@contember/engine-tenant-api 2.2.0-alpha.3 → 2.2.0-alpha.6

package/dist/development/src/model/queries/idp/PersonIdentityProvidersQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonIdentityProvidersQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/PersonIdentityProvidersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\nexport interface PersonIdentityProviderRow {\n\treadonly id: string\n\treadonly createdAt: Date\n\treadonly externalIdentifier: string\n\treadonly identityProviderSlug: string\n\treadonly identityProviderType: string\n\treadonly identityProviderDisabledAt: Date | null\n}\n\n/**\n * Lists the external IdP connections of a single person, joined with the\n * identity provider they belong to. Used by the `Person.identityProviders`\n * field and by the disconnect flow to enforce ownership and lock-out protection.\n */\nexport class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityProviderRow[]> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await SelectBuilder.create<PersonIdentityProviderRow>()\n\t\t\t.select(['person_identity_provider', 'id'])\n\t\t\t.select(['person_identity_provider', 'created_at'], 'createdAt')\n\t\t\t.select(['person_identity_provider', 'external_identifier'], 'externalIdentifier')\n\t\t\t.select(['identity_provider', 'slug'], 'identityProviderSlug')\n\t\t\t.select(['identity_provider', 'type'], 'identityProviderType')\n\t\t\t.select(['identity_provider', 'disabled_at'], 'identityProviderDisabledAt')\n\t\t\t.from('person_identity_provider')\n\t\t\t.join(\n\t\t\t\t'identity_provider',\n\t\t\t\t'identity_provider',\n\t\t\t\texpr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),\n\t\t\t)\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.orderBy(['person_identity_provider', 'created_at'])\n\t\t\t.orderBy(['person_identity_provider', 'id'])\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder"],"mappings":";;;AAgBO,MAAM,qCAAqCA,SAAAA,cAA2C;AAAA,EAC5F,YACkB,UAChB;AACD,UAAA;AAFiB,SAAA,WAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,WAAO,MAAMC,SAAAA,cAAc,SACzB,OAAO,CAAC,4BAA4B,IAAI,CAAC,EACzC,OAAO,CAAC,4BAA4B,YAAY,GAAG,WAAW,EAC9D,OAAO,CAAC,4BAA4B,qBAAqB,GAAG,oBAAoB,EAChF,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,aAAa,GAAG,4BAA4B,EACzE,KAAK,0BAA0B,EAC/B;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAA,SAAQ,KAAK,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,4BAA4B,sBAAsB,CAAC;AAAA,IAAA,EAExG,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,CAAC,4BAA4B,YAAY,CAAC,EAClD,QAAQ,CAAC,4BAA4B,IAAI,CAAC,EAC1C,UAAU,EAAE;AAAA,EACf;AACD;;"}
+{"version":3,"file":"PersonIdentityProvidersQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/PersonIdentityProvidersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\nexport interface PersonIdentityProviderRow {\n\treadonly id: string\n\treadonly createdAt: Date\n\treadonly externalIdentifier: string\n\treadonly identityProviderSlug: string\n\treadonly identityProviderType: string\n\treadonly identityProviderDisabledAt: Date | null\n\treadonly identityProviderDisableLocalAuthentication: boolean\n}\n\n/**\n * Lists the external IdP connections of a single person, joined with the\n * identity provider they belong to. Used by the `Person.identityProviders`\n * field and by the disconnect flow to enforce ownership and lock-out protection.\n */\nexport class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityProviderRow[]> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await SelectBuilder.create<PersonIdentityProviderRow>()\n\t\t\t.select(['person_identity_provider', 'id'])\n\t\t\t.select(['person_identity_provider', 'created_at'], 'createdAt')\n\t\t\t.select(['person_identity_provider', 'external_identifier'], 'externalIdentifier')\n\t\t\t.select(['identity_provider', 'slug'], 'identityProviderSlug')\n\t\t\t.select(['identity_provider', 'type'], 'identityProviderType')\n\t\t\t.select(['identity_provider', 'disabled_at'], 'identityProviderDisabledAt')\n\t\t\t.select(['identity_provider', 'disable_local_authentication'], 'identityProviderDisableLocalAuthentication')\n\t\t\t.from('person_identity_provider')\n\t\t\t.join(\n\t\t\t\t'identity_provider',\n\t\t\t\t'identity_provider',\n\t\t\t\texpr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),\n\t\t\t)\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.orderBy(['person_identity_provider', 'created_at'])\n\t\t\t.orderBy(['person_identity_provider', 'id'])\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":["DatabaseQuery","SelectBuilder"],"mappings":";;;AAiBO,MAAM,qCAAqCA,SAAAA,cAA2C;AAAA,EAC5F,YACkB,UAChB;AACD,UAAA;AAFiB,SAAA,WAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,WAAO,MAAMC,SAAAA,cAAc,OAAA,EACzB,OAAO,CAAC,4BAA4B,IAAI,CAAC,EACzC,OAAO,CAAC,4BAA4B,YAAY,GAAG,WAAW,EAC9D,OAAO,CAAC,4BAA4B,qBAAqB,GAAG,oBAAoB,EAChF,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,aAAa,GAAG,4BAA4B,EACzE,OAAO,CAAC,qBAAqB,8BAA8B,GAAG,4CAA4C,EAC1G,KAAK,0BAA0B,EAC/B;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAA,SAAQ,KAAK,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,4BAA4B,sBAAsB,CAAC;AAAA,IAAA,EAExG,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,CAAC,4BAA4B,YAAY,CAAC,EAClD,QAAQ,CAAC,4BAA4B,IAAI,CAAC,EAC1C,UAAU,EAAE;AAAA,EACf;AACD;;"}

package/dist/development/src/model/queries/idp/PersonIdentityProvidersQuery.js

@@ -5,7 +5,7 @@ class PersonIdentityProvidersQuery extends DatabaseQuery {
     this.personId = personId;
   }
   async fetch({ db }) {
-    return await SelectBuilder.create().select(["person_identity_provider", "id"]).select(["person_identity_provider", "created_at"], "createdAt").select(["person_identity_provider", "external_identifier"], "externalIdentifier").select(["identity_provider", "slug"], "identityProviderSlug").select(["identity_provider", "type"], "identityProviderType").select(["identity_provider", "disabled_at"], "identityProviderDisabledAt").from("person_identity_provider").join(
+    return await SelectBuilder.create().select(["person_identity_provider", "id"]).select(["person_identity_provider", "created_at"], "createdAt").select(["person_identity_provider", "external_identifier"], "externalIdentifier").select(["identity_provider", "slug"], "identityProviderSlug").select(["identity_provider", "type"], "identityProviderType").select(["identity_provider", "disabled_at"], "identityProviderDisabledAt").select(["identity_provider", "disable_local_authentication"], "identityProviderDisableLocalAuthentication").from("person_identity_provider").join(
       "identity_provider",
       "identity_provider",
       (expr) => expr.columnsEq(["identity_provider", "id"], ["person_identity_provider", "identity_provider_id"])

package/dist/development/src/model/queries/idp/PersonIdentityProvidersQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonIdentityProvidersQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/PersonIdentityProvidersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\nexport interface PersonIdentityProviderRow {\n\treadonly id: string\n\treadonly createdAt: Date\n\treadonly externalIdentifier: string\n\treadonly identityProviderSlug: string\n\treadonly identityProviderType: string\n\treadonly identityProviderDisabledAt: Date | null\n}\n\n/**\n * Lists the external IdP connections of a single person, joined with the\n * identity provider they belong to. Used by the `Person.identityProviders`\n * field and by the disconnect flow to enforce ownership and lock-out protection.\n */\nexport class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityProviderRow[]> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await SelectBuilder.create<PersonIdentityProviderRow>()\n\t\t\t.select(['person_identity_provider', 'id'])\n\t\t\t.select(['person_identity_provider', 'created_at'], 'createdAt')\n\t\t\t.select(['person_identity_provider', 'external_identifier'], 'externalIdentifier')\n\t\t\t.select(['identity_provider', 'slug'], 'identityProviderSlug')\n\t\t\t.select(['identity_provider', 'type'], 'identityProviderType')\n\t\t\t.select(['identity_provider', 'disabled_at'], 'identityProviderDisabledAt')\n\t\t\t.from('person_identity_provider')\n\t\t\t.join(\n\t\t\t\t'identity_provider',\n\t\t\t\t'identity_provider',\n\t\t\t\texpr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),\n\t\t\t)\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.orderBy(['person_identity_provider', 'created_at'])\n\t\t\t.orderBy(['person_identity_provider', 'id'])\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":[],"mappings":";AAgBO,MAAM,qCAAqC,cAA2C;AAAA,EAC5F,YACkB,UAChB;AACD,UAAA;AAFiB,SAAA,WAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,WAAO,MAAM,cAAc,SACzB,OAAO,CAAC,4BAA4B,IAAI,CAAC,EACzC,OAAO,CAAC,4BAA4B,YAAY,GAAG,WAAW,EAC9D,OAAO,CAAC,4BAA4B,qBAAqB,GAAG,oBAAoB,EAChF,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,aAAa,GAAG,4BAA4B,EACzE,KAAK,0BAA0B,EAC/B;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAA,SAAQ,KAAK,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,4BAA4B,sBAAsB,CAAC;AAAA,IAAA,EAExG,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,CAAC,4BAA4B,YAAY,CAAC,EAClD,QAAQ,CAAC,4BAA4B,IAAI,CAAC,EAC1C,UAAU,EAAE;AAAA,EACf;AACD;"}
+{"version":3,"file":"PersonIdentityProvidersQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/PersonIdentityProvidersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\n\nexport interface PersonIdentityProviderRow {\n\treadonly id: string\n\treadonly createdAt: Date\n\treadonly externalIdentifier: string\n\treadonly identityProviderSlug: string\n\treadonly identityProviderType: string\n\treadonly identityProviderDisabledAt: Date | null\n\treadonly identityProviderDisableLocalAuthentication: boolean\n}\n\n/**\n * Lists the external IdP connections of a single person, joined with the\n * identity provider they belong to. Used by the `Person.identityProviders`\n * field and by the disconnect flow to enforce ownership and lock-out protection.\n */\nexport class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityProviderRow[]> {\n\tconstructor(\n\t\tprivate readonly personId: string,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<PersonIdentityProviderRow[]> {\n\t\treturn await SelectBuilder.create<PersonIdentityProviderRow>()\n\t\t\t.select(['person_identity_provider', 'id'])\n\t\t\t.select(['person_identity_provider', 'created_at'], 'createdAt')\n\t\t\t.select(['person_identity_provider', 'external_identifier'], 'externalIdentifier')\n\t\t\t.select(['identity_provider', 'slug'], 'identityProviderSlug')\n\t\t\t.select(['identity_provider', 'type'], 'identityProviderType')\n\t\t\t.select(['identity_provider', 'disabled_at'], 'identityProviderDisabledAt')\n\t\t\t.select(['identity_provider', 'disable_local_authentication'], 'identityProviderDisableLocalAuthentication')\n\t\t\t.from('person_identity_provider')\n\t\t\t.join(\n\t\t\t\t'identity_provider',\n\t\t\t\t'identity_provider',\n\t\t\t\texpr => expr.columnsEq(['identity_provider', 'id'], ['person_identity_provider', 'identity_provider_id']),\n\t\t\t)\n\t\t\t.where({ person_id: this.personId })\n\t\t\t.orderBy(['person_identity_provider', 'created_at'])\n\t\t\t.orderBy(['person_identity_provider', 'id'])\n\t\t\t.getResult(db)\n\t}\n}\n"],"names":[],"mappings":";AAiBO,MAAM,qCAAqC,cAA2C;AAAA,EAC5F,YACkB,UAChB;AACD,UAAA;AAFiB,SAAA,WAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA+D;AAC5E,WAAO,MAAM,cAAc,OAAA,EACzB,OAAO,CAAC,4BAA4B,IAAI,CAAC,EACzC,OAAO,CAAC,4BAA4B,YAAY,GAAG,WAAW,EAC9D,OAAO,CAAC,4BAA4B,qBAAqB,GAAG,oBAAoB,EAChF,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,MAAM,GAAG,sBAAsB,EAC5D,OAAO,CAAC,qBAAqB,aAAa,GAAG,4BAA4B,EACzE,OAAO,CAAC,qBAAqB,8BAA8B,GAAG,4CAA4C,EAC1G,KAAK,0BAA0B,EAC/B;AAAA,MACA;AAAA,MACA;AAAA,MACA,CAAA,SAAQ,KAAK,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,4BAA4B,sBAAsB,CAAC;AAAA,IAAA,EAExG,MAAM,EAAE,WAAW,KAAK,SAAA,CAAU,EAClC,QAAQ,CAAC,4BAA4B,YAAY,CAAC,EAClD,QAAQ,CAAC,4BAA4B,IAAI,CAAC,EAC1C,UAAU,EAAE;AAAA,EACf;AACD;"}

