npm - @contember/engine-tenant-api - Versions diffs - 2.2.0-alpha.5 → 2.2.0-alpha.7 - Mend

@contember/engine-tenant-api 2.2.0-alpha.5 → 2.2.0-alpha.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (245) hide show

package/dist/production/src/migrations/runner.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"runner.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/runner.ts"],"sourcesContent":["import { Connection, createDatabaseIfNotExists, DatabaseConfig, EventManager } from '@contember/database'\nimport { TenantMigrationArgs } from './types.js'\nimport { MigrationsRunner as DbMigrationsRunner, SnapshotMigrationResolver } from '@contember/database-migrations'\nimport _20180802174310init from './2018-08-02-174310-init.js'\nimport _20180903140621identityproject from './2018-09-03-140621-identity-project.js'\nimport _20181026165450setupapikey from './2018-10-26-165450-setup-api-key.js'\nimport _20181026175155variables from './2018-10-26-175155-variables.js'\nimport _20190218110949projectslug from './2019-02-18-110949-project-slug.js'\nimport _20190218160155sessionexpiration from './2019-02-18-160155-session-expiration.js'\nimport _20190503163729apikeydisabledat from './2019-05-03-163729-api-key-disabled-at.js'\nimport _20190814153300projectslugunique from './2019-08-14-153300-project-slug-unique.js'\nimport _20190906111000membership from './2019-09-06-111000-membership.js'\nimport _20190906111001dropoldmember from './2019-09-06-111001-drop-old-member.js'\nimport _20200129idenitynote from './2020-01-29-idenity-note.js'\nimport _20200417fixpersonindex from './2020-04-17-fix-person-index.js'\nimport _20200501170000apikeyindex from './2020-05-01-170000-api-key-index.js'\nimport _20200608134000tenantcredentials from './2020-06-08-134000-tenant-credentials.js'\nimport _20200807110000personotp from './2020-08-07-110000-person-otp.js'\nimport _20200817162200mailtemplates from './2020-08-17-162200-mail-templates.js'\nimport _20200821143400personpasswordreset from './2020-08-21-143400-person-password-reset.js'\nimport _20200907094200identityprovider from './2020-09-07-094200-identity-provider.js'\nimport _20210328134000timestamp from './2021-03-28-134000-timestamp.js'\nimport _20210726105000projectconfig from './2021-07-26-105000-project-config.js'\nimport _20210726132000projectsecrets from './2021-07-26-132000-project-secrets.js'\nimport _20210727174000projectaliasindex from './2021-07-27-174000-project-alias-index.js'\nimport _20211124130000personpasswordnull from './2021-11-24-130000-person-password-null.js'\nimport _20211124161500mailtemplateprojectnull from './2021-11-24-161500-mail-template-project-null.js'\nimport _20220104144000personuniqueidentity from './2022-01-04-144000-person-unique-identity.js'\nimport _20220209111800fixcrypted from './2022-02-09-111800-fix-crypted.js'\nimport _20220211153000idpautosignup from './2022-02-11-153000-idp-auto-sign-up.js'\nimport _20220629105000personidp from './2022-06-29-105000-person-idp.js'\nimport _20220707135000personemailoptuniq from './2022-07-07-135000-person-email-opt-uniq.js'\nimport _20220707141000persondisplayname from './2022-07-07-141000-person-display-name.js'\nimport _20220714145000personloginoptions from './2022-07-14-145000-person-login-options.js'\nimport _20221108projectupdatenotification from './2022-11-08-project-update-notification.js'\nimport _20230120135500personemailnormalize from './2023-01-20-135500-person-email-normalize.js'\nimport _20230603104000persondisabled from './2023-06-03-104000-person-disabled.js'\nimport _20230901165000idpreturnconfig from './2023-09-01-165000-idp-return-config.js'\nimport _20240620140000mailreply from './2024-06-20-140000-mail-reply.js'\nimport _20240826120000passwordless from './2024-08-26-120000-passwordless.js'\nimport _20250416180000configup from './2025-04-16-180000-config-up.js'\nimport _20250417160000authlog from './2025-04-17-160000-auth-log.js'\nimport _20260512120000apikeysessiontracking from './2026-05-12-120000-api-key-session-tracking.js'\nimport _20260512130000apikeytrustforwardedinfo from './2026-05-12-130000-api-key-trust-forwarded-info.js'\nimport _20260513120000authlogeventdata from './2026-05-13-120000-auth-log-event-data.js'\nimport _20260513130000antiabuse from './2026-05-13-130000-anti-abuse.js'\nimport _20260514100000authlogadminactions from './2026-05-14-100000-auth-log-admin-actions.js'\nimport _20260515120000configreveallogmethod from './2026-05-15-120000-config-reveal-login-method.js'\nimport _20260521100000personmfa from './2026-05-21-100000-person-mfa.js'\nimport _20260521110000mfafoundation from './2026-05-21-110000-mfa-foundation.js'\nimport _20260521120000emailotp from './2026-05-21-120000-email-otp.js'\nimport _20260521130000apikeysessionpolicy from './2026-05-21-130000-api-key-session-policy.js'\nimport _20260521140000mfagraceduration from './2026-05-21-140000-mfa-grace-duration.js'\nimport _20260521150000emailotpratelimit from './2026-05-21-150000-email-otp-rate-limit.js'\nimport _20260526120000emailverificationtypes from './2026-05-26-120000-email-verification-types.js'\nimport _20260526120010emailverification from './2026-05-26-120010-email-verification.js'\nimport _20260526130000emailchangeverificationconfig from './2026-05-26-130000-email-change-verification-config.js'\nimport _20260526130010idprequireverifiedemail from './2026-05-26-130010-idp-require-verified-email.js'\nimport _20260526130020emailverificationratelimit from './2026-05-26-130020-email-verification-rate-limit.js'\nimport _20260526130030captchaprotectflows from './2026-05-26-130030-captcha-protect-flows.js'\nimport _20260526140000idpsession from './2026-05-26-140000-idp-session.js'\nimport _20260608100000idpassumeemailverified from './2026-06-08-100000-idp-assume-email-verified.js'\nimport _20260616120000loginanomalydetection from './2026-06-16-120000-login-anomaly-detection.js'\nimport _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'\nimport _20260618120000idpclaimmapping from './2026-06-18-120000-idp-claim-mapping.js'\nimport _20260803120000personenableauthlog from './2026-08-03-120000-person-enable-auth-log.js'\nimport _20260804120000configpanel from './2026-08-04-120000-config-panel.js'\nimport snapshot from './snapshot.js'\nimport { computeTokenHash, Providers } from '../model/index.js'\nimport { Logger } from '@contember/logger'\n\nexport interface TenantCredentials {\n\tloginToken?: string\n\trootEmail?: string\n\trootToken?: string\n\trootTokenHash?: string\n\trootPassword?: string\n\t/*\n\t Unpersisted root tokens (plain values). When set, these tokens are\n\t * verified at runtime and resolve to a super-admin identity without being\n\t * stored in the database. Useful for easy rotation.\n\t /\n\trootTokens?: readonly string[]\n\t/\n\t Unpersisted root token hashes (sha256 hex). Same as {@link rootTokens} but\n\t * the plain token never needs to be passed to the engine.