@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.5

package/dist/development/src/model/service/apiKey/ApiKeyManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/ApiKeyManager.ts"],"sourcesContent":["import {\n\tApiKeyRequestInfo,\n\tCreateApiKeyCommand,\n\tDisableApiKeyCommand,\n\tDisableIdentityApiKeysCommand,\n\tDisableOneOffApiKeyCommand,\n\tPROLONG_THROTTLE_MS,\n\tProlongApiKeyCommand,\n} from '../../commands/index.js'\nimport { ApiKey } from '../../type/index.js'\n\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\nimport { DatabaseContext, TokenHash } from '../../utils/index.js'\nimport { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService.js'\nimport assert from 'node:assert'\nimport { Acl } from '@contember/schema'\nimport { ApiKeyByIdQuery, ApiKeyByTokenQuery, ApiKeyRow, ConfigurationQuery, IdentityQuery } from '../../queries/index.js'\nimport PostgresInterval from 'postgres-interval'\nimport { Config } from '../../type/Config.js'\nimport { intervalToPostgres, intervalToSeconds } from '../../utils/interval.js'\nimport { AuthPolicyResolver } from '../AuthPolicyResolver.js'\nimport { AuthLogService } from '../AuthLogService.js'\nimport { IdpSessionRevalidator } from '../idp/IdpSessionRevalidator.js'\nimport { UnpersistedApiKeyManager } from './UnpersistedApiKeyManager.js'\n\nexport class ApiKeyManager {\n\tconstructor(\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t\tprivate readonly authLogService: AuthLogService,\n\t\tprivate readonly unpersistedApiKeyManager: UnpersistedApiKeyManager = new UnpersistedApiKeyManager(),\n\t\tprivate readonly idpSessionRevalidator?: IdpSessionRevalidator,\n\t) {}\n\n\tasync verifyAndProlong(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\ttoken: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\tforwardedInfo?: ApiKeyRequestInfo,\n\t): Promise<VerifyResponse> {\n\t\tconst unpersistedResult = this.unpersistedApiKeyManager.verify(token)\n\t\tif (unpersistedResult !== null) {\n\t\t\t// Configured (unpersisted) root token: no DB row to prolong/track.\n\t\t\treturn new ResponseOk(unpersistedResult)\n\t\t}\n\n\t\tconst apiKeyRow = await readDbContext.queryHandler.fetch(new ApiKeyByTokenQuery(token))\n\t\tif (apiKeyRow === null) {\n\t\t\treturn new ResponseError(VerifyErrorCode.NOT_FOUND, 'API key was not found')\n\t\t}\n\n\t\tif (apiKeyRow.disabled_at !== null) {\n\t\t\treturn new ResponseError(\n\t\t\t\tVerifyErrorCode.DISABLED,\n\t\t\t\t`API key was disabled at ${apiKeyRow.disabled_at.toISOString()}`,\n\t\t\t)\n\t\t}\n\n\t\t// Single injectable clock for all session-policy time math (matches issuance,\n\t\t// which uses providers.now()), so the A19 idle/max logic is deterministically testable.\n\t\tconst now = dbContext.providers.now()\n\t\tif (apiKeyRow.expires_at !== null && apiKeyRow.expires_at <= now) {\n\t\t\treturn new ResponseError(VerifyErrorCode.DISABLED, `API key expired at ${apiKeyRow.expires_at.toISOString()}`)\n\t\t}\n\n\t\t// A19: absolute hard cap (defensive — the prolong clamp should already keep\n\t\t// expires_at <= max_expires_at, but enforce it here regardless).\n\t\tif (apiKeyRow.max_expires_at !== null && apiKeyRow.max_expires_at <= now) {\n\t\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\t\treturn new ResponseError(\n\t\t\t\tVerifyErrorCode.DISABLED,\n\t\t\t\t`API key reached its maximum lifetime at ${apiKeyRow.max_expires_at.toISOString()}`,\n\t\t\t)\n\t\t}\n\n\t\t// A19: idle timeout. Reject + disable when the session has been idle longer\n\t\t// than the policy's idle_timeout. A null idle_timeout (today's default) or a\n\t\t// never-used key (last_used_at null) are never idle-expired.\n\t\tif (apiKeyRow.idle_timeout !== null && apiKeyRow.last_used_at !== null) {\n\t\t\tconst idleMs = intervalToSeconds(apiKeyRow.idle_timeout) * 1000\n\t\t\t// last_used_at is written at most once per PROLONG_THROTTLE_MS (tracking is\n\t\t\t// throttled), so it can legitimately lag a continuously-active session by up\n\t\t\t// to that window. Add the throttle as slack so a small idle_timeout can't\n\t\t\t// idle-expire a session that is actually in use.\n\t\t\tif (now.getTime() - apiKeyRow.last_used_at.getTime() > idleMs + PROLONG_THROTTLE_MS) {\n\t\t\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\t\t\ttry {\n\t\t\t\t\tawait this.authLogService.logSessionEvent(dbContext, {\n\t\t\t\t\t\ttype: 'session_expired_idle',\n\t\t\t\t\t\tidentityId: apiKeyRow.identity_id,\n\t\t\t\t\t\tpersonId: apiKeyRow.person_id,\n\t\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\teventData: {\n\t\t\t\t\t\t\tlastUsedAt: apiKeyRow.last_used_at?.toISOString() ?? null,\n\t\t\t\t\t\t\tidleTimeout: String(apiKeyRow.idle_timeout),\n\t\t\t\t\t\t},\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\t/* best-effort: auth path must stay resilient */\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\tVerifyErrorCode.DISABLED,\n\t\t\t\t\t`API key was idle since ${apiKeyRow.last_used_at.toISOString()} and exceeded the idle timeout`,\n\t\t\t\t)\n\t\t\t}\n\t\t}\n\n\t\tconst effectiveInfo: ApiKeyRequestInfo | undefined = apiKeyRow.trust_forwarded_info && forwardedInfo\n\t\t\t? {\n\t\t\t\tip: forwardedInfo.ip ?? requestInfo?.ip,\n\t\t\t\tuserAgent: forwardedInfo.userAgent ?? requestInfo?.userAgent,\n\t\t\t}\n\t\t\t: requestInfo\n\n\t\t// Re-validate IdP-backed sessions against their identity provider (A24). In the\n\t\t// default `background` mode this returns immediately and revalidates after the\n\t\t// response (revocation lands on the next request); in `blocking` mode it can revoke\n\t\t// the current request. No-op for password sessions and IdPs without revalidation.\n\t\t// `effectiveInfo` is passed so the audit entries record the originating request's IP/UA.\n\t\tif (this.idpSessionRevalidator) {\n\t\t\tconst outcome = await this.idpSessionRevalidator.revalidate(dbContext, readDbContext, apiKeyRow, effectiveInfo)\n\t\t\tif (outcome === 'revoked') {\n\t\t\t\treturn new ResponseError(VerifyErrorCode.DISABLED, 'IdP session was revoked')\n\t\t\t}\n\t\t}\n\n\t\tsetImmediate(async () => {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew ProlongApiKeyCommand(\n\t\t\t\t\tapiKeyRow.id,\n\t\t\t\t\tapiKeyRow.type,\n\t\t\t\t\tapiKeyRow.expiration,\n\t\t\t\t\tapiKeyRow.expires_at,\n\t\t\t\t\teffectiveInfo,\n\t\t\t\t\t{\n\t\t\t\t\t\tlastIp: apiKeyRow.last_ip,\n\t\t\t\t\t\tlastUserAgent: apiKeyRow.last_user_agent,\n\t\t\t\t\t\tlastUsedAt: apiKeyRow.last_used_at,\n\t\t\t\t\t},\n\t\t\t\t\tapiKeyRow.max_expires_at,\n\t\t\t\t),\n\t\t\t)\n\t\t})\n\n\t\treturn new ResponseOk(\n\t\t\tnew VerifyResult(\n\t\t\t\tapiKeyRow.identity_id,\n\t\t\t\tapiKeyRow.id,\n\t\t\t\tapiKeyRow.roles,\n\t\t\t\tapiKeyRow.person_id,\n\t\t\t\tapiKeyRow.trust_forwarded_info,\n\t\t\t),\n\t\t)\n\t}\n\n\tasync createSessionApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\texpiration?: number,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<string> {\n\t\tconst { token } = await this.createSessionApiKeyWithId(dbContext, identityId, expiration, requestInfo, trustForwardedInfo)\n\t\treturn token\n\t}\n\n\t/**\n\t * Like {@link createSessionApiKey} but also returns the api_key id — needed when the\n\t * caller has to bind another row to the session (e.g. an `idp_session` for IdP\n\t * re-validation).\n\t */\n\tasync createSessionApiKeyWithId(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\texpiration?: number,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<{ id: string; token: string }> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\n\t\t// A19: snapshot the effective session policy onto the api_key at sign-in.\n\t\t// With no matching policy, every field is null/baseline and the result is\n\t\t// byte-for-byte today's behavior.\n\t\tconst [identityRow] = await dbContext.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst globalRoles = identityRow?.roles ?? []\n\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(dbContext, identityId, globalRoles)\n\n\t\tconst defaultExpirationMinutes = intervalToSeconds(config.login.defaultTokenExpiration) / 60\n\t\t// remember_me_allowed === false: ignore a client-supplied longer lifetime and\n\t\t// force the default. (true/null leave the requested expiration untouched.)\n\t\tconst requestedMinutes = policy.rememberMeAllowed === false\n\t\t\t? defaultExpirationMinutes\n\t\t\t: (expiration ?? defaultExpirationMinutes)\n\n\t\t// Cap by maxTokenExpiration (existing behavior) AND by the policy's\n\t\t// tokenExpiration (A19) — strictest wins.\n\t\tlet expirationCapped = config.login.maxTokenExpiration\n\t\t\t? Math.min(requestedMinutes, intervalToSeconds(config.login.maxTokenExpiration) / 60)\n\t\t\t: requestedMinutes\n\t\tif (policy.tokenExpiration) {\n\t\t\texpirationCapped = Math.min(expirationCapped, intervalToSeconds(policy.tokenExpiration) / 60)\n\t\t}\n\n\t\t// Absolute hard cap: issued_at + policy.tokenExpiration. NULL = uncapped\n\t\t// sliding window (today's behavior).\n\t\tconst issuedAt = dbContext.providers.now()\n\t\tconst maxExpiresAt = policy.tokenExpiration\n\t\t\t? new Date(issuedAt.getTime() + intervalToSeconds(policy.tokenExpiration) * 1000)\n\t\t\t: null\n\n\t\tconst command = new CreateApiKeyCommand({\n\t\t\ttype: ApiKey.Type.SESSION,\n\t\t\tidentityId,\n\t\t\texpiration: expirationCapped,\n\t\t\trequestInfo,\n\t\t\ttrustForwardedInfo,\n\t\t\tidleTimeout: policy.idleTimeout ? intervalToPostgres(policy.idleTimeout) : null,\n\t\t\tmaxExpiresAt,\n\t\t})\n\t\tconst { id, token } = await dbContext.commandBus.execute(command)\n\t\tassert(token !== undefined)\n\n\t\t// A19: audit only when a policy is actually in effect. With zero auth_policy\n\t\t// rows the resolved policy is inert and no extra insert happens.\n\t\tconst policyApplied = policy.mfaRequired === true\n\t\t\t|| policy.tokenExpiration !== null\n\t\t\t|| policy.idleTimeout !== null\n\t\t\t|| policy.rememberMeAllowed !