package/dist/development/src/model/queries/idp/helpers.cjs

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const Database = require("@contember/database");
-const createBaseIdpQuery = () => Database.SelectBuilder.create().select("id").select("slug").select("type").select("configuration").select("disabled_at", "disabledAt").select("auto_sign_up", "autoSignUp").select("exclusive").select("init_returns_config", "initReturnsConfig").select("require_verified_email", "requireVerifiedEmail").select("assume_email_verified", "assumeEmailVerified").from("identity_provider");
-const createIdpDto = ({ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }) => {
+const createBaseIdpQuery = () => Database.SelectBuilder.create().select("id").select("slug").select("type").select("configuration").select("disabled_at", "disabledAt").select("auto_sign_up", "autoSignUp").select("exclusive").select("init_returns_config", "initReturnsConfig").select("require_verified_email", "requireVerifiedEmail").select("assume_email_verified", "assumeEmailVerified").select("disable_local_authentication", "disableLocalAuthentication").from("identity_provider");
+const createIdpDto = ({ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }) => {
   return {
     ...row,
-    options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }
+    options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication }
   };
 };
 exports.createBaseIdpQuery = createBaseIdpQuery;

package/dist/development/src/model/queries/idp/helpers.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/helpers.ts"],"sourcesContent":["import { SelectBuilder } from '@contember/database'\nimport { IdentityProviderDto, IdentityProviderRow } from './types.js'\n\nexport const createBaseIdpQuery = () =>\n\tSelectBuilder.create<IdentityProviderRow>()\n\t\t.select('id')\n\t\t.select('slug')\n\t\t.select('type')\n\t\t.select('configuration')\n\t\t.select('disabled_at', 'disabledAt')\n\t\t.select('auto_sign_up', 'autoSignUp')\n\t\t.select('exclusive')\n\t\t.select('init_returns_config', 'initReturnsConfig')\n\t\t.select('require_verified_email', 'requireVerifiedEmail')\n\t\t.select('assume_email_verified', 'assumeEmailVerified')\n\t\t.from('identity_provider')\n\nexport const createIdpDto = (\n\t{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }: IdentityProviderRow,\n): IdentityProviderDto => {\n\treturn {\n\t\t...row,\n\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified },\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,qBAAqB,MACjCA,SAAAA,cAAc,SACZ,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,eAAe,EACtB,OAAO,eAAe,YAAY,EAClC,OAAO,gBAAgB,YAAY,EACnC,OAAO,WAAW,EAClB,OAAO,uBAAuB,mBAAmB,EACjD,OAAO,0BAA0B,sBAAsB,EACvD,OAAO,yBAAyB,qBAAqB,EACrD,KAAK,mBAAmB;AAEpB,MAAM,eAAe,CAC3B,EAAE,WAAW,YAAY,mBAAmB,sBAAsB,qBAAqB,GAAG,UACjE;AACzB,SAAO;AAAA,IACN,GAAG;AAAA,IACH,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,oBAAA;AAAA,EAAoB;AAEjG;;;"}
+{"version":3,"file":"helpers.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/helpers.ts"],"sourcesContent":["import { SelectBuilder } from '@contember/database'\nimport { IdentityProviderDto, IdentityProviderRow } from './types.js'\n\nexport const createBaseIdpQuery = () =>\n\tSelectBuilder.create<IdentityProviderRow>()\n\t\t.select('id')\n\t\t.select('slug')\n\t\t.select('type')\n\t\t.select('configuration')\n\t\t.select('disabled_at', 'disabledAt')\n\t\t.select('auto_sign_up', 'autoSignUp')\n\t\t.select('exclusive')\n\t\t.select('init_returns_config', 'initReturnsConfig')\n\t\t.select('require_verified_email', 'requireVerifiedEmail')\n\t\t.select('assume_email_verified', 'assumeEmailVerified')\n\t\t.select('disable_local_authentication', 'disableLocalAuthentication')\n\t\t.from('identity_provider')\n\nexport const createIdpDto = (\n\t{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }: IdentityProviderRow,\n): IdentityProviderDto => {\n\treturn {\n\t\t...row,\n\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,qBAAqB,MACjCA,SAAAA,cAAc,OAAA,EACZ,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,eAAe,EACtB,OAAO,eAAe,YAAY,EAClC,OAAO,gBAAgB,YAAY,EACnC,OAAO,WAAW,EAClB,OAAO,uBAAuB,mBAAmB,EACjD,OAAO,0BAA0B,sBAAsB,EACvD,OAAO,yBAAyB,qBAAqB,EACrD,OAAO,gCAAgC,4BAA4B,EACnE,KAAK,mBAAmB;AAEpB,MAAM,eAAe,CAC3B,EAAE,WAAW,YAAY,mBAAmB,sBAAsB,qBAAqB,4BAA4B,GAAG,UAC7F;AACzB,SAAO;AAAA,IACN,GAAG;AAAA,IACH,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,2BAAA;AAAA,EAA2B;AAE7H;;;"}

package/dist/development/src/model/queries/idp/helpers.js

@@ -1,9 +1,9 @@
 import { SelectBuilder } from "@contember/database";
-const createBaseIdpQuery = () => SelectBuilder.create().select("id").select("slug").select("type").select("configuration").select("disabled_at", "disabledAt").select("auto_sign_up", "autoSignUp").select("exclusive").select("init_returns_config", "initReturnsConfig").select("require_verified_email", "requireVerifiedEmail").select("assume_email_verified", "assumeEmailVerified").from("identity_provider");
-const createIdpDto = ({ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }) => {
+const createBaseIdpQuery = () => SelectBuilder.create().select("id").select("slug").select("type").select("configuration").select("disabled_at", "disabledAt").select("auto_sign_up", "autoSignUp").select("exclusive").select("init_returns_config", "initReturnsConfig").select("require_verified_email", "requireVerifiedEmail").select("assume_email_verified", "assumeEmailVerified").select("disable_local_authentication", "disableLocalAuthentication").from("identity_provider");
+const createIdpDto = ({ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }) => {
   return {
     ...row,
-    options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }
+    options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication }
   };
 };
 export {

package/dist/development/src/model/queries/idp/helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/helpers.ts"],"sourcesContent":["import { SelectBuilder } from '@contember/database'\nimport { IdentityProviderDto, IdentityProviderRow } from './types.js'\n\nexport const createBaseIdpQuery = () =>\n\tSelectBuilder.create<IdentityProviderRow>()\n\t\t.select('id')\n\t\t.select('slug')\n\t\t.select('type')\n\t\t.select('configuration')\n\t\t.select('disabled_at', 'disabledAt')\n\t\t.select('auto_sign_up', 'autoSignUp')\n\t\t.select('exclusive')\n\t\t.select('init_returns_config', 'initReturnsConfig')\n\t\t.select('require_verified_email', 'requireVerifiedEmail')\n\t\t.select('assume_email_verified', 'assumeEmailVerified')\n\t\t.from('identity_provider')\n\nexport const createIdpDto = (\n\t{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }: IdentityProviderRow,\n): IdentityProviderDto => {\n\treturn {\n\t\t...row,\n\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified },\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,qBAAqB,MACjC,cAAc,SACZ,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,eAAe,EACtB,OAAO,eAAe,YAAY,EAClC,OAAO,gBAAgB,YAAY,EACnC,OAAO,WAAW,EAClB,OAAO,uBAAuB,mBAAmB,EACjD,OAAO,0BAA0B,sBAAsB,EACvD,OAAO,yBAAyB,qBAAqB,EACrD,KAAK,mBAAmB;AAEpB,MAAM,eAAe,CAC3B,EAAE,WAAW,YAAY,mBAAmB,sBAAsB,qBAAqB,GAAG,UACjE;AACzB,SAAO;AAAA,IACN,GAAG;AAAA,IACH,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,oBAAA;AAAA,EAAoB;AAEjG;"}
+{"version":3,"file":"helpers.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/idp/helpers.ts"],"sourcesContent":["import { SelectBuilder } from '@contember/database'\nimport { IdentityProviderDto, IdentityProviderRow } from './types.js'\n\nexport const createBaseIdpQuery = () =>\n\tSelectBuilder.create<IdentityProviderRow>()\n\t\t.select('id')\n\t\t.select('slug')\n\t\t.select('type')\n\t\t.select('configuration')\n\t\t.select('disabled_at', 'disabledAt')\n\t\t.select('auto_sign_up', 'autoSignUp')\n\t\t.select('exclusive')\n\t\t.select('init_returns_config', 'initReturnsConfig')\n\t\t.select('require_verified_email', 'requireVerifiedEmail')\n\t\t.select('assume_email_verified', 'assumeEmailVerified')\n\t\t.select('disable_local_authentication', 'disableLocalAuthentication')\n\t\t.from('identity_provider')\n\nexport const createIdpDto = (\n\t{ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }: IdentityProviderRow,\n): IdentityProviderDto => {\n\treturn {\n\t\t...row,\n\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,qBAAqB,MACjC,cAAc,OAAA,EACZ,OAAO,IAAI,EACX,OAAO,MAAM,EACb,OAAO,MAAM,EACb,OAAO,eAAe,EACtB,OAAO,eAAe,YAAY,EAClC,OAAO,gBAAgB,YAAY,EACnC,OAAO,WAAW,EAClB,OAAO,uBAAuB,mBAAmB,EACjD,OAAO,0BAA0B,sBAAsB,EACvD,OAAO,yBAAyB,qBAAqB,EACrD,OAAO,gCAAgC,4BAA4B,EACnE,KAAK,mBAAmB;AAEpB,MAAM,eAAe,CAC3B,EAAE,WAAW,YAAY,mBAAmB,sBAAsB,qBAAqB,4BAA4B,GAAG,UAC7F;AACzB,SAAO;AAAA,IACN,GAAG;AAAA,IACH,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,2BAAA;AAAA,EAA2B;AAE7H;"}

package/dist/development/src/model/queries/membership/ProjectMembersQuery.cjs

@@ -29,7 +29,7 @@ class ProjectMembersQuery extends Database.DatabaseQuery {
         return qb.where((it) => it.not((it2) => it2.exists(personQuery)));
       }
       return qb;
-    }).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
+    }).orderBy(["identity", "id"]).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
   }
 }
 exports.ProjectMembersQuery = ProjectMembersQuery;

package/dist/development/src/model/queries/membership/ProjectMembersQuery.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["DatabaseQuery","SelectBuilder","ImplementationException","qb","it"],"mappings":";;;;AAIO,MAAM,4BAA4BA,SAAAA,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAMC,SAAAA,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAIC,WAAAA,wBAAA;AAAA,MACX;AAEA,YAAM,cAAcD,SAAAA,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAE,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;;"}
+{"version":3,"file":"ProjectMembersQuery.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.orderBy(['identity', 'id'])\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["DatabaseQuery","SelectBuilder","ImplementationException","qb","it"],"mappings":";;;;AAIO,MAAM,4BAA4BA,SAAAA,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAMC,SAAAA,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAIC,WAAAA,wBAAA;AAAA,MACX;AAEA,YAAM,cAAcD,SAAAA,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAE,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,QAAQ,CAAC,YAAY,IAAI,CAAC,EAC1B,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;;"}

package/dist/development/src/model/queries/membership/ProjectMembersQuery.js

@@ -27,7 +27,7 @@ class ProjectMembersQuery extends DatabaseQuery {
         return qb.where((it) => it.not((it2) => it2.exists(personQuery)));
       }
       return qb;
-    }).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
+    }).orderBy(["identity", "id"]).limit(this.projectMemberInput.limit ?? void 0, this.projectMemberInput.offset ?? void 0).getResult(db);
   }
 }
 export {