\n\t */\n\trootTokenHashes?: readonly string[]\n}\n\nconst migrations = {\n\t'2018-08-02-174310-init': _20180802174310init,\n\t'2018-09-03-140621-identity-project': _20180903140621identityproject,\n\t'2018-10-26-165450-setup-api-key': _20181026165450setupapikey,\n\t'2018-10-26-175155-variables': _20181026175155variables,\n\t'2019-02-18-110949-project-slug': _20190218110949projectslug,\n\t'2019-02-18-160155-session-expiration': _20190218160155sessionexpiration,\n\t'2019-05-03-163729-api-key-disabled-at': _20190503163729apikeydisabledat,\n\t'2019-08-14-153300-project-slug-unique': _20190814153300projectslugunique,\n\t'2019-09-06-111000-membership': _20190906111000membership,\n\t'2019-09-06-111001-drop-old-member': _20190906111001dropoldmember,\n\t'2020-01-29-idenity-note': _20200129idenitynote,\n\t'2020-04-17-fix-person-index': _20200417fixpersonindex,\n\t'2020-05-01-170000-api-key-index': _20200501170000apikeyindex,\n\t'2020-06-08-134000-tenant-credentials': _20200608134000tenantcredentials,\n\t'2020-08-07-110000-person-otp': _20200807110000personotp,\n\t'2020-08-17-162200-mail-templates': _20200817162200mailtemplates,\n\t'2020-08-21-143400-person-password-reset': _20200821143400personpasswordreset,\n\t'2020-09-07-094200-identity-provider': _20200907094200identityprovider,\n\t'2021-03-28-134000-timestamp': _20210328134000timestamp,\n\t'2021-07-26-105000-project-config': _20210726105000projectconfig,\n\t'2021-07-26-132000-project-secrets': _20210726132000projectsecrets,\n\t'2021-07-27-174000-project-alias-index': _20210727174000projectaliasindex,\n\t'2021-11-24-130000-person-password-null': _20211124130000personpasswordnull,\n\t'2021-11-24-161500-mail-template-project-null': _20211124161500mailtemplateprojectnull,\n\t'2022-01-04-144000-person-unique-identity': _20220104144000personuniqueidentity,\n\t'2022-02-09-111800-fix-crypted': _20220209111800fixcrypted,\n\t'2022-02-11-153000-idp-auto-sign-up': _20220211153000idpautosignup,\n\t'2022-06-29-105000-person-idp': _20220629105000personidp,\n\t'2022-07-07-135000-person-email-opt-uniq': _20220707135000personemailoptuniq,\n\t'2022-07-07-141000-person-display-name': _20220707141000persondisplayname,\n\t'2022-07-14-145000-person-login-options': _20220714145000personloginoptions,\n\t'2022-11-08-project-update-notification': _20221108projectupdatenotification,\n\t'2023-01-20-135500-person-email-normalize': _20230120135500personemailnormalize,\n\t'2023-06-03-104000-person-disabled': _20230603104000persondisabled,\n\t'2023-09-01-165000-idp-return-config': _20230901165000idpreturnconfig,\n\t'2024-06-20-140000-mail-reply': _20240620140000mailreply,\n\t'2024-08-26-120000-passwordless': _20240826120000passwordless,\n\t'2025-04-16-180000-config-up': _20250416180000configup,\n\t'2025-04-17-160000-auth-log': _20250417160000authlog,\n\t'2026-05-12-120000-api-key-session-tracking': _20260512120000apikeysessiontracking,\n\t'2026-05-12-130000-api-key-trust-forwarded-info': _20260512130000apikeytrustforwardedinfo,\n\t'2026-05-13-120000-auth-log-event-data': _20260513120000authlogeventdata,\n\t'2026-05-13-130000-anti-abuse': _20260513130000antiabuse,\n\t'2026-05-14-100000-auth-log-admin-actions': _20260514100000authlogadminactions,\n\t'2026-05-15-120000-config-reveal-login-method': _20260515120000configreveallogmethod,\n\t'2026-05-21-100000-person-mfa': _20260521100000personmfa,\n\t'2026-05-21-110000-mfa-foundation': _20260521110000mfafoundation,\n\t'2026-05-21-120000-email-otp': _20260521120000emailotp,\n\t'2026-05-21-130000-api-key-session-policy': _20260521130000apikeysessionpolicy,\n\t'2026-05-21-140000-mfa-grace-duration': _20260521140000mfagraceduration,\n\t'2026-05-21-150000-email-otp-rate-limit': _20260521150000emailotpratelimit,\n\t'2026-05-26-120000-email-verification-types': _20260526120000emailverificationtypes,\n\t'2026-05-26-120010-email-verification': _20260526120010emailverification,\n\t'2026-05-26-130000-email-change-verification-config': _20260526130000emailchangeverificationconfig,\n\t'2026-05-26-130010-idp-require-verified-email': _20260526130010idprequireverifiedemail,\n\t'2026-05-26-130020-email-verification-rate-limit': _20260526130020emailverificationratelimit,\n\t'2026-05-26-130030-captcha-protect-flows': _20260526130030captchaprotectflows,\n\t'2026-05-26-140000-idp-session': _20260526140000idpsession,\n\t'2026-06-08-100000-idp-assume-email-verified': _20260608100000idpassumeemailverified,\n\t'2026-06-16-120000-login-anomaly-detection': _20260616120000loginanomalydetection,\n\t'2026-06-16-130000-idp-logout': _20260616130000idplogout,\n\t'2026-06-18-120000-idp-claim-mapping': _20260618120000idpclaimmapping,\n\t'2026-08-03-120000-person-enable-auth-log': _20260803120000personenableauthlog,\n\t'2026-08-04-120000-config-panel': _20260804120000configpanel,\n}\n\nexport class TenantMigrationsRunner {\n\tconstructor(\n\t\tprivate readonly db: DatabaseConfig,\n\t\tprivate readonly schema: string,\n\t\tprivate readonly tenantCredentials: TenantCredentials,\n\t\tprivate readonly providers: Pick<Providers, 'bcrypt' \| 'uuid'>,\n\t) {\n\t}\n\n\tpublic async run(logger: Logger): Promise<{ name: string }[]> {\n\t\tawait createDatabaseIfNotExists(this.db, message => typeof message === 'string' ? logger.warn(message) : logger.error(message))\n\t\tconst connection = Connection.createSingle(this.db, err => logger.error(err))\n\t\tconst result = await connection.scope(async connection => {\n\t\t\tconst migrationsResolver = new SnapshotMigrationResolver(snapshot, migrations)\n\n\t\t\tconst innerRunner = new DbMigrationsRunner<TenantMigrationArgs>(connection, this.schema, migrationsResolver)\n\t\t\treturn await innerRunner.migrate(message => logger.warn(message), {\n\t\t\t\tgetCredentials: async () => ({\n\t\t\t\t\tloginTokenHash: this.tenantCredentials.loginToken ? computeTokenHash(this.tenantCredentials.loginToken) : undefined,\n\t\t\t\t\trootTokenHash: this.tenantCredentials.rootTokenHash\n\t\t\t\t\t\t?? (this.tenantCredentials.rootToken ? computeTokenHash(this.tenantCredentials.rootToken) : undefined),\n\t\t\t\t\trootEmail: this.tenantCredentials.rootEmail,\n\t\t\t\t\trootPasswordBcrypted: this.tenantCredentials.rootPassword ? await this.providers.bcrypt(this.tenantCredentials.rootPassword) : undefined,\n\t\t\t\t}),\n\t\t\t\tproviders: this.providers,\n\t\t\t})\n\t\t})\n\t\tawait connection.end()\n\t\treturn result\n\t}\n}\n"],"names":["connection","DbMigrationsRunner"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0FA,MAAM,aAAa;AAAA,EAClB,0BAA0B;AAAA,EAC1B,sCAAsC;AAAA,EACtC,mCAAmC;AAAA,EACnC,+BAA+B;AAAA,EAC/B,kCAAkC;AAAA,EAClC,wCAAwC;AAAA,EACxC,yCAAyC;AAAA,EACzC,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,qCAAqC;AAAA,EACrC,2BAA2B;AAAA,EAC3B,+BAA+B;AAAA,EAC/B,mCAAmC;AAAA,EACnC,wCAAwC;AAAA,EACxC,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,2CAA2C;AAAA,EAC3C,uCAAuC;AAAA,EACvC,+BAA+B;AAAA,EAC/B,oCAAoC;AAAA,EACpC,qCAAqC;AAAA,EACrC,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,gDAAgD;AAAA,EAChD,4CAA4C;AAAA,EAC5C,iCAAiC;AAAA,EACjC,sCAAsC;AAAA,EACtC,gCAAgC;AAAA,EAChC,2CAA2C;AAAA,EAC3C,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,0CAA0C;AAAA,EAC1C,4CAA4C;AAAA,EAC5C,qCAAqC;AAAA,EACrC,uCAAuC;AAAA,EACvC,gCAAgC;AAAA,EAChC,kCAAkC;AAAA,EAClC,+BAA+B;AAAA,EAC/B,8BAA8B;AAAA,EAC9B,8CAA8C;AAAA,EAC9C,kDAAkD;AAAA,EAClD,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,4CAA4C;AAAA,EAC5C,gDAAgD;AAAA,EAChD,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,+BAA+B;AAAA,EAC/B,4CAA4C;AAAA,EAC5C,wCAAwC;AAAA,EACxC,0CAA0C;AAAA,EAC1C,8CAA8C;AAAA,EAC9C,wCAAwC;AAAA,EACxC,sDAAsD;AAAA,EACtD,gDAAgD;AAAA,EAChD,mDAAmD;AAAA,EACnD,2CAA2C;AAAA,EAC3C,iCAAiC;AAAA,EACjC,+CAA+C;AAAA,EAC/C,6CAA6C;AAAA,EAC7C,gCAAgC;AAAA,EAChC,uCAAuC;AAAA,EACvC,4CAA4C;AAAA,EAC5C,kCAAkC;AACnC;AAEO,MAAM,uBAAuB;AAAA,EACnC,YACkB,IACA,QACA,mBACA,WAChB;AAJgB,SAAA,KAAA;AACA,SAAA,SAAA;AACA,SAAA,oBAAA;AACA,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,IAAI,QAA6C;AAC7D,UAAM,0BAA0B,KAAK,IAAI,CAAA,YAAW,OAAO,YAAY,WAAW,OAAO,KAAK,OAAO,IAAI,OAAO,MAAM,OAAO,CAAC;AAC9H,UAAM,aAAa,WAAW,aAAa,KAAK,IAAI,CAAA,QAAO,OAAO,MAAM,GAAG,CAAC;AAC5E,UAAM,SAAS,MAAM,WAAW,MAAM,OAAMA,gBAAc;AACzD,YAAM,qBAAqB,IAAI,0BAA0B,UAAU,UAAU;AAE7E,YAAM,cAAc,IAAIC,iBAAwCD,aAAY,KAAK,QAAQ,kBAAkB;AAC3G,aAAO,MAAM,YAAY,QAAQ,aAAW,OAAO,KAAK,OAAO,GAAG;AAAA,QACjE,gBAAgB,aAAa;AAAA,UAC5B,gBAAgB,KAAK,kBAAkB,aAAa,iBAAiB,KAAK,kBAAkB,UAAU,IAAI;AAAA,UAC1G,eAAe,KAAK,kBAAkB,kBACjC,KAAK,kBAAkB,YAAY,iBAAiB,KAAK,kBAAkB,SAAS,IAAI;AAAA,UAC7F,WAAW,KAAK,kBAAkB;AAAA,UAClC,sBAAsB,KAAK,kBAAkB,eAAe,MAAM,KAAK,UAAU,OAAO,KAAK,kBAAkB,YAAY,IAAI;AAAA,QAAA;AAAA,QAEhI,WAAW,KAAK;AAAA,MAAA,CAChB;AAAA,IACF,CAAC;AACD,UAAM,WAAW,IAAA;AACjB,WAAO;AAAA,EACR;AACD;"}
1	+ {"version":3,"file":"runner.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/runner.ts"],"sourcesContent":["import { Connection, createDatabaseIfNotExists, DatabaseConfig, EventManager } from '@contember/database'\nimport { TenantMigrationArgs } from './types.js'\nimport { MigrationsRunner as DbMigrationsRunner, SnapshotMigrationResolver } from '@contember/database-migrations'\nimport _20180802174310init from './2018-08-02-174310-init.js'\nimport _20180903140621identityproject from './2018-09-03-140621-identity-project.js'\nimport _20181026165450setupapikey from './2018-10-26-165450-setup-api-key.js'\nimport _20181026175155variables from './2018-10-26-175155-variables.js'\nimport _20190218110949projectslug from './2019-02-18-110949-project-slug.js'\nimport _20190218160155sessionexpiration from './2019-02-18-160155-session-expiration.js'\nimport _20190503163729apikeydisabledat from './2019-05-03-163729-api-key-disabled-at.js'\nimport _20190814153300projectslugunique from './2019-08-14-153300-project-slug-unique.js'\nimport _20190906111000membership from './2019-09-06-111000-membership.js'\nimport _20190906111001dropoldmember from './2019-09-06-111001-drop-old-member.js'\nimport _20200129idenitynote from './2020-01-29-idenity-note.js'\nimport _20200417fixpersonindex from './2020-04-17-fix-person-index.js'\nimport _20200501170000apikeyindex from './2020-05-01-170000-api-key-index.js'\nimport _20200608134000tenantcredentials from './2020-06-08-134000-tenant-credentials.js'\nimport _20200807110000personotp from './2020-08-07-110000-person-otp.js'\nimport _20200817162200mailtemplates from './2020-08-17-162200-mail-templates.js'\nimport _20200821143400personpasswordreset from './2020-08-21-143400-person-password-reset.js'\nimport _20200907094200identityprovider from './2020-09-07-094200-identity-provider.js'\nimport _20210328134000timestamp from './2021-03-28-134000-timestamp.js'\nimport _20210726105000projectconfig from './2021-07-26-105000-project-config.js'\nimport _20210726132000projectsecrets from './2021-07-26-132000-project-secrets.js'\nimport _20210727174000projectaliasindex from './2021-07-27-174000-project-alias-index.js'\nimport _20211124130000personpasswordnull from './2021-11-24-130000-person-password-null.js'\nimport _20211124161500mailtemplateprojectnull from './2021-11-24-161500-mail-template-project-null.js'\nimport _20220104144000personuniqueidentity from './2022-01-04-144000-person-unique-identity.js'\nimport _20220209111800fixcrypted from './2022-02-09-111800-fix-crypted.js'\nimport _20220211153000idpautosignup from './2022-02-11-153000-idp-auto-sign-up.js'\nimport _20220629105000personidp from './2022-06-29-105000-person-idp.js'\nimport _20220707135000personemailoptuniq from './2022-07-07-135000-person-email-opt-uniq.js'\nimport _20220707141000persondisplayname from './2022-07-07-141000-person-display-name.js'\nimport _20220714145000personloginoptions from './2022-07-14-145000-person-login-options.js'\nimport _20221108projectupdatenotification from './2022-11-08-project-update-notification.js'\nimport _20230120135500personemailnormalize from './2023-01-20-135500-person-email-normalize.js'\nimport _20230603104000persondisabled from './2023-06-03-104000-person-disabled.js'\nimport _20230901165000idpreturnconfig from './2023-09-01-165000-idp-return-config.js'\nimport _20240620140000mailreply from './2024-06-20-140000-mail-reply.js'\nimport _20240826120000passwordless from './2024-08-26-120000-passwordless.js'\nimport _20250416180000configup from './2025-04-16-180000-config-up.js'\nimport _20250417160000authlog from './2025-04-17-160000-auth-log.js'\nimport _20260512120000apikeysessiontracking from './2026-05-12-120000-api-key-session-tracking.js'\nimport _20260512130000apikeytrustforwardedinfo from './2026-05-12-130000-api-key-trust-forwarded-info.js'\nimport _20260513120000authlogeventdata from './2026-05-13-120000-auth-log-event-data.js'\nimport _20260513130000antiabuse from './2026-05-13-130000-anti-abuse.js'\nimport _20260514100000authlogadminactions from './2026-05-14-100000-auth-log-admin-actions.js'\nimport _20260515120000configreveallogmethod from './2026-05-15-120000-config-reveal-login-method.js'\nimport _20260521100000personmfa from './2026-05-21-100000-person-mfa.js'\nimport _20260521110000mfafoundation from './2026-05-21-110000-mfa-foundation.js'\nimport _20260521120000emailotp from './2026-05-21-120000-email-otp.js'\nimport _20260521130000apikeysessionpolicy from './2026-05-21-130000-api-key-session-policy.js'\nimport _20260521140000mfagraceduration from './2026-05-21-140000-mfa-grace-duration.js'\nimport _20260521150000emailotpratelimit from './2026-05-21-150000-email-otp-rate-limit.js'\nimport _20260526120000emailverificationtypes from './2026-05-26-120000-email-verification-types.js'\nimport _20260526120010emailverification from './2026-05-26-120010-email-verification.js'\nimport _20260526130000emailchangeverificationconfig from './2026-05-26-130000-email-change-verification-config.js'\nimport _20260526130010idprequireverifiedemail from './2026-05-26-130010-idp-require-verified-email.js'\nimport _20260526130020emailverificationratelimit from './2026-05-26-130020-email-verification-rate-limit.js'\nimport _20260526130030captchaprotectflows from './2026-05-26-130030-captcha-protect-flows.js'\nimport _20260526140000idpsession from './2026-05-26-140000-idp-session.js'\nimport _20260608100000idpassumeemailverified from './2026-06-08-100000-idp-assume-email-verified.js'\nimport _20260616120000loginanomalydetection from './2026-06-16-120000-login-anomaly-detection.js'\nimport _20260616130000idplogout from './2026-06-16-130000-idp-logout.js'\nimport _20260618120000idpclaimmapping from './2026-06-18-120000-idp-claim-mapping.js'\nimport _20260803120000personenableauthlog from './2026-08-03-120000-person-enable-auth-log.js'\nimport _20260804120000configpanel from './2026-08-04-120000-config-panel.js'\nimport _20260904120000idpdisablelocalauthentication from './2026-09-04-120000-idp-disable-local-authentication.js'\nimport snapshot from './snapshot.js'\nimport { computeTokenHash, Providers } from '../model/index.js'\nimport { Logger } from '@contember/logger'\n\nexport interface TenantCredentials {\n\tloginToken?: string\n\trootEmail?: string\n\trootToken?: string\n\trootTokenHash?: string\n\trootPassword?: string\n\t/*\n\t Unpersisted root tokens (plain values). When set, these tokens are\n\t * verified at runtime and resolve to a super-admin identity without being\n\t * stored in the database. Useful for easy rotation.