== null\n\t\tif (policyApplied) {\n\t\t\ttry {\n\t\t\t\tawait this.authLogService.logSessionEvent(dbContext, {\n\t\t\t\t\ttype: 'session_policy_applied',\n\t\t\t\t\tidentityId,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\teventData: {\n\t\t\t\t\t\ttokenExpiration: policy.tokenExpiration ? intervalToPostgres(policy.tokenExpiration) : null,\n\t\t\t\t\t\tidleTimeout: policy.idleTimeout ? intervalToPostgres(policy.idleTimeout) : null,\n\t\t\t\t\t\trememberMeAllowed: policy.rememberMeAllowed,\n\t\t\t\t\t\tmfaRequired: policy.mfaRequired,\n\t\t\t\t\t},\n\t\t\t\t})\n\t\t\t} catch {\n\t\t\t\t/* best-effort: sign-in must not break on an audit failure */\n\t\t\t}\n\t\t}\n\n\t\treturn { id, token }\n\t}\n\n\tasync findApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<ApiKeyRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tnew ApiKeyByIdQuery(apiKeyId),\n\t\t)\n\t}\n\n\tasync disableOneOffApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOneOffApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableIdentityApiKeys(dbContext: DatabaseContext, identityId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableIdentityApiKeysCommand(identityId))\n\t}\n\n\tasync createGlobalPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tdescription: string,\n\t\troles: readonly string[],\n\t\ttokenHash?: TokenHash,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createPermanentApiKey(db, description, roles, tokenHash, trustForwardedInfo)\n\t\t})\n\t}\n\n\tasync createProjectPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tdescription: string,\n\t\ttokenHash?: TokenHash,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createProjectPermanentApiKey(db, projectId, memberships, description, tokenHash, trustForwardedInfo)\n\t\t})\n\t}\n}\n\nexport type VerifyResponse = Response<VerifyResult, VerifyErrorCode>\n\nexport class VerifyResult {\n\treadonly valid = true\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly apiKeyId: string,\n\t\tpublic readonly roles: string[],\n\t\tpublic readonly personId: string | null,\n\t\tpublic readonly trustForwardedInfo: boolean = false,\n\t) {}\n}\n\nexport enum VerifyErrorCode {\n\tNOT_FOUND = 'not_found',\n\tDISABLED = 'disabled',\n\tEXPIRED = 'expired',\n\tNO_AUTH_HEADER = 'no_auth_header',\n\tINVALID_AUTH_HEADER = 'invalid_auth_header',\n}\n"],"names":["VerifyErrorCode"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAyBO,MAAM,cAAc;AAAA,EAC1B,YACkB,eACA,oBACA,gBACA,2BAAqD,IAAI,yBAAA,GACzD,uBAChB;AALgB,SAAA,gBAAA;AACA,SAAA,qBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBACL,WACA,eACA,OACA,aACA,eAC0B;AAC1B,UAAM,oBAAoB,KAAK,yBAAyB,OAAO,KAAK;AACpE,QAAI,sBAAsB,MAAM;AAE/B,aAAO,IAAI,WAAW,iBAAiB;AAAA,IACxC;AAEA,UAAM,YAAY,MAAM,cAAc,aAAa,MAAM,IAAI,mBAAmB,KAAK,CAAC;AACtF,QAAI,cAAc,MAAM;AACvB,aAAO,IAAI,cAAc,aAA2B,uBAAuB;AAAA,IAC5E;AAEA,QAAI,UAAU,gBAAgB,MAAM;AACnC,aAAO,IAAI;AAAA,QACV;AAAA,QACA,2BAA2B,UAAU,YAAY,YAAA,CAAa;AAAA,MAAA;AAAA,IAEhE;AAIA,UAAM,MAAM,UAAU,UAAU,IAAA;AAChC,QAAI,UAAU,eAAe,QAAQ,UAAU,cAAc,KAAK;AACjE,aAAO,IAAI,cAAc,YAA0B,sBAAsB,UAAU,WAAW,YAAA,CAAa,EAAE;AAAA,IAC9G;AAIA,QAAI,UAAU,mBAAmB,QAAQ,UAAU,kBAAkB,KAAK;AACzE,YAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,UAAU,EAAE,CAAC;AACzE,aAAO,IAAI;AAAA,QACV;AAAA,QACA,2CAA2C,UAAU,eAAe,YAAA,CAAa;AAAA,MAAA;AAAA,IAEnF;AAKA,QAAI,UAAU,iBAAiB,QAAQ,UAAU,iBAAiB,MAAM;AACvE,YAAM,SAAS,kBAAkB,UAAU,YAAY,IAAI;AAK3D,UAAI,IAAI,YAAY,UAAU,aAAa,QAAA,IAAY,SAAS,qBAAqB;AACpF,cAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,UAAU,EAAE,CAAC;AACzE,YAAI;AACH,gBAAM,KAAK,eAAe,gBAAgB,WAAW;AAAA,YACpD,MAAM;AAAA,YACN,YAAY,UAAU;AAAA,YACtB,UAAU,UAAU;AAAA,YACpB,WAAW,aAAa;AAAA,YACxB,WAAW,aAAa;AAAA,YACxB,SAAS;AAAA,YACT,WAAW;AAAA,cACV,YAAY,UAAU,cAAc,YAAA,KAAiB;AAAA,cACrD,aAAa,OAAO,UAAU,YAAY;AAAA,YAAA;AAAA,UAC3C,CACA;AAAA,QACF,QAAQ;AAAA,QAER;AACA,eAAO,IAAI;AAAA,UACV;AAAA,UACA,0BAA0B,UAAU,aAAa,YAAA,CAAa;AAAA,QAAA;AAAA,MAEhE;AAAA,IACD;AAEA,UAAM,gBAA+C,UAAU,wBAAwB,gBACpF;AAAA,MACD,IAAI,cAAc,MAAM,aAAa;AAAA,MACrC,WAAW,cAAc,aAAa,aAAa;AAAA,IAAA,IAElD;AAOH,QAAI,KAAK,uBAAuB;AAC/B,YAAM,UAAU,MAAM,KAAK,sBAAsB,WAAW,WAAW,eAAe,WAAW,aAAa;AAC9G,UAAI,YAAY,WAAW;AAC1B,eAAO,IAAI,cAAc,YAA0B,yBAAyB;AAAA,MAC7E;AAAA,IACD;AAEA,iBAAa,YAAY;AACxB,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAI;AAAA,UACH,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,UACV;AAAA,UACA;AAAA,YACC,QAAQ,UAAU;AAAA,YAClB,eAAe,UAAU;AAAA,YACzB,YAAY,UAAU;AAAA,UAAA;AAAA,UAEvB,UAAU;AAAA,QAAA;AAAA,MACX;AAAA,IAEF,CAAC;AAED,WAAO,IAAI;AAAA,MACV,IAAI;AAAA,QACH,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,MAAA;AAAA,IACX;AAAA,EAEF;AAAA,EAEA,MAAM,oBACL,WACA,YACA,YACA,aACA,oBACkB;AAClB,UAAM,EAAE,UAAU,MAAM,KAAK,0BAA0B,WAAW,YAAY,YAAY,aAAa,kBAAkB;AACzH,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,0BACL,WACA,YACA,YACA,aACA,oBACyC;AACzC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AAK7F,UAAM,CAAC,WAAW,IAAI,MAAM,UAAU,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACxF,UAAM,cAAc,aAAa,SAAS,CAAA;AAC1C,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,WAAW,YAAY,WAAW;AAElG,UAAM,2BAA2B,kBAAkB,OAAO,MAAM,sBAAsB,IAAI;AAG1F,UAAM,mBAAmB,OAAO,sBAAsB,QACnD,2BACC,cAAc;AAIlB,QAAI,mBAAmB,OAAO,MAAM,qBACjC,KAAK,IAAI,kBAAkB,kBAAkB,OAAO,MAAM,kBAAkB,IAAI,EAAE,IAClF;AACH,QAAI,OAAO,iBAAiB;AAC3B,yBAAmB,KAAK,IAAI,kBAAkB,kBAAkB,OAAO,eAAe,IAAI,EAAE;AAAA,IAC7F;AAIA,UAAM,WAAW,UAAU,UAAU,IAAA;AACrC,UAAM,eAAe,OAAO,kBACzB,IAAI,KAAK,SAAS,QAAA,IAAY,kBAAkB,OAAO,eAAe,IAAI,GAAI,IAC9E;AAEH,UAAM,UAAU,IAAI,oBAAoB;AAAA,MACvC,MAAM,OAAO,KAAK;AAAA,MAClB;AAAA,MACA,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA,aAAa,OAAO,cAAc,mBAAmB,OAAO,WAAW,IAAI;AAAA,MAC3E;AAAA,IAAA,CACA;AACD,UAAM,EAAE,IAAI,MAAA,IAAU,MAAM,UAAU,WAAW,QAAQ,OAAO;AAChE,WAAO,UAAU,MAAS;AAI1B,UAAM,gBAAgB,OAAO,gBAAgB,QACzC,OAAO,oBAAoB,QAC3B,OAAO,gBAAgB,QACvB,OAAO,sBAAsB;AACjC,QAAI,eAAe;AAClB,UAAI;AACH,cAAM,KAAK,eAAe,gBAAgB,WAAW;AAAA,UACpD,MAAM;AAAA,UACN;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,UACxB,SAAS;AAAA,UACT,WAAW;AAAA,YACV,iBAAiB,OAAO,kBAAkB,mBAAmB,OAAO,eAAe,IAAI;AAAA,YACvF,aAAa,OAAO,cAAc,mBAAmB,OAAO,WAAW,IAAI;AAAA,YAC3E,mBAAmB,OAAO;AAAA,YAC1B,aAAa,OAAO;AAAA,UAAA;AAAA,QACrB,CACA;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACD;AAEA,WAAO,EAAE,IAAI,MAAA;AAAA,EACd;AAAA,EAEA,MAAM,WAAW,WAA4B,UAA6C;AACzF,WAAO,MAAM,UAAU,aAAa;AAAA,MACnC,IAAI,gBAAgB,QAAQ;AAAA,IAAA;AAAA,EAE9B;AAAA,EAEA,MAAM,oBAAoB,WAA4B,UAAiC;AACtF,UAAM,UAAU,WAAW,QAAQ,IAAI,2BAA2B,QAAQ,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAM,cAAc,WAA4B,UAAoC;AACnF,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,uBAAuB,WAA4B,YAAmC;AAC3F,UAAM,UAAU,WAAW,QAAQ,IAAI,8BAA8B,UAAU,CAAC;AAAA,EACjF;AAAA,EAEA,MAAM,4BACL,WACA,aACA,OACA,WACA,oBACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,KAAK,cAAc,sBAAsB,IAAI,aAAa,OAAO,WAAW,kBAAkB;AAAA,IAC5G,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,6BACL,WACA,WACA,aACA,aACA,WACA,oBACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,aAAa,aAAa,WAAW,kBAAkB;AAAA,IACpI,CAAC;AAAA,EACF;AACD;AAIO,MAAM,aAAa;AAAA,EAGzB,YACiB,YACA,UACA,OACA,UACA,qBAA8B,OAC7C;AALe,SAAA,aAAA;AACA,SAAA,WAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AACA,SAAA,qBAAA;AAPjB,kBAAA,MAAS,SAAQ,IAAA;AAAA,EAQd;AACJ;AAEO,IAAK,oCAAAA,qBAAL;AACNA,mBAAA,WAAA,IAAY;AACZA,mBAAA,UAAA,IAAW;AACXA,mBAAA,SAAA,IAAU;AACVA,mBAAA,gBAAA,IAAiB;AACjBA,mBAAA,qBAAA,IAAsB;AALX,SAAAA;AAAA,GAAA,mBAAA,CAAA,CAAA;"}
+{"version":3,"file":"ApiKeyManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/ApiKeyManager.ts"],"sourcesContent":["import {\n\tApiKeyRequestInfo,\n\tCreateApiKeyCommand,\n\tDisableApiKeyCommand,\n\tDisableIdentityApiKeysCommand,\n\tDisableOneOffApiKeyCommand,\n\tPROLONG_THROTTLE_MS,\n\tProlongApiKeyCommand,\n} from '../../commands/index.js'\nimport { ApiKey } from '../../type/index.js'\n\nimport { Response, ResponseError, ResponseOk } from '../../utils/Response.js'\nimport { DatabaseContext, TokenHash } from '../../utils/index.js'\nimport { ApiKeyService, CreateApiKeyResponse } from './ApiKeyService.js'\nimport assert from 'node:assert'\nimport { Acl } from '@contember/schema'\nimport { ApiKeyByIdQuery, ApiKeyByTokenQuery, ApiKeyRow, ConfigurationQuery, IdentityQuery } from '../../queries/index.js'\nimport PostgresInterval from 'postgres-interval'\nimport { Config } from '../../type/Config.js'\nimport { intervalToPostgres, intervalToSeconds } from '../../utils/interval.js'\nimport { AuthPolicyResolver } from '../AuthPolicyResolver.js'\nimport { AuthLogService } from '../AuthLogService.js'\nimport { IdpSessionRevalidator } from '../idp/IdpSessionRevalidator.js'\nimport { UnpersistedApiKeyManager } from './UnpersistedApiKeyManager.js'\n\nexport class ApiKeyManager {\n\tconstructor(\n\t\tprivate readonly apiKeyService: ApiKeyService,\n\t\tprivate readonly authPolicyResolver: AuthPolicyResolver,\n\t\tprivate readonly authLogService: AuthLogService,\n\t\tprivate readonly unpersistedApiKeyManager: UnpersistedApiKeyManager = new UnpersistedApiKeyManager(),\n\t\tprivate readonly idpSessionRevalidator?: IdpSessionRevalidator,\n\t) {}\n\n\tasync verifyAndProlong(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\ttoken: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\tforwardedInfo?: ApiKeyRequestInfo,\n\t): Promise<VerifyResponse> {\n\t\tconst unpersistedResult = this.unpersistedApiKeyManager.verify(token)\n\t\tif (unpersistedResult !== null) {\n\t\t\t// Configured (unpersisted) root token: no DB row to prolong/track.\n\t\t\treturn new ResponseOk(unpersistedResult)\n\t\t}\n\n\t\tconst apiKeyRow = await readDbContext.queryHandler.fetch(new ApiKeyByTokenQuery(token))\n\t\tif (apiKeyRow === null) {\n\t\t\treturn new ResponseError(VerifyErrorCode.NOT_FOUND, 'API key was not found')\n\t\t}\n\n\t\tif (apiKeyRow.disabled_at !== null) {\n\t\t\treturn new ResponseError(\n\t\t\t\tVerifyErrorCode.DISABLED,\n\t\t\t\t`API key was disabled at ${apiKeyRow.disabled_at.toISOString()}`,\n\t\t\t)\n\t\t}\n\n\t\t// Single injectable clock for all session-policy time math (matches issuance,\n\t\t// which uses providers.now()), so the A19 idle/max logic is deterministically testable.\n\t\tconst now = dbContext.providers.now()\n\t\tif (apiKeyRow.expires_at !== null && apiKeyRow.expires_at <= now) {\n\t\t\treturn new ResponseError(VerifyErrorCode.DISABLED, `API key expired at ${apiKeyRow.expires_at.toISOString()}`)\n\t\t}\n\n\t\t// A19: absolute hard cap (defensive — the prolong clamp should already keep\n\t\t// expires_at <= max_expires_at, but enforce it here regardless).\n\t\tif (apiKeyRow.max_expires_at !== null && apiKeyRow.max_expires_at <= now) {\n\t\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\t\treturn new ResponseError(\n\t\t\t\tVerifyErrorCode.DISABLED,\n\t\t\t\t`API key reached its maximum lifetime at ${apiKeyRow.max_expires_at.toISOString()}`,\n\t\t\t)\n\t\t}\n\n\t\t// A19: idle timeout. Reject + disable when the session has been idle longer\n\t\t// than the policy's idle_timeout. A null idle_timeout (today's default) or a\n\t\t// never-used key (last_used_at null) are never idle-expired.\n\t\tif (apiKeyRow.idle_timeout !== null && apiKeyRow.last_used_at !== null) {\n\t\t\tconst idleMs = intervalToSeconds(apiKeyRow.idle_timeout) * 1000\n\t\t\t// last_used_at is written at most once per PROLONG_THROTTLE_MS (tracking is\n\t\t\t// throttled), so it can legitimately lag a continuously-active session by up\n\t\t\t// to that window. Add the throttle as slack so a small idle_timeout can't\n\t\t\t// idle-expire a session that is actually in use.\n\t\t\tif (now.getTime() - apiKeyRow.last_used_at.getTime() > idleMs + PROLONG_THROTTLE_MS) {\n\t\t\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\t\t\ttry {\n\t\t\t\t\tawait this.authLogService.logSessionEvent(dbContext, {\n\t\t\t\t\t\ttype: 'session_expired_idle',\n\t\t\t\t\t\tidentityId: apiKeyRow.identity_id,\n\t\t\t\t\t\tpersonId: apiKeyRow.person_id,\n\t\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t\t\tsuccess: false,\n\t\t\t\t\t\teventData: {\n\t\t\t\t\t\t\tlastUsedAt: apiKeyRow.last_used_at?.toISOString() ?? null,\n\t\t\t\t\t\t\tidleTimeout: String(apiKeyRow.idle_timeout),\n\t\t\t\t\t\t},\n\t\t\t\t\t})\n\t\t\t\t} catch {\n\t\t\t\t\t/* best-effort: auth path must stay resilient */\n\t\t\t\t}\n\t\t\t\treturn new ResponseError(\n\t\t\t\t\tVerifyErrorCode.DISABLED,\n\t\t\t\t\t`API key was idle since ${apiKeyRow.last_used_at.toISOString()} and exceeded the idle timeout`,\n\t\t\t\t)\n\t\t\t}\n\t\t}\n\n\t\tconst effectiveInfo: ApiKeyRequestInfo | undefined = apiKeyRow.trust_forwarded_info && forwardedInfo\n\t\t\t? {\n\t\t\t\tip: forwardedInfo.ip ?? requestInfo?.ip,\n\t\t\t\tuserAgent: forwardedInfo.userAgent ?? requestInfo?.userAgent,\n\t\t\t}\n\t\t\t: requestInfo\n\n\t\t// Re-validate IdP-backed sessions against their identity provider (A24). In the\n\t\t// default `background` mode this returns immediately and revalidates after the\n\t\t// response (revocation lands on the next request); in `blocking` mode it can revoke\n\t\t// the current request. No-op for password sessions and IdPs without revalidation.\n\t\t// `effectiveInfo` is passed so the audit entries record the originating request's IP/UA.\n\t\tif (this.idpSessionRevalidator) {\n\t\t\tconst outcome = await this.idpSessionRevalidator.revalidate(dbContext, readDbContext, apiKeyRow, effectiveInfo)\n\t\t\tif (outcome === 'revoked') {\n\t\t\t\treturn new ResponseError(VerifyErrorCode.DISABLED, 'IdP session was revoked')\n\t\t\t}\n\t\t}\n\n\t\t// Detached (runs after the response), so a rejection here would be an unhandledRejection and can take the\n\t\t// worker down. Tracking is best-effort — the next request writes it again.\n\t\tsetImmediate(() => {\n\t\t\tdbContext.commandBus.execute(\n\t\t\t\tnew ProlongApiKeyCommand(\n\t\t\t\t\tapiKeyRow.id,\n\t\t\t\t\tapiKeyRow.type,\n\t\t\t\t\tapiKeyRow.expiration,\n\t\t\t\t\tapiKeyRow.expires_at,\n\t\t\t\t\teffectiveInfo,\n\t\t\t\t\t{\n\t\t\t\t\t\tlastIp: apiKeyRow.last_ip,\n\t\t\t\t\t\tlastUserAgent: apiKeyRow.last_user_agent,\n\t\t\t\t\t\tlastUsedAt: apiKeyRow.last_used_at,\n\t\t\t\t\t},\n\t\t\t\t\tapiKeyRow.max_expires_at,\n\t\t\t\t),\n\t\t\t).catch(() => {})\n\t\t})\n\n\t\treturn new ResponseOk(\n\t\t\tnew VerifyResult(\n\t\t\t\tapiKeyRow.identity_id,\n\t\t\t\tapiKeyRow.id,\n\t\t\t\tapiKeyRow.roles,\n\t\t\t\tapiKeyRow.person_id,\n\t\t\t\tapiKeyRow.trust_forwarded_info,\n\t\t\t),\n\t\t)\n\t}\n\n\tasync createSessionApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\texpiration?: number,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<string> {\n\t\tconst { token } = await this.createSessionApiKeyWithId(dbContext, identityId, expiration, requestInfo, trustForwardedInfo)\n\t\treturn token\n\t}\n\n\t/**\n\t * Like {@link createSessionApiKey} but also returns the api_key id — needed when the\n\t * caller has to bind another row to the session (e.g. an `idp_session` for IdP\n\t * re-validation).\n\t */\n\tasync createSessionApiKeyWithId(\n\t\tdbContext: DatabaseContext,\n\t\tidentityId: string,\n\t\texpiration?: number,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<{ id: string; token: string }> {\n\t\tconst config = await dbContext.queryHandler.fetch(new ConfigurationQuery(dbContext.providers))\n\n\t\t// A19: snapshot the effective session policy onto the api_key at sign-in.\n\t\t// With no matching policy, every field is null/baseline and the result is\n\t\t// byte-for-byte today's behavior.\n\t\tconst [identityRow] = await dbContext.queryHandler.fetch(new IdentityQuery([identityId]))\n\t\tconst globalRoles = identityRow?.roles ?? []\n\t\tconst policy = await this.authPolicyResolver.resolveForIdentity(dbContext, identityId, globalRoles)\n\n\t\tconst defaultExpirationMinutes = intervalToSeconds(config.login.defaultTokenExpiration) / 60\n\t\t// remember_me_allowed === false: ignore a client-supplied longer lifetime and\n\t\t// force the default. (true/null leave the requested expiration untouched.)\n\t\tconst requestedMinutes = policy.rememberMeAllowed === false\n\t\t\t? defaultExpirationMinutes\n\t\t\t: (expiration ?? defaultExpirationMinutes)\n\n\t\t// Cap by maxTokenExpiration (existing behavior) AND by the policy's\n\t\t// tokenExpiration (A19) — strictest wins.\n\t\tlet expirationCapped = config.login.maxTokenExpiration\n\t\t\t? Math.min(requestedMinutes, intervalToSeconds(config.login.maxTokenExpiration) / 60)\n\t\t\t: requestedMinutes\n\t\tif (policy.tokenExpiration) {\n\t\t\texpirationCapped = Math.min(expirationCapped, intervalToSeconds(policy.tokenExpiration) / 60)\n\t\t}\n\n\t\t// Absolute hard cap: issued_at + policy.tokenExpiration. NULL = uncapped\n\t\t// sliding window (today's behavior).\n\t\tconst issuedAt = dbContext.providers.now()\n\t\tconst maxExpiresAt = policy.tokenExpiration\n\t\t\t? new Date(issuedAt.getTime() + intervalToSeconds(policy.tokenExpiration) * 1000)\n\t\t\t: null\n\n\t\tconst command = new CreateApiKeyCommand({\n\t\t\ttype: ApiKey.Type.SESSION,\n\t\t\tidentityId,\n\t\t\texpiration: expirationCapped,\n\t\t\trequestInfo,\n\t\t\ttrustForwardedInfo,\n\t\t\tidleTimeout: policy.idleTimeout ? intervalToPostgres(policy.idleTimeout) : null,\n\t\t\tmaxExpiresAt,\n\t\t})\n\t\tconst { id, token } = await dbContext.commandBus.execute(command)\n\t\tassert(token !== undefined)\n\n\t\t// A19: audit only when a policy is actually in effect. With zero auth_policy\n\t\t// rows the resolved policy is inert and no extra insert happens.\n\t\tconst policyApplied = policy.mfaRequired === true\n\t\t\t|| policy.tokenExpiration !== null\n\t\t\t|| policy.idleTimeout !== null\n\t\t\t|| policy.rememberMeAllowed !== null\n\t\tif (policyApplied) {\n\t\t\ttry {\n\t\t\t\tawait this.authLogService.logSessionEvent(dbContext, {\n\t\t\t\t\ttype: 'session_policy_applied',\n\t\t\t\t\tidentityId,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\teventData: {\n\t\t\t\t\t\ttokenExpiration: policy.tokenExpiration ? intervalToPostgres(policy.tokenExpiration) : null,\n\t\t\t\t\t\tidleTimeout: policy.idleTimeout ? intervalToPostgres(policy.idleTimeout) : null,\n\t\t\t\t\t\trememberMeAllowed: policy.rememberMeAllowed,\n\t\t\t\t\t\tmfaRequired: policy.mfaRequired,\n\t\t\t\t\t},\n\t\t\t\t})\n\t\t\t} catch {\n\t\t\t\t/* best-effort: sign-in must not break on an audit failure */\n\t\t\t}\n\t\t}\n\n\t\treturn { id, token }\n\t}\n\n\tasync findApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<ApiKeyRow | null> {\n\t\treturn await dbContext.queryHandler.fetch(\n\t\t\tnew ApiKeyByIdQuery(apiKeyId),\n\t\t)\n\t}\n\n\tasync disableOneOffApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableOneOffApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableApiKey(dbContext: DatabaseContext, apiKeyId: string): Promise<boolean> {\n\t\treturn await dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyId))\n\t}\n\n\tasync disableIdentityApiKeys(dbContext: DatabaseContext, identityId: string): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableIdentityApiKeysCommand(identityId))\n\t}\n\n\tasync createGlobalPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tdescription: string,\n\t\troles: readonly string[],\n\t\ttokenHash?: TokenHash,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createPermanentApiKey(db, description, roles, tokenHash, trustForwardedInfo)\n\t\t})\n\t}\n\n\tasync createProjectPermanentApiKey(\n\t\tdbContext: DatabaseContext,\n\t\tprojectId: string,\n\t\tmemberships: readonly Acl.Membership[],\n\t\tdescription: string,\n\t\ttokenHash?: TokenHash,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<CreateApiKeyResponse> {\n\t\treturn await dbContext.transaction(async db => {\n\t\t\treturn await this.apiKeyService.createProjectPermanentApiKey(db, projectId, memberships, description, tokenHash, trustForwardedInfo)\n\t\t})\n\t}\n}\n\nexport type VerifyResponse = Response<VerifyResult, VerifyErrorCode>\n\nexport class VerifyResult {\n\treadonly valid = true\n\n\tconstructor(\n\t\tpublic readonly identityId: string,\n\t\tpublic readonly apiKeyId: string,\n\t\tpublic readonly roles: string[],\n\t\tpublic readonly personId: string | null,\n\t\tpublic readonly trustForwardedInfo: boolean = false,\n\t) {}\n}\n\nexport enum VerifyErrorCode {\n\tNOT_FOUND = 'not_found',\n\tDISABLED = 'disabled',\n\tEXPIRED = 'expired',\n\tNO_AUTH_HEADER = 'no_auth_header',\n\tINVALID_AUTH_HEADER = 'invalid_auth_header',\n}\n"],"names":["VerifyErrorCode"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAyBO,MAAM,cAAc;AAAA,EAC1B,YACkB,eACA,oBACA,gBACA,2BAAqD,IAAI,yBAAA,GACzD,uBAChB;AALgB,SAAA,gBAAA;AACA,SAAA,qBAAA;AACA,SAAA,iBAAA;AACA,SAAA,2BAAA;AACA,SAAA,wBAAA;AAAA,EACf;AAAA,EAEH,MAAM,iBACL,WACA,eACA,OACA,aACA,eAC0B;AAC1B,UAAM,oBAAoB,KAAK,yBAAyB,OAAO,KAAK;AACpE,QAAI,sBAAsB,MAAM;AAE/B,aAAO,IAAI,WAAW,iBAAiB;AAAA,IACxC;AAEA,UAAM,YAAY,MAAM,cAAc,aAAa,MAAM,IAAI,mBAAmB,KAAK,CAAC;AACtF,QAAI,cAAc,MAAM;AACvB,aAAO,IAAI,cAAc,aAA2B,uBAAuB;AAAA,IAC5E;AAEA,QAAI,UAAU,gBAAgB,MAAM;AACnC,aAAO,IAAI;AAAA,QACV;AAAA,QACA,2BAA2B,UAAU,YAAY,YAAA,CAAa;AAAA,MAAA;AAAA,IAEhE;AAIA,UAAM,MAAM,UAAU,UAAU,IAAA;AAChC,QAAI,UAAU,eAAe,QAAQ,UAAU,cAAc,KAAK;AACjE,aAAO,IAAI,cAAc,YAA0B,sBAAsB,UAAU,WAAW,YAAA,CAAa,EAAE;AAAA,IAC9G;AAIA,QAAI,UAAU,mBAAmB,QAAQ,UAAU,kBAAkB,KAAK;AACzE,YAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,UAAU,EAAE,CAAC;AACzE,aAAO,IAAI;AAAA,QACV;AAAA,QACA,2CAA2C,UAAU,eAAe,YAAA,CAAa;AAAA,MAAA;AAAA,IAEnF;AAKA,QAAI,UAAU,iBAAiB,QAAQ,UAAU,iBAAiB,MAAM;AACvE,YAAM,SAAS,kBAAkB,UAAU,YAAY,IAAI;AAK3D,UAAI,IAAI,YAAY,UAAU,aAAa,QAAA,IAAY,SAAS,qBAAqB;AACpF,cAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,UAAU,EAAE,CAAC;AACzE,YAAI;AACH,gBAAM,KAAK,eAAe,gBAAgB,WAAW;AAAA,YACpD,MAAM;AAAA,YACN,YAAY,UAAU;AAAA,YACtB,UAAU,UAAU;AAAA,YACpB,WAAW,aAAa;AAAA,YACxB,WAAW,aAAa;AAAA,YACxB,SAAS;AAAA,YACT,WAAW;AAAA,cACV,YAAY,UAAU,cAAc,YAAA,KAAiB;AAAA,cACrD,aAAa,OAAO,UAAU,YAAY;AAAA,YAAA;AAAA,UAC3C,CACA;AAAA,QACF,QAAQ;AAAA,QAER;AACA,eAAO,IAAI;AAAA,UACV;AAAA,UACA,0BAA0B,UAAU,aAAa,YAAA,CAAa;AAAA,QAAA;AAAA,MAEhE;AAAA,IACD;AAEA,UAAM,gBAA+C,UAAU,wBAAwB,gBACpF;AAAA,MACD,IAAI,cAAc,MAAM,aAAa;AAAA,MACrC,WAAW,cAAc,aAAa,aAAa;AAAA,IAAA,IAElD;AAOH,QAAI,KAAK,uBAAuB;AAC/B,YAAM,UAAU,MAAM,KAAK,sBAAsB,WAAW,WAAW,eAAe,WAAW,aAAa;AAC9G,UAAI,YAAY,WAAW;AAC1B,eAAO,IAAI,cAAc,YAA0B,yBAAyB;AAAA,MAC7E;AAAA,IACD;AAIA,iBAAa,MAAM;AAClB,gBAAU,WAAW;AAAA,QACpB,IAAI;AAAA,UACH,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,UACV,UAAU;AAAA,UACV;AAAA,UACA;AAAA,YACC,QAAQ,UAAU;AAAA,YAClB,eAAe,UAAU;AAAA,YACzB,YAAY,UAAU;AAAA,UAAA;AAAA,UAEvB,UAAU;AAAA,QAAA;AAAA,MACX,EACC,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACjB,CAAC;AAED,WAAO,IAAI;AAAA,MACV,IAAI;AAAA,QACH,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,QACV,UAAU;AAAA,MAAA;AAAA,IACX;AAAA,EAEF;AAAA,EAEA,MAAM,oBACL,WACA,YACA,YACA,aACA,oBACkB;AAClB,UAAM,EAAE,UAAU,MAAM,KAAK,0BAA0B,WAAW,YAAY,YAAY,aAAa,kBAAkB;AACzH,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,0BACL,WACA,YACA,YACA,aACA,oBACyC;AACzC,UAAM,SAAS,MAAM,UAAU,aAAa,MAAM,IAAI,mBAAmB,UAAU,SAAS,CAAC;AAK7F,UAAM,CAAC,WAAW,IAAI,MAAM,UAAU,aAAa,MAAM,IAAI,cAAc,CAAC,UAAU,CAAC,CAAC;AACxF,UAAM,cAAc,aAAa,SAAS,CAAA;AAC1C,UAAM,SAAS,MAAM,KAAK,mBAAmB,mBAAmB,WAAW,YAAY,WAAW;AAElG,UAAM,2BAA2B,kBAAkB,OAAO,MAAM,sBAAsB,IAAI;AAG1F,UAAM,mBAAmB,OAAO,sBAAsB,QACnD,2BACC,cAAc;AAIlB,QAAI,mBAAmB,OAAO,MAAM,qBACjC,KAAK,IAAI,kBAAkB,kBAAkB,OAAO,MAAM,kBAAkB,IAAI,EAAE,IAClF;AACH,QAAI,OAAO,iBAAiB;AAC3B,yBAAmB,KAAK,IAAI,kBAAkB,kBAAkB,OAAO,eAAe,IAAI,EAAE;AAAA,IAC7F;AAIA,UAAM,WAAW,UAAU,UAAU,IAAA;AACrC,UAAM,eAAe,OAAO,kBACzB,IAAI,KAAK,SAAS,QAAA,IAAY,kBAAkB,OAAO,eAAe,IAAI,GAAI,IAC9E;AAEH,UAAM,UAAU,IAAI,oBAAoB;AAAA,MACvC,MAAM,OAAO,KAAK;AAAA,MAClB;AAAA,MACA,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA,aAAa,OAAO,cAAc,mBAAmB,OAAO,WAAW,IAAI;AAAA,MAC3E;AAAA,IAAA,CACA;AACD,UAAM,EAAE,IAAI,MAAA,IAAU,MAAM,UAAU,WAAW,QAAQ,OAAO;AAChE,WAAO,UAAU,MAAS;AAI1B,UAAM,gBAAgB,OAAO,gBAAgB,QACzC,OAAO,oBAAoB,QAC3B,OAAO,gBAAgB,QACvB,OAAO,sBAAsB;AACjC,QAAI,eAAe;AAClB,UAAI;AACH,cAAM,KAAK,eAAe,gBAAgB,WAAW;AAAA,UACpD,MAAM;AAAA,UACN;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,UACxB,SAAS;AAAA,UACT,WAAW;AAAA,YACV,iBAAiB,OAAO,kBAAkB,mBAAmB,OAAO,eAAe,IAAI;AAAA,YACvF,aAAa,OAAO,cAAc,mBAAmB,OAAO,WAAW,IAAI;AAAA,YAC3E,mBAAmB,OAAO;AAAA,YAC1B,aAAa,OAAO;AAAA,UAAA;AAAA,QACrB,CACA;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACD;AAEA,WAAO,EAAE,IAAI,MAAA;AAAA,EACd;AAAA,EAEA,MAAM,WAAW,WAA4B,UAA6C;AACzF,WAAO,MAAM,UAAU,aAAa;AAAA,MACnC,IAAI,gBAAgB,QAAQ;AAAA,IAAA;AAAA,EAE9B;AAAA,EAEA,MAAM,oBAAoB,WAA4B,UAAiC;AACtF,UAAM,UAAU,WAAW,QAAQ,IAAI,2BAA2B,QAAQ,CAAC;AAAA,EAC5E;AAAA,EAEA,MAAM,cAAc,WAA4B,UAAoC;AACnF,WAAO,MAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,QAAQ,CAAC;AAAA,EAC7E;AAAA,EAEA,MAAM,uBAAuB,WAA4B,YAAmC;AAC3F,UAAM,UAAU,WAAW,QAAQ,IAAI,8BAA8B,UAAU,CAAC;AAAA,EACjF;AAAA,EAEA,MAAM,4BACL,WACA,aACA,OACA,WACA,oBACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,KAAK,cAAc,sBAAsB,IAAI,aAAa,OAAO,WAAW,kBAAkB;AAAA,IAC5G,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,6BACL,WACA,WACA,aACA,aACA,WACA,oBACgC;AAChC,WAAO,MAAM,UAAU,YAAY,OAAM,OAAM;AAC9C,aAAO,MAAM,KAAK,cAAc,6BAA6B,IAAI,WAAW,aAAa,aAAa,WAAW,kBAAkB;AAAA,IACpI,CAAC;AAAA,EACF;AACD;AAIO,MAAM,aAAa;AAAA,EAGzB,YACiB,YACA,UACA,OACA,UACA,qBAA8B,OAC7C;AALe,SAAA,aAAA;AACA,SAAA,WAAA;AACA,SAAA,QAAA;AACA,SAAA,WAAA;AACA,SAAA,qBAAA;AAPjB,kBAAA,MAAS,SAAQ,IAAA;AAAA,EAQd;AACJ;AAEO,IAAK,oCAAAA,qBAAL;AACNA,mBAAA,WAAA,IAAY;AACZA,mBAAA,UAAA,IAAW;AACXA,mBAAA,SAAA,IAAU;AACVA,mBAAA,gBAAA,IAAiB;AACjBA,mBAAA,qBAAA,IAAsB;AALX,SAAAA;AAAA,GAAA,mBAAA,CAAA,CAAA;"}

package/dist/development/src/model/service/apiKey/UnpersistedApiKeyManager.cjs

@@ -14,6 +14,10 @@ var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
 const UNPERSISTED_ROOT_IDENTITY_ID = "f3b2c4d6-0000-4000-8000-000000000001";
+const UNPERSISTED_LOGIN_IDENTITY_ID = "f3b2c4d6-0000-4000-8000-000000000002";
+const unpersistedIdentityIds = /* @__PURE__ */ new Set([UNPERSISTED_ROOT_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID]);
+const isUnpersistedIdentityId = (identityId) => identityId !== void 0 && unpersistedIdentityIds.has(identityId);
+const createUnpersistedLoginVerifyResult = () => new ApiKeyManager.VerifyResult(UNPERSISTED_LOGIN_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID, [Roles.TenantRole.LOGIN], null, false);
 class UnpersistedApiKeyManager {
   constructor(apiKeys = []) {
     __publicField(this, "apiKeys");
@@ -77,6 +81,9 @@ class UnpersistedApiKeyManager {
     return new UnpersistedApiKeyManager(hashes.map((it) => UnpersistedApiKeyManager.createRootApiKey(it)));
   }
 }
+exports.UNPERSISTED_LOGIN_IDENTITY_ID = UNPERSISTED_LOGIN_IDENTITY_ID;
 exports.UNPERSISTED_ROOT_IDENTITY_ID = UNPERSISTED_ROOT_IDENTITY_ID;
 exports.UnpersistedApiKeyManager = UnpersistedApiKeyManager;
+exports.createUnpersistedLoginVerifyResult = createUnpersistedLoginVerifyResult;
+exports.isUnpersistedIdentityId = isUnpersistedIdentityId;
 //# sourceMappingURL=UnpersistedApiKeyManager.cjs.map

package/dist/development/src/model/service/apiKey/UnpersistedApiKeyManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"UnpersistedApiKeyManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/UnpersistedApiKeyManager.ts"],"sourcesContent":["import { computeTokenHash, isTokenHash, timingSafeCompareHash, TokenHash } from '../../utils/index.js'\nimport { TenantRole } from '../../authorization/index.js'\nimport { VerifyResult } from './ApiKeyManager.js'\n\n/**\n * Well-known identity id used for super-admin identities authenticated via an\n * unpersisted (configured) root token. The id is stable so that audit logs and\n * created entities consistently reference the same virtual identity, even\n * though no row exists in the `identity` table.\n */\nexport const UNPERSISTED_ROOT_IDENTITY_ID = 'f3b2c4d6-0000-4000-8000-000000000001'\n\nexport interface UnpersistedApiKey {\n\treadonly tokenHash: TokenHash\n\treadonly identityId: string\n\treadonly roles: readonly string[]\n}\n\n/**\n * Verifies incoming tokens against a fixed set of root tokens configured out of\n * band (env/config) instead of being stored in the database. This enables token\n * rotation without database writes and avoids persisting the token hash.\n *\n * Token hashes are compared in constant time to avoid leaking information about\n * the configured secret.\n */\nexport class UnpersistedApiKeyManager {\n\tprivate readonly apiKeys: readonly UnpersistedApiKey[]\n\n\tconstructor(apiKeys: readonly UnpersistedApiKey[] = []) {\n\t\tthis.apiKeys = apiKeys\n\t}\n\n\tget isEmpty(): boolean {\n\t\treturn this.apiKeys.length === 0\n\t}\n\n\tverify(token: string): VerifyResult | null {\n\t\tif (this.apiKeys.length === 0) {\n\t\t\treturn null\n\t\t}\n\t\tconst tokenHash = computeTokenHash(token)\n\t\t// Iterate over all configured keys (no early return) so that matching\n\t\t// remains independent of the position of the matching key.\n\t\tlet matched: UnpersistedApiKey | null = null\n\t\tfor (const apiKey of this.apiKeys) {\n\t\t\tif (timingSafeCompareHash(tokenHash, apiKey.tokenHash)) {\n\t\t\t\tmatched = apiKey\n\t\t\t}\n\t\t}\n\t\tif (matched === null) {\n\t\t\treturn null\n\t\t}\n\t\treturn new VerifyResult(\n\t\t\tmatched.identityId,\n\t\t\t// There is no persisted api_key row, so there is no api key id.\n\t\t\tmatched.identityId,\n\t\t\t[...matched.roles],\n\t\t\tnull,\n\t\t\tfalse,\n\t\t)\n\t}\n\n\tstatic createRootApiKey(tokenHash: TokenHash): UnpersistedApiKey {\n\t\treturn {\n\t\t\ttokenHash,\n\t\t\tidentityId: UNPERSISTED_ROOT_IDENTITY_ID,\n\t\t\troles: [TenantRole.SUPER_ADMIN],\n\t\t}\n\t}\n\n\t/**\n\t * Builds a manager for unpersisted super-admin root tokens from configured\n\t * plain tokens and/or pre-computed token hashes.\n\t */\n\tstatic createForRootTokens(input: {\n\t\ttokens?: readonly string[]\n\t\ttokenHashes?: readonly string[]\n\t}): UnpersistedApiKeyManager {\n\t\tconst hashes: TokenHash[] = []\n\t\tfor (const token of input.tokens ?? []) {\n\t\t\tif (token.length === 0) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\thashes.push(computeTokenHash(token))\n\t\t}\n\t\tfor (const hash of input.tokenHashes ?? []) {\n\t\t\tif (hash.length === 0) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst normalized = hash.toLowerCase()\n\t\t\tif (!isTokenHash(normalized)) {\n\t\t\t\tthrow new Error(`Invalid unpersisted root token hash: expected a 64-character sha256 hex string.`)\n\t\t\t}\n\t\t\thashes.push(normalized)\n\t\t}\n\t\treturn new UnpersistedApiKeyManager(hashes.map(it => UnpersistedApiKeyManager.createRootApiKey(it)))\n\t}\n}\n"],"names":["token","computeTokenHash","timingSafeCompareHash","VerifyResult","TenantRole","isTokenHash"],"mappings":";;;;;;;;;;;;;;;AAUO,MAAM,+BAA+B;AAgBrC,MAAM,yBAAyB;AAAA,EAGrC,YAAY,UAAwC,IAAI;AAFxD,kBAAA,MAAiB,SAAA;AAGhB,SAAK,UAAU;AAAA,EAChB;AAAA,EAEA,IAAI,UAAmB;AACtB,WAAO,KAAK,QAAQ,WAAW;AAAA,EAChC;AAAA,EAEA,OAAOA,SAAoC;AAC1C,QAAI,KAAK,QAAQ,WAAW,GAAG;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,YAAYC,MAAAA,iBAAiBD,OAAK;AAGxC,QAAI,UAAoC;AACxC,eAAW,UAAU,KAAK,SAAS;AAClC,UAAIE,4BAAsB,WAAW,OAAO,SAAS,GAAG;AACvD,kBAAU;AAAA,MACX;AAAA,IACD;AACA,QAAI,YAAY,MAAM;AACrB,aAAO;AAAA,IACR;AACA,WAAO,IAAIC,cAAAA;AAAAA,MACV,QAAQ;AAAA;AAAA,MAER,QAAQ;AAAA,MACR,CAAC,GAAG,QAAQ,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,OAAO,iBAAiB,WAAyC;AAChE,WAAO;AAAA,MACN;AAAA,MACA,YAAY;AAAA,MACZ,OAAO,CAACC,MAAAA,WAAW,WAAW;AAAA,IAAA;AAAA,EAEhC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,oBAAoB,OAGE;AAC5B,UAAM,SAAsB,CAAA;AAC5B,eAAWJ,WAAS,MAAM,UAAU,CAAA,GAAI;AACvC,UAAIA,QAAM,WAAW,GAAG;AACvB;AAAA,MACD;AACA,aAAO,KAAKC,uBAAiBD,OAAK,CAAC;AAAA,IACpC;AACA,eAAW,QAAQ,MAAM,eAAe,CAAA,GAAI;AAC3C,UAAI,KAAK,WAAW,GAAG;AACtB;AAAA,MACD;AACA,YAAM,aAAa,KAAK,YAAA;AACxB,UAAI,CAACK,MAAAA,YAAY,UAAU,GAAG;AAC7B,cAAM,IAAI,MAAM,iFAAiF;AAAA,MAClG;AACA,aAAO,KAAK,UAAU;AAAA,IACvB;AACA,WAAO,IAAI,yBAAyB,OAAO,IAAI,QAAM,yBAAyB,iBAAiB,EAAE,CAAC,CAAC;AAAA,EACpG;AACD;;;"}
+{"version":3,"file":"UnpersistedApiKeyManager.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/UnpersistedApiKeyManager.ts"],"sourcesContent":["import { computeTokenHash, isTokenHash, timingSafeCompareHash, TokenHash } from '../../utils/index.js'\nimport { TenantRole } from '../../authorization/index.js'\nimport { VerifyResult } from './ApiKeyManager.js'\n\n/**\n * Well-known identity id used for super-admin identities authenticated via an\n * unpersisted (configured) root token. The id is stable so that audit logs and\n * created entities consistently reference the same virtual identity, even\n * though no row exists in the `identity` table.\n */\nexport const UNPERSISTED_ROOT_IDENTITY_ID = 'f3b2c4d6-0000-4000-8000-000000000001'\n\n/**\n * Well-known identity id for the pre-sign-in caller of a first-party UI served by the engine (the\n * management panel's login screen). It holds exactly {@link TenantRole.LOGIN} and exists only in\n * memory, so the surface it opens is fixed by this file rather than by whatever token an operator\n * happened to configure.\n */\nexport const UNPERSISTED_LOGIN_IDENTITY_ID = 'f3b2c4d6-0000-4000-8000-000000000002'\n\nconst unpersistedIdentityIds: ReadonlySet<string> = new Set([UNPERSISTED_ROOT_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID])\n\n/**\n * Whether an identity id is one of the virtual identities above, i.e. has no row in `identity`.\n * Anything writing a foreign key to `identity` must ask first — see `AuthLogService`.\n */\nexport const isUnpersistedIdentityId = (identityId: string | undefined): boolean => identityId !== undefined && unpersistedIdentityIds.has(identityId)\n\n/**\n * The pre-sign-in caller of an engine-served UI, as an already-verified result. There is no token to\n * present: the surface is reached by being routed there, so nothing is compared and nothing is read\n * from the database.\n */\nexport const createUnpersistedLoginVerifyResult = (): VerifyResult =>\n\tnew VerifyResult(UNPERSISTED_LOGIN_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID, [TenantRole.LOGIN], null, false)\n\nexport interface UnpersistedApiKey {\n\treadonly tokenHash: TokenHash\n\treadonly identityId: string\n\treadonly roles: readonly string[]\n}\n\n/**\n * Verifies incoming tokens against a fixed set of root tokens configured out of\n * band (env/config) instead of being stored in the database. This enables token\n * rotation without database writes and avoids persisting the token hash.\n *\n * Token hashes are compared in constant time to avoid leaking information about\n * the configured secret.\n */\nexport class UnpersistedApiKeyManager {\n\tprivate readonly apiKeys: readonly UnpersistedApiKey[]\n\n\tconstructor(apiKeys: readonly UnpersistedApiKey[] = []) {\n\t\tthis.apiKeys = apiKeys\n\t}\n\n\tget isEmpty(): boolean {\n\t\treturn this.apiKeys.length === 0\n\t}\n\n\tverify(token: string): VerifyResult | null {\n\t\tif (this.apiKeys.length === 0) {\n\t\t\treturn null\n\t\t}\n\t\tconst tokenHash = computeTokenHash(token)\n\t\t// Iterate over all configured keys (no early return) so that matching\n\t\t// remains independent of the position of the matching key.\n\t\tlet matched: UnpersistedApiKey | null = null\n\t\tfor (const apiKey of this.apiKeys) {\n\t\t\tif (timingSafeCompareHash(tokenHash, apiKey.tokenHash)) {\n\t\t\t\tmatched = apiKey\n\t\t\t}\n\t\t}\n\t\tif (matched === null) {\n\t\t\treturn null\n\t\t}\n\t\treturn new VerifyResult(\n\t\t\tmatched.identityId,\n\t\t\t// There is no persisted api_key row, so there is no api key id.\n\t\t\tmatched.identityId,\n\t\t\t[...matched.roles],\n\t\t\tnull,\n\t\t\tfalse,\n\t\t)\n\t}\n\n\tstatic createRootApiKey(tokenHash: TokenHash): UnpersistedApiKey {\n\t\treturn {\n\t\t\ttokenHash,\n\t\t\tidentityId: UNPERSISTED_ROOT_IDENTITY_ID,\n\t\t\troles: [TenantRole.SUPER_ADMIN],\n\t\t}\n\t}\n\n\t/**\n\t * Builds a manager for unpersisted super-admin root tokens from configured\n\t * plain tokens and/or pre-computed token hashes.\n\t */\n\tstatic createForRootTokens(input: {\n\t\ttokens?: readonly string[]\n\t\ttokenHashes?: readonly string[]\n\t}): UnpersistedApiKeyManager {\n\t\tconst hashes: TokenHash[] = []\n\t\tfor (const token of input.tokens ?? []) {\n\t\t\tif (token.length === 0) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\thashes.push(computeTokenHash(token))\n\t\t}\n\t\tfor (const hash of input.tokenHashes ?? []) {\n\t\t\tif (hash.length === 0) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst normalized = hash.toLowerCase()\n\t\t\tif (!isTokenHash(normalized)) {\n\t\t\t\tthrow new Error(`Invalid unpersisted root token hash: expected a 64-character sha256 hex string.`)\n\t\t\t}\n\t\t\thashes.push(normalized)\n\t\t}\n\t\treturn new UnpersistedApiKeyManager(hashes.map(it => UnpersistedApiKeyManager.createRootApiKey(it)))\n\t}\n}\n"],"names":["VerifyResult","TenantRole","token","computeTokenHash","timingSafeCompareHash","isTokenHash"],"mappings":";;;;;;;;;;;;;;;AAUO,MAAM,+BAA+B;AAQrC,MAAM,gCAAgC;AAE7C,MAAM,yBAA8C,oBAAI,IAAI,CAAC,8BAA8B,6BAA6B,CAAC;AAMlH,MAAM,0BAA0B,CAAC,eAA4C,eAAe,UAAa,uBAAuB,IAAI,UAAU;AAO9I,MAAM,qCAAqC,MACjD,IAAIA,cAAAA,aAAa,+BAA+B,+BAA+B,CAACC,iBAAW,KAAK,GAAG,MAAM,KAAK;AAgBxG,MAAM,yBAAyB;AAAA,EAGrC,YAAY,UAAwC,IAAI;AAFxD,kBAAA,MAAiB,SAAA;AAGhB,SAAK,UAAU;AAAA,EAChB;AAAA,EAEA,IAAI,UAAmB;AACtB,WAAO,KAAK,QAAQ,WAAW;AAAA,EAChC;AAAA,EAEA,OAAOC,SAAoC;AAC1C,QAAI,KAAK,QAAQ,WAAW,GAAG;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,YAAYC,MAAAA,iBAAiBD,OAAK;AAGxC,QAAI,UAAoC;AACxC,eAAW,UAAU,KAAK,SAAS;AAClC,UAAIE,4BAAsB,WAAW,OAAO,SAAS,GAAG;AACvD,kBAAU;AAAA,MACX;AAAA,IACD;AACA,QAAI,YAAY,MAAM;AACrB,aAAO;AAAA,IACR;AACA,WAAO,IAAIJ,cAAAA;AAAAA,MACV,QAAQ;AAAA;AAAA,MAER,QAAQ;AAAA,MACR,CAAC,GAAG,QAAQ,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,OAAO,iBAAiB,WAAyC;AAChE,WAAO;AAAA,MACN;AAAA,MACA,YAAY;AAAA,MACZ,OAAO,CAACC,MAAAA,WAAW,WAAW;AAAA,IAAA;AAAA,EAEhC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,oBAAoB,OAGE;AAC5B,UAAM,SAAsB,CAAA;AAC5B,eAAWC,WAAS,MAAM,UAAU,CAAA,GAAI;AACvC,UAAIA,QAAM,WAAW,GAAG;AACvB;AAAA,MACD;AACA,aAAO,KAAKC,uBAAiBD,OAAK,CAAC;AAAA,IACpC;AACA,eAAW,QAAQ,MAAM,eAAe,CAAA,GAAI;AAC3C,UAAI,KAAK,WAAW,GAAG;AACtB;AAAA,MACD;AACA,YAAM,aAAa,KAAK,YAAA;AACxB,UAAI,CAACG,MAAAA,YAAY,UAAU,GAAG;AAC7B,cAAM,IAAI,MAAM,iFAAiF;AAAA,MAClG;AACA,aAAO,KAAK,UAAU;AAAA,IACvB;AACA,WAAO,IAAI,yBAAyB,OAAO,IAAI,QAAM,yBAAyB,iBAAiB,EAAE,CAAC,CAAC;AAAA,EACpG;AACD;;;;;;"}

package/dist/development/src/model/service/apiKey/UnpersistedApiKeyManager.js

@@ -12,6 +12,10 @@ var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, key + "", value);
 const UNPERSISTED_ROOT_IDENTITY_ID = "f3b2c4d6-0000-4000-8000-000000000001";
+const UNPERSISTED_LOGIN_IDENTITY_ID = "f3b2c4d6-0000-4000-8000-000000000002";
+const unpersistedIdentityIds = /* @__PURE__ */ new Set([UNPERSISTED_ROOT_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID]);
+const isUnpersistedIdentityId = (identityId) => identityId !== void 0 && unpersistedIdentityIds.has(identityId);
+const createUnpersistedLoginVerifyResult = () => new VerifyResult(UNPERSISTED_LOGIN_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID, [TenantRole.LOGIN], null, false);
 class UnpersistedApiKeyManager {
   constructor(apiKeys = []) {
     __publicField(this, "apiKeys");
@@ -76,7 +80,10 @@ class UnpersistedApiKeyManager {
   }
 }
 export {
+  UNPERSISTED_LOGIN_IDENTITY_ID,
   UNPERSISTED_ROOT_IDENTITY_ID,
-  UnpersistedApiKeyManager
+  UnpersistedApiKeyManager,
+  createUnpersistedLoginVerifyResult,
+  isUnpersistedIdentityId
 };
 //# sourceMappingURL=UnpersistedApiKeyManager.js.map

package/dist/development/src/model/service/apiKey/UnpersistedApiKeyManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"UnpersistedApiKeyManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/UnpersistedApiKeyManager.ts"],"sourcesContent":["import { computeTokenHash, isTokenHash, timingSafeCompareHash, TokenHash } from '../../utils/index.js'\nimport { TenantRole } from '../../authorization/index.js'\nimport { VerifyResult } from './ApiKeyManager.js'\n\n/**\n * Well-known identity id used for super-admin identities authenticated via an\n * unpersisted (configured) root token. The id is stable so that audit logs and\n * created entities consistently reference the same virtual identity, even\n * though no row exists in the `identity` table.\n */\nexport const UNPERSISTED_ROOT_IDENTITY_ID = 'f3b2c4d6-0000-4000-8000-000000000001'\n\nexport interface UnpersistedApiKey {\n\treadonly tokenHash: TokenHash\n\treadonly identityId: string\n\treadonly roles: readonly string[]\n}\n\n/**\n * Verifies incoming tokens against a fixed set of root tokens configured out of\n * band (env/config) instead of being stored in the database. This enables token\n * rotation without database writes and avoids persisting the token hash.\n *\n * Token hashes are compared in constant time to avoid leaking information about\n * the configured secret.\n */\nexport class UnpersistedApiKeyManager {\n\tprivate readonly apiKeys: readonly UnpersistedApiKey[]\n\n\tconstructor(apiKeys: readonly UnpersistedApiKey[] = []) {\n\t\tthis.apiKeys = apiKeys\n\t}\n\n\tget isEmpty(): boolean {\n\t\treturn this.apiKeys.length === 0\n\t}\n\n\tverify(token: string): VerifyResult | null {\n\t\tif (this.apiKeys.length === 0) {\n\t\t\treturn null\n\t\t}\n\t\tconst tokenHash = computeTokenHash(token)\n\t\t// Iterate over all configured keys (no early return) so that matching\n\t\t// remains independent of the position of the matching key.\n\t\tlet matched: UnpersistedApiKey | null = null\n\t\tfor (const apiKey of this.apiKeys) {\n\t\t\tif (timingSafeCompareHash(tokenHash, apiKey.tokenHash)) {\n\t\t\t\tmatched = apiKey\n\t\t\t}\n\t\t}\n\t\tif (matched === null) {\n\t\t\treturn null\n\t\t}\n\t\treturn new VerifyResult(\n\t\t\tmatched.identityId,\n\t\t\t// There is no persisted api_key row, so there is no api key id.\n\t\t\tmatched.identityId,\n\t\t\t[...matched.roles],\n\t\t\tnull,\n\t\t\tfalse,\n\t\t)\n\t}\n\n\tstatic createRootApiKey(tokenHash: TokenHash): UnpersistedApiKey {\n\t\treturn {\n\t\t\ttokenHash,\n\t\t\tidentityId: UNPERSISTED_ROOT_IDENTITY_ID,\n\t\t\troles: [TenantRole.SUPER_ADMIN],\n\t\t}\n\t}\n\n\t/**\n\t * Builds a manager for unpersisted super-admin root tokens from configured\n\t * plain tokens and/or pre-computed token hashes.\n\t */\n\tstatic createForRootTokens(input: {\n\t\ttokens?: readonly string[]\n\t\ttokenHashes?: readonly string[]\n\t}): UnpersistedApiKeyManager {\n\t\tconst hashes: TokenHash[] = []\n\t\tfor (const token of input.tokens ?? []) {\n\t\t\tif (token.length === 0) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\thashes.push(computeTokenHash(token))\n\t\t}\n\t\tfor (const hash of input.tokenHashes ?? []) {\n\t\t\tif (hash.length === 0) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst normalized = hash.toLowerCase()\n\t\t\tif (!isTokenHash(normalized)) {\n\t\t\t\tthrow new Error(`Invalid unpersisted root token hash: expected a 64-character sha256 hex string.`)\n\t\t\t}\n\t\t\thashes.push(normalized)\n\t\t}\n\t\treturn new UnpersistedApiKeyManager(hashes.map(it => UnpersistedApiKeyManager.createRootApiKey(it)))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;AAUO,MAAM,+BAA+B;AAgBrC,MAAM,yBAAyB;AAAA,EAGrC,YAAY,UAAwC,IAAI;AAFxD,kBAAA,MAAiB,SAAA;AAGhB,SAAK,UAAU;AAAA,EAChB;AAAA,EAEA,IAAI,UAAmB;AACtB,WAAO,KAAK,QAAQ,WAAW;AAAA,EAChC;AAAA,EAEA,OAAO,OAAoC;AAC1C,QAAI,KAAK,QAAQ,WAAW,GAAG;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,YAAY,iBAAiB,KAAK;AAGxC,QAAI,UAAoC;AACxC,eAAW,UAAU,KAAK,SAAS;AAClC,UAAI,sBAAsB,WAAW,OAAO,SAAS,GAAG;AACvD,kBAAU;AAAA,MACX;AAAA,IACD;AACA,QAAI,YAAY,MAAM;AACrB,aAAO;AAAA,IACR;AACA,WAAO,IAAI;AAAA,MACV,QAAQ;AAAA;AAAA,MAER,QAAQ;AAAA,MACR,CAAC,GAAG,QAAQ,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,OAAO,iBAAiB,WAAyC;AAChE,WAAO;AAAA,MACN;AAAA,MACA,YAAY;AAAA,MACZ,OAAO,CAAC,WAAW,WAAW;AAAA,IAAA;AAAA,EAEhC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,oBAAoB,OAGE;AAC5B,UAAM,SAAsB,CAAA;AAC5B,eAAW,SAAS,MAAM,UAAU,CAAA,GAAI;AACvC,UAAI,MAAM,WAAW,GAAG;AACvB;AAAA,MACD;AACA,aAAO,KAAK,iBAAiB,KAAK,CAAC;AAAA,IACpC;AACA,eAAW,QAAQ,MAAM,eAAe,CAAA,GAAI;AAC3C,UAAI,KAAK,WAAW,GAAG;AACtB;AAAA,MACD;AACA,YAAM,aAAa,KAAK,YAAA;AACxB,UAAI,CAAC,YAAY,UAAU,GAAG;AAC7B,cAAM,IAAI,MAAM,iFAAiF;AAAA,MAClG;AACA,aAAO,KAAK,UAAU;AAAA,IACvB;AACA,WAAO,IAAI,yBAAyB,OAAO,IAAI,QAAM,yBAAyB,iBAAiB,EAAE,CAAC,CAAC;AAAA,EACpG;AACD;"}
+{"version":3,"file":"UnpersistedApiKeyManager.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/apiKey/UnpersistedApiKeyManager.ts"],"sourcesContent":["import { computeTokenHash, isTokenHash, timingSafeCompareHash, TokenHash } from '../../utils/index.js'\nimport { TenantRole } from '../../authorization/index.js'\nimport { VerifyResult } from './ApiKeyManager.js'\n\n/**\n * Well-known identity id used for super-admin identities authenticated via an\n * unpersisted (configured) root token. The id is stable so that audit logs and\n * created entities consistently reference the same virtual identity, even\n * though no row exists in the `identity` table.\n */\nexport const UNPERSISTED_ROOT_IDENTITY_ID = 'f3b2c4d6-0000-4000-8000-000000000001'\n\n/**\n * Well-known identity id for the pre-sign-in caller of a first-party UI served by the engine (the\n * management panel's login screen). It holds exactly {@link TenantRole.LOGIN} and exists only in\n * memory, so the surface it opens is fixed by this file rather than by whatever token an operator\n * happened to configure.\n */\nexport const UNPERSISTED_LOGIN_IDENTITY_ID = 'f3b2c4d6-0000-4000-8000-000000000002'\n\nconst unpersistedIdentityIds: ReadonlySet<string> = new Set([UNPERSISTED_ROOT_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID])\n\n/**\n * Whether an identity id is one of the virtual identities above, i.e. has no row in `identity`.\n * Anything writing a foreign key to `identity` must ask first — see `AuthLogService`.\n */\nexport const isUnpersistedIdentityId = (identityId: string | undefined): boolean => identityId !== undefined && unpersistedIdentityIds.has(identityId)\n\n/**\n * The pre-sign-in caller of an engine-served UI, as an already-verified result. There is no token to\n * present: the surface is reached by being routed there, so nothing is compared and nothing is read\n * from the database.\n */\nexport const createUnpersistedLoginVerifyResult = (): VerifyResult =>\n\tnew VerifyResult(UNPERSISTED_LOGIN_IDENTITY_ID, UNPERSISTED_LOGIN_IDENTITY_ID, [TenantRole.LOGIN], null, false)\n\nexport interface UnpersistedApiKey {\n\treadonly tokenHash: TokenHash\n\treadonly identityId: string\n\treadonly roles: readonly string[]\n}\n\n/**\n * Verifies incoming tokens against a fixed set of root tokens configured out of\n * band (env/config) instead of being stored in the database. This enables token\n * rotation without database writes and avoids persisting the token hash.\n *\n * Token hashes are compared in constant time to avoid leaking information about\n * the configured secret.\n */\nexport class UnpersistedApiKeyManager {\n\tprivate readonly apiKeys: readonly UnpersistedApiKey[]\n\n\tconstructor(apiKeys: readonly UnpersistedApiKey[] = []) {\n\t\tthis.apiKeys = apiKeys\n\t}\n\n\tget isEmpty(): boolean {\n\t\treturn this.apiKeys.length === 0\n\t}\n\n\tverify(token: string): VerifyResult | null {\n\t\tif (this.apiKeys.length === 0) {\n\t\t\treturn null\n\t\t}\n\t\tconst tokenHash = computeTokenHash(token)\n\t\t// Iterate over all configured keys (no early return) so that matching\n\t\t// remains independent of the position of the matching key.\n\t\tlet matched: UnpersistedApiKey | null = null\n\t\tfor (const apiKey of this.apiKeys) {\n\t\t\tif (timingSafeCompareHash(tokenHash, apiKey.tokenHash)) {\n\t\t\t\tmatched = apiKey\n\t\t\t}\n\t\t}\n\t\tif (matched === null) {\n\t\t\treturn null\n\t\t}\n\t\treturn new VerifyResult(\n\t\t\tmatched.identityId,\n\t\t\t// There is no persisted api_key row, so there is no api key id.\n\t\t\tmatched.identityId,\n\t\t\t[...matched.roles],\n\t\t\tnull,\n\t\t\tfalse,\n\t\t)\n\t}\n\n\tstatic createRootApiKey(tokenHash: TokenHash): UnpersistedApiKey {\n\t\treturn {\n\t\t\ttokenHash,\n\t\t\tidentityId: UNPERSISTED_ROOT_IDENTITY_ID,\n\t\t\troles: [TenantRole.SUPER_ADMIN],\n\t\t}\n\t}\n\n\t/**\n\t * Builds a manager for unpersisted super-admin root tokens from configured\n\t * plain tokens and/or pre-computed token hashes.\n\t */\n\tstatic createForRootTokens(input: {\n\t\ttokens?: readonly string[]\n\t\ttokenHashes?: readonly string[]\n\t}): UnpersistedApiKeyManager {\n\t\tconst hashes: TokenHash[] = []\n\t\tfor (const token of input.tokens ?? []) {\n\t\t\tif (token.length === 0) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\thashes.push(computeTokenHash(token))\n\t\t}\n\t\tfor (const hash of input.tokenHashes ?? []) {\n\t\t\tif (hash.length === 0) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tconst normalized = hash.toLowerCase()\n\t\t\tif (!isTokenHash(normalized)) {\n\t\t\t\tthrow new Error(`Invalid unpersisted root token hash: expected a 64-character sha256 hex string.`)\n\t\t\t}\n\t\t\thashes.push(normalized)\n\t\t}\n\t\treturn new UnpersistedApiKeyManager(hashes.map(it => UnpersistedApiKeyManager.createRootApiKey(it)))\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;AAUO,MAAM,+BAA+B;AAQrC,MAAM,gCAAgC;AAE7C,MAAM,yBAA8C,oBAAI,IAAI,CAAC,8BAA8B,6BAA6B,CAAC;AAMlH,MAAM,0BAA0B,CAAC,eAA4C,eAAe,UAAa,uBAAuB,IAAI,UAAU;AAO9I,MAAM,qCAAqC,MACjD,IAAI,aAAa,+BAA+B,+BAA+B,CAAC,WAAW,KAAK,GAAG,MAAM,KAAK;AAgBxG,MAAM,yBAAyB;AAAA,EAGrC,YAAY,UAAwC,IAAI;AAFxD,kBAAA,MAAiB,SAAA;AAGhB,SAAK,UAAU;AAAA,EAChB;AAAA,EAEA,IAAI,UAAmB;AACtB,WAAO,KAAK,QAAQ,WAAW;AAAA,EAChC;AAAA,EAEA,OAAO,OAAoC;AAC1C,QAAI,KAAK,QAAQ,WAAW,GAAG;AAC9B,aAAO;AAAA,IACR;AACA,UAAM,YAAY,iBAAiB,KAAK;AAGxC,QAAI,UAAoC;AACxC,eAAW,UAAU,KAAK,SAAS;AAClC,UAAI,sBAAsB,WAAW,OAAO,SAAS,GAAG;AACvD,kBAAU;AAAA,MACX;AAAA,IACD;AACA,QAAI,YAAY,MAAM;AACrB,aAAO;AAAA,IACR;AACA,WAAO,IAAI;AAAA,MACV,QAAQ;AAAA;AAAA,MAER,QAAQ;AAAA,MACR,CAAC,GAAG,QAAQ,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,OAAO,iBAAiB,WAAyC;AAChE,WAAO;AAAA,MACN;AAAA,MACA,YAAY;AAAA,MACZ,OAAO,CAAC,WAAW,WAAW;AAAA,IAAA;AAAA,EAEhC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,oBAAoB,OAGE;AAC5B,UAAM,SAAsB,CAAA;AAC5B,eAAW,SAAS,MAAM,UAAU,CAAA,GAAI;AACvC,UAAI,MAAM,WAAW,GAAG;AACvB;AAAA,MACD;AACA,aAAO,KAAK,iBAAiB,KAAK,CAAC;AAAA,IACpC;AACA,eAAW,QAAQ,MAAM,eAAe,CAAA,GAAI;AAC3C,UAAI,KAAK,WAAW,GAAG;AACtB;AAAA,MACD;AACA,YAAM,aAAa,KAAK,YAAA;AACxB,UAAI,CAAC,YAAY,UAAU,GAAG;AAC7B,cAAM,IAAI,MAAM,iFAAiF;AAAA,MAClG;AACA,aAAO,KAAK,UAAU;AAAA,IACvB;AACA,WAAO,IAAI,yBAAyB,OAAO,IAAI,QAAM,yBAAyB,iBAAiB,EAAE,CAAC,CAAC;AAAA,EACpG;AACD;"}

package/dist/development/src/model/service/idp/ClaimMapping.cjs

@@ -0,0 +1,187 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Typesafe = require("@contember/typesafe");
+function _interopNamespaceDefault(e) {
+  const n = Object.create(null, { [Symbol.toStringTag]: { value: "Module" } });
+  if (e) {
+    for (const k in e) {
+      if (k !== "default") {
+        const d = Object.getOwnPropertyDescriptor(e, k);
+        Object.defineProperty(n, k, d.get ? d : {
+          enumerable: true,
+          get: () => e[k]
+        });
+      }
+    }
+  }
+  n.default = e;
+  return Object.freeze(n);
+}
+const Typesafe__namespace = /* @__PURE__ */ _interopNamespaceDefault(Typesafe);
+const ClaimValueSource = Typesafe__namespace.noExtraProps(Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    /** Claim to read: the exact name first (URL-namespaced names work), then as a dot-path (e.g. `profile.languages`). */
+    claim: Typesafe__namespace.string
+  }),
+  Typesafe__namespace.partial({
+    /** Split each string value on this delimiter (e.g. `,` or ` `): a scalar string claim and every string element of an array claim. A no-op for non-string values. */
+    split: Typesafe__namespace.string,
+    /** For an array-of-objects claim, take this (dot-path) field from each element. */
+    pick: Typesafe__namespace.string,
+    /** For an array-of-objects claim, keep only elements whose `field` equals `equals`. */
+    where: Typesafe__namespace.noExtraProps(Typesafe__namespace.object({
+      field: Typesafe__namespace.string,
+      equals: Typesafe__namespace.scalar
+    }))
+  })
+));
+const ClaimMappingVariable = Typesafe__namespace.noExtraProps(Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    name: Typesafe__namespace.string
+  }),
+  Typesafe__namespace.partial({
+    /** Constant values, set regardless of any claim (the original static form). */
+    values: Typesafe__namespace.array(Typesafe__namespace.string),
+    /** Derive (additional) values from a claim. */
+    from: ClaimValueSource,
+    /** Lookup table applied to each raw value from `from`. A raw value with no entry is dropped unless `passthrough`. */
+    map: Typesafe__namespace.record(Typesafe__namespace.string, Typesafe__namespace.array(Typesafe__namespace.string)),
+    /** When `true`, a raw value from `from` not present in `map` is set verbatim. See the security note above. */
+    passthrough: Typesafe__namespace.boolean,
+    /** Allowlist applied to the values derived from `from` (constants in `values` are unaffected). */
+    allow: Typesafe__namespace.array(Typesafe__namespace.string)
+  })
+));
+const ClaimMappingMembership = Typesafe__namespace.noExtraProps(Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    project: Typesafe__namespace.string,
+    role: Typesafe__namespace.string
+  }),
+  Typesafe__namespace.partial({
+    /**
+     * Membership variables to set. Each is constant (`values`, e.g. `[{ name: 'locale', values: ['cs'] }]`)
+     * and/or claim-derived (`from`, e.g. map a `languages` claim through a lookup table to locale ids).
+     */
+    variables: Typesafe__namespace.array(ClaimMappingVariable)
+  })
+));
+const ClaimMappingRule = Typesafe__namespace.noExtraProps(Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    /** Claim/attribute from the IdP response to inspect: the exact name first, then as a dot-path into nested objects. */
+    claim: Typesafe__namespace.string
+  }),
+  Typesafe__namespace.partial({
+    /** Match when the claim equals this value (array claims: when it contains this element). */
+    equals: Typesafe__namespace.scalar,
+    /** Match when the claim contains this value (substring for strings, element for arrays). */
+    contains: Typesafe__namespace.scalar,
+    /** Project membership to grant when the rule matches. */
+    grantMembership: ClaimMappingMembership
+  })
+));
+const ClaimMapping = Typesafe__namespace.intersection(
+  Typesafe__namespace.object({
+    rules: Typesafe__namespace.array(ClaimMappingRule)
+  }),
+  Typesafe__namespace.partial({
+    /**
+     * When to apply the mapping:
+     * - `always` (default) — re-sync memberships on every sign-in (and on every OIDC session refresh).
+     * - `sticky`           — apply only when the account is first created by auto-sign-up; existing
+     *                        accounts (including one being linked to this IdP for the first time) are
+     *                        left untouched.
+     */
+    syncPolicy: Typesafe__namespace.enumeration("always", "sticky"),
+    /**
+     * How to treat existing grants the mapping does NOT (re)assign on this sign-in:
+     * - `keep`   (default, safer) — leave pre-existing memberships untouched.
+     * - `remove` — strip memberships that the mapping no longer grants (IdP becomes the source of
+     *              truth). Only ever touches grants the mapping itself could have made; memberships
+     *              outside the mapping's vocabulary are never removed.
+     */
+    unmatched: Typesafe__namespace.enumeration("keep", "remove")
+  })
+);
+const DEFAULT_SYNC_POLICY = "always";
+const DEFAULT_UNMATCHED = "keep";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parseClaimMapping = (configuration) => {
+  const raw = configuration.claimMapping;
+  if (!isRecord(raw) || raw.rules === void 0 || raw.rules === null) {
+    return null;
+  }
+  const input = { rules: raw.rules };
+  if (raw.syncPolicy !== void 0) {
+    input.syncPolicy = raw.syncPolicy;
+  }
+  if (raw.unmatched !== void 0) {
+    input.unmatched = raw.unmatched;
+  }
+  return ClaimMapping(input, ["claimMapping"]);
+};
+const REMOVED_RULE_KEYS = ["grantRoles"];
+const findRemovedRuleKeys = (configuration) => {
+  const raw = configuration.claimMapping;
+  if (!isRecord(raw) || !Array.isArray(raw.rules)) {
+    return [];
+  }
+  const found = /* @__PURE__ */ new Set();
+  for (const rule of raw.rules) {
+    if (isRecord(rule)) {
+      for (const key of REMOVED_RULE_KEYS) {
+        if (key in rule) {
+          found.add(key);
+        }
+      }
+    }
+  }
+  return [...found];
+};
+const findClaimMappingShapeErrors = (mapping) => {
+  const errors = [];
+  for (const rule of mapping.rules) {
+    if (rule.grantMembership === void 0) {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has no 'grantMembership', so it matches but grants nothing; add a 'grantMembership'`
+      );
+    }
+    if (rule.equals !== void 0 && rule.contains !== void 0) {
+      errors.push(`claimMapping rule for claim '${rule.claim}' sets both 'equals' and 'contains'; a rule may use at most one`);
+    }
+    if (typeof rule.equals === "string" && rule.equals.trim() === "") {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has an empty 'equals' value; omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`
+      );
+    }
+    if (typeof rule.contains === "string" && rule.contains.trim() === "") {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has an empty 'contains' value, which would substring-match every string value of the claim (a match-everything grant); omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`
+      );
+    }
+    for (const variable of rule.grantMembership?.variables ?? []) {
+      if (variable.from?.where !== void 0 && variable.from.pick === void 0) {
+        errors.push(
+          `claimMapping variable '${variable.name}' uses 'from.where' without 'from.pick'; it can only ever resolve to no values — set 'pick' (the field to take from each matched element)`
+        );
+      }
+      if (variable.from?.split === "") {
+        errors.push(
+          `claimMapping variable '${variable.name}' has an empty 'from.split' delimiter, which splits every claim value into its individual characters; omit 'split' to keep the value whole, or set a non-empty delimiter`
+        );
+      }
+    }
+  }
+  return errors;
+};
+exports.ClaimMapping = ClaimMapping;
+exports.ClaimMappingMembership = ClaimMappingMembership;
+exports.ClaimMappingRule = ClaimMappingRule;
+exports.ClaimMappingVariable = ClaimMappingVariable;
+exports.ClaimValueSource = ClaimValueSource;
+exports.DEFAULT_SYNC_POLICY = DEFAULT_SYNC_POLICY;
+exports.DEFAULT_UNMATCHED = DEFAULT_UNMATCHED;
+exports.findClaimMappingShapeErrors = findClaimMappingShapeErrors;
+exports.findRemovedRuleKeys = findRemovedRuleKeys;
+exports.isRecord = isRecord;
+exports.parseClaimMapping = parseClaimMapping;
+//# sourceMappingURL=ClaimMapping.cjs.map

package/dist/development/src/model/service/idp/ClaimMapping.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClaimMapping.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/ClaimMapping.ts"],"sourcesContent":["import * as Typesafe from '@contember/typesafe'\n\n/**\n * Provider-agnostic mapping of IdP claims/attributes to Contember project memberships (A09).\n * Stored on an IdP's `configuration.claimMapping`, so it rides inside the existing\n * `identity_provider.configuration` JSONB and needs no schema change — `addIDP` / `updateIDP`\n * already accept an opaque configuration object.\n *\n * The mapping grants **project memberships only** (a project role plus optional membership\n * variables). It deliberately does NOT grant global/tenant roles: those are privilege-bearing\n * and granting them from external claims would be a privilege-escalation path, so global-role\n * mapping was dropped. A project membership stays within what the IdP configurer\n * (`project_admin`, holding `IDP_ADD` / `IDP_UPDATE`) may already grant directly.\n *\n * Coexistence: the OIDC provider also uses `configuration.claimMapping` for an unrelated\n * identity-field remap (`email` / `name` / `externalIdentifier` / `attributesKey`). A09 only\n * looks at the `rules` field, so the two coexist in the same object — {@link parseClaimMapping}\n * returns `null` when no `rules` are present (an OIDC-only remap) instead of rejecting it.\n *\n * Each rule inspects one `claim` from the IdP response (the raw claims flow through verbatim,\n * since `IDPResponse` is `& Record<string, unknown>`) and, when it matches, grants a project\n * membership. Rules are independent and additive — every matching rule contributes; a\n * non-matching rule is simply skipped.\n *\n * Matching is declarative, never code:\n * - `equals`   — the claim equals the value (scalar compare; for array claims, the value is one\n *                of the elements).\n * - `contains` — the claim contains the value: substring for string claims, membership for array\n *                claims. This is the natural fit for multi-valued `groups`.\n * - neither    — the rule matches whenever the claim is merely present (and truthy for booleans).\n */\n/**\n * Where a membership variable's values come from when they are not constant. Reads one `claim` from the\n * IdP response — by exact name first (a URL-namespaced claim with literal dots works), then as a dot-path\n * (nested claims like `profile.languages`) — and shapes the raw value(s) into a flat list of strings:\n * - array claim       → its elements (`languages: ['cs','en']`)\n * - `split`           → split a delimited string claim (`'cs,en'`, OIDC-style `'cs en'`) into elements\n * - `pick` / `where`  → for an array-of-objects claim, keep elements matching `where` and take their\n *                       `pick` field (`orgs: [{ code, role }]` → codes of the elements where role matches)\n *\n * The extracted raw values are then run through {@link ClaimMappingVariable}'s `map` / `passthrough`.\n */\nexport const ClaimValueSource = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\t/** Claim to read: the exact name first (URL-namespaced names work), then as a dot-path (e.g. `profile.languages`). */\n\t\tclaim: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/** Split each string value on this delimiter (e.g. `,` or ` `): a scalar string claim and every string element of an array claim. A no-op for non-string values. */\n\t\tsplit: Typesafe.string,\n\t\t/** For an array-of-objects claim, take this (dot-path) field from each element. */\n\t\tpick: Typesafe.string,\n\t\t/** For an array-of-objects claim, keep only elements whose `field` equals `equals`. */\n\t\twhere: Typesafe.noExtraProps(Typesafe.object({\n\t\t\tfield: Typesafe.string,\n\t\t\tequals: Typesafe.scalar,\n\t\t})),\n\t}),\n))\n\nexport type ClaimValueSource = ReturnType<typeof ClaimValueSource>\n\n/**\n * One membership variable to set on a granted membership. Either constant (`values`), claim-derived\n * (`from`), or both — the two sets are unioned. When derived from a claim:\n * - `map`         — lookup table from a raw claim value to the value(s) actually set, e.g.\n *                   `{ cs: ['<locale-uuid>'] }`. A raw value absent from the map is dropped…\n * - `passthrough` — …unless `passthrough` is `true`, in which case it is set verbatim. Off by\n *                   default: raw external claim values then flow straight into row-level ACL\n *                   variables, so enable it only when the variable legitimately holds claim values\n *                   (not opaque ids), and prefer `map` / `allow` to bound what an IdP can inject.\n * - `allow`       — optional allowlist applied to the claim-derived values (constants are never filtered).\n */\nexport const ClaimMappingVariable = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tname: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/** Constant values, set regardless of any claim (the original static form). */\n\t\tvalues: Typesafe.array(Typesafe.string),\n\t\t/** Derive (additional) values from a claim. */\n\t\tfrom: ClaimValueSource,\n\t\t/** Lookup table applied to each raw value from `from`. A raw value with no entry is dropped unless `passthrough`. */\n\t\tmap: Typesafe.record(Typesafe.string, Typesafe.array(Typesafe.string)),\n\t\t/** When `true`, a raw value from `from` not present in `map` is set verbatim. See the security note above. */\n\t\tpassthrough: Typesafe.boolean,\n\t\t/** Allowlist applied to the values derived from `from` (constants in `values` are unaffected). */\n\t\tallow: Typesafe.array(Typesafe.string),\n\t}),\n))\n\nexport type ClaimMappingVariable = ReturnType<typeof ClaimMappingVariable>\n\nexport const ClaimMappingMembership = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\tproject: Typesafe.string,\n\t\trole: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/**\n\t\t * Membership variables to set. Each is constant (`values`, e.g. `[{ name: 'locale', values: ['cs'] }]`)\n\t\t * and/or claim-derived (`from`, e.g. map a `languages` claim through a lookup table to locale ids).\n\t\t */\n\t\tvariables: Typesafe.array(ClaimMappingVariable),\n\t}),\n))\n\nexport type ClaimMappingMembership = ReturnType<typeof ClaimMappingMembership>\n\nexport const ClaimMappingRule = Typesafe.noExtraProps(Typesafe.intersection(\n\tTypesafe.object({\n\t\t/** Claim/attribute from the IdP response to inspect: the exact name first, then as a dot-path into nested objects. */\n\t\tclaim: Typesafe.string,\n\t}),\n\tTypesafe.partial({\n\t\t/** Match when the claim equals this value (array claims: when it contains this element). */\n\t\tequals: Typesafe.scalar,\n\t\t/** Match when the claim contains this value (substring for strings, element for arrays). */\n\t\tcontains: Typesafe.scalar,\n\t\t/** Project membership to grant when the rule matches. */\n\t\tgrantMembership: ClaimMappingMembership,\n\t}),\n))\n\nexport type ClaimMappingRule = ReturnType<typeof ClaimMappingRule>\n\n/**\n * The validated A09 mapping. `rules` is required here — {@link parseClaimMapping} only returns a\n * mapping once it has confirmed `rules` is present, and returns `null` otherwise (so an OIDC-only\n * `claimMapping` is treated as \"no role mapping\", not an error).\n */\nexport const ClaimMapping = Typesafe.intersection(\n\tTypesafe.object({\n\t\trules: Typesafe.array(ClaimMappingRule),\n\t}),\n\tTypesafe.partial({\n\t\t/**\n\t\t * When to apply the mapping:\n\t\t * - `always` (default) — re-sync memberships on every sign-in (and on every OIDC session refresh).\n\t\t * - `sticky`           — apply only when the account is first created by auto-sign-up; existing\n\t\t *                        accounts (including one being linked to this IdP for the first time) are\n\t\t *                        left untouched.\n\t\t */\n\t\tsyncPolicy: Typesafe.enumeration('always', 'sticky'),\n\t\t/**\n\t\t * How to treat existing grants the mapping does NOT (re)assign on this sign-in:\n\t\t * - `keep`   (default, safer) — leave pre-existing memberships untouched.\n\t\t * - `remove` — strip memberships that the mapping no longer grants (IdP becomes the source of\n\t\t *              truth). Only ever touches grants the mapping itself could have made; memberships\n\t\t *              outside the mapping's vocabulary are never removed.\n\t\t */\n\t\tunmatched: Typesafe.enumeration('keep', 'remove'),\n\t}),\n)\n\nexport type ClaimMapping = ReturnType<typeof ClaimMapping>\n\nexport const DEFAULT_SYNC_POLICY: NonNullable<ClaimMapping['syncPolicy']> = 'always'\nexport const DEFAULT_UNMATCHED: NonNullable<ClaimMapping['unmatched']> = 'keep'\n\nexport const isRecord = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null && !Array.isArray(value)\n\n/**\n * Parse the optional A09 `claimMapping` out of an IdP `configuration` blob. Returns `null` when no\n * A09 mapping is present — either no `claimMapping` at all, or a `claimMapping` that carries no\n * `rules` (e.g. the OIDC identity-field remap, which shares this key). Returning `null` keeps both\n * the pre-A09 sign-in path and the OIDC remap untouched.\n *\n * Only the A09 fields (`rules`, `syncPolicy`, `unmatched`) are validated; any other keys on the\n * `claimMapping` object (the OIDC remap fields) are ignored, so the two features coexist. Throws via\n * Typesafe when `rules` is present but structurally malformed (e.g. a rule missing its required\n * `claim`), so an A09 misconfiguration surfaces loudly rather than silently dropping grants.\n *\n * The nested A09 schemas (rule / membership / variable / value-source) are wrapped in\n * `Typesafe.noExtraProps`, so a typo'd key on any of them (e.g. `grantMembershp`, `equls`) is\n * REJECTED, not silently stripped — a misconfiguration surfaces loudly instead of degrading into a\n * grants-nothing or match-everyone rule. The one exception is the top-level `claimMapping` object\n * itself: it is the key SHARED with the OIDC identity-remap (`email`/`name`/`externalIdentifier`/\n * `attributesKey`), so this parse first projects only the A09 fields (`rules`/`syncPolicy`/`unmatched`)\n * into a fresh object (above) and deliberately does NOT apply `noExtraProps` there — the OIDC remap\n * fields must coexist. The `map` lookup table is likewise a `record` (arbitrary keys are legitimate),\n * not a strict object. The removed `grantRoles` key is still caught separately by\n * {@link findRemovedRuleKeys} (run before this parse) for a clearer message than the generic\n * extra-property error `noExtraProps` would otherwise raise.\n */\nexport const parseClaimMapping = (configuration: Record<string, unknown>): ClaimMapping | null => {\n\tconst raw = configuration.claimMapping\n\tif (!isRecord(raw) || raw.rules === undefined || raw.rules === null) {\n\t\treturn null\n\t}\n\tconst input: Record<string, unknown> = { rules: raw.rules }\n\tif (raw.syncPolicy !== undefined) {\n\t\tinput.syncPolicy = raw.syncPolicy\n\t}\n\tif (raw.unmatched !== undefined) {\n\t\tinput.unmatched = raw.unmatched\n\t}\n\treturn ClaimMapping(input, ['claimMapping'])\n}\n\n/**\n * The set of A09 rule keys that were removed when global-role mapping was dropped. Detected\n * explicitly (rather than relying on Typesafe's generic \"extra property\" rejection) so a config\n * that still tries to grant global roles gets an actionable error.\n */\nconst REMOVED_RULE_KEYS = ['grantRoles'] as const\n\n/**\n * Returns the removed rule keys (currently only `grantRoles`) still present in a raw `claimMapping`,\n * so config-time validation can reject them with a clear message pointing at `grantMembership`.\n */\nexport const findRemovedRuleKeys = (configuration: Record<string, unknown>): string[] => {\n\tconst raw = configuration.claimMapping\n\tif (!isRecord(raw) || !Array.isArray(raw.rules)) {\n\t\treturn []\n\t}\n\tconst found = new Set<string>()\n\tfor (const rule of raw.rules) {\n\t\tif (isRecord(rule)) {\n\t\t\tfor (const key of REMOVED_RULE_KEYS) {\n\t\t\t\tif (key in rule) {\n\t\t\t\t\tfound.add(key)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t}\n\treturn [...found]\n}\n\n/**\n * Semantic checks on a parsed mapping that the Typesafe shape cannot express. Returns one\n * human-readable message per problem (empty = ok); run at config time (IdP add/update) so a\n * contradictory rule is rejected loudly rather than silently mis-matching or granting nothing:\n * - a rule may use at most one of `equals` / `contains` ({@link ruleMatches} only ever honours `equals`\n *   when both are set, so the other would be silently ignored);\n * - a rule's `equals` / `contains` must not be an empty string: an empty `contains` substring-matches EVERY\n *   string claim (`'...'.includes('')` is always true), i.e. a match-everything grant to every user of the\n *   IdP, and an empty `equals` is an always-no-op footgun — to match on the claim's mere presence, omit both;\n * - a rule must carry a `grantMembership` — a rule with none matches but grants nothing. (A *misspelled*\n *   `grantMembership`, e.g. `grantMembershp`, is now rejected earlier by `noExtraProps` during\n *   {@link parseClaimMapping}; this check remains for a `grantMembership` that is genuinely OMITTED,\n *   which the `partial` schema permits.)\n * - a variable's `from.where` requires a `from.pick` — `where` filters elements but without `pick` there\n *   is nothing to project, so the source can only ever resolve to no values;\n * - a variable's `from.split` must not be the empty string — `''.split('')` explodes every claim value\n *   into its individual characters (the same class of footgun as an empty `equals` / `contains`).\n */\nexport const findClaimMappingShapeErrors = (mapping: ClaimMapping): string[] => {\n\tconst errors: string[] = []\n\tfor (const rule of mapping.rules) {\n\t\tif (rule.grantMembership === undefined) {\n\t\t\terrors.push(\n\t\t\t\t`claimMapping rule for claim '${rule.claim}' has no 'grantMembership', so it matches but grants nothing; add a 'grantMembership'`,\n\t\t\t)\n\t\t}\n\t\tif (rule.equals !== undefined && rule.contains !== undefined) {\n\t\t\terrors.push(`claimMapping rule for claim '${rule.claim}' sets both 'equals' and 'contains'; a rule may use at most one`)\n\t\t}\n\t\tif (typeof rule.equals === 'string' && rule.equals.trim() === '') {\n\t\t\terrors.push(\n\t\t\t\t`claimMapping rule for claim '${rule.claim}' has an empty 'equals' value; omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`,\n\t\t\t)\n\t\t}\n\t\tif (typeof rule.contains === 'string' && rule.contains.trim() === '') {\n\t\t\terrors.push(\n\t\t\t\t`claimMapping rule for claim '${rule.claim}' has an empty 'contains' value, which would substring-match every string value of the claim (a match-everything grant); omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`,\n\t\t\t)\n\t\t}\n\t\tfor (const variable of rule.grantMembership?.variables ?? []) {\n\t\t\tif (variable.from?.where !== undefined && variable.from.pick === undefined) {\n\t\t\t\terrors.push(\n\t\t\t\t\t`claimMapping variable '${variable.name}' uses 'from.where' without 'from.pick'; it can only ever resolve to no values — set 'pick' (the field to take from each matched element)`,\n\t\t\t\t)\n\t\t\t}\n\t\t\tif (variable.from?.split === '') {\n\t\t\t\terrors.push(\n\t\t\t\t\t`claimMapping variable '${variable.name}' has an empty 'from.split' delimiter, which splits every claim value into its individual characters; omit 'split' to keep the value whole, or set a non-empty delimiter`,\n\t\t\t\t)\n\t\t\t}\n\t\t}\n\t}\n\treturn errors\n}\n"],"names":["Typesafe"],"mappings":";;;;;;;;;;;;;;;;;;;;AA0CO,MAAM,mBAAmBA,oBAAS,aAAaA,oBAAS;AAAA,EAC9DA,oBAAS,OAAO;AAAA;AAAA,IAEf,OAAOA,oBAAS;AAAA,EAAA,CAChB;AAAA,EACDA,oBAAS,QAAQ;AAAA;AAAA,IAEhB,OAAOA,oBAAS;AAAA;AAAA,IAEhB,MAAMA,oBAAS;AAAA;AAAA,IAEf,OAAOA,oBAAS,aAAaA,oBAAS,OAAO;AAAA,MAC5C,OAAOA,oBAAS;AAAA,MAChB,QAAQA,oBAAS;AAAA,IAAA,CACjB,CAAC;AAAA,EAAA,CACF;AACF,CAAC;AAeM,MAAM,uBAAuBA,oBAAS,aAAaA,oBAAS;AAAA,EAClEA,oBAAS,OAAO;AAAA,IACf,MAAMA,oBAAS;AAAA,EAAA,CACf;AAAA,EACDA,oBAAS,QAAQ;AAAA;AAAA,IAEhB,QAAQA,oBAAS,MAAMA,oBAAS,MAAM;AAAA;AAAA,IAEtC,MAAM;AAAA;AAAA,IAEN,KAAKA,oBAAS,OAAOA,oBAAS,QAAQA,oBAAS,MAAMA,oBAAS,MAAM,CAAC;AAAA;AAAA,IAErE,aAAaA,oBAAS;AAAA;AAAA,IAEtB,OAAOA,oBAAS,MAAMA,oBAAS,MAAM;AAAA,EAAA,CACrC;AACF,CAAC;AAIM,MAAM,yBAAyBA,oBAAS,aAAaA,oBAAS;AAAA,EACpEA,oBAAS,OAAO;AAAA,IACf,SAASA,oBAAS;AAAA,IAClB,MAAMA,oBAAS;AAAA,EAAA,CACf;AAAA,EACDA,oBAAS,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,IAKhB,WAAWA,oBAAS,MAAM,oBAAoB;AAAA,EAAA,CAC9C;AACF,CAAC;AAIM,MAAM,mBAAmBA,oBAAS,aAAaA,oBAAS;AAAA,EAC9DA,oBAAS,OAAO;AAAA;AAAA,IAEf,OAAOA,oBAAS;AAAA,EAAA,CAChB;AAAA,EACDA,oBAAS,QAAQ;AAAA;AAAA,IAEhB,QAAQA,oBAAS;AAAA;AAAA,IAEjB,UAAUA,oBAAS;AAAA;AAAA,IAEnB,iBAAiB;AAAA,EAAA,CACjB;AACF,CAAC;AASM,MAAM,eAAeA,oBAAS;AAAA,EACpCA,oBAAS,OAAO;AAAA,IACf,OAAOA,oBAAS,MAAM,gBAAgB;AAAA,EAAA,CACtC;AAAA,EACDA,oBAAS,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQhB,YAAYA,oBAAS,YAAY,UAAU,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQnD,WAAWA,oBAAS,YAAY,QAAQ,QAAQ;AAAA,EAAA,CAChD;AACF;AAIO,MAAM,sBAA+D;AACrE,MAAM,oBAA4D;AAElE,MAAM,WAAW,CAAC,UAAqD,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAyB1I,MAAM,oBAAoB,CAAC,kBAAgE;AACjG,QAAM,MAAM,cAAc;AAC1B,MAAI,CAAC,SAAS,GAAG,KAAK,IAAI,UAAU,UAAa,IAAI,UAAU,MAAM;AACpE,WAAO;AAAA,EACR;AACA,QAAM,QAAiC,EAAE,OAAO,IAAI,MAAA;AACpD,MAAI,IAAI,eAAe,QAAW;AACjC,UAAM,aAAa,IAAI;AAAA,EACxB;AACA,MAAI,IAAI,cAAc,QAAW;AAChC,UAAM,YAAY,IAAI;AAAA,EACvB;AACA,SAAO,aAAa,OAAO,CAAC,cAAc,CAAC;AAC5C;AAOA,MAAM,oBAAoB,CAAC,YAAY;AAMhC,MAAM,sBAAsB,CAAC,kBAAqD;AACxF,QAAM,MAAM,cAAc;AAC1B,MAAI,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,QAAQ,IAAI,KAAK,GAAG;AAChD,WAAO,CAAA;AAAA,EACR;AACA,QAAM,4BAAY,IAAA;AAClB,aAAW,QAAQ,IAAI,OAAO;AAC7B,QAAI,SAAS,IAAI,GAAG;AACnB,iBAAW,OAAO,mBAAmB;AACpC,YAAI,OAAO,MAAM;AAChB,gBAAM,IAAI,GAAG;AAAA,QACd;AAAA,MACD;AAAA,IACD;AAAA,EACD;AACA,SAAO,CAAC,GAAG,KAAK;AACjB;AAoBO,MAAM,8BAA8B,CAAC,YAAoC;AAC/E,QAAM,SAAmB,CAAA;AACzB,aAAW,QAAQ,QAAQ,OAAO;AACjC,QAAI,KAAK,oBAAoB,QAAW;AACvC,aAAO;AAAA,QACN,gCAAgC,KAAK,KAAK;AAAA,MAAA;AAAA,IAE5C;AACA,QAAI,KAAK,WAAW,UAAa,KAAK,aAAa,QAAW;AAC7D,aAAO,KAAK,gCAAgC,KAAK,KAAK,iEAAiE;AAAA,IACxH;AACA,QAAI,OAAO,KAAK,WAAW,YAAY,KAAK,OAAO,KAAA,MAAW,IAAI;AACjE,aAAO;AAAA,QACN,gCAAgC,KAAK,KAAK;AAAA,MAAA;AAAA,IAE5C;AACA,QAAI,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,KAAA,MAAW,IAAI;AACrE,aAAO;AAAA,QACN,gCAAgC,KAAK,KAAK;AAAA,MAAA;AAAA,IAE5C;AACA,eAAW,YAAY,KAAK,iBAAiB,aAAa,CAAA,GAAI;AAC7D,UAAI,SAAS,MAAM,UAAU,UAAa,SAAS,KAAK,SAAS,QAAW;AAC3E,eAAO;AAAA,UACN,0BAA0B,SAAS,IAAI;AAAA,QAAA;AAAA,MAEzC;AACA,UAAI,SAAS,MAAM,UAAU,IAAI;AAChC,eAAO;AAAA,UACN,0BAA0B,SAAS,IAAI;AAAA,QAAA;AAAA,MAEzC;AAAA,IACD;AAAA,EACD;AACA,SAAO;AACR;;;;;;;;;;;;"}

package/dist/development/src/model/service/idp/ClaimMapping.js

@@ -0,0 +1,170 @@
+import * as Typesafe from "@contember/typesafe";
+const ClaimValueSource = Typesafe.noExtraProps(Typesafe.intersection(
+  Typesafe.object({
+    /** Claim to read: the exact name first (URL-namespaced names work), then as a dot-path (e.g. `profile.languages`). */
+    claim: Typesafe.string
+  }),
+  Typesafe.partial({
+    /** Split each string value on this delimiter (e.g. `,` or ` `): a scalar string claim and every string element of an array claim. A no-op for non-string values. */
+    split: Typesafe.string,
+    /** For an array-of-objects claim, take this (dot-path) field from each element. */
+    pick: Typesafe.string,
+    /** For an array-of-objects claim, keep only elements whose `field` equals `equals`. */
+    where: Typesafe.noExtraProps(Typesafe.object({
+      field: Typesafe.string,
+      equals: Typesafe.scalar
+    }))
+  })
+));
+const ClaimMappingVariable = Typesafe.noExtraProps(Typesafe.intersection(
+  Typesafe.object({
+    name: Typesafe.string
+  }),
+  Typesafe.partial({
+    /** Constant values, set regardless of any claim (the original static form). */
+    values: Typesafe.array(Typesafe.string),
+    /** Derive (additional) values from a claim. */
+    from: ClaimValueSource,
+    /** Lookup table applied to each raw value from `from`. A raw value with no entry is dropped unless `passthrough`. */
+    map: Typesafe.record(Typesafe.string, Typesafe.array(Typesafe.string)),
+    /** When `true`, a raw value from `from` not present in `map` is set verbatim. See the security note above. */
+    passthrough: Typesafe.boolean,
+    /** Allowlist applied to the values derived from `from` (constants in `values` are unaffected). */
+    allow: Typesafe.array(Typesafe.string)
+  })
+));
+const ClaimMappingMembership = Typesafe.noExtraProps(Typesafe.intersection(
+  Typesafe.object({
+    project: Typesafe.string,
+    role: Typesafe.string
+  }),
+  Typesafe.partial({
+    /**
+     * Membership variables to set. Each is constant (`values`, e.g. `[{ name: 'locale', values: ['cs'] }]`)
+     * and/or claim-derived (`from`, e.g. map a `languages` claim through a lookup table to locale ids).
+     */
+    variables: Typesafe.array(ClaimMappingVariable)
+  })
+));
+const ClaimMappingRule = Typesafe.noExtraProps(Typesafe.intersection(
+  Typesafe.object({
+    /** Claim/attribute from the IdP response to inspect: the exact name first, then as a dot-path into nested objects. */
+    claim: Typesafe.string
+  }),
+  Typesafe.partial({
+    /** Match when the claim equals this value (array claims: when it contains this element). */
+    equals: Typesafe.scalar,
+    /** Match when the claim contains this value (substring for strings, element for arrays). */
+    contains: Typesafe.scalar,
+    /** Project membership to grant when the rule matches. */
+    grantMembership: ClaimMappingMembership
+  })
+));
+const ClaimMapping = Typesafe.intersection(
+  Typesafe.object({
+    rules: Typesafe.array(ClaimMappingRule)
+  }),
+  Typesafe.partial({
+    /**
+     * When to apply the mapping:
+     * - `always` (default) — re-sync memberships on every sign-in (and on every OIDC session refresh).
+     * - `sticky`           — apply only when the account is first created by auto-sign-up; existing
+     *                        accounts (including one being linked to this IdP for the first time) are
+     *                        left untouched.
+     */
+    syncPolicy: Typesafe.enumeration("always", "sticky"),
+    /**
+     * How to treat existing grants the mapping does NOT (re)assign on this sign-in:
+     * - `keep`   (default, safer) — leave pre-existing memberships untouched.
+     * - `remove` — strip memberships that the mapping no longer grants (IdP becomes the source of
+     *              truth). Only ever touches grants the mapping itself could have made; memberships
+     *              outside the mapping's vocabulary are never removed.
+     */
+    unmatched: Typesafe.enumeration("keep", "remove")
+  })
+);
+const DEFAULT_SYNC_POLICY = "always";
+const DEFAULT_UNMATCHED = "keep";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parseClaimMapping = (configuration) => {
+  const raw = configuration.claimMapping;
+  if (!isRecord(raw) || raw.rules === void 0 || raw.rules === null) {
+    return null;
+  }
+  const input = { rules: raw.rules };
+  if (raw.syncPolicy !== void 0) {
+    input.syncPolicy = raw.syncPolicy;
+  }
+  if (raw.unmatched !== void 0) {
+    input.unmatched = raw.unmatched;
+  }
+  return ClaimMapping(input, ["claimMapping"]);
+};
+const REMOVED_RULE_KEYS = ["grantRoles"];
+const findRemovedRuleKeys = (configuration) => {
+  const raw = configuration.claimMapping;
+  if (!isRecord(raw) || !Array.isArray(raw.rules)) {
+    return [];
+  }
+  const found = /* @__PURE__ */ new Set();
+  for (const rule of raw.rules) {
+    if (isRecord(rule)) {
+      for (const key of REMOVED_RULE_KEYS) {
+        if (key in rule) {
+          found.add(key);
+        }
+      }
+    }
+  }
+  return [...found];
+};
+const findClaimMappingShapeErrors = (mapping) => {
+  const errors = [];
+  for (const rule of mapping.rules) {
+    if (rule.grantMembership === void 0) {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has no 'grantMembership', so it matches but grants nothing; add a 'grantMembership'`
+      );
+    }
+    if (rule.equals !== void 0 && rule.contains !== void 0) {
+      errors.push(`claimMapping rule for claim '${rule.claim}' sets both 'equals' and 'contains'; a rule may use at most one`);
+    }
+    if (typeof rule.equals === "string" && rule.equals.trim() === "") {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has an empty 'equals' value; omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`
+      );
+    }
+    if (typeof rule.contains === "string" && rule.contains.trim() === "") {
+      errors.push(
+        `claimMapping rule for claim '${rule.claim}' has an empty 'contains' value, which would substring-match every string value of the claim (a match-everything grant); omit both 'equals' and 'contains' to match on the claim's mere presence, or set a non-empty value`
+      );
+    }
+    for (const variable of rule.grantMembership?.variables ?? []) {
+      if (variable.from?.where !== void 0 && variable.from.pick === void 0) {
+        errors.push(
+          `claimMapping variable '${variable.name}' uses 'from.where' without 'from.pick'; it can only ever resolve to no values — set 'pick' (the field to take from each matched element)`
+        );
+      }
+      if (variable.from?.split === "") {
+        errors.push(
+          `claimMapping variable '${variable.name}' has an empty 'from.split' delimiter, which splits every claim value into its individual characters; omit 'split' to keep the value whole, or set a non-empty delimiter`
+        );
+      }
+    }
+  }
+  return errors;
+};
+export {
+  ClaimMapping,
+  ClaimMappingMembership,
+  ClaimMappingRule,
+  ClaimMappingVariable,
+  ClaimValueSource,
+  DEFAULT_SYNC_POLICY,
+  DEFAULT_UNMATCHED,
+  findClaimMappingShapeErrors,
+  findRemovedRuleKeys,
+  isRecord,
+  parseClaimMapping
+};
+//# sourceMappingURL=ClaimMapping.js.map