package/dist/development/src/model/queries/membership/ProjectMembersQuery.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["qb","it"],"mappings":";;AAIO,MAAM,4BAA4B,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAM,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAI,wBAAA;AAAA,MACX;AAEA,YAAM,cAAc,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAA,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;"}
+{"version":3,"file":"ProjectMembersQuery.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/membership/ProjectMembersQuery.ts"],"sourcesContent":["import { DatabaseQuery, DatabaseQueryable, SelectBuilder } from '@contember/database'\nimport { MemberType, ProjectMembersInput } from '../../../schema/index.js'\nimport { ImplementationException } from '../../../exceptions.js'\n\nexport class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {\n\tconstructor(\n\t\tprivate readonly projectId: string,\n\t\tprivate readonly projectMemberInput: ProjectMembersInput,\n\t) {\n\t\tsuper()\n\t}\n\n\tasync fetch({ db }: DatabaseQueryable): Promise<ProjectMembersQueryResult> {\n\t\treturn await SelectBuilder.create<{ id: string; description: string }>()\n\t\t\t.select('id')\n\t\t\t.select('description')\n\t\t\t.from('identity')\n\t\t\t.where(it =>\n\t\t\t\tit.exists(\n\t\t\t\t\tbuilder =>\n\t\t\t\t\t\tbuilder\n\t\t\t\t\t\t\t.from('project_membership')\n\t\t\t\t\t\t\t.where(expr => expr.columnsEq(['project_membership', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t\t\t.where({ project_id: this.projectId }),\n\t\t\t\t)\n\t\t\t)\n\t\t\t.match(qb => {\n\t\t\t\tconst identityId = this.projectMemberInput.filter?.identityId\n\t\t\t\treturn identityId ? qb.where(it => it.in(['identity', 'id'], identityId)) : qb\n\t\t\t})\n\t\t\t.match(qb => {\n\t\t\t\tconst { email, memberType, personId } = this.projectMemberInput.filter ?? {}\n\t\t\t\tif ((email || personId) && memberType === 'API_KEY') {\n\t\t\t\t\tthrow new ImplementationException()\n\t\t\t\t}\n\n\t\t\t\tconst personQuery = SelectBuilder.create()\n\t\t\t\t\t.from('person')\n\t\t\t\t\t.where(expr => expr.columnsEq(['person', 'identity_id'], ['identity', 'id']))\n\t\t\t\t\t.match(qb => email ? qb.where(it => it.in('email', email)) : qb)\n\t\t\t\t\t.match(qb => personId ? qb.where(it => it.in(['person', 'id'], personId)) : qb)\n\n\t\t\t\tif (email || personId || memberType === 'PERSON') {\n\t\t\t\t\treturn qb.where(it => it.exists(personQuery))\n\t\t\t\t}\n\n\t\t\t\tif (memberType === 'API_KEY') {\n\t\t\t\t\treturn qb.where(it => it.not(it => it.exists(personQuery)))\n\t\t\t\t}\n\n\t\t\t\treturn qb\n\t\t\t})\n\t\t\t.orderBy(['identity', 'id'])\n\t\t\t.limit(this.projectMemberInput.limit ?? undefined, this.projectMemberInput.offset ?? undefined)\n\t\t\t.getResult(db)\n\t}\n}\n\nexport interface ProjectMembersQueryRow {\n\tid: string\n\tdescription: string\n}\n\nexport type ProjectMembersQueryResult = ProjectMembersQueryRow[]\n"],"names":["qb","it"],"mappings":";;AAIO,MAAM,4BAA4B,cAAyC;AAAA,EACjF,YACkB,WACA,oBAChB;AACD,UAAA;AAHiB,SAAA,YAAA;AACA,SAAA,qBAAA;AAAA,EAGlB;AAAA,EAEA,MAAM,MAAM,EAAE,MAA6D;AAC1E,WAAO,MAAM,cAAc,OAAA,EACzB,OAAO,IAAI,EACX,OAAO,aAAa,EACpB,KAAK,UAAU,EACf;AAAA,MAAM,QACN,GAAG;AAAA,QACF,CAAA,YACC,QACE,KAAK,oBAAoB,EACzB,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,sBAAsB,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EACvF,MAAM,EAAE,YAAY,KAAK,UAAA,CAAW;AAAA,MAAA;AAAA,IACxC,EAEA,MAAM,CAAA,OAAM;AACZ,YAAM,aAAa,KAAK,mBAAmB,QAAQ;AACnD,aAAO,aAAa,GAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,UAAU,CAAC,IAAI;AAAA,IAC7E,CAAC,EACA,MAAM,CAAA,OAAM;AACZ,YAAM,EAAE,OAAO,YAAY,SAAA,IAAa,KAAK,mBAAmB,UAAU,CAAA;AAC1E,WAAK,SAAS,aAAa,eAAe,WAAW;AACpD,cAAM,IAAI,wBAAA;AAAA,MACX;AAEA,YAAM,cAAc,cAAc,OAAA,EAChC,KAAK,QAAQ,EACb,MAAM,CAAA,SAAQ,KAAK,UAAU,CAAC,UAAU,aAAa,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,EAC3E,MAAM,CAAAA,QAAM,QAAQA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,SAAS,KAAK,CAAC,IAAIA,GAAE,EAC9D,MAAM,CAAAA,QAAM,WAAWA,IAAG,MAAM,CAAA,OAAM,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,QAAQ,CAAC,IAAIA,GAAE;AAE/E,UAAI,SAAS,YAAY,eAAe,UAAU;AACjD,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,OAAO,WAAW,CAAC;AAAA,MAC7C;AAEA,UAAI,eAAe,WAAW;AAC7B,eAAO,GAAG,MAAM,CAAA,OAAM,GAAG,IAAI,CAAAC,QAAMA,IAAG,OAAO,WAAW,CAAC,CAAC;AAAA,MAC3D;AAEA,aAAO;AAAA,IACR,CAAC,EACA,QAAQ,CAAC,YAAY,IAAI,CAAC,EAC1B,MAAM,KAAK,mBAAmB,SAAS,QAAW,KAAK,mBAAmB,UAAU,MAAS,EAC7F,UAAU,EAAE;AAAA,EACf;AACD;"}

package/dist/development/src/model/queries/person/PersonQueryBuilderFactory.cjs

@@ -8,7 +8,7 @@ class PersonQueryBuilderFactory {
    * and the `identity` join that the full builder needs only for `roles`.
    */
   static createPersonListQueryBuilder() {
-    return Database.SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
+    return Database.SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).select(["person", "disabled_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
   }
   static createPersonQueryBuilder() {
     return Database.SelectBuilder.create().select(["person", "id"]).select(["person", "password_hash"]).select(["person_mfa", "totp_secret"], "otp_secret").select(["person_mfa", "totp_secret_version"], "otp_secret_version").select(["person_mfa", "totp_activated_at"], "otp_activated_at").select(["person_mfa", "totp_pending_secret"], "otp_pending_secret").select(["person_mfa", "totp_pending_version"], "otp_pending_version").select(["person_mfa", "totp_pending_created_at"], "otp_pending_created_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person", "disabled_at"]).select(["person", "passwordless_enabled"]).select(["person", "mfa_grace_until"]).select(["person", "email_verified_at"]).select(["person", "email_verification_required"]).select(["identity", "roles"]).from("person").join("identity", "identity", (expr) => expr.columnsEq(["identity", "id"], ["person", "identity_id"])).leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));

package/dist/development/src/model/queries/person/PersonQueryBuilderFactory.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryBuilderFactory.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAA,SAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;;"}
+{"version":3,"file":"PersonQueryBuilderFactory.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":["SelectBuilder"],"mappings":";;;AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,CAAA,SAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAOA,SAAAA,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;;"}

package/dist/development/src/model/queries/person/PersonQueryBuilderFactory.js

@@ -6,7 +6,7 @@ class PersonQueryBuilderFactory {
    * and the `identity` join that the full builder needs only for `roles`.
    */
   static createPersonListQueryBuilder() {
-    return SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
+    return SelectBuilder.create().select(["person", "id"]).select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person_mfa", "totp_activated_at"], "otp_activated_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "passwordless_enabled"]).select(["person", "email_verified_at"]).select(["person", "disabled_at"]).from("person").leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));
   }
   static createPersonQueryBuilder() {
     return SelectBuilder.create().select(["person", "id"]).select(["person", "password_hash"]).select(["person_mfa", "totp_secret"], "otp_secret").select(["person_mfa", "totp_secret_version"], "otp_secret_version").select(["person_mfa", "totp_activated_at"], "otp_activated_at").select(["person_mfa", "totp_pending_secret"], "otp_pending_secret").select(["person_mfa", "totp_pending_version"], "otp_pending_version").select(["person_mfa", "totp_pending_created_at"], "otp_pending_created_at").select((expr) => expr.raw('coalesce("person_mfa"."email_otp_enabled", false)'), "email_otp_enabled").select(["person", "identity_id"]).select(["person", "email"]).select(["person", "name"]).select(["person", "disabled_at"]).select(["person", "passwordless_enabled"]).select(["person", "mfa_grace_until"]).select(["person", "email_verified_at"]).select(["person", "email_verification_required"]).select(["identity", "roles"]).from("person").join("identity", "identity", (expr) => expr.columnsEq(["identity", "id"], ["person", "identity_id"])).leftJoin("person_mfa", "person_mfa", (expr) => expr.columnsEq(["person_mfa", "person_id"], ["person", "id"]));

package/dist/development/src/model/queries/person/PersonQueryBuilderFactory.js.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryBuilderFactory.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAA,SAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;"}
+{"version":3,"file":"PersonQueryBuilderFactory.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/queries/person/PersonQueryBuilderFactory.ts"],"sourcesContent":["import { PersonListRow, PersonRow } from './types.js'\nimport { SelectBuilder } from '@contember/database'\n\nexport class PersonQueryBuilderFactory {\n\t/**\n\t * Slim builder for listings — selects only the columns surfaced by\n\t * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`\n\t * and the `identity` join that the full builder needs only for `roles`.\n\t */\n\tpublic static createPersonListQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonListRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.from('person')\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n\n\tpublic static createPersonQueryBuilder() {\n\t\treturn SelectBuilder.create<PersonRow>()\n\t\t\t.select(['person', 'id'])\n\t\t\t.select(['person', 'password_hash'])\n\t\t\t.select(['person_mfa', 'totp_secret'], 'otp_secret')\n\t\t\t.select(['person_mfa', 'totp_secret_version'], 'otp_secret_version')\n\t\t\t.select(['person_mfa', 'totp_activated_at'], 'otp_activated_at')\n\t\t\t.select(['person_mfa', 'totp_pending_secret'], 'otp_pending_secret')\n\t\t\t.select(['person_mfa', 'totp_pending_version'], 'otp_pending_version')\n\t\t\t.select(['person_mfa', 'totp_pending_created_at'], 'otp_pending_created_at')\n\t\t\t.select(expr => expr.raw('coalesce(\"person_mfa\".\"email_otp_enabled\", false)'), 'email_otp_enabled')\n\t\t\t.select(['person', 'identity_id'])\n\t\t\t.select(['person', 'email'])\n\t\t\t.select(['person', 'name'])\n\t\t\t.select(['person', 'disabled_at'])\n\t\t\t.select(['person', 'passwordless_enabled'])\n\t\t\t.select(['person', 'mfa_grace_until'])\n\t\t\t.select(['person', 'email_verified_at'])\n\t\t\t.select(['person', 'email_verification_required'])\n\t\t\t.select(['identity', 'roles'])\n\t\t\t.from('person')\n\t\t\t.join('identity', 'identity', expr => expr.columnsEq(['identity', 'id'], ['person', 'identity_id']))\n\t\t\t.leftJoin('person_mfa', 'person_mfa', expr => expr.columnsEq(['person_mfa', 'person_id'], ['person', 'id']))\n\t}\n}\n"],"names":[],"mappings":";AAGO,MAAM,0BAA0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtC,OAAc,+BAA+B;AAC5C,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,KAAK,QAAQ,EACb,SAAS,cAAc,cAAc,CAAA,SAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AAAA,EAEA,OAAc,2BAA2B;AACxC,WAAO,cAAc,OAAA,EACnB,OAAO,CAAC,UAAU,IAAI,CAAC,EACvB,OAAO,CAAC,UAAU,eAAe,CAAC,EAClC,OAAO,CAAC,cAAc,aAAa,GAAG,YAAY,EAClD,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,mBAAmB,GAAG,kBAAkB,EAC9D,OAAO,CAAC,cAAc,qBAAqB,GAAG,oBAAoB,EAClE,OAAO,CAAC,cAAc,sBAAsB,GAAG,qBAAqB,EACpE,OAAO,CAAC,cAAc,yBAAyB,GAAG,wBAAwB,EAC1E,OAAO,UAAQ,KAAK,IAAI,mDAAmD,GAAG,mBAAmB,EACjG,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,OAAO,CAAC,EAC1B,OAAO,CAAC,UAAU,MAAM,CAAC,EACzB,OAAO,CAAC,UAAU,aAAa,CAAC,EAChC,OAAO,CAAC,UAAU,sBAAsB,CAAC,EACzC,OAAO,CAAC,UAAU,iBAAiB,CAAC,EACpC,OAAO,CAAC,UAAU,mBAAmB,CAAC,EACtC,OAAO,CAAC,UAAU,6BAA6B,CAAC,EAChD,OAAO,CAAC,YAAY,OAAO,CAAC,EAC5B,KAAK,QAAQ,EACb,KAAK,YAAY,YAAY,CAAA,SAAQ,KAAK,UAAU,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,aAAa,CAAC,CAAC,EAClG,SAAS,cAAc,cAAc,UAAQ,KAAK,UAAU,CAAC,cAAc,WAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;AAAA,EAC7G;AACD;"}

package/dist/development/src/model/service/AuthLogService.cjs

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const CreateAuthLogEntryCommand = require("../commands/authLog/CreateAuthLogEntryCommand.cjs");
+const UnpersistedApiKeyManager = require("./apiKey/UnpersistedApiKeyManager.cjs");
+const invokedBy = (identityId) => UnpersistedApiKeyManager.isUnpersistedIdentityId(identityId) ? { metadata: { invokedByUnpersistedIdentityId: identityId } } : { invokedById: identityId };
 class AuthLogService {
   async logAuthAction(db, ctx, data) {
     const dataContainer = data.response.ok ? data.response.result ?? {} : data.response.metadata ?? {};
@@ -13,12 +15,14 @@ class AuthLogService {
     if (ctx.forwarderUserAgent !== void 0) {
       metadata.forwarderUserAgent = ctx.forwarderUserAgent;
     }
+    const invoker = invokedBy(ctx.identityId);
+    Object.assign(metadata, invoker.metadata);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
         success: data.response.ok,
         personInputIdentifier: data.personInput ?? authData?.data?.personInput,
         personId: data.personId ?? authData?.data?.personId,
-        invokedById: ctx.identityId,
+        invokedById: invoker.invokedById,
         type: data.type,
         identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
         errorCode: data.response.ok ? null : data.response.error,
@@ -40,10 +44,12 @@ class AuthLogService {
    * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
    */
   async logSessionEvent(db, entry) {
+    const invoker = invokedBy(entry.identityId);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand.CreateAuthLogEntryCommand({
         type: entry.type,
-        invokedById: entry.identityId,
+        invokedById: invoker.invokedById,
+        metadata: invoker.metadata,
         personId: entry.personId ?? void 0,
         success: entry.success,
         ipAddress: entry.ipAddress,

package/dist/development/src/model/service/AuthLogService.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: ctx.identityId,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: entry.identityId,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["CreateAuthLogEntryCommand","AuthLogService"],"mappings":";;;AAMA,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AAEA,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,IAAI;AAAA,QACjB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUC,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;;"}
+{"version":3,"file":"AuthLogService.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\nimport { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'\n\n/**\n * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a\n * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort\n * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is\n * still recorded, just not as a reference.\n */\nconst invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>\n\tisUnpersistedIdentityId(identityId)\n\t\t? { metadata: { invokedByUnpersistedIdentityId: identityId } }\n\t\t: { invokedById: identityId }\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\t\tconst invoker = invokedBy(ctx.identityId)\n\t\tObject.assign(metadata, invoker.metadata)\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tconst invoker = invokedBy(entry.identityId)\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\tmetadata: invoker.metadata,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["isUnpersistedIdentityId","CreateAuthLogEntryCommand","AuthLogService"],"mappings":";;;;AAaA,MAAM,YAAY,CAAC,eAClBA,iDAAwB,UAAU,IAC/B,EAAE,UAAU,EAAE,gCAAgC,WAAA,EAAW,IACzD,EAAE,aAAa,WAAA;AAEnB,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AACA,UAAM,UAAU,UAAU,IAAI,UAAU;AACxC,WAAO,OAAO,UAAU,QAAQ,QAAQ;AAExC,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIC,oDAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,QAAQ;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,UAAU,UAAU,MAAM,UAAU;AAC1C,UAAM,GAAG,WAAW;AAAA,MACnB,IAAIA,oDAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,UAAU,QAAQ;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUC,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;;"}

package/dist/development/src/model/service/AuthLogService.js

@@ -1,4 +1,6 @@
 import { CreateAuthLogEntryCommand } from "../commands/authLog/CreateAuthLogEntryCommand.js";
+import { isUnpersistedIdentityId } from "./apiKey/UnpersistedApiKeyManager.js";
+const invokedBy = (identityId) => isUnpersistedIdentityId(identityId) ? { metadata: { invokedByUnpersistedIdentityId: identityId } } : { invokedById: identityId };
 class AuthLogService {
   async logAuthAction(db, ctx, data) {
     const dataContainer = data.response.ok ? data.response.result ?? {} : data.response.metadata ?? {};
@@ -11,12 +13,14 @@ class AuthLogService {
     if (ctx.forwarderUserAgent !== void 0) {
       metadata.forwarderUserAgent = ctx.forwarderUserAgent;
     }
+    const invoker = invokedBy(ctx.identityId);
+    Object.assign(metadata, invoker.metadata);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand({
         success: data.response.ok,
         personInputIdentifier: data.personInput ?? authData?.data?.personInput,
         personId: data.personId ?? authData?.data?.personId,
-        invokedById: ctx.identityId,
+        invokedById: invoker.invokedById,
         type: data.type,
         identityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,
         errorCode: data.response.ok ? null : data.response.error,
@@ -38,10 +42,12 @@ class AuthLogService {
    * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
    */
   async logSessionEvent(db, entry) {
+    const invoker = invokedBy(entry.identityId);
     await db.commandBus.execute(
       new CreateAuthLogEntryCommand({
         type: entry.type,
-        invokedById: entry.identityId,
+        invokedById: invoker.invokedById,
+        metadata: invoker.metadata,
         personId: entry.personId ?? void 0,
         success: entry.success,
         ipAddress: entry.ipAddress,

package/dist/development/src/model/service/AuthLogService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: ctx.identityId,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: entry.identityId,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["AuthLogService"],"mappings":";AAMA,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AAEA,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,IAAI;AAAA,QACjB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,MAAM;AAAA,QACnB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUA,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;"}
+{"version":3,"file":"AuthLogService.js","sources":["../../../../../../packages/engine-tenant-api/src/model/service/AuthLogService.ts"],"sourcesContent":["import { DatabaseContext } from '../utils/index.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { Response } from '../utils/Response.js'\nimport { AuthActionType } from '../type/AuthLog.js'\nimport { JSONValue } from '@contember/schema'\nimport { isUnpersistedIdentityId } from './apiKey/UnpersistedApiKeyManager.js'\n\n/**\n * `person_auth_log.invoked_by_id` is a foreign key into `identity`, and a virtual identity (a\n * configured root token, the panel's pre-sign-in caller) has no row there — writing it would abort\n * the insert and lose the entry entirely. The id is kept in `metadata` instead, so the caller is\n * still recorded, just not as a reference.\n */\nconst invokedBy = (identityId: string): { invokedById?: string; metadata?: Record<string, JSONValue> } =>\n\tisUnpersistedIdentityId(identityId)\n\t\t? { metadata: { invokedByUnpersistedIdentityId: identityId } }\n\t\t: { invokedById: identityId }\n\nclass AuthLogService {\n\tasync logAuthAction(\n\t\tdb: DatabaseContext,\n\t\tctx: {\n\t\t\tidentityId: string\n\t\t\tclientIp?: string\n\t\t\tuserAgent?: string\n\t\t\tforwarderIp?: string\n\t\t\tforwarderUserAgent?: string\n\t\t\t/** A03: country from the trusted reverse-proxy geo header, when present. */\n\t\t\tgeoCountry?: string\n\t\t\t/** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */\n\t\t\tdeviceFingerprint?: string\n\t\t},\n\t\tdata: AuthLogService.LogArgs,\n\t): Promise<void> {\n\t\tconst dataContainer = data.response.ok\n\t\t\t? data.response.result ?? {}\n\t\t\t: data.response.metadata ?? {}\n\t\tconst authData = typeof dataContainer === 'object' && dataContainer !== null && AuthLogService.Key in dataContainer\n\t\t\t? dataContainer[AuthLogService.Key] as AuthLogService.Bag\n\t\t\t: undefined\n\n\t\tconst baseMetadata = (data.metadata && typeof data.metadata === 'object' && !Array.isArray(data.metadata))\n\t\t\t? data.metadata as Record<string, JSONValue>\n\t\t\t: {}\n\t\tconst metadata: Record<string, JSONValue> = { ...baseMetadata }\n\t\tif (ctx.forwarderIp !== undefined) {\n\t\t\tmetadata.forwarderIp = ctx.forwarderIp\n\t\t}\n\t\tif (ctx.forwarderUserAgent !== undefined) {\n\t\t\tmetadata.forwarderUserAgent = ctx.forwarderUserAgent\n\t\t}\n\t\tconst invoker = invokedBy(ctx.identityId)\n\t\tObject.assign(metadata, invoker.metadata)\n\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\tsuccess: data.response.ok,\n\t\t\t\tpersonInputIdentifier: data.personInput ?? authData?.data?.personInput,\n\t\t\t\tpersonId: data.personId ?? authData?.data?.personId,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\ttype: data.type,\n\t\t\t\tidentityProviderId: data.identityProviderId ?? authData?.data?.identityProviderId,\n\t\t\t\terrorCode: data.response.ok ? null : data.response.error,\n\t\t\t\tpersonTokenId: data.tokenId ?? authData?.data?.tokenId,\n\t\t\t\terrorMessage: data.response.ok ? undefined : data.response.errorMessage,\n\t\t\t\tipAddress: ctx.clientIp,\n\t\t\t\tuserAgent: ctx.userAgent,\n\t\t\t\tmetadata,\n\t\t\t\ttargetPersonId: data.targetPersonId ?? authData?.data?.targetPersonId,\n\t\t\t\teventData: data.eventData ?? authData?.data?.eventData,\n\t\t\t\tgeoCountry: ctx.geoCountry,\n\t\t\t\tdeviceFingerprint: ctx.deviceFingerprint,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Focused, response-agnostic emit for internal auth-path events (A19) that\n\t * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth\n\t * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.\n\t */\n\tasync logSessionEvent(\n\t\tdb: DatabaseContext,\n\t\tentry: {\n\t\t\ttype: AuthActionType\n\t\t\tidentityId: string\n\t\t\tpersonId?: string | null\n\t\t\tipAddress?: string\n\t\t\tuserAgent?: string\n\t\t\tsuccess: boolean\n\t\t\teventData?: JSONValue\n\t\t},\n\t): Promise<void> {\n\t\tconst invoker = invokedBy(entry.identityId)\n\t\tawait db.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: entry.type,\n\t\t\t\tinvokedById: invoker.invokedById,\n\t\t\t\tmetadata: invoker.metadata,\n\t\t\t\tpersonId: entry.personId ?? undefined,\n\t\t\t\tsuccess: entry.success,\n\t\t\t\tipAddress: entry.ipAddress,\n\t\t\t\tuserAgent: entry.userAgent,\n\t\t\t\teventData: entry.eventData,\n\t\t\t}),\n\t\t)\n\t}\n}\n\nnamespace AuthLogService {\n\texport const Key = Symbol('AuthLogData')\n\ttype Data = {\n\t\tpersonId?: string\n\t\tpersonInput?: string // e.g. email\n\t\ttokenId?: string\n\t\tidentityProviderId?: string\n\t\ttargetPersonId?: string\n\t\tmetadata?: JSONValue\n\t\teventData?: JSONValue\n\t}\n\n\texport type LogArgs = {\n\t\tresponse: Response<\n\t\t\tnull | { [Key]?: Bag },\n\t\t\tany,\n\t\t\t{} | { [Key]?: Bag }\n\t\t>\n\t\ttype: AuthActionType\n\t} & Data\n\n\texport class Bag {\n\t\tconstructor(\n\t\t\tpublic readonly data: Data,\n\t\t) {\n\t\t}\n\t}\n}\n\nexport { AuthLogService }\n"],"names":["AuthLogService"],"mappings":";;AAaA,MAAM,YAAY,CAAC,eAClB,wBAAwB,UAAU,IAC/B,EAAE,UAAU,EAAE,gCAAgC,WAAA,EAAW,IACzD,EAAE,aAAa,WAAA;AAEnB,MAAM,eAAe;AAAA,EACpB,MAAM,cACL,IACA,KAWA,MACgB;AAChB,UAAM,gBAAgB,KAAK,SAAS,KACjC,KAAK,SAAS,UAAU,CAAA,IACxB,KAAK,SAAS,YAAY,CAAA;AAC7B,UAAM,WAAW,OAAO,kBAAkB,YAAY,kBAAkB,QAAQ,eAAe,OAAO,gBACnG,cAAc,eAAe,GAAG,IAChC;AAEH,UAAM,eAAgB,KAAK,YAAY,OAAO,KAAK,aAAa,YAAY,CAAC,MAAM,QAAQ,KAAK,QAAQ,IACrG,KAAK,WACL,CAAA;AACH,UAAM,WAAsC,EAAE,GAAG,aAAA;AACjD,QAAI,IAAI,gBAAgB,QAAW;AAClC,eAAS,cAAc,IAAI;AAAA,IAC5B;AACA,QAAI,IAAI,uBAAuB,QAAW;AACzC,eAAS,qBAAqB,IAAI;AAAA,IACnC;AACA,UAAM,UAAU,UAAU,IAAI,UAAU;AACxC,WAAO,OAAO,UAAU,QAAQ,QAAQ;AAExC,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,SAAS,KAAK,SAAS;AAAA,QACvB,uBAAuB,KAAK,eAAe,UAAU,MAAM;AAAA,QAC3D,UAAU,KAAK,YAAY,UAAU,MAAM;AAAA,QAC3C,aAAa,QAAQ;AAAA,QACrB,MAAM,KAAK;AAAA,QACX,oBAAoB,KAAK,sBAAsB,UAAU,MAAM;AAAA,QAC/D,WAAW,KAAK,SAAS,KAAK,OAAO,KAAK,SAAS;AAAA,QACnD,eAAe,KAAK,WAAW,UAAU,MAAM;AAAA,QAC/C,cAAc,KAAK,SAAS,KAAK,SAAY,KAAK,SAAS;AAAA,QAC3D,WAAW,IAAI;AAAA,QACf,WAAW,IAAI;AAAA,QACf;AAAA,QACA,gBAAgB,KAAK,kBAAkB,UAAU,MAAM;AAAA,QACvD,WAAW,KAAK,aAAa,UAAU,MAAM;AAAA,QAC7C,YAAY,IAAI;AAAA,QAChB,mBAAmB,IAAI;AAAA,MAAA,CACvB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,gBACL,IACA,OASgB;AAChB,UAAM,UAAU,UAAU,MAAM,UAAU;AAC1C,UAAM,GAAG,WAAW;AAAA,MACnB,IAAI,0BAA0B;AAAA,QAC7B,MAAM,MAAM;AAAA,QACZ,aAAa,QAAQ;AAAA,QACrB,UAAU,QAAQ;AAAA,QAClB,UAAU,MAAM,YAAY;AAAA,QAC5B,SAAS,MAAM;AAAA,QACf,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,QACjB,WAAW,MAAM;AAAA,MAAA,CACjB;AAAA,IAAA;AAAA,EAEH;AACD;AAAA,CAEA,CAAUA,oBAAV;AACcA,kBAAA,MAAM,uBAAO,aAAa;AAAA,EAoBhC,MAAM,IAAI;AAAA,IAChB,YACiB,MACf;AADe,WAAA,OAAA;AAAA,IAEjB;AAAA,EAAA;AAJMA,kBAAM,MAAA;AAAA,GArBJ,mBAAA,iBAAA,CAAA,EAAA;"}

package/dist/development/src/model/service/IDPSignInManager.cjs

@@ -19,7 +19,9 @@ const CreatePersonIdentityProviderIdentifierCommand = require("../commands/perso
 const CreateIdentityCommand = require("../commands/identity/CreateIdentityCommand.cjs");
 const CreateAuthLogEntryCommand = require("../commands/authLog/CreateAuthLogEntryCommand.cjs");
 require("./idp/IDPRevalidation.cjs");
+const ClaimMapping = require("./idp/ClaimMapping.cjs");
 const IDPValidationError = require("./idp/IDPValidationError.cjs");
+require("@contember/schema-utils");
 const IDPResponseError = require("./idp/IDPResponseError.cjs");
 require("./idp/providers/AppleProvider.cjs");
 require("openid-client");
@@ -31,9 +33,10 @@ const CreateIdpSessionCommand = require("../commands/idp/CreateIdpSessionCommand
 const Password = require("../dtos/Password.cjs");
 const AuthLogService = require("./AuthLogService.cjs");
 class IDPSignInManager {
-  constructor(apiKeyManager, idpRegistry) {
+  constructor(apiKeyManager, idpRegistry, claimSyncService) {
     this.apiKeyManager = apiKeyManager;
     this.idpRegistry = idpRegistry;
+    this.claimSyncService = claimSyncService;
   }
   async signInIDP(dbContext, idpSlug, responseData, expiration, requestInfo, trustForwardedInfo) {
     return dbContext.transaction(async (db) => {
@@ -89,6 +92,27 @@ class IDPSignInManager {
           })
         });
       }
+      let mapping = null;
+      let claimMappingFailed = false;
+      try {
+        mapping = ClaimMapping.parseClaimMapping(provider.configuration);
+      } catch {
+        claimMappingFailed = true;
+      }
+      let claimMappingAudit = null;
+      if (mapping) {
+        const syncResult = await this.claimSyncService.sync(
+          db,
+          mapping,
+          claim,
+          { id: personRow.identity_id },
+          resolved.isNewPerson === true
+        );
+        claimMappingAudit = syncResult.audit;
+        if (syncResult.droppedUnsafeRules) {
+          claimMappingFailed = true;
+        }
+      }
       const { id: apiKeyId, token: sessionToken } = await this.apiKeyManager.createSessionApiKeyWithId(
         db,
         personRow.identity_id,
@@ -120,6 +144,9 @@ class IDPSignInManager {
         person: personRow,
         token: sessionToken,
         idpResponse: claim,
+        claimMappingAudit,
+        claimMappingFailed,
+        identityProviderId: provider.id,
         [AuthLogService.AuthLogService.Key]: new AuthLogService.AuthLogService.Bag({
           personId: personRow.id,
           identityProviderId: provider.id,
@@ -169,7 +196,7 @@ class IDPSignInManager {
     if (provider.autoSignUp) {
       const signedUpPerson = await this.signUp(db, claim, provider);
       await this.saveIdpIdentifier(db, provider, claim, signedUpPerson);
-      return { person: signedUpPerson };
+      return { person: signedUpPerson, isNewPerson: true };
     }
     return { person: null };
   }

package/dist/development/src/model/service/IDPSignInManager.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"IDPSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/IDPSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey/index.js'\nimport { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries/index.js'\nimport { IDPHandlerRegistry, IDPResponse, IDPResponseError, IDPValidationError } from './idp/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ApiKeyRequestInfo, CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProviderIdentifierCommand } from '../commands/index.js'\nimport { CreateIdpSessionCommand } from '../commands/idp/CreateIdpSessionCommand.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { TenantRole } from '../authorization/index.js'\nimport { NoPassword } from '../dtos/index.js'\nimport { IdentityProviderRow } from '../queries/idp/types.js'\nimport { AuthLogService } from './AuthLogService.js'\n\nclass IDPSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t) {}\n\n\tasync signInIDP(\n\t\tdbContext: DatabaseContext,\n\t\tidpSlug: string,\n\t\tresponseData: unknown,\n\t\texpiration?: number,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<IDPSignInManager.SignInIDPResponse> {\n\t\treturn dbContext.transaction(async (db): Promise<IDPSignInManager.SignInIDPResponse> => {\n\t\t\tconst provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\t\tif (!provider || provider.disabledAt) {\n\t\t\t\tthrow new Error('provider not found')\n\t\t\t}\n\t\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\t\tlet claim: IDPResponse\n\t\t\ttry {\n\t\t\t\tclaim = await providerService.processResponse(\n\t\t\t\t\tvalidatedConfig,\n\t\t\t\t\tresponseData,\n\t\t\t\t)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IDPResponseError) {\n\t\t\t\t\treturn new ResponseError('INVALID_IDP_RESPONSE', e.message, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: undefined,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: undefined,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tconst resolved = await this.resolvePerson(db, claim, provider)\n\t\t\tconst personRow = resolved.person\n\n\t\t\tif (!personRow) {\n\t\t\t\t// Keep the external error generic (no account-existence leak), but\n\t\t\t\t// record the email-verification gate block distinctly in the audit\n\t\t\t\t// log — it is a takeover-grade event, not an ordinary \"not found\".\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t\t\tpersonId: resolved.blockedPersonId,\n\t\t\t\t\t\teventData: resolved.blockedReason ? { reason: resolved.blockedReason } : undefined,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tconst { id: apiKeyId, token: sessionToken } = await this.apiKeyManager.createSessionApiKeyWithId(\n\t\t\t\tdb,\n\t\t\t\tpersonRow.identity_id,\n\t\t\t\texpiration,\n\t\t\t\trequestInfo,\n\t\t\t\ttrustForwardedInfo,\n\t\t\t)\n\n\t\t\t// Bind the federated-session state to this session so it can be re-validated\n\t\t\t// against the IdP later. Present only when the provider supports it and\n\t\t\t// revalidation is enabled on the IdP configuration (A24). Refresh tokens must be\n\t\t\t// encrypted at rest, so when no encryption key is configured we skip persisting a\n\t\t\t// token-bearing session (it would otherwise crash or store secrets in plaintext) —\n\t\t\t// the session then behaves like a plain session with no re-validation.\n\t\t\tif (claim.idpSession) {\n\t\t\t\tconst hasTokens = !!claim.idpSession.tokens && Object.keys(claim.idpSession.tokens).length > 0\n\t\t\t\tif (!hasTokens || db.providers.encryptionEnabled) {\n\t\t\t\t\tawait db.commandBus.execute(new CreateIdpSessionCommand(apiKeyId, provider.id, claim.idpSession))\n\t\t\t\t} else {\n\t\t\t\t\t// Re-validation is enabled on this IdP but no encryption key is configured, so we\n\t\t\t\t\t// won't store the token-bearing session — it silently degrades to a plain,\n\t\t\t\t\t// non-revalidated session. Audit the downgrade (errorCode `encryption_disabled`)\n\t\t\t\t\t// so the operator can see that a session they expected to be continuously\n\t\t\t\t\t// re-validated is in fact not protected, instead of failing closed at sign-in.\n\t\t\t\t\tawait db.commandBus.execute(\n\t\t\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\t\t\tinvokedById: personRow.identity_id,\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t\tpersonTokenId: apiKeyId,\n\t\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\t\terrorCode: 'encryption_disabled',\n\t\t\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t\t\t}),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\tidpResponse: claim,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse> {\n\t\tconst provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\tif (!provider || provider.disabledAt) {\n\t\t\treturn new ResponseError('PROVIDER_NOT_FOUND', `Identity provider ${idpSlug} not found`)\n\t\t}\n\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\ttry {\n\t\t\tconst initResponse = await providerService.initAuth(validatedConfig, data)\n\n\t\t\tconst publicConfig = providerService.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(validatedConfig)\n\t\t\t\t: validatedConfig\n\n\t\t\treturn new ResponseOk({\n\t\t\t\t...initResponse,\n\t\t\t\tidpConfiguration: provider.initReturnsConfig ? publicConfig : null,\n\t\t\t})\n\t\t} catch (e) {\n\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message)\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\t}\n\n\tprivate async resolvePerson(db: DatabaseContext, claim: IDPResponse, provider: IdentityProviderRow): Promise<IDPSignInManager.ResolvePersonResult> {\n\t\tconst personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)\n\t\tconst personByIdp = await db.queryHandler.fetch(personByIdPQuery)\n\t\tif (personByIdp) {\n\t\t\treturn { person: personByIdp }\n\t\t}\n\n\t\tif (!provider.exclusive) {\n\t\t\tconst personByEmail = typeof claim.email === 'string' && claim.email\n\t\t\t\t? await db.queryHandler.fetch(PersonQuery.byEmail(claim.email))\n\t\t\t\t: null\n\t\t\tif (personByEmail) {\n\t\t\t\t// Auto-linking an IdP identity to a pre-existing local account by\n\t\t\t\t// e-mail is takeover-grade: if the provider returns an unverified\n\t\t\t\t// (or attacker-controlled) e-mail, it could hijack the account. When\n\t\t\t\t// the provider requires a verified e-mail, refuse to link — and to\n\t\t\t\t// sign in — unless the address is asserted verified. `assumeEmailVerified`\n\t\t\t\t// lets a trusted IdP that never emits the claim still satisfy the gate.\n\t\t\t\tconst emailVerified = provider.assumeEmailVerified || claim.emailVerified === true\n\t\t\t\tif (provider.requireVerifiedEmail && !emailVerified) {\n\t\t\t\t\treturn { person: null, blockedReason: 'idp_email_unverified', blockedPersonId: personByEmail.id }\n\t\t\t\t}\n\t\t\t\tawait this.saveIdpIdentifier(db, provider, claim, personByEmail)\n\t\t\t\treturn { person: personByEmail }\n\t\t\t}\n\t\t}\n\n\t\tif (provider.autoSignUp) {\n\t\t\tconst signedUpPerson = await this.signUp(db, claim, provider)\n\t\t\tawait this.saveIdpIdentifier(db, provider, claim, signedUpPerson)\n\t\t\treturn { person: signedUpPerson }\n\t\t}\n\n\t\treturn { person: null }\n\t}\n\n\tprivate async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow> {\n\t\tconst roles = [TenantRole.PERSON]\n\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))\n\t\tconst newPerson = await db.commandBus.execute(\n\t\t\tnew CreatePersonCommand({\n\t\t\t\tidentityId,\n\t\t\t\temail: provider.exclusive ? undefined : email,\n\t\t\t\tpassword: NoPassword,\n\t\t\t\tname: name ?? email?.split('@')[0] ?? externalIdentifier,\n\t\t\t\tidpOnly: provider.exclusive,\n\t\t\t}),\n\t\t)\n\n\t\treturn {\n\t\t\t...newPerson,\n\t\t\troles,\n\t\t}\n\t}\n\n\tprivate async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPResponse, person: PersonRow) {\n\t\tawait db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier))\n\t}\n}\n\nnamespace IDPSignInManager {\n\texport type ResolvePersonResult = {\n\t\treadonly person: PersonRow | null\n\t\treadonly blockedReason?: 'idp_email_unverified'\n\t\treadonly blockedPersonId?: string\n\t}\n\n\texport type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>\n\n\tinterface SignInIDPResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\treadonly idpResponse?: Record<string, unknown>\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\n\texport type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { IDPSignInManager }\n"],"names":["IdentityProviderBySlugQuery","IDPResponseError","ResponseError","AuthLogService","IDPValidationError","CreateIdpSessionCommand","CreateAuthLogEntryCommand","ResponseOk","PersonByIdPQuery","PersonQuery","TenantRole","CreateIdentityCommand","CreatePersonCommand","NoPassword","CreatePersonIdentityProviderIdentifierCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAM,iBAAiB;AAAA,EACtB,YACkB,eACA,aAChB;AAFgB,SAAA,gBAAA;AACA,SAAA,cAAA;AAAA,EACf;AAAA,EAEH,MAAM,UACL,WACA,SACA,cACA,YACA,aACA,oBAC8C;AAC9C,WAAO,UAAU,YAAY,OAAO,OAAoD;AACvF,YAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIA,4BAAAA,4BAA4B,OAAO,CAAC;AACrF,UAAI,CAAC,YAAY,SAAS,YAAY;AACrC,cAAM,IAAI,MAAM,oBAAoB;AAAA,MACrC;AACA,YAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,YAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AACpF,UAAI;AACJ,UAAI;AACH,gBAAQ,MAAM,gBAAgB;AAAA,UAC7B;AAAA,UACA;AAAA,QAAA;AAAA,MAEF,SAAS,GAAG;AACX,YAAI,aAAaC,iBAAAA,kBAAkB;AAClC,iBAAO,IAAIC,SAAAA,cAAc,wBAAwB,EAAE,SAAS;AAAA,YAC3D,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU;AAAA,cACV,oBAAoB,SAAS;AAAA,YAAA,CAC7B;AAAA,UAAA,CACD;AAAA,QACF;AACA,YAAI,aAAaC,mBAAAA,oBAAoB;AACpC,iBAAO,IAAIF,SAAAA,cAAc,yBAAyB,EAAE,SAAS;AAAA,YAC5D,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU;AAAA,cACV,oBAAoB,SAAS;AAAA,YAAA,CAC7B;AAAA,UAAA,CACD;AAAA,QACF;AACA,cAAM;AAAA,MACP;AACA,YAAM,WAAW,MAAM,KAAK,cAAc,IAAI,OAAO,QAAQ;AAC7D,YAAM,YAAY,SAAS;AAE3B,UAAI,CAAC,WAAW;AAIf,eAAO,IAAID,SAAAA,cAAc,oBAAoB,UAAU,MAAM,KAAK,cAAc;AAAA,UAC/E,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,oBAAoB,SAAS;AAAA,YAC7B,aAAa,MAAM;AAAA,YACnB,UAAU,SAAS;AAAA,YACnB,WAAW,SAAS,gBAAgB,EAAE,QAAQ,SAAS,kBAAkB;AAAA,UAAA,CACzE;AAAA,QAAA,CACD;AAAA,MACF;AAEA,UAAI,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAID,SAAAA,cAAc,mBAAmB,sBAAsB,MAAM,KAAK,gBAAgB;AAAA,UAC5F,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,oBAAoB,SAAS;AAAA,YAC7B,aAAa,MAAM;AAAA,YACnB,UAAU,UAAU;AAAA,UAAA,CACpB;AAAA,QAAA,CACD;AAAA,MACF;AAEA,YAAM,EAAE,IAAI,UAAU,OAAO,iBAAiB,MAAM,KAAK,cAAc;AAAA,QACtE;AAAA,QACA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AASD,UAAI,MAAM,YAAY;AACrB,cAAM,YAAY,CAAC,CAAC,MAAM,WAAW,UAAU,OAAO,KAAK,MAAM,WAAW,MAAM,EAAE,SAAS;AAC7F,YAAI,CAAC,aAAa,GAAG,UAAU,mBAAmB;AACjD,gBAAM,GAAG,WAAW,QAAQ,IAAIE,wBAAAA,wBAAwB,UAAU,SAAS,IAAI,MAAM,UAAU,CAAC;AAAA,QACjG,OAAO;AAMN,gBAAM,GAAG,WAAW;AAAA,YACnB,IAAIC,oDAA0B;AAAA,cAC7B,MAAM;AAAA,cACN,aAAa,UAAU;AAAA,cACvB,UAAU,UAAU;AAAA,cACpB,oBAAoB,SAAS;AAAA,cAC7B,eAAe;AAAA,cACf,SAAS;AAAA,cACT,WAAW;AAAA,cACX,WAAW,aAAa;AAAA,cACxB,WAAW,aAAa;AAAA,YAAA,CACxB;AAAA,UAAA;AAAA,QAEH;AAAA,MACD;AAEA,aAAO,IAAIC,SAAAA,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,aAAa;AAAA,QACb,CAACJ,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,oBAAoB,SAAS;AAAA,UAC7B,aAAa,MAAM;AAAA,QAAA,CACnB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,WAA4B,SAAiB,MAAgE;AAChI,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,IAAIH,4BAAAA,4BAA4B,OAAO,CAAC;AAC5F,QAAI,CAAC,YAAY,SAAS,YAAY;AACrC,aAAO,IAAIE,SAAAA,cAAc,sBAAsB,qBAAqB,OAAO,YAAY;AAAA,IACxF;AACA,UAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,UAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AACpF,QAAI;AACH,YAAM,eAAe,MAAM,gBAAgB,SAAS,iBAAiB,IAAI;AAEzE,YAAM,eAAe,gBAAgB,yBAClC,gBAAgB,uBAAuB,eAAe,IACtD;AAEH,aAAO,IAAIK,SAAAA,WAAW;AAAA,QACrB,GAAG;AAAA,QACH,kBAAkB,SAAS,oBAAoB,eAAe;AAAA,MAAA,CAC9D;AAAA,IACF,SAAS,GAAG;AACX,UAAI,aAAaH,mBAAAA,oBAAoB;AACpC,eAAO,IAAIF,SAAAA,cAAc,yBAAyB,EAAE,OAAO;AAAA,MAC5D;AACA,YAAM;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAc,cAAc,IAAqB,OAAoB,UAA8E;AAClJ,UAAM,mBAAmB,IAAIM,iBAAAA,iBAAiB,SAAS,IAAI,MAAM,kBAAkB;AACnF,UAAM,cAAc,MAAM,GAAG,aAAa,MAAM,gBAAgB;AAChE,QAAI,aAAa;AAChB,aAAO,EAAE,QAAQ,YAAA;AAAA,IAClB;AAEA,QAAI,CAAC,SAAS,WAAW;AACxB,YAAM,gBAAgB,OAAO,MAAM,UAAU,YAAY,MAAM,QAC5D,MAAM,GAAG,aAAa,MAAMC,wBAAY,QAAQ,MAAM,KAAK,CAAC,IAC5D;AACH,UAAI,eAAe;AAOlB,cAAM,gBAAgB,SAAS,uBAAuB,MAAM,kBAAkB;AAC9E,YAAI,SAAS,wBAAwB,CAAC,eAAe;AACpD,iBAAO,EAAE,QAAQ,MAAM,eAAe,wBAAwB,iBAAiB,cAAc,GAAA;AAAA,QAC9F;AACA,cAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,aAAa;AAC/D,eAAO,EAAE,QAAQ,cAAA;AAAA,MAClB;AAAA,IACD;AAEA,QAAI,SAAS,YAAY;AACxB,YAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,OAAO,QAAQ;AAC5D,YAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,cAAc;AAChE,aAAO,EAAE,QAAQ,eAAA;AAAA,IAClB;AAEA,WAAO,EAAE,QAAQ,KAAA;AAAA,EAClB;AAAA,EAEA,MAAc,OAAO,IAAqB,EAAE,OAAO,MAAM,mBAAA,GAAmC,UAAmD;AAC9I,UAAM,QAAQ,CAACC,MAAAA,WAAW,MAAM;AAChC,UAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,KAAK,CAAC;AAC/E,UAAM,YAAY,MAAM,GAAG,WAAW;AAAA,MACrC,IAAIC,wCAAoB;AAAA,QACvB;AAAA,QACA,OAAO,SAAS,YAAY,SAAY;AAAA,QACxC,UAAUC,SAAAA;AAAAA,QACV,MAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,QACtC,SAAS,SAAS;AAAA,MAAA,CAClB;AAAA,IAAA;AAGF,WAAO;AAAA,MACN,GAAG;AAAA,MACH;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAc,kBAAkB,IAAqB,UAA+B,OAAoB,QAAmB;AAC1H,UAAM,GAAG,WAAW,QAAQ,IAAIC,8CAAAA,8CAA8C,SAAS,IAAI,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,EAChI;AACD;;"}
+{"version":3,"file":"IDPSignInManager.cjs","sources":["../../../../../../packages/engine-tenant-api/src/model/service/IDPSignInManager.ts"],"sourcesContent":["import { ApiKeyManager } from './apiKey/index.js'\nimport { IdentityProviderBySlugQuery, PersonByIdPQuery, PersonQuery, PersonRow } from '../queries/index.js'\nimport { IDPHandlerRegistry, IDPResponse, IDPResponseError, IDPValidationError } from './idp/index.js'\nimport { Response, ResponseError, ResponseOk } from '../utils/Response.js'\nimport { InitSignInIdpErrorCode, InitSignInIdpResult, SignInIdpErrorCode } from '../../schema/index.js'\nimport { DatabaseContext } from '../utils/index.js'\nimport { ApiKeyRequestInfo, CreateIdentityCommand, CreatePersonCommand, CreatePersonIdentityProviderIdentifierCommand } from '../commands/index.js'\nimport { CreateIdpSessionCommand } from '../commands/idp/CreateIdpSessionCommand.js'\nimport { CreateAuthLogEntryCommand } from '../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { TenantRole } from '../authorization/index.js'\nimport { NoPassword } from '../dtos/index.js'\nimport { IdentityProviderRow } from '../queries/idp/types.js'\nimport { AuthLogService } from './AuthLogService.js'\nimport { ClaimMappingAudit, IDPClaimSyncService } from './idp/IDPClaimSyncService.js'\nimport { ClaimMapping, parseClaimMapping } from './idp/ClaimMapping.js'\n\nclass IDPSignInManager {\n\tconstructor(\n\t\tprivate readonly apiKeyManager: ApiKeyManager,\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t\tprivate readonly claimSyncService: IDPClaimSyncService,\n\t) {}\n\n\tasync signInIDP(\n\t\tdbContext: DatabaseContext,\n\t\tidpSlug: string,\n\t\tresponseData: unknown,\n\t\texpiration?: number,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t\ttrustForwardedInfo?: boolean,\n\t): Promise<IDPSignInManager.SignInIDPResponse> {\n\t\treturn dbContext.transaction(async (db): Promise<IDPSignInManager.SignInIDPResponse> => {\n\t\t\tconst provider = await db.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\t\tif (!provider || provider.disabledAt) {\n\t\t\t\tthrow new Error('provider not found')\n\t\t\t}\n\t\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\t\tlet claim: IDPResponse\n\t\t\ttry {\n\t\t\t\tclaim = await providerService.processResponse(\n\t\t\t\t\tvalidatedConfig,\n\t\t\t\t\tresponseData,\n\t\t\t\t)\n\t\t\t} catch (e) {\n\t\t\t\tif (e instanceof IDPResponseError) {\n\t\t\t\t\treturn new ResponseError('INVALID_IDP_RESPONSE', e.message, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: undefined,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message, {\n\t\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\t\tpersonId: undefined,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t}),\n\t\t\t\t\t})\n\t\t\t\t}\n\t\t\t\tthrow e\n\t\t\t}\n\t\t\tconst resolved = await this.resolvePerson(db, claim, provider)\n\t\t\tconst personRow = resolved.person\n\n\t\t\tif (!personRow) {\n\t\t\t\t// Keep the external error generic (no account-existence leak), but\n\t\t\t\t// record the email-verification gate block distinctly in the audit\n\t\t\t\t// log — it is a takeover-grade event, not an ordinary \"not found\".\n\t\t\t\treturn new ResponseError('PERSON_NOT_FOUND', `Person ${claim.email} not found`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t\t\tpersonId: resolved.blockedPersonId,\n\t\t\t\t\t\teventData: resolved.blockedReason ? { reason: resolved.blockedReason } : undefined,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\tif (personRow.disabled_at !== null) {\n\t\t\t\treturn new ResponseError('PERSON_DISABLED', `Person with e-mail ${claim.email} is disabled`, {\n\t\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t}),\n\t\t\t\t})\n\t\t\t}\n\n\t\t\t// A09 — map IdP claims to project memberships. Returns a `{ before, after }` delta only\n\t\t\t// when something actually changed; the resolver emits the `idp_role_mapped` audit from it\n\t\t\t// (audit stays at the resolver layer).\n\t\t\t//\n\t\t\t// Fail-open on a MALFORMED/out-of-band `claimMapping`: parsing is caught so a bad config can\n\t\t\t// never lock the user out — sign-in proceeds without claim mapping and the resolver emits an\n\t\t\t// `idp_role_mapping_failed` marker. A DB error during the apply itself is NOT caught: it\n\t\t\t// propagates and rolls back the whole sign-in transaction, so a half-applied set of grants is\n\t\t\t// never committed (failing sign-in on an infra error is the safe outcome).\n\t\t\tlet mapping: ClaimMapping | null = null\n\t\t\tlet claimMappingFailed = false\n\t\t\ttry {\n\t\t\t\tmapping = parseClaimMapping(provider.configuration)\n\t\t\t} catch {\n\t\t\t\tclaimMappingFailed = true\n\t\t\t}\n\t\t\tlet claimMappingAudit: ClaimMappingAudit | null = null\n\t\t\tif (mapping) {\n\t\t\t\tconst syncResult = await this.claimSyncService.sync(\n\t\t\t\t\tdb,\n\t\t\t\t\tmapping,\n\t\t\t\t\tclaim,\n\t\t\t\t\t{ id: personRow.identity_id },\n\t\t\t\t\tresolved.isNewPerson === true,\n\t\t\t\t)\n\t\t\t\tclaimMappingAudit = syncResult.audit\n\t\t\t\t// The apply-time safety backstop dropped a configured rule (config-time validation was skipped, or\n\t\t\t\t// the project's ACL drifted since): surface the same fail-open marker as a malformed config, so a\n\t\t\t\t// silently-unapplied grant is visible to the operator. The resolver emits `idp_role_mapping_failed`.\n\t\t\t\tif (syncResult.droppedUnsafeRules) {\n\t\t\t\t\tclaimMappingFailed = true\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tconst { id: apiKeyId, token: sessionToken } = await this.apiKeyManager.createSessionApiKeyWithId(\n\t\t\t\tdb,\n\t\t\t\tpersonRow.identity_id,\n\t\t\t\texpiration,\n\t\t\t\trequestInfo,\n\t\t\t\ttrustForwardedInfo,\n\t\t\t)\n\n\t\t\t// Bind the federated-session state to this session so it can be re-validated\n\t\t\t// against the IdP later. Present only when the provider supports it and\n\t\t\t// revalidation is enabled on the IdP configuration (A24). Refresh tokens must be\n\t\t\t// encrypted at rest, so when no encryption key is configured we skip persisting a\n\t\t\t// token-bearing session (it would otherwise crash or store secrets in plaintext) —\n\t\t\t// the session then behaves like a plain session with no re-validation.\n\t\t\tif (claim.idpSession) {\n\t\t\t\tconst hasTokens = !!claim.idpSession.tokens && Object.keys(claim.idpSession.tokens).length > 0\n\t\t\t\tif (!hasTokens || db.providers.encryptionEnabled) {\n\t\t\t\t\tawait db.commandBus.execute(new CreateIdpSessionCommand(apiKeyId, provider.id, claim.idpSession))\n\t\t\t\t} else {\n\t\t\t\t\t// Re-validation is enabled on this IdP but no encryption key is configured, so we\n\t\t\t\t\t// won't store the token-bearing session — it silently degrades to a plain,\n\t\t\t\t\t// non-revalidated session. Audit the downgrade (errorCode `encryption_disabled`)\n\t\t\t\t\t// so the operator can see that a session they expected to be continuously\n\t\t\t\t\t// re-validated is in fact not protected, instead of failing closed at sign-in.\n\t\t\t\t\tawait db.commandBus.execute(\n\t\t\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\t\t\tinvokedById: personRow.identity_id,\n\t\t\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\t\t\tpersonTokenId: apiKeyId,\n\t\t\t\t\t\t\tsuccess: true,\n\t\t\t\t\t\t\terrorCode: 'encryption_disabled',\n\t\t\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t\t\t}),\n\t\t\t\t\t)\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn new ResponseOk({\n\t\t\t\tperson: personRow,\n\t\t\t\ttoken: sessionToken,\n\t\t\t\tidpResponse: claim,\n\t\t\t\tclaimMappingAudit,\n\t\t\t\tclaimMappingFailed,\n\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t[AuthLogService.Key]: new AuthLogService.Bag({\n\t\t\t\t\tpersonId: personRow.id,\n\t\t\t\t\tidentityProviderId: provider.id,\n\t\t\t\t\tpersonInput: claim.email,\n\t\t\t\t}),\n\t\t\t})\n\t\t})\n\t}\n\n\tasync initSignInIDP(dbContext: DatabaseContext, idpSlug: string, data: unknown): Promise<IDPSignInManager.InitSignInIDPResponse> {\n\t\tconst provider = await dbContext.queryHandler.fetch(new IdentityProviderBySlugQuery(idpSlug))\n\t\tif (!provider || provider.disabledAt) {\n\t\t\treturn new ResponseError('PROVIDER_NOT_FOUND', `Identity provider ${idpSlug} not found`)\n\t\t}\n\t\tconst providerService = this.idpRegistry.getHandler(provider.type)\n\t\tconst validatedConfig = providerService.validateConfiguration(provider.configuration)\n\t\ttry {\n\t\t\tconst initResponse = await providerService.initAuth(validatedConfig, data)\n\n\t\t\tconst publicConfig = providerService.getPublicConfiguration\n\t\t\t\t? providerService.getPublicConfiguration(validatedConfig)\n\t\t\t\t: validatedConfig\n\n\t\t\treturn new ResponseOk({\n\t\t\t\t...initResponse,\n\t\t\t\tidpConfiguration: provider.initReturnsConfig ? publicConfig : null,\n\t\t\t})\n\t\t} catch (e) {\n\t\t\tif (e instanceof IDPValidationError) {\n\t\t\t\treturn new ResponseError('IDP_VALIDATION_FAILED', e.message)\n\t\t\t}\n\t\t\tthrow e\n\t\t}\n\t}\n\n\tprivate async resolvePerson(db: DatabaseContext, claim: IDPResponse, provider: IdentityProviderRow): Promise<IDPSignInManager.ResolvePersonResult> {\n\t\tconst personByIdPQuery = new PersonByIdPQuery(provider.id, claim.externalIdentifier)\n\t\tconst personByIdp = await db.queryHandler.fetch(personByIdPQuery)\n\t\tif (personByIdp) {\n\t\t\treturn { person: personByIdp }\n\t\t}\n\n\t\tif (!provider.exclusive) {\n\t\t\tconst personByEmail = typeof claim.email === 'string' && claim.email\n\t\t\t\t? await db.queryHandler.fetch(PersonQuery.byEmail(claim.email))\n\t\t\t\t: null\n\t\t\tif (personByEmail) {\n\t\t\t\t// Auto-linking an IdP identity to a pre-existing local account by\n\t\t\t\t// e-mail is takeover-grade: if the provider returns an unverified\n\t\t\t\t// (or attacker-controlled) e-mail, it could hijack the account. When\n\t\t\t\t// the provider requires a verified e-mail, refuse to link — and to\n\t\t\t\t// sign in — unless the address is asserted verified. `assumeEmailVerified`\n\t\t\t\t// lets a trusted IdP that never emits the claim still satisfy the gate.\n\t\t\t\tconst emailVerified = provider.assumeEmailVerified || claim.emailVerified === true\n\t\t\t\tif (provider.requireVerifiedEmail && !emailVerified) {\n\t\t\t\t\treturn { person: null, blockedReason: 'idp_email_unverified', blockedPersonId: personByEmail.id }\n\t\t\t\t}\n\t\t\t\tawait this.saveIdpIdentifier(db, provider, claim, personByEmail)\n\t\t\t\treturn { person: personByEmail }\n\t\t\t}\n\t\t}\n\n\t\tif (provider.autoSignUp) {\n\t\t\tconst signedUpPerson = await this.signUp(db, claim, provider)\n\t\t\tawait this.saveIdpIdentifier(db, provider, claim, signedUpPerson)\n\t\t\treturn { person: signedUpPerson, isNewPerson: true }\n\t\t}\n\n\t\treturn { person: null }\n\t}\n\n\tprivate async signUp(db: DatabaseContext, { email, name, externalIdentifier }: IDPResponse, provider: IdentityProviderRow): Promise<PersonRow> {\n\t\tconst roles = [TenantRole.PERSON]\n\t\tconst identityId = await db.commandBus.execute(new CreateIdentityCommand(roles))\n\t\tconst newPerson = await db.commandBus.execute(\n\t\t\tnew CreatePersonCommand({\n\t\t\t\tidentityId,\n\t\t\t\temail: provider.exclusive ? undefined : email,\n\t\t\t\tpassword: NoPassword,\n\t\t\t\tname: name ?? email?.split('@')[0] ?? externalIdentifier,\n\t\t\t\tidpOnly: provider.exclusive,\n\t\t\t}),\n\t\t)\n\n\t\treturn {\n\t\t\t...newPerson,\n\t\t\troles,\n\t\t}\n\t}\n\n\tprivate async saveIdpIdentifier(db: DatabaseContext, provider: IdentityProviderRow, claim: IDPResponse, person: PersonRow) {\n\t\tawait db.commandBus.execute(new CreatePersonIdentityProviderIdentifierCommand(provider.id, person.id, claim.externalIdentifier))\n\t}\n}\n\nnamespace IDPSignInManager {\n\texport type ResolvePersonResult = {\n\t\treadonly person: PersonRow | null\n\t\treadonly blockedReason?: 'idp_email_unverified'\n\t\treadonly blockedPersonId?: string\n\t\t/** True when the person row was just created by auto-sign-up (drives the `sticky` claim-mapping policy). */\n\t\treadonly isNewPerson?: boolean\n\t}\n\n\texport type InitSignInIDPResponse = Response<InitSignInIdpResult, InitSignInIdpErrorCode>\n\n\tinterface SignInIDPResult {\n\t\treadonly person: PersonRow\n\t\treadonly token: string\n\t\treadonly idpResponse?: Record<string, unknown>\n\t\t/** Identity provider the sign-in went through (for the resolver's audit). */\n\t\treadonly identityProviderId?: string\n\t\t/** Claim-mapping (A09) before/after delta — present only when a mapping changed grants. */\n\t\treadonly claimMappingAudit?: ClaimMappingAudit | null\n\t\t/** True when claim mapping failed and was skipped (fail-open) — drives the `idp_role_mapping_failed` audit. */\n\t\treadonly claimMappingFailed?: boolean\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}\n\n\texport type SignInIDPResponse = Response<SignInIDPResult, SignInIdpErrorCode, {\n\t\t[AuthLogService.Key]: AuthLogService.Bag\n\t}>\n}\n\nexport { IDPSignInManager }\n"],"names":["IdentityProviderBySlugQuery","IDPResponseError","ResponseError","AuthLogService","IDPValidationError","parseClaimMapping","CreateIdpSessionCommand","CreateAuthLogEntryCommand","ResponseOk","PersonByIdPQuery","PersonQuery","TenantRole","CreateIdentityCommand","CreatePersonCommand","NoPassword","CreatePersonIdentityProviderIdentifierCommand"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,MAAM,iBAAiB;AAAA,EACtB,YACkB,eACA,aACA,kBAChB;AAHgB,SAAA,gBAAA;AACA,SAAA,cAAA;AACA,SAAA,mBAAA;AAAA,EACf;AAAA,EAEH,MAAM,UACL,WACA,SACA,cACA,YACA,aACA,oBAC8C;AAC9C,WAAO,UAAU,YAAY,OAAO,OAAoD;AACvF,YAAM,WAAW,MAAM,GAAG,aAAa,MAAM,IAAIA,4BAAAA,4BAA4B,OAAO,CAAC;AACrF,UAAI,CAAC,YAAY,SAAS,YAAY;AACrC,cAAM,IAAI,MAAM,oBAAoB;AAAA,MACrC;AACA,YAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,YAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AACpF,UAAI;AACJ,UAAI;AACH,gBAAQ,MAAM,gBAAgB;AAAA,UAC7B;AAAA,UACA;AAAA,QAAA;AAAA,MAEF,SAAS,GAAG;AACX,YAAI,aAAaC,iBAAAA,kBAAkB;AAClC,iBAAO,IAAIC,SAAAA,cAAc,wBAAwB,EAAE,SAAS;AAAA,YAC3D,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU;AAAA,cACV,oBAAoB,SAAS;AAAA,YAAA,CAC7B;AAAA,UAAA,CACD;AAAA,QACF;AACA,YAAI,aAAaC,mBAAAA,oBAAoB;AACpC,iBAAO,IAAIF,SAAAA,cAAc,yBAAyB,EAAE,SAAS;AAAA,YAC5D,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,cAC5C,UAAU;AAAA,cACV,oBAAoB,SAAS;AAAA,YAAA,CAC7B;AAAA,UAAA,CACD;AAAA,QACF;AACA,cAAM;AAAA,MACP;AACA,YAAM,WAAW,MAAM,KAAK,cAAc,IAAI,OAAO,QAAQ;AAC7D,YAAM,YAAY,SAAS;AAE3B,UAAI,CAAC,WAAW;AAIf,eAAO,IAAID,SAAAA,cAAc,oBAAoB,UAAU,MAAM,KAAK,cAAc;AAAA,UAC/E,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,oBAAoB,SAAS;AAAA,YAC7B,aAAa,MAAM;AAAA,YACnB,UAAU,SAAS;AAAA,YACnB,WAAW,SAAS,gBAAgB,EAAE,QAAQ,SAAS,kBAAkB;AAAA,UAAA,CACzE;AAAA,QAAA,CACD;AAAA,MACF;AAEA,UAAI,UAAU,gBAAgB,MAAM;AACnC,eAAO,IAAID,SAAAA,cAAc,mBAAmB,sBAAsB,MAAM,KAAK,gBAAgB;AAAA,UAC5F,CAACC,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,YAC5C,oBAAoB,SAAS;AAAA,YAC7B,aAAa,MAAM;AAAA,YACnB,UAAU,UAAU;AAAA,UAAA,CACpB;AAAA,QAAA,CACD;AAAA,MACF;AAWA,UAAI,UAA+B;AACnC,UAAI,qBAAqB;AACzB,UAAI;AACH,kBAAUE,aAAAA,kBAAkB,SAAS,aAAa;AAAA,MACnD,QAAQ;AACP,6BAAqB;AAAA,MACtB;AACA,UAAI,oBAA8C;AAClD,UAAI,SAAS;AACZ,cAAM,aAAa,MAAM,KAAK,iBAAiB;AAAA,UAC9C;AAAA,UACA;AAAA,UACA;AAAA,UACA,EAAE,IAAI,UAAU,YAAA;AAAA,UAChB,SAAS,gBAAgB;AAAA,QAAA;AAE1B,4BAAoB,WAAW;AAI/B,YAAI,WAAW,oBAAoB;AAClC,+BAAqB;AAAA,QACtB;AAAA,MACD;AAEA,YAAM,EAAE,IAAI,UAAU,OAAO,iBAAiB,MAAM,KAAK,cAAc;AAAA,QACtE;AAAA,QACA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AASD,UAAI,MAAM,YAAY;AACrB,cAAM,YAAY,CAAC,CAAC,MAAM,WAAW,UAAU,OAAO,KAAK,MAAM,WAAW,MAAM,EAAE,SAAS;AAC7F,YAAI,CAAC,aAAa,GAAG,UAAU,mBAAmB;AACjD,gBAAM,GAAG,WAAW,QAAQ,IAAIC,wBAAAA,wBAAwB,UAAU,SAAS,IAAI,MAAM,UAAU,CAAC;AAAA,QACjG,OAAO;AAMN,gBAAM,GAAG,WAAW;AAAA,YACnB,IAAIC,oDAA0B;AAAA,cAC7B,MAAM;AAAA,cACN,aAAa,UAAU;AAAA,cACvB,UAAU,UAAU;AAAA,cACpB,oBAAoB,SAAS;AAAA,cAC7B,eAAe;AAAA,cACf,SAAS;AAAA,cACT,WAAW;AAAA,cACX,WAAW,aAAa;AAAA,cACxB,WAAW,aAAa;AAAA,YAAA,CACxB;AAAA,UAAA;AAAA,QAEH;AAAA,MACD;AAEA,aAAO,IAAIC,SAAAA,WAAW;AAAA,QACrB,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,aAAa;AAAA,QACb;AAAA,QACA;AAAA,QACA,oBAAoB,SAAS;AAAA,QAC7B,CAACL,8BAAe,GAAG,GAAG,IAAIA,eAAAA,eAAe,IAAI;AAAA,UAC5C,UAAU,UAAU;AAAA,UACpB,oBAAoB,SAAS;AAAA,UAC7B,aAAa,MAAM;AAAA,QAAA,CACnB;AAAA,MAAA,CACD;AAAA,IACF,CAAC;AAAA,EACF;AAAA,EAEA,MAAM,cAAc,WAA4B,SAAiB,MAAgE;AAChI,UAAM,WAAW,MAAM,UAAU,aAAa,MAAM,IAAIH,4BAAAA,4BAA4B,OAAO,CAAC;AAC5F,QAAI,CAAC,YAAY,SAAS,YAAY;AACrC,aAAO,IAAIE,SAAAA,cAAc,sBAAsB,qBAAqB,OAAO,YAAY;AAAA,IACxF;AACA,UAAM,kBAAkB,KAAK,YAAY,WAAW,SAAS,IAAI;AACjE,UAAM,kBAAkB,gBAAgB,sBAAsB,SAAS,aAAa;AACpF,QAAI;AACH,YAAM,eAAe,MAAM,gBAAgB,SAAS,iBAAiB,IAAI;AAEzE,YAAM,eAAe,gBAAgB,yBAClC,gBAAgB,uBAAuB,eAAe,IACtD;AAEH,aAAO,IAAIM,SAAAA,WAAW;AAAA,QACrB,GAAG;AAAA,QACH,kBAAkB,SAAS,oBAAoB,eAAe;AAAA,MAAA,CAC9D;AAAA,IACF,SAAS,GAAG;AACX,UAAI,aAAaJ,mBAAAA,oBAAoB;AACpC,eAAO,IAAIF,SAAAA,cAAc,yBAAyB,EAAE,OAAO;AAAA,MAC5D;AACA,YAAM;AAAA,IACP;AAAA,EACD;AAAA,EAEA,MAAc,cAAc,IAAqB,OAAoB,UAA8E;AAClJ,UAAM,mBAAmB,IAAIO,iBAAAA,iBAAiB,SAAS,IAAI,MAAM,kBAAkB;AACnF,UAAM,cAAc,MAAM,GAAG,aAAa,MAAM,gBAAgB;AAChE,QAAI,aAAa;AAChB,aAAO,EAAE,QAAQ,YAAA;AAAA,IAClB;AAEA,QAAI,CAAC,SAAS,WAAW;AACxB,YAAM,gBAAgB,OAAO,MAAM,UAAU,YAAY,MAAM,QAC5D,MAAM,GAAG,aAAa,MAAMC,wBAAY,QAAQ,MAAM,KAAK,CAAC,IAC5D;AACH,UAAI,eAAe;AAOlB,cAAM,gBAAgB,SAAS,uBAAuB,MAAM,kBAAkB;AAC9E,YAAI,SAAS,wBAAwB,CAAC,eAAe;AACpD,iBAAO,EAAE,QAAQ,MAAM,eAAe,wBAAwB,iBAAiB,cAAc,GAAA;AAAA,QAC9F;AACA,cAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,aAAa;AAC/D,eAAO,EAAE,QAAQ,cAAA;AAAA,MAClB;AAAA,IACD;AAEA,QAAI,SAAS,YAAY;AACxB,YAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,OAAO,QAAQ;AAC5D,YAAM,KAAK,kBAAkB,IAAI,UAAU,OAAO,cAAc;AAChE,aAAO,EAAE,QAAQ,gBAAgB,aAAa,KAAA;AAAA,IAC/C;AAEA,WAAO,EAAE,QAAQ,KAAA;AAAA,EAClB;AAAA,EAEA,MAAc,OAAO,IAAqB,EAAE,OAAO,MAAM,mBAAA,GAAmC,UAAmD;AAC9I,UAAM,QAAQ,CAACC,MAAAA,WAAW,MAAM;AAChC,UAAM,aAAa,MAAM,GAAG,WAAW,QAAQ,IAAIC,sBAAAA,sBAAsB,KAAK,CAAC;AAC/E,UAAM,YAAY,MAAM,GAAG,WAAW;AAAA,MACrC,IAAIC,wCAAoB;AAAA,QACvB;AAAA,QACA,OAAO,SAAS,YAAY,SAAY;AAAA,QACxC,UAAUC,SAAAA;AAAAA,QACV,MAAM,QAAQ,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AAAA,QACtC,SAAS,SAAS;AAAA,MAAA,CAClB;AAAA,IAAA;AAGF,WAAO;AAAA,MACN,GAAG;AAAA,MACH;AAAA,IAAA;AAAA,EAEF;AAAA,EAEA,MAAc,kBAAkB,IAAqB,UAA+B,OAAoB,QAAmB;AAC1H,UAAM,GAAG,WAAW,QAAQ,IAAIC,8CAAAA,8CAA8C,SAAS,IAAI,OAAO,IAAI,MAAM,kBAAkB,CAAC;AAAA,EAChI;AACD;;"}