\n\t /\n\trootTokens?: readonly string[]\n\t/\n\t Unpersisted root token hashes (sha256 hex). Same as {@link rootTokens} but\n\t * the plain token never needs to be passed to the engine.\n\t */\n\trootTokenHashes?: readonly string[]\n}\n\nconst migrations = {\n\t'2018-08-02-174310-init': _20180802174310init,\n\t'2018-09-03-140621-identity-project': _20180903140621identityproject,\n\t'2018-10-26-165450-setup-api-key': _20181026165450setupapikey,\n\t'2018-10-26-175155-variables': _20181026175155variables,\n\t'2019-02-18-110949-project-slug': _20190218110949projectslug,\n\t'2019-02-18-160155-session-expiration': _20190218160155sessionexpiration,\n\t'2019-05-03-163729-api-key-disabled-at': _20190503163729apikeydisabledat,\n\t'2019-08-14-153300-project-slug-unique': _20190814153300projectslugunique,\n\t'2019-09-06-111000-membership': _20190906111000membership,\n\t'2019-09-06-111001-drop-old-member': _20190906111001dropoldmember,\n\t'2020-01-29-idenity-note': _20200129idenitynote,\n\t'2020-04-17-fix-person-index': _20200417fixpersonindex,\n\t'2020-05-01-170000-api-key-index': _20200501170000apikeyindex,\n\t'2020-06-08-134000-tenant-credentials': _20200608134000tenantcredentials,\n\t'2020-08-07-110000-person-otp': _20200807110000personotp,\n\t'2020-08-17-162200-mail-templates': _20200817162200mailtemplates,\n\t'2020-08-21-143400-person-password-reset': _20200821143400personpasswordreset,\n\t'2020-09-07-094200-identity-provider': _20200907094200identityprovider,\n\t'2021-03-28-134000-timestamp': _20210328134000timestamp,\n\t'2021-07-26-105000-project-config': _20210726105000projectconfig,\n\t'2021-07-26-132000-project-secrets': _20210726132000projectsecrets,\n\t'2021-07-27-174000-project-alias-index': _20210727174000projectaliasindex,\n\t'2021-11-24-130000-person-password-null': _20211124130000personpasswordnull,\n\t'2021-11-24-161500-mail-template-project-null': _20211124161500mailtemplateprojectnull,\n\t'2022-01-04-144000-person-unique-identity': _20220104144000personuniqueidentity,\n\t'2022-02-09-111800-fix-crypted': _20220209111800fixcrypted,\n\t'2022-02-11-153000-idp-auto-sign-up': _20220211153000idpautosignup,\n\t'2022-06-29-105000-person-idp': _20220629105000personidp,\n\t'2022-07-07-135000-person-email-opt-uniq': _20220707135000personemailoptuniq,\n\t'2022-07-07-141000-person-display-name': _20220707141000persondisplayname,\n\t'2022-07-14-145000-person-login-options': _20220714145000personloginoptions,\n\t'2022-11-08-project-update-notification': _20221108projectupdatenotification,\n\t'2023-01-20-135500-person-email-normalize': _20230120135500personemailnormalize,\n\t'2023-06-03-104000-person-disabled': _20230603104000persondisabled,\n\t'2023-09-01-165000-idp-return-config': _20230901165000idpreturnconfig,\n\t'2024-06-20-140000-mail-reply': _20240620140000mailreply,\n\t'2024-08-26-120000-passwordless': _20240826120000passwordless,\n\t'2025-04-16-180000-config-up': _20250416180000configup,\n\t'2025-04-17-160000-auth-log': _20250417160000authlog,\n\t'2026-05-12-120000-api-key-session-tracking': _20260512120000apikeysessiontracking,\n\t'2026-05-12-130000-api-key-trust-forwarded-info': _20260512130000apikeytrustforwardedinfo,\n\t'2026-05-13-120000-auth-log-event-data': _20260513120000authlogeventdata,\n\t'2026-05-13-130000-anti-abuse': _20260513130000antiabuse,\n\t'2026-05-14-100000-auth-log-admin-actions': _20260514100000authlogadminactions,\n\t'2026-05-15-120000-config-reveal-login-method': _20260515120000configreveallogmethod,\n\t'2026-05-21-100000-person-mfa': _20260521100000personmfa,\n\t'2026-05-21-110000-mfa-foundation': _20260521110000mfafoundation,\n\t'2026-05-21-120000-email-otp': _20260521120000emailotp,\n\t'2026-05-21-130000-api-key-session-policy': _20260521130000apikeysessionpolicy,\n\t'2026-05-21-140000-mfa-grace-duration': _20260521140000mfagraceduration,\n\t'2026-05-21-150000-email-otp-rate-limit': _20260521150000emailotpratelimit,\n\t'2026-05-26-120000-email-verification-types': _20260526120000emailverificationtypes,\n\t'2026-05-26-120010-email-verification': _20260526120010emailverification,\n\t'2026-05-26-130000-email-change-verification-config': _20260526130000emailchangeverificationconfig,\n\t'2026-05-26-130010-idp-require-verified-email': _20260526130010idprequireverifiedemail,\n\t'2026-05-26-130020-email-verification-rate-limit': _20260526130020emailverificationratelimit,\n\t'2026-05-26-130030-captcha-protect-flows': _20260526130030captchaprotectflows,\n\t'2026-05-26-140000-idp-session': _20260526140000idpsession,\n\t'2026-06-08-100000-idp-assume-email-verified': _20260608100000idpassumeemailverified,\n\t'2026-06-16-120000-login-anomaly-detection': _20260616120000loginanomalydetection,\n\t'2026-06-16-130000-idp-logout': _20260616130000idplogout,\n\t'2026-06-18-120000-idp-claim-mapping': _20260618120000idpclaimmapping,\n\t'2026-08-03-120000-person-enable-auth-log': _20260803120000personenableauthlog,\n\t'2026-08-04-120000-config-panel': _20260804120000configpanel,\n\t'2026-09-04-120000-idp-disable-local-authentication': _20260904120000idpdisablelocalauthentication,\n}\n\nexport class TenantMigrationsRunner {\n\tconstructor(\n\t\tprivate readonly db: DatabaseConfig,\n\t\tprivate readonly schema: string,\n\t\tprivate readonly tenantCredentials: TenantCredentials,\n\t\tprivate readonly providers: Pick<Providers, 'bcrypt' \| 'uuid'>,\n\t) {\n\t}\n\n\tpublic async run(logger: Logger): Promise<{ name: string }[]> {\n\t\tawait createDatabaseIfNotExists(this.db, message => typeof message === 'string' ? logger.warn(message) : logger.error(message))\n\t\tconst connection = Connection.createSingle(this.db, err => logger.error(err))\n\t\tconst result = await connection.scope(async connection => {\n\t\t\tconst migrationsResolver = new SnapshotMigrationResolver(snapshot, migrations)\n\n\t\t\tconst innerRunner = new DbMigrationsRunner<TenantMigrationArgs>(connection, this.schema, migrationsResolver)\n\t\t\treturn await innerRunner.migrate(message => logger.warn(message), {\n\t\t\t\tgetCredentials: async () => ({\n\t\t\t\t\tloginTokenHash: this.tenantCredentials.loginToken ? computeTokenHash(this.tenantCredentials.loginToken) : undefined,\n\t\t\t\t\trootTokenHash: this.tenantCredentials.rootTokenHash\n\t\t\t\t\t\t?? (this.tenantCredentials.rootToken ? computeTokenHash(this.tenantCredentials.rootToken) : undefined),\n\t\t\t\t\trootEmail: this.tenantCredentials.rootEmail,\n\t\t\t\t\trootPasswordBcrypted: this.tenantCredentials.rootPassword ? await this.providers.bcrypt(this.tenantCredentials.rootPassword) : undefined,\n\t\t\t\t}),\n\t\t\t\tproviders: this.providers,\n\t\t\t})\n\t\t})\n\t\tawait connection.end()\n\t\treturn result\n\t}\n}\n"],"names":["connection","DbMigrationsRunner"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2FA,MAAM,aAAa;AAAA,EAClB,0BAA0B;AAAA,EAC1B,sCAAsC;AAAA,EACtC,mCAAmC;AAAA,EACnC,+BAA+B;AAