoker.metadata,
         personId: entry.personId ?? void 0,
         success: entry.success,
         ipAddress: entry.ipAddress,

package/dist/development/src/model/service/AuthLogService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: ctx.identityId,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: entry.identityId,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["AuthLogService"],"mappings":";AAMA,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AAEA,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,IAAI;AAAA,QACjB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUA,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;"}
+{"version":3,"file":"AuthLogService.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\nimport { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'\n\n/**\n * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a\n * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort\n * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is\n * still recorded, just not as a reference.\n */\nconst invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>\n\tisUnpersistedIdentityId(identityId)\n\t\t? { metadata: { invokedByUnpersistedIdentityId: identityId } }\n\t\t: { invokedById: identityId }\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\t\tconst invoker = invokedBy(ctx.identityId)\n\t\tObject.assign(metadata, invoker.metadata)\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tconst invoker = invokedBy(entry.identityId)\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\tmetadata: invoker.metadata,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["AuthLogService"],"mappings":";;AAaA,MAAM,YAAY,CAAC,eAClB,wBAAwB,UAAU,IAC/B,EAAE,UAAU,EAAE,gCAAgC,WAAA,EAAW,IACzD,EAAE,aAAa,WAAA;AAEnB,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AACA,UAAM,UAAU,UAAU,IAAI,UAAU;AACxC,WAAO,OAAO,UAAU,QAAQ,QAAQ;AAExC,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,QAAQ;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,UAAU,UAAU,MAAM,UAAU;AAC1C,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,UAAU,QAAQ;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUA,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;"}

package/dist/development/src/model/service/IDPSignInManager.cjs

@@ -19,7 +19,9 @@ const CreatePersonIdentityProviderIdentifierCommand = require("../commands/perso
 const CreateIdentityCommand = require("../commands/identity/CreateIdentityCommand.cjs");
 const CreateAuthLogEntryCommand = require("../commands/authLog/CreateAuthLogEntryCommand.cjs");
 require("./idp/IDPRevalidation.cjs");
+const ClaimMapping = require("./idp/ClaimMapping.cjs");
 const IDPValidationError = require("./idp/IDPValidationError.cjs");
+require("@contember/schema-utils");
 const IDPResponseError = require("./idp/IDPResponseError.cjs");
 require("./idp/providers/AppleProvider.cjs");
 require("openid-client");
@@ -31,9 +33,10 @@ const CreateIdpSessionCommand = require("../commands/idp/CreateIdpSessionCommand
 const Password = require("../dtos/Password.cjs");
 const AuthLogService = require("./AuthLogService.cjs");
 class IDPSignInManager {
-  constructor(apiKeyManager, idpRegistry) {
+  constructor(apiKeyManager, idpRegistry, claimSyncService) {
     this.apiKeyManager = apiKeyManager;
     this.idpRegistry = idpRegistry;
+    this.claimSyncService = claimSyncService;
   }
   async signInIDP(dbContext, idpSlug, responseData, expiration, requestInfo, trustForwardedInfo) {
     return dbContext.transaction(async (db) => {
@@ -89,6 +92,27 @@ class IDPSignInManager {
           })
         });
       }
+      let mapping = null;
+      let claimMappingFailed = false;
+      try {
+        mapping = ClaimMapping.parseClaimMapping(provider.configuration);
+      } catch {
+        claimMappingFailed = true;
+      }
+      let claimMappingAudit = null;
+      if (mapping) {
+        const syncResult = await this.claimSyncService.sync(
+          db,
+          mapping,
+          claim,
+          { id: personRow.identity_id },
+          resolved.isNewPerson === true
+        );
+        claimMappingAudit = syncResult.audit;
+        if (syncResult.droppedUnsafeRules) {
+          claimMappingFailed = true;
+        }
+      }
       const { id: apiKeyId, token: sessionToken } = await this.apiKeyManager.createSessionApiKeyWithId(
         db,
         personRow.identity_id,
@@ -120,6 +144,9 @@ class IDPSignInManager {
         person: personRow,
         token: sessionToken,
         idpResponse: claim,
+        claimMappingAudit,
+        claimMappingFailed,
+        identityProviderId: provider.id,
         [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
           personId: personRow.id,
           identityProviderId: provider.id,
@@ -169,7 +196,7 @@ class IDPSignInManager {
     if (provider.autoSignUp) {
       const signedUpPerson = await this.signUp(db, claim, provider);
       await this.saveIdpIdentifier(db, provider, claim, signedUpPerson);
-      return { person: signedUpPerson };
+      return { person: signedUpPerson, isNewPerson: true };
     }
     return { person: null };
   }