@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/dist/production/src/model/commands/person/EnablePersonCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EnablePersonCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/person/EnablePersonCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\n\nexport class EnablePersonCommand implements Command<void> {\n\tconstructor(private readonly personId: string) {}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('person')\n\t\t\t.values({\n\t\t\t\tdisabled_at: null,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.personId,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAGO,MAAM,oBAA6C;AAAA,EACzD,YAA6B,UAAkB;AAAlB,SAAA,WAAA;AAAA,EAAmB;AAAA,EAEhD,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAMA,gBAAc,OAAA,EAClB,MAAM,QAAQ,EACd,OAAO;AAAA,MACP,aAAa;AAAA,IAAA,CACb,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/queries/configuration/ConfigurationQuery.cjs

@@ -87,6 +87,10 @@ class ConfigurationQuery extends Database.DatabaseQuery {
           limit: result.rate_limit_email_verification_per_ip_limit,
           window: result.rate_limit_email_verification_per_ip_window
         }
+      },
+      panel: {
+        globalRoles: result.panel_global_roles,
+        projectRoles: result.panel_project_roles
       }
     };
   }

package/dist/production/src/model/queries/configuration/ConfigurationQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config.js'\nimport { Providers } from '../../providers.js'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tconstructor(private readonly providers: Providers) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\tconst captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === 'number'\n\t\t\t? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString('utf8')\n\t\t\t: null\n\n\t\treturn {\n\t\t\tsignup: {\n\t\t\t\trequireEmailVerification: result.signup_require_email_verification,\n\t\t\t},\n\t\t\temailChange: {\n\t\t\t\trequireVerification: result.require_email_change_verification,\n\t\t\t},\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t\tcheckHibp: result.password_check_hibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\trevealLoginMethod: result.login_reveal_login_method,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t\tmfaGraceDuration: result.login_mfa_grace_duration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: result.login_anomaly_detection_enabled,\n\t\t\t\t\thistorySize: result.login_anomaly_history_size,\n\t\t\t\t\temailThreshold: result.login_anomaly_email_threshold,\n\t\t\t\t\tstepUpThreshold: result.login_anomaly_step_up_threshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: result.captcha_provider,\n\t\t\t\tthreshold: result.captcha_threshold,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: result.captcha_protect_sign_up,\n\t\t\t\t\tpasswordReset: result.captcha_protect_password_reset,\n\t\t\t\t\tpasswordlessInit: result.captcha_protect_passwordless_init,\n\t\t\t\t\temailVerification: result.captcha_protect_email_verification,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptchaSecret,\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_sign_up_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_sign_up_per_ip_window,\n\t\t\t\t},\n\t\t\t\tloginPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_login_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_login_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordResetPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_password_reset_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_password_reset_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordlessInitPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_passwordless_init_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_passwordless_init_per_ip_window,\n\t\t\t\t},\n\t\t\t\temailOtpPerPerson: {\n\t\t\t\t\tlimit: result.rate_limit_email_otp_per_person_limit,\n\t\t\t\t\twindow: result.rate_limit_email_otp_per_person_window,\n\t\t\t\t},\n\t\t\t\temailVerificationPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_email_verification_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_email_verification_per_ip_window,\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal"],"mappings":";;;AAIO,MAAM,2BAA2BA,SAAAA,cAAsB;AAAA,EAC7D,YAA6B,WAAsB;AAClD,UAAA;AAD4B,SAAA,YAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAIC,SAAAA,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,UAAM,gBAAgB,OAAO,kBAAkB,OAAO,OAAO,2BAA2B,YACpF,MAAM,KAAK,UAAU,QAAQ,OAAO,gBAAgB,OAAO,sBAAsB,GAAG,MAAM,SAAS,MAAM,IAC1G;AAEH,WAAO;AAAA,MACN,QAAQ;AAAA,QACP,0BAA0B,OAAO;AAAA,MAAA;AAAA,MAElC,aAAa;AAAA,QACZ,qBAAqB,OAAO;AAAA,MAAA;AAAA,MAE7B,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,QACvB,WAAW,OAAO;AAAA,MAAA;AAAA,MAEnB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,mBAAmB,OAAO;AAAA,QAC1B,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,QAC3B,kBAAkB,OAAO;AAAA,QACzB,kBAAkB;AAAA,UACjB,SAAS,OAAO;AAAA,UAChB,aAAa,OAAO;AAAA,UACpB,gBAAgB,OAAO;AAAA,UACvB,iBAAiB,OAAO;AAAA,QAAA;AAAA,MACzB;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,eAAe,OAAO;AAAA,UACtB,kBAAkB,OAAO;AAAA,UACzB,mBAAmB,OAAO;AAAA,QAAA;AAAA,MAC3B;AAAA,MAED;AAAA,MACA,YAAY;AAAA,QACX,aAAa;AAAA,UACZ,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,YAAY;AAAA,UACX,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,oBAAoB;AAAA,UACnB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,uBAAuB;AAAA,UACtB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,mBAAmB;AAAA,UAClB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,wBAAwB;AAAA,UACvB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,MAChB;AAAA,IACD;AAAA,EAEF;AACD;;"}
+{"version":3,"file":"ConfigurationQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config.js'\nimport { Providers } from '../../providers.js'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tconstructor(private readonly providers: Providers) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\tconst captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === 'number'\n\t\t\t? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString('utf8')\n\t\t\t: null\n\n\t\treturn {\n\t\t\tsignup: {\n\t\t\t\trequireEmailVerification: result.signup_require_email_verification,\n\t\t\t},\n\t\t\temailChange: {\n\t\t\t\trequireVerification: result.require_email_change_verification,\n\t\t\t},\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t\tcheckHibp: result.password_check_hibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\trevealLoginMethod: result.login_reveal_login_method,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t\tmfaGraceDuration: result.login_mfa_grace_duration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: result.login_anomaly_detection_enabled,\n\t\t\t\t\thistorySize: result.login_anomaly_history_size,\n\t\t\t\t\temailThreshold: result.login_anomaly_email_threshold,\n\t\t\t\t\tstepUpThreshold: result.login_anomaly_step_up_threshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: result.captcha_provider,\n\t\t\t\tthreshold: result.captcha_threshold,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: result.captcha_protect_sign_up,\n\t\t\t\t\tpasswordReset: result.captcha_protect_password_reset,\n\t\t\t\t\tpasswordlessInit: result.captcha_protect_passwordless_init,\n\t\t\t\t\temailVerification: result.captcha_protect_email_verification,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptchaSecret,\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_sign_up_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_sign_up_per_ip_window,\n\t\t\t\t},\n\t\t\t\tloginPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_login_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_login_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordResetPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_password_reset_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_password_reset_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordlessInitPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_passwordless_init_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_passwordless_init_per_ip_window,\n\t\t\t\t},\n\t\t\t\temailOtpPerPerson: {\n\t\t\t\t\tlimit: result.rate_limit_email_otp_per_person_limit,\n\t\t\t\t\twindow: result.rate_limit_email_otp_per_person_window,\n\t\t\t\t},\n\t\t\t\temailVerificationPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_email_verification_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_email_verification_per_ip_window,\n\t\t\t\t},\n\t\t\t},\n\t\t\tpanel: {\n\t\t\t\tglobalRoles: result.panel_global_roles,\n\t\t\t\tprojectRoles: result.panel_project_roles,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Literal"],"mappings":";;;AAIO,MAAM,2BAA2BA,SAAAA,cAAsB;AAAA,EAC7D,YAA6B,WAAsB;AAClD,UAAA;AAD4B,SAAA,YAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAIC,SAAAA,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,UAAM,gBAAgB,OAAO,kBAAkB,OAAO,OAAO,2BAA2B,YACpF,MAAM,KAAK,UAAU,QAAQ,OAAO,gBAAgB,OAAO,sBAAsB,GAAG,MAAM,SAAS,MAAM,IAC1G;AAEH,WAAO;AAAA,MACN,QAAQ;AAAA,QACP,0BAA0B,OAAO;AAAA,MAAA;AAAA,MAElC,aAAa;AAAA,QACZ,qBAAqB,OAAO;AAAA,MAAA;AAAA,MAE7B,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,QACvB,WAAW,OAAO;AAAA,MAAA;AAAA,MAEnB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,mBAAmB,OAAO;AAAA,QAC1B,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,QAC3B,kBAAkB,OAAO;AAAA,QACzB,kBAAkB;AAAA,UACjB,SAAS,OAAO;AAAA,UAChB,aAAa,OAAO;AAAA,UACpB,gBAAgB,OAAO;AAAA,UACvB,iBAAiB,OAAO;AAAA,QAAA;AAAA,MACzB;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,eAAe,OAAO;AAAA,UACtB,kBAAkB,OAAO;AAAA,UACzB,mBAAmB,OAAO;AAAA,QAAA;AAAA,MAC3B;AAAA,MAED;AAAA,MACA,YAAY;AAAA,QACX,aAAa;AAAA,UACZ,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,YAAY;AAAA,UACX,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,oBAAoB;AAAA,UACnB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,uBAAuB;AAAA,UACtB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,mBAAmB;AAAA,UAClB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,wBAAwB;AAAA,UACvB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,MAChB;AAAA,MAED,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,cAAc,OAAO;AAAA,MAAA;AAAA,IACtB;AAAA,EAEF;AACD;;"}

package/dist/production/src/model/queries/configuration/ConfigurationQuery.js

@@ -85,6 +85,10 @@ class ConfigurationQuery extends DatabaseQuery {
           limit: result.rate_limit_email_verification_per_ip_limit,
           window: result.rate_limit_email_verification_per_ip_window
         }
+      },
+      panel: {
+        globalRoles: result.panel_global_roles,
+        projectRoles: result.panel_project_roles
       }
     };
   }

package/dist/production/src/model/queries/configuration/ConfigurationQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config.js'\nimport { Providers } from '../../providers.js'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tconstructor(private readonly providers: Providers) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\tconst captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === 'number'\n\t\t\t? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString('utf8')\n\t\t\t: null\n\n\t\treturn {\n\t\t\tsignup: {\n\t\t\t\trequireEmailVerification: result.signup_require_email_verification,\n\t\t\t},\n\t\t\temailChange: {\n\t\t\t\trequireVerification: result.require_email_change_verification,\n\t\t\t},\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t\tcheckHibp: result.password_check_hibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\trevealLoginMethod: result.login_reveal_login_method,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t\tmfaGraceDuration: result.login_mfa_grace_duration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: result.login_anomaly_detection_enabled,\n\t\t\t\t\thistorySize: result.login_anomaly_history_size,\n\t\t\t\t\temailThreshold: result.login_anomaly_email_threshold,\n\t\t\t\t\tstepUpThreshold: result.login_anomaly_step_up_threshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: result.captcha_provider,\n\t\t\t\tthreshold: result.captcha_threshold,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: result.captcha_protect_sign_up,\n\t\t\t\t\tpasswordReset: result.captcha_protect_password_reset,\n\t\t\t\t\tpasswordlessInit: result.captcha_protect_passwordless_init,\n\t\t\t\t\temailVerification: result.captcha_protect_email_verification,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptchaSecret,\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_sign_up_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_sign_up_per_ip_window,\n\t\t\t\t},\n\t\t\t\tloginPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_login_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_login_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordResetPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_password_reset_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_password_reset_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordlessInitPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_passwordless_init_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_passwordless_init_per_ip_window,\n\t\t\t\t},\n\t\t\t\temailOtpPerPerson: {\n\t\t\t\t\tlimit: result.rate_limit_email_otp_per_person_limit,\n\t\t\t\t\twindow: result.rate_limit_email_otp_per_person_window,\n\t\t\t\t},\n\t\t\t\temailVerificationPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_email_verification_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_email_verification_per_ip_window,\n\t\t\t\t},\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,2BAA2B,cAAsB;AAAA,EAC7D,YAA6B,WAAsB;AAClD,UAAA;AAD4B,SAAA,YAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAI,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,UAAM,gBAAgB,OAAO,kBAAkB,OAAO,OAAO,2BAA2B,YACpF,MAAM,KAAK,UAAU,QAAQ,OAAO,gBAAgB,OAAO,sBAAsB,GAAG,MAAM,SAAS,MAAM,IAC1G;AAEH,WAAO;AAAA,MACN,QAAQ;AAAA,QACP,0BAA0B,OAAO;AAAA,MAAA;AAAA,MAElC,aAAa;AAAA,QACZ,qBAAqB,OAAO;AAAA,MAAA;AAAA,MAE7B,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,QACvB,WAAW,OAAO;AAAA,MAAA;AAAA,MAEnB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,mBAAmB,OAAO;AAAA,QAC1B,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,QAC3B,kBAAkB,OAAO;AAAA,QACzB,kBAAkB;AAAA,UACjB,SAAS,OAAO;AAAA,UAChB,aAAa,OAAO;AAAA,UACpB,gBAAgB,OAAO;AAAA,UACvB,iBAAiB,OAAO;AAAA,QAAA;AAAA,MACzB;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,eAAe,OAAO;AAAA,UACtB,kBAAkB,OAAO;AAAA,UACzB,mBAAmB,OAAO;AAAA,QAAA;AAAA,MAC3B;AAAA,MAED;AAAA,MACA,YAAY;AAAA,QACX,aAAa;AAAA,UACZ,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,YAAY;AAAA,UACX,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,oBAAoB;AAAA,UACnB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,uBAAuB;AAAA,UACtB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,mBAAmB;AAAA,UAClB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,wBAAwB;AAAA,UACvB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,MAChB;AAAA,IACD;AAAA,EAEF;AACD;"}
+{"version":3,"file":"ConfigurationQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/configuration/ConfigurationQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Literal, SelectBuilder } from '@contember/database'\nimport { Config, ConfigRow } from '../../type/Config.js'\nimport { Providers } from '../../providers.js'\n\nexport class ConfigurationQuery extends DatabaseQuery<Config> {\n\tconstructor(private readonly providers: Providers) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<Config> {\n\t\tconst rows = await SelectBuilder.create<ConfigRow>()\n\t\t\t.from('config')\n\t\t\t.select(new Literal('*'))\n\t\t\t.getResult(db)\n\t\tconst result = this.fetchOneOrNull(rows)\n\t\tif (!result) {\n\t\t\tthrow new Error('Configuration not found')\n\t\t}\n\n\t\tconst captchaSecret = result.captcha_secret && typeof result.captcha_secret_version === 'number'\n\t\t\t? (await this.providers.decrypt(result.captcha_secret, result.captcha_secret_version)).value.toString('utf8')\n\t\t\t: null\n\n\t\treturn {\n\t\t\tsignup: {\n\t\t\t\trequireEmailVerification: result.signup_require_email_verification,\n\t\t\t},\n\t\t\temailChange: {\n\t\t\t\trequireVerification: result.require_email_change_verification,\n\t\t\t},\n\t\t\tpasswordless: {\n\t\t\t\tenabled: result.passwordless_enabled,\n\t\t\t\turl: result.passwordless_url,\n\t\t\t\texpiration: result.passwordless_expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: result.password_min_length,\n\t\t\t\trequireUppercase: result.password_require_uppercase,\n\t\t\t\trequireLowercase: result.password_require_lowercase,\n\t\t\t\trequireDigit: result.password_require_digit,\n\t\t\t\trequireSpecial: result.password_require_special,\n\t\t\t\tpattern: result.password_pattern,\n\t\t\t\tcheckBlacklist: result.password_check_blacklist,\n\t\t\t\tcheckHibp: result.password_check_hibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: result.login_base_backoff,\n\t\t\t\tmaxBackoff: result.login_max_backoff,\n\t\t\t\tattemptWindow: result.login_attempt_window,\n\t\t\t\trevealUserExists: result.login_reveal_user_exits,\n\t\t\t\trevealLoginMethod: result.login_reveal_login_method,\n\t\t\t\tdefaultTokenExpiration: result.login_default_token_expiration,\n\t\t\t\tmaxTokenExpiration: result.login_max_token_expiration,\n\t\t\t\tmfaGraceDuration: result.login_mfa_grace_duration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: result.login_anomaly_detection_enabled,\n\t\t\t\t\thistorySize: result.login_anomaly_history_size,\n\t\t\t\t\temailThreshold: result.login_anomaly_email_threshold,\n\t\t\t\t\tstepUpThreshold: result.login_anomaly_step_up_threshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: result.captcha_provider,\n\t\t\t\tthreshold: result.captcha_threshold,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: result.captcha_protect_sign_up,\n\t\t\t\t\tpasswordReset: result.captcha_protect_password_reset,\n\t\t\t\t\tpasswordlessInit: result.captcha_protect_passwordless_init,\n\t\t\t\t\temailVerification: result.captcha_protect_email_verification,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptchaSecret,\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_sign_up_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_sign_up_per_ip_window,\n\t\t\t\t},\n\t\t\t\tloginPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_login_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_login_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordResetPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_password_reset_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_password_reset_per_ip_window,\n\t\t\t\t},\n\t\t\t\tpasswordlessInitPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_passwordless_init_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_passwordless_init_per_ip_window,\n\t\t\t\t},\n\t\t\t\temailOtpPerPerson: {\n\t\t\t\t\tlimit: result.rate_limit_email_otp_per_person_limit,\n\t\t\t\t\twindow: result.rate_limit_email_otp_per_person_window,\n\t\t\t\t},\n\t\t\t\temailVerificationPerIp: {\n\t\t\t\t\tlimit: result.rate_limit_email_verification_per_ip_limit,\n\t\t\t\t\twindow: result.rate_limit_email_verification_per_ip_window,\n\t\t\t\t},\n\t\t\t},\n\t\t\tpanel: {\n\t\t\t\tglobalRoles: result.panel_global_roles,\n\t\t\t\tprojectRoles: result.panel_project_roles,\n\t\t\t},\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";AAIO,MAAM,2BAA2B,cAAsB;AAAA,EAC7D,YAA6B,WAAsB;AAClD,UAAA;AAD4B,SAAA,YAAA;AAAA,EAE7B;AAAA,EAEA,MAAM,MAAM,EAAE,MAA0C;AACvD,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,KAAK,QAAQ,EACb,OAAO,IAAI,QAAQ,GAAG,CAAC,EACvB,UAAU,EAAE;AACd,UAAM,SAAS,KAAK,eAAe,IAAI;AACvC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,MAAM,yBAAyB;AAAA,IAC1C;AAEA,UAAM,gBAAgB,OAAO,kBAAkB,OAAO,OAAO,2BAA2B,YACpF,MAAM,KAAK,UAAU,QAAQ,OAAO,gBAAgB,OAAO,sBAAsB,GAAG,MAAM,SAAS,MAAM,IAC1G;AAEH,WAAO;AAAA,MACN,QAAQ;AAAA,QACP,0BAA0B,OAAO;AAAA,MAAA;AAAA,MAElC,aAAa;AAAA,QACZ,qBAAqB,OAAO;AAAA,MAAA;AAAA,MAE7B,cAAc;AAAA,QACb,SAAS,OAAO;AAAA,QAChB,KAAK,OAAO;AAAA,QACZ,YAAY,OAAO;AAAA,MAAA;AAAA,MAEpB,UAAU;AAAA,QACT,WAAW,OAAO;AAAA,QAClB,kBAAkB,OAAO;AAAA,QACzB,kBAAkB,OAAO;AAAA,QACzB,cAAc,OAAO;AAAA,QACrB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,QAChB,gBAAgB,OAAO;AAAA,QACvB,WAAW,OAAO;AAAA,MAAA;AAAA,MAEnB,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,YAAY,OAAO;AAAA,QACnB,eAAe,OAAO;AAAA,QACtB,kBAAkB,OAAO;AAAA,QACzB,mBAAmB,OAAO;AAAA,QAC1B,wBAAwB,OAAO;AAAA,QAC/B,oBAAoB,OAAO;AAAA,QAC3B,kBAAkB,OAAO;AAAA,QACzB,kBAAkB;AAAA,UACjB,SAAS,OAAO;AAAA,UAChB,aAAa,OAAO;AAAA,UACpB,gBAAgB,OAAO;AAAA,UACvB,iBAAiB,OAAO;AAAA,QAAA;AAAA,MACzB;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO;AAAA,QACjB,WAAW,OAAO;AAAA,QAClB,SAAS;AAAA,UACR,QAAQ,OAAO;AAAA,UACf,eAAe,OAAO;AAAA,UACtB,kBAAkB,OAAO;AAAA,UACzB,mBAAmB,OAAO;AAAA,QAAA;AAAA,MAC3B;AAAA,MAED;AAAA,MACA,YAAY;AAAA,QACX,aAAa;AAAA,UACZ,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,YAAY;AAAA,UACX,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,oBAAoB;AAAA,UACnB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,uBAAuB;AAAA,UACtB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,mBAAmB;AAAA,UAClB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,QAEhB,wBAAwB;AAAA,UACvB,OAAO,OAAO;AAAA,UACd,QAAQ,OAAO;AAAA,QAAA;AAAA,MAChB;AAAA,MAED,OAAO;AAAA,QACN,aAAa,OAAO;AAAA,QACpB,cAAc,OAAO;AAAA,MAAA;AAAA,IACtB;AAAA,EAEF;AACD;"}

package/dist/production/src/model/queries/idp/LocalAuthDisablingIdpsQuery.cjs

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
+class LocalAuthDisablingIdpsQuery extends Database.DatabaseQuery {
+  constructor(personId) {
+    super();
+    this.personId = personId;
+  }
+  async fetch({ db }) {
+    const rows = await Database.SelectBuilder.create().select(["identity_provider", "slug"], "slug").from("person_identity_provider").join(
+      "identity_provider",
+      "identity_provider",
+      (expr) => expr.columnsEq(["identity_provider", "id"], ["person_identity_provider", "identity_provider_id"])
+    ).where(
+      (where) => where.compare(["person_identity_provider", "person_id"], Database.Operator.eq, this.personId).compare(["identity_provider", "disable_local_authentication"], Database.Operator.eq, true).isNull(["identity_provider", "disabled_at"])
+    ).orderBy(["identity_provider", "slug"]).getResult(db);
+    return rows.map((it) => it.slug);
+  }
+}
+exports.LocalAuthDisablingIdpsQuery = LocalAuthDisablingIdpsQuery;
+//# sourceMappingURL=LocalAuthDisablingIdpsQuery.cjs.map

package/dist/production/src/model/queries/idp/LocalAuthDisablingIdpsQuery.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalAuthDisablingIdpsQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/LocalAuthDisablingIdpsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'\n\n/**\n * Slugs of the identity providers that forbid this person every local\n * authentication method — password sign-in, passwordless sign-in and the\n * password-reset mail. Empty means local authentication is available.\n *\n * The IdP link is the marker, so this also covers a person who predates the\n * provider and was linked to it by e-mail matching, not only one created by\n * auto-sign-up. A DISABLED provider does not count: turning the provider off\n * hands local authentication back to everyone linked to it, which is the\n * break-glass when the IdP is unreachable.\n */\nexport class LocalAuthDisablingIdpsQuery extends DatabaseQuery<string[]> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<string[]> {\n\t\tconst rows = await SelectBuilder.create<{ slug: string }>()\n\t\t\t.select(['identity_provider', 'slug'], 'slug')\n\t\t\t.from('person_identity_provider')\n\t\t\t.join(\n\t\t\t\t'identity_provider',\n\t\t\t\t'identity_provider',\n\t\t\t\texpr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),\n\t\t\t)\n\t\t\t.where(where =>\n\t\t\t\twhere\n\t\t\t\t\t.compare(['person_identity_provider', 'person_id'], Operator.eq, this.personId)\n\t\t\t\t\t.compare(['identity_provider', 'disable_local_authentication'], Operator.eq, true)\n\t\t\t\t\t.isNull(['identity_provider', 'disabled_at'])\n\t\t\t)\n\t\t\t.orderBy(['identity_provider', 'slug'])\n\t\t\t.getResult(db)\n\n\t\treturn rows.map(it => it.slug)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder","Operator"],"mappings":";;;AAaO,MAAM,oCAAoCA,SAAAA,cAAwB;AAAA,EACxE,YACkB,UAChB;AACD,UAAA;AAFiB,SAAA,WAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA4C;AACzD,UAAM,OAAO,MAAMC,SAAAA,cAAc,OAAA,EAC/B,OAAO,CAAC,qBAAqB,MAAM,GAAG,MAAM,EAC5C,KAAK,0BAA0B,EAC/B;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAA,SAAQ,KAAK,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,4BAA4B,sBAAsB,CAAC;AAAA,IAAA,EAExG;AAAA,MAAM,CAAA,UACN,MACE,QAAQ,CAAC,4BAA4B,WAAW,GAAGC,SAAAA,SAAS,IAAI,KAAK,QAAQ,EAC7E,QAAQ,CAAC,qBAAqB,8BAA8B,GAAGA,kBAAS,IAAI,IAAI,EAChF,OAAO,CAAC,qBAAqB,aAAa,CAAC;AAAA,IAAA,EAE7C,QAAQ,CAAC,qBAAqB,MAAM,CAAC,EACrC,UAAU,EAAE;AAEd,WAAO,KAAK,IAAI,CAAA,OAAM,GAAG,IAAI;AAAA,EAC9B;AACD;;"}

package/dist/production/src/model/queries/idp/LocalAuthDisablingIdpsQuery.js

@@ -0,0 +1,21 @@
+import { DatabaseQuery, SelectBuilder, Operator } from "@contember/database";
+class LocalAuthDisablingIdpsQuery extends DatabaseQuery {
+  constructor(personId) {
+    super();
+    this.personId = personId;
+  }
+  async fetch({ db }) {
+    const rows = await SelectBuilder.create().select(["identity_provider", "slug"], "slug").from("person_identity_provider").join(
+      "identity_provider",
+      "identity_provider",
+      (expr) => expr.columnsEq(["identity_provider", "id"], ["person_identity_provider", "identity_provider_id"])
+    ).where(
+      (where) => where.compare(["person_identity_provider", "person_id"], Operator.eq, this.personId).compare(["identity_provider", "disable_local_authentication"], Operator.eq, true).isNull(["identity_provider", "disabled_at"])
+    ).orderBy(["identity_provider", "slug"]).getResult(db);
+    return rows.map((it) => it.slug);
+  }
+}
+export {
+  LocalAuthDisablingIdpsQuery
+};
+//# sourceMappingURL=LocalAuthDisablingIdpsQuery.js.map

package/dist/production/src/model/queries/idp/LocalAuthDisablingIdpsQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalAuthDisablingIdpsQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/LocalAuthDisablingIdpsQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, Operator, SelectBuilder } from '@contember/database'\n\n/**\n * Slugs of the identity providers that forbid this person every local\n * authentication method — password sign-in, passwordless sign-in and the\n * password-reset mail. Empty means local authentication is available.\n *\n * The IdP link is the marker, so this also covers a person who predates the\n * provider and was linked to it by e-mail matching, not only one created by\n * auto-sign-up. A DISABLED provider does not count: turning the provider off\n * hands local authentication back to everyone linked to it, which is the\n * break-glass when the IdP is unreachable.\n */\nexport class LocalAuthDisablingIdpsQuery extends DatabaseQuery<string[]> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<string[]> {\n\t\tconst rows = await SelectBuilder.create<{ slug: string }>()\n\t\t\t.select(['identity_provider', 'slug'], 'slug')\n\t\t\t.from('person_identity_provider')\n\t\t\t.join(\n\t\t\t\t'identity_provider',\n\t\t\t\t'identity_provider',\n\t\t\t\texpr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),\n\t\t\t)\n\t\t\t.where(where =>\n\t\t\t\twhere\n\t\t\t\t\t.compare(['person_identity_provider', 'person_id'], Operator.eq, this.personId)\n\t\t\t\t\t.compare(['identity_provider', 'disable_local_authentication'], Operator.eq, true)\n\t\t\t\t\t.isNull(['identity_provider', 'disabled_at'])\n\t\t\t)\n\t\t\t.orderBy(['identity_provider', 'slug'])\n\t\t\t.getResult(db)\n\n\t\treturn rows.map(it => it.slug)\n\t}\n}\n"],"names":[],"mappings":";AAaO,MAAM,oCAAoC,cAAwB;AAAA,EACxE,YACkB,UAChB;AACD,UAAA;AAFiB,SAAA,WAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA4C;AACzD,UAAM,OAAO,MAAM,cAAc,OAAA,EAC/B,OAAO,CAAC,qBAAqB,MAAM,GAAG,MAAM,EAC5C,KAAK,0BAA0B,EAC/B;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAA,SAAQ,KAAK,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,4BAA4B,sBAAsB,CAAC;AAAA,IAAA,EAExG;AAAA,MAAM,CAAA,UACN,MACE,QAAQ,CAAC,4BAA4B,WAAW,GAAG,SAAS,IAAI,KAAK,QAAQ,EAC7E,QAAQ,CAAC,qBAAqB,8BAA8B,GAAG,SAAS,IAAI,IAAI,EAChF,OAAO,CAAC,qBAAqB,aAAa,CAAC;AAAA,IAAA,EAE7C,QAAQ,CAAC,qBAAqB,MAAM,CAAC,EACrC,UAAU,EAAE;AAEd,WAAO,KAAK,IAAI,CAAA,OAAM,GAAG,IAAI;AAAA,EAC9B;AACD;"}

package/dist/production/src/model/queries/idp/PersonIdentityProvidersQuery.cjs

@@ -7,7 +7,7 @@ class PersonIdentityProvidersQuery extends Database.DatabaseQuery {
     this.personId = personId;
   }
   async fetch({ db }) {
-    return await Database.SelectBuilder.create().select(["person_identity_provider", "id"]).select(["person_identity_provider", "created_at"], "createdAt").select(["person_identity_provider", "external_identifier"], "externalIdentifier").select(["identity_provider", "slug"], "identityProviderSlug").select(["identity_provider", "type"], "identityProviderType").select(["identity_provider", "disabled_at"], "identityProviderDisabledAt").from("person_identity_provider").join(
+    return await Database.SelectBuilder.create().select(["person_identity_provider", "id"]).select(["person_identity_provider", "created_at"], "createdAt").select(["person_identity_provider", "external_identifier"], "externalIdentifier").select(["identity_provider", "slug"], "identityProviderSlug").select(["identity_provider", "type"], "identityProviderType").select(["identity_provider", "disabled_at"], "identityProviderDisabledAt").select(["identity_provider", "disable_local_authentication"], "identityProviderDisableLocalAuthentication").from("person_identity_provider").join(
       "identity_provider",
       "identity_provider",
       (expr) => expr.columnsEq(["identity_provider", "id"], ["person_identity_provider", "identity_provider_id"])

package/dist/production/src/model/queries/idp/PersonIdentityProvidersQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonIdentityProvidersQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/PersonIdentityProvidersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\nexport interface PersonIdentityProviderRow {\n\treadonly id: string\n\treadonly createdAt: Date\n\treadonly externalIdentifier: string\n\treadonly identityProviderSlug: string\n\treadonly identityProviderType: string\n\treadonly identityProviderDisabledAt: Date | null\n}\n\n/**\n * Lists the external IdP connections of a single person, joined with the\n * identity provider they belong to. Used by the `Person.identityProviders`\n * field and by the disconnect flow to enforce ownership and lock-out protection.\n */\nexport class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityProviderRow[]> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await SelectBuilder.create<PersonIdentityProviderRow>()\n\t\t\t.select(['person_identity_provider', 'id'])\n\t\t\t.select(['person_identity_provider', 'created_at'], 'createdAt')\n\t\t\t.select(['person_identity_provider', 'external_identifier'], 'externalIdentifier')\n\t\t\t.select(['identity_provider', 'slug'], 'identityProviderSlug')\n\t\t\t.select(['identity_provider', 'type'], 'identityProviderType')\n\t\t\t.select(['identity_provider', 'disabled_at'], 'identityProviderDisabledAt')\n\t\t\t.from('person_identity_provider')\n\t\t\t.join(\n\t\t\t\t'identity_provider',\n\t\t\t\t'identity_provider',\n\t\t\t\texpr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),\n\t\t\t)\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.orderBy(['person_identity_provider', 'created_at'])\n\t\t\t.orderBy(['person_identity_provider', 'id'])\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder"],"mappings":";;;AAgBO,MAAM,qCAAqCA,SAAAA,cAA2C;AAAA,EAC5F,YACkB,UAChB;AACD,UAAA;AAFiB,SAAA,WAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,WAAO,MAAMC,SAAAA,cAAc,SACzB,OAAO,CAAC,4BAA4B,IAAI,CAAC,EACzC,OAAO,CAAC,4BAA4B,YAAY,GAAG,WAAW,EAC9D,OAAO,CAAC,4BAA4B,qBAAqB,GAAG,oBAAoB,EAChF,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,aAAa,GAAG,4BAA4B,EACzE,KAAK,0BAA0B,EAC/B;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAA,SAAQ,KAAK,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,4BAA4B,sBAAsB,CAAC;AAAA,IAAA,EAExG,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,CAAC,4BAA4B,YAAY,CAAC,EAClD,QAAQ,CAAC,4BAA4B,IAAI,CAAC,EAC1C,UAAU,EAAE;AAAA,EACf;AACD;;"}
+{"version":3,"file":"PersonIdentityProvidersQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/PersonIdentityProvidersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\nexport interface PersonIdentityProviderRow {\n\treadonly id: string\n\treadonly createdAt: Date\n\treadonly externalIdentifier: string\n\treadonly identityProviderSlug: string\n\treadonly identityProviderType: string\n\treadonly identityProviderDisabledAt: Date | null\n\treadonly identityProviderDisableLocalAuthentication: boolean\n}\n\n/**\n * Lists the external IdP connections of a single person, joined with the\n * identity provider they belong to. Used by the `Person.identityProviders`\n * field and by the disconnect flow to enforce ownership and lock-out protection.\n */\nexport class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityProviderRow[]> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await SelectBuilder.create<PersonIdentityProviderRow>()\n\t\t\t.select(['person_identity_provider', 'id'])\n\t\t\t.select(['person_identity_provider', 'created_at'], 'createdAt')\n\t\t\t.select(['person_identity_provider', 'external_identifier'], 'externalIdentifier')\n\t\t\t.select(['identity_provider', 'slug'], 'identityProviderSlug')\n\t\t\t.select(['identity_provider', 'type'], 'identityProviderType')\n\t\t\t.select(['identity_provider', 'disabled_at'], 'identityProviderDisabledAt')\n\t\t\t.select(['identity_provider', 'disable_local_authentication'], 'identityProviderDisableLocalAuthentication')\n\t\t\t.from('person_identity_provider')\n\t\t\t.join(\n\t\t\t\t'identity_provider',\n\t\t\t\t'identity_provider',\n\t\t\t\texpr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),\n\t\t\t)\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.orderBy(['person_identity_provider', 'created_at'])\n\t\t\t.orderBy(['person_identity_provider', 'id'])\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder"],"mappings":";;;AAiBO,MAAM,qCAAqCA,SAAAA,cAA2C;AAAA,EAC5F,YACkB,UAChB;AACD,UAAA;AAFiB,SAAA,WAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,WAAO,MAAMC,SAAAA,cAAc,OAAA,EACzB,OAAO,CAAC,4BAA4B,IAAI,CAAC,EACzC,OAAO,CAAC,4BAA4B,YAAY,GAAG,WAAW,EAC9D,OAAO,CAAC,4BAA4B,qBAAqB,GAAG,oBAAoB,EAChF,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,aAAa,GAAG,4BAA4B,EACzE,OAAO,CAAC,qBAAqB,8BAA8B,GAAG,4CAA4C,EAC1G,KAAK,0BAA0B,EAC/B;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAA,SAAQ,KAAK,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,4BAA4B,sBAAsB,CAAC;AAAA,IAAA,EAExG,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,CAAC,4BAA4B,YAAY,CAAC,EAClD,QAAQ,CAAC,4BAA4B,IAAI,CAAC,EAC1C,UAAU,EAAE;AAAA,EACf;AACD;;"}

package/dist/production/src/model/queries/idp/PersonIdentityProvidersQuery.js

@@ -5,7 +5,7 @@ class PersonIdentityProvidersQuery extends DatabaseQuery {
     this.personId = personId;
   }
   async fetch({ db }) {
-    return await SelectBuilder.create().select(["person_identity_provider", "id"]).select(["person_identity_provider", "created_at"], "createdAt").select(["person_identity_provider", "external_identifier"], "externalIdentifier").select(["identity_provider", "slug"], "identityProviderSlug").select(["identity_provider", "type"], "identityProviderType").select(["identity_provider", "disabled_at"], "identityProviderDisabledAt").from("person_identity_provider").join(
+    return await SelectBuilder.create().select(["person_identity_provider", "id"]).select(["person_identity_provider", "created_at"], "createdAt").select(["person_identity_provider", "external_identifier"], "externalIdentifier").select(["identity_provider", "slug"], "identityProviderSlug").select(["identity_provider", "type"], "identityProviderType").select(["identity_provider", "disabled_at"], "identityProviderDisabledAt").select(["identity_provider", "disable_local_authentication"], "identityProviderDisableLocalAuthentication").from("person_identity_provider").join(
       "identity_provider",
       "identity_provider",
       (expr) => expr.columnsEq(["identity_provider", "id"], ["person_identity_provider", "identity_provider_id"])

package/dist/production/src/model/queries/idp/PersonIdentityProvidersQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonIdentityProvidersQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/PersonIdentityProvidersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\nexport interface PersonIdentityProviderRow {\n\treadonly id: string\n\treadonly createdAt: Date\n\treadonly externalIdentifier: string\n\treadonly identityProviderSlug: string\n\treadonly identityProviderType: string\n\treadonly identityProviderDisabledAt: Date | null\n}\n\n/**\n * Lists the external IdP connections of a single person, joined with the\n * identity provider they belong to. Used by the `Person.identityProviders`\n * field and by the disconnect flow to enforce ownership and lock-out protection.\n */\nexport class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityProviderRow[]> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await SelectBuilder.create<PersonIdentityProviderRow>()\n\t\t\t.select(['person_identity_provider', 'id'])\n\t\t\t.select(['person_identity_provider', 'created_at'], 'createdAt')\n\t\t\t.select(['person_identity_provider', 'external_identifier'], 'externalIdentifier')\n\t\t\t.select(['identity_provider', 'slug'], 'identityProviderSlug')\n\t\t\t.select(['identity_provider', 'type'], 'identityProviderType')\n\t\t\t.select(['identity_provider', 'disabled_at'], 'identityProviderDisabledAt')\n\t\t\t.from('person_identity_provider')\n\t\t\t.join(\n\t\t\t\t'identity_provider',\n\t\t\t\t'identity_provider',\n\t\t\t\texpr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),\n\t\t\t)\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.orderBy(['person_identity_provider', 'created_at'])\n\t\t\t.orderBy(['person_identity_provider', 'id'])\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":[],"mappings":";AAgBO,MAAM,qCAAqC,cAA2C;AAAA,EAC5F,YACkB,UAChB;AACD,UAAA;AAFiB,SAAA,WAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,WAAO,MAAM,cAAc,SACzB,OAAO,CAAC,4BAA4B,IAAI,CAAC,EACzC,OAAO,CAAC,4BAA4B,YAAY,GAAG,WAAW,EAC9D,OAAO,CAAC,4BAA4B,qBAAqB,GAAG,oBAAoB,EAChF,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,aAAa,GAAG,4BAA4B,EACzE,KAAK,0BAA0B,EAC/B;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAA,SAAQ,KAAK,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,4BAA4B,sBAAsB,CAAC;AAAA,IAAA,EAExG,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,CAAC,4BAA4B,YAAY,CAAC,EAClD,QAAQ,CAAC,4BAA4B,IAAI,CAAC,EAC1C,UAAU,EAAE;AAAA,EACf;AACD;"}
+{"version":3,"file":"PersonIdentityProvidersQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/PersonIdentityProvidersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\nexport interface PersonIdentityProviderRow {\n\treadonly id: string\n\treadonly createdAt: Date\n\treadonly externalIdentifier: string\n\treadonly identityProviderSlug: string\n\treadonly identityProviderType: string\n\treadonly identityProviderDisabledAt: Date | null\n\treadonly identityProviderDisableLocalAuthentication: boolean\n}\n\n/**\n * Lists the external IdP connections of a single person, joined with the\n * identity provider they belong to. Used by the `Person.identityProviders`\n * field and by the disconnect flow to enforce ownership and lock-out protection.\n */\nexport class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityProviderRow[]> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await SelectBuilder.create<PersonIdentityProviderRow>()\n\t\t\t.select(['person_identity_provider', 'id'])\n\t\t\t.select(['person_identity_provider', 'created_at'], 'createdAt')\n\t\t\t.select(['person_identity_provider', 'external_identifier'], 'externalIdentifier')\n\t\t\t.select(['identity_provider', 'slug'], 'identityProviderSlug')\n\t\t\t.select(['identity_provider', 'type'], 'identityProviderType')\n\t\t\t.select(['identity_provider', 'disabled_at'], 'identityProviderDisabledAt')\n\t\t\t.select(['identity_provider', 'disable_local_authentication'], 'identityProviderDisableLocalAuthentication')\n\t\t\t.from('person_identity_provider')\n\t\t\t.join(\n\t\t\t\t'identity_provider',\n\t\t\t\t'identity_provider',\n\t\t\t\texpr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),\n\t\t\t)\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.orderBy(['person_identity_provider', 'created_at'])\n\t\t\t.orderBy(['person_identity_provider', 'id'])\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":[],"mappings":";AAiBO,MAAM,qCAAqC,cAA2C;AAAA,EAC5F,YACkB,UAChB;AACD,UAAA;AAFiB,SAAA,WAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,WAAO,MAAM,cAAc,OAAA,EACzB,OAAO,CAAC,4BAA4B,IAAI,CAAC,EACzC,OAAO,CAAC,4BAA4B,YAAY,GAAG,WAAW,EAC9D,OAAO,CAAC,4BAA4B,qBAAqB,GAAG,oBAAoB,EAChF,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,aAAa,GAAG,4BAA4B,EACzE,OAAO,CAAC,qBAAqB,8BAA8B,GAAG,4CAA4C,EAC1G,KAAK,0BAA0B,EAC/B;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAA,SAAQ,KAAK,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,4BAA4B,sBAAsB,CAAC;AAAA,IAAA,EAExG,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,CAAC,4BAA4B,YAAY,CAAC,EAClD,QAAQ,CAAC,4BAA4B,IAAI,CAAC,EAC1C,UAAU,EAAE;AAAA,EACf;AACD;"}

package/dist/production/src/model/queries/idp/helpers.cjs

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
-const createBaseIdpQuery = () => Database.SelectBuilder.create().select("id").select("slug").select("type").select("configuration").select("disabled_at", "disabledAt").select("auto_sign_up", "autoSignUp").select("exclusive").select("init_returns_config", "initReturnsConfig").select("require_verified_email", "requireVerifiedEmail").select("assume_email_verified", "assumeEmailVerified").from("identity_provider");
-const createIdpDto = ({ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }) => {
+const createBaseIdpQuery = () => Database.SelectBuilder.create().select("id").select("slug").select("type").select("configuration").select("disabled_at", "disabledAt").select("auto_sign_up", "autoSignUp").select("exclusive").select("init_returns_config", "initReturnsConfig").select("require_verified_email", "requireVerifiedEmail").select("assume_email_verified", "assumeEmailVerified").select("disable_local_authentication", "disableLocalAuthentication").from("identity_provider");
+const createIdpDto = ({ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }) => {
   return {
     ...row,
-    options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }
+    options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication }
   };
 };
 exports.createBaseIdpQuery = createBaseIdpQuery;

package/dist/production/src/model/queries/idp/helpers.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/helpers.ts"],"sourcesContent":["import { SelectBuilder } from '@contember/database'\nimport { IdentityProviderDto, IdentityProviderRow } from './types.js'\n\nexport const createBaseIdpQuery = () =>\n\tSelectBuilder.create<IdentityProviderRow>()\n\t\t.select('id')\n\t\t.select('slug')\n\t\t.select('type')\n\t\t.select('configuration')\n\t\t.select('disabled_at', 'disabledAt')\n\t\t.select('auto_sign_up', 'autoSignUp')\n\t\t.select('exclusive')\n\t\t.select('init_returns_config', 'initReturnsConfig')\n\t\t.select('require_verified_email', 'requireVerifiedEmail')\n\t\t.select('assume_email_verified', 'assumeEmailVerified')\n\t\t.from('identity_provider')\n\nexport const createIdpDto = (\n\t{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }: IdentityProviderRow,\n): IdentityProviderDto => {\n\treturn {\n\t\t...row,\n\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified },\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,qBAAqB,MACjCA,SAAAA,cAAc,SACZ,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,eAAe,EACtB,OAAO,eAAe,YAAY,EAClC,OAAO,gBAAgB,YAAY,EACnC,OAAO,WAAW,EAClB,OAAO,uBAAuB,mBAAmB,EACjD,OAAO,0BAA0B,sBAAsB,EACvD,OAAO,yBAAyB,qBAAqB,EACrD,KAAK,mBAAmB;AAEpB,MAAM,eAAe,CAC3B,EAAE,WAAW,YAAY,mBAAmB,sBAAsB,qBAAqB,GAAG,UACjE;AACzB,SAAO;AAAA,IACN,GAAG;AAAA,IACH,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,oBAAA;AAAA,EAAoB;AAEjG;;;"}
+{"version":3,"file":"helpers.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/helpers.ts"],"sourcesContent":["import { SelectBuilder } from '@contember/database'\nimport { IdentityProviderDto, IdentityProviderRow } from './types.js'\n\nexport const createBaseIdpQuery = () =>\n\tSelectBuilder.create<IdentityProviderRow>()\n\t\t.select('id')\n\t\t.select('slug')\n\t\t.select('type')\n\t\t.select('configuration')\n\t\t.select('disabled_at', 'disabledAt')\n\t\t.select('auto_sign_up', 'autoSignUp')\n\t\t.select('exclusive')\n\t\t.select('init_returns_config', 'initReturnsConfig')\n\t\t.select('require_verified_email', 'requireVerifiedEmail')\n\t\t.select('assume_email_verified', 'assumeEmailVerified')\n\t\t.select('disable_local_authentication', 'disableLocalAuthentication')\n\t\t.from('identity_provider')\n\nexport const createIdpDto = (\n\t{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }: IdentityProviderRow,\n): IdentityProviderDto => {\n\treturn {\n\t\t...row,\n\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,qBAAqB,MACjCA,SAAAA,cAAc,OAAA,EACZ,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,eAAe,EACtB,OAAO,eAAe,YAAY,EAClC,OAAO,gBAAgB,YAAY,EACnC,OAAO,WAAW,EAClB,OAAO,uBAAuB,mBAAmB,EACjD,OAAO,0BAA0B,sBAAsB,EACvD,OAAO,yBAAyB,qBAAqB,EACrD,OAAO,gCAAgC,4BAA4B,EACnE,KAAK,mBAAmB;AAEpB,MAAM,eAAe,CAC3B,EAAE,WAAW,YAAY,mBAAmB,sBAAsB,qBAAqB,4BAA4B,GAAG,UAC7F;AACzB,SAAO;AAAA,IACN,GAAG;AAAA,IACH,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,2BAAA;AAAA,EAA2B;AAE7H;;;"}

package/dist/production/src/model/queries/idp/helpers.js

@@ -1,9 +1,9 @@
 import { SelectBuilder } from "@contember/database";
-const createBaseIdpQuery = () => SelectBuilder.create().select("id").select("slug").select("type").select("configuration").select("disabled_at", "disabledAt").select("auto_sign_up", "autoSignUp").select("exclusive").select("init_returns_config", "initReturnsConfig").select("require_verified_email", "requireVerifiedEmail").select("assume_email_verified", "assumeEmailVerified").from("identity_provider");
-const createIdpDto = ({ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }) => {
+const createBaseIdpQuery = () => SelectBuilder.create().select("id").select("slug").select("type").select("configuration").select("disabled_at", "disabledAt").select("auto_sign_up", "autoSignUp").select("exclusive").select("init_returns_config", "initReturnsConfig").select("require_verified_email", "requireVerifiedEmail").select("assume_email_verified", "assumeEmailVerified").select("disable_local_authentication", "disableLocalAuthentication").from("identity_provider");
+const createIdpDto = ({ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }) => {
   return {
     ...row,
-    options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }
+    options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication }
   };
 };
 export {

package/dist/production/src/model/queries/idp/helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/helpers.ts"],"sourcesContent":["import { SelectBuilder } from '@contember/database'\nimport { IdentityProviderDto, IdentityProviderRow } from './types.js'\n\nexport const createBaseIdpQuery = () =>\n\tSelectBuilder.create<IdentityProviderRow>()\n\t\t.select('id')\n\t\t.select('slug')\n\t\t.select('type')\n\t\t.select('configuration')\n\t\t.select('disabled_at', 'disabledAt')\n\t\t.select('auto_sign_up', 'autoSignUp')\n\t\t.select('exclusive')\n\t\t.select('init_returns_config', 'initReturnsConfig')\n\t\t.select('require_verified_email', 'requireVerifiedEmail')\n\t\t.select('assume_email_verified', 'assumeEmailVerified')\n\t\t.from('identity_provider')\n\nexport const createIdpDto = (\n\t{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }: IdentityProviderRow,\n): IdentityProviderDto => {\n\treturn {\n\t\t...row,\n\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified },\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,qBAAqB,MACjC,cAAc,SACZ,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,eAAe,EACtB,OAAO,eAAe,YAAY,EAClC,OAAO,gBAAgB,YAAY,EACnC,OAAO,WAAW,EAClB,OAAO,uBAAuB,mBAAmB,EACjD,OAAO,0BAA0B,sBAAsB,EACvD,OAAO,yBAAyB,qBAAqB,EACrD,KAAK,mBAAmB;AAEpB,MAAM,eAAe,CAC3B,EAAE,WAAW,YAAY,mBAAmB,sBAAsB,qBAAqB,GAAG,UACjE;AACzB,SAAO;AAAA,IACN,GAAG;AAAA,IACH,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,oBAAA;AAAA,EAAoB;AAEjG;"}
+{"version":3,"file":"helpers.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/helpers.ts"],"sourcesContent":["import { SelectBuilder } from '@contember/database'\nimport { IdentityProviderDto, IdentityProviderRow } from './types.js'\n\nexport const createBaseIdpQuery = () =>\n\tSelectBuilder.create<IdentityProviderRow>()\n\t\t.select('id')\n\t\t.select('slug')\n\t\t.select('type')\n\t\t.select('configuration')\n\t\t.select('disabled_at', 'disabledAt')\n\t\t.select('auto_sign_up', 'autoSignUp')\n\t\t.select('exclusive')\n\t\t.select('init_returns_config', 'initReturnsConfig')\n\t\t.select('require_verified_email', 'requireVerifiedEmail')\n\t\t.select('assume_email_verified', 'assumeEmailVerified')\n\t\t.select('disable_local_authentication', 'disableLocalAuthentication')\n\t\t.from('identity_provider')\n\nexport const createIdpDto = (\n\t{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }: IdentityProviderRow,\n): IdentityProviderDto => {\n\treturn {\n\t\t...row,\n\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,qBAAqB,MACjC,cAAc,OAAA,EACZ,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,eAAe,EACtB,OAAO,eAAe,YAAY,EAClC,OAAO,gBAAgB,YAAY,EACnC,OAAO,WAAW,EAClB,OAAO,uBAAuB,mBAAmB,EACjD,OAAO,0BAA0B,sBAAsB,EACvD,OAAO,yBAAyB,qBAAqB,EACrD,OAAO,gCAAgC,4BAA4B,EACnE,KAAK,mBAAmB;AAEpB,MAAM,eAAe,CAC3B,EAAE,WAAW,YAAY,mBAAmB,sBAAsB,qBAAqB,4BAA4B,GAAG,UAC7F;AACzB,SAAO;AAAA,IACN,GAAG;AAAA,IACH,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,2BAAA;AAAA,EAA2B;AAE7H;"}

package/dist/production/src/model/queries/membership/ProjectMembersQuery.cjs

@@ -29,7 +29,7 @@ class ProjectMembersQuery extends Database.DatabaseQuery {
         return qb.where((it) => it.not((it2) => it2.exists(personQuery)));
       }
       return qb;
-    }).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
+    }).orderBy(["identity", "id"]).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
   }
 }
 exports.ProjectMembersQuery = ProjectMembersQuery;

package/dist/production/src/model/queries/membership/ProjectMembersQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["DatabaseQuery","SelectBuilder","ImplementationException","qb","it"],"mappings":";;;;AAIO,MAAM,4BAA4BA,SAAAA,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAMC,SAAAA,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAIC,WAAAA,wBAAA;AAAA,MACX;AAEA,YAAM,cAAcD,SAAAA,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAE,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;;"}
+{"version":3,"file":"ProjectMembersQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.orderBy(['identity', 'id'])\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["DatabaseQuery","SelectBuilder","ImplementationException","qb","it"],"mappings":";;;;AAIO,MAAM,4BAA4BA,SAAAA,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAMC,SAAAA,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAIC,WAAAA,wBAAA;AAAA,MACX;AAEA,YAAM,cAAcD,SAAAA,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAE,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,QAAQ,CAAC,YAAY,IAAI,CAAC,EAC1B,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;;"}

package/dist/production/src/model/queries/membership/ProjectMembersQuery.js

@@ -27,7 +27,7 @@ class ProjectMembersQuery extends DatabaseQuery {
         return qb.where((it) => it.not((it2) => it2.exists(personQuery)));
       }
       return qb;
-    }).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
+    }).orderBy(["identity", "id"]).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
   }
 }
 export {

package/dist/production/src/model/queries/membership/ProjectMembersQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["qb","it"],"mappings":";;AAIO,MAAM,4BAA4B,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAM,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAI,wBAAA;AAAA,MACX;AAEA,YAAM,cAAc,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAA,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;"}
+{"version":3,"file":"ProjectMembersQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.orderBy(['identity', 'id'])\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["qb","it"],"mappings":";;AAIO,MAAM,4BAA4B,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAM,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAI,wBAAA;AAAA,MACX;AAEA,YAAM,cAAc,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAA,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,QAAQ,CAAC,YAAY,IAAI,CAAC,EAC1B,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;"}

package/dist/production/src/model/queries/person/PersonQueryBuilderFactory.cjs

@@ -8,7 +8,7 @@ class PersonQueryBuilderFactory {
    * and the `identity` join that the full builder needs only for `roles`.
    */
   static createPersonListQueryBuilder() {
-    return Database.SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
+    return Database.SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).select(["person", "disabled_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
   }
   static createPersonQueryBuilder() {
     return Database.SelectBuilder.create().select(["person", "id"]).select(["person", "password_hash"]).select(["person_mfa", "totp_secret"], "otp_secret").select(["person_mfa", "totp_secret_version"], "otp_secret_version").select(["person_mfa", "totp_activated_at"], "otp_activated_at").select(["person_mfa", "totp_pending_secret"], "otp_pending_secret").select(["person_mfa", "totp_pending_version"], "otp_pending_version").select(["person_mfa", "totp_pending_created_at"], "otp_pending_created_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person", "disabled_at"]).select(["person", "passwordless_enabled"]).select(["person", "mfa_grace_until"]).select(["person", "email_verified_at"]).select(["person", "email_verification_required"]).select(["identity", "roles"]).from("person").join("identity", "identity", (expr) => expr.columnsEq(["identity", "id"], ["person", "identity_id"])).leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));

package/dist/production/src/model/queries/person/PersonQueryBuilderFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryBuilderFactory.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAA,SAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;;"}
+{"version":3,"file":"PersonQueryBuilderFactory.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,CAAA,SAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;;"}

package/dist/production/src/model/queries/person/PersonQueryBuilderFactory.js

@@ -6,7 +6,7 @@ class PersonQueryBuilderFactory {
    * and the `identity` join that the full builder needs only for `roles`.
    */
   static createPersonListQueryBuilder() {
-    return SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
+    return SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).select(["person", "disabled_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
   }
   static createPersonQueryBuilder() {
     return SelectBuilder.create().select(["person", "id"]).select(["person", "password_hash"]).select(["person_mfa", "totp_secret"], "otp_secret").select(["person_mfa", "totp_secret_version"], "otp_secret_version").select(["person_mfa", "totp_activated_at"], "otp_activated_at").select(["person_mfa", "totp_pending_secret"], "otp_pending_secret").select(["person_mfa", "totp_pending_version"], "otp_pending_version").select(["person_mfa", "totp_pending_created_at"], "otp_pending_created_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person", "disabled_at"]).select(["person", "passwordless_enabled"]).select(["person", "mfa_grace_until"]).select(["person", "email_verified_at"]).select(["person", "email_verification_required"]).select(["identity", "roles"]).from("person").join("identity", "identity", (expr) => expr.columnsEq(["identity", "id"], ["person", "identity_id"])).leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));

package/dist/production/src/model/queries/person/PersonQueryBuilderFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryBuilderFactory.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAA,SAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;"}
+{"version":3,"file":"PersonQueryBuilderFactory.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,CAAA,SAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;"}

package/dist/production/src/model/service/AuthLogService.cjs

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const CreateAuthLogEntryCommand = require("../commands/authLog/CreateAuthLogEntryCommand.cjs");
+const UnpersistedApiKeyManager = require("./apiKey/UnpersistedApiKeyManager.cjs");
+const invokedBy = (identityId) => UnpersistedApiKeyManager.isUnpersistedIdentityId(identityId) ? { metadata: { invokedByUnpersistedIdentityId: identityId } } : { invokedById: identityId };
 class AuthLogService {
   async logAuthAction(db, ctx, data) {
     const dataContainer = data.response.ok ? data.response.result ?? {} : data.response.metadata ?? {};
@@ -13,12 +15,14 @@ class AuthLogService {
     if (ctx.forwarderUserAgent !== void 0) {
       metadata.forwarderUserAgent = ctx.forwarderUserAgent;
     }
+    const invoker = invokedBy(ctx.identityId);
+    Object.assign(metadata, invoker.metadata);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
         success: data.response.ok,
         personInputIdentifier: data.personInput ?? authData?.data?.personInput,
         personId: data.personId ?? authData?.data?.personId,
-        invokedById: ctx.identityId,
+        invokedById: invoker.invokedById,
         type: data.type,
         identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
         errorCode: data.response.ok ? null : data.response.error,
@@ -40,10 +44,12 @@ class AuthLogService {
    * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
    */
   async logSessionEvent(db, entry) {
+    const invoker = invokedBy(entry.identityId);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
         type: entry.type,
-        invokedById: entry.identityId,
+        invokedById: invoker.invokedById,
+        metadata: invoker.metadata,
         personId: entry.personId ?? void 0,
         success: entry.success,
         ipAddress: entry.ipAddress,

package/dist/production/src/model/service/AuthLogService.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: ctx.identityId,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: entry.identityId,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["CreateAuthLogEntryCommand","AuthLogService"],"mappings":";;;AAMA,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AAEA,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,IAAI;AAAA,QACjB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUC,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;;"}
+{"version":3,"file":"AuthLogService.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\nimport { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'\n\n/**\n * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a\n * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort\n * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is\n * still recorded, just not as a reference.\n */\nconst invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>\n\tisUnpersistedIdentityId(identityId)\n\t\t? { metadata: { invokedByUnpersistedIdentityId: identityId } }\n\t\t: { invokedById: identityId }\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\t\tconst invoker = invokedBy(ctx.identityId)\n\t\tObject.assign(metadata, invoker.metadata)\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tconst invoker = invokedBy(entry.identityId)\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\tmetadata: invoker.metadata,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["isUnpersistedIdentityId","CreateAuthLogEntryCommand","AuthLogService"],"mappings":";;;;AAaA,MAAM,YAAY,CAAC,eAClBA,iDAAwB,UAAU,IAC/B,EAAE,UAAU,EAAE,gCAAgC,WAAA,EAAW,IACzD,EAAE,aAAa,WAAA;AAEnB,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AACA,UAAM,UAAU,UAAU,IAAI,UAAU;AACxC,WAAO,OAAO,UAAU,QAAQ,QAAQ;AAExC,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIC,oDAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,QAAQ;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,UAAU,UAAU,MAAM,UAAU;AAC1C,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,UAAU,QAAQ;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUC,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;;"}

package/dist/production/src/model/service/AuthLogService.js

@@ -1,4 +1,6 @@
 import { CreateAuthLogEntryCommand } from "../commands/authLog/CreateAuthLogEntryCommand.js";
+import { isUnpersistedIdentityId } from "./apiKey/UnpersistedApiKeyManager.js";
+const invokedBy = (identityId) => isUnpersistedIdentityId(identityId) ? { metadata: { invokedByUnpersistedIdentityId: identityId } } : { invokedById: identityId };
 class AuthLogService {
   async logAuthAction(db, ctx, data) {
     const dataContainer = data.response.ok ? data.response.result ?? {} : data.response.metadata ?? {};
@@ -11,12 +13,14 @@ class AuthLogService {
     if (ctx.forwarderUserAgent !== void 0) {
       metadata.forwarderUserAgent = ctx.forwarderUserAgent;
     }
+    const invoker = invokedBy(ctx.identityId);
+    Object.assign(metadata, invoker.metadata);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand({
         success: data.response.ok,
         personInputIdentifier: data.personInput ?? authData?.data?.personInput,
         personId: data.personId ?? authData?.data?.personId,
-        invokedById: ctx.identityId,
+        invokedById: invoker.invokedById,
         type: data.type,
         identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
         errorCode: data.response.ok ? null : data.response.error,
@@ -38,10 +42,12 @@ class AuthLogService {
    * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
    */
   async logSessionEvent(db, entry) {
+    const invoker = invokedBy(entry.identityId);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand({
         type: entry.type,
-        invokedById: entry.identityId,
+        invokedById: invoker.invokedById,
+        metadata: invoker.metadata,
         personId: entry.personId ?? void 0,
         success: entry.success,
         ipAddress: entry.ipAddress,

package/dist/production/src/model/service/AuthLogService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: ctx.identityId,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: entry.identityId,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["AuthLogService"],"mappings":";AAMA,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AAEA,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,IAAI;AAAA,QACjB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUA,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;"}
+{"version":3,"file":"AuthLogService.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\nimport { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'\n\n/**\n * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a\n * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort\n * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is\n * still recorded, just not as a reference.\n */\nconst invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>\n\tisUnpersistedIdentityId(identityId)\n\t\t? { metadata: { invokedByUnpersistedIdentityId: identityId } }\n\t\t: { invokedById: identityId }\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\t\tconst invoker = invokedBy(ctx.identityId)\n\t\tObject.assign(metadata, invoker.metadata)\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tconst invoker = invokedBy(entry.identityId)\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\tmetadata: invoker.metadata,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["AuthLogService"],"mappings":";;AAaA,MAAM,YAAY,CAAC,eAClB,wBAAwB,UAAU,IAC/B,EAAE,UAAU,EAAE,gCAAgC,WAAA,EAAW,IACzD,EAAE,aAAa,WAAA;AAEnB,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AACA,UAAM,UAAU,UAAU,IAAI,UAAU;AACxC,WAAO,OAAO,UAAU,QAAQ,QAAQ;AAExC,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,QAAQ;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,UAAU,UAAU,MAAM,UAAU;AAC1C,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,UAAU,QAAQ;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUA,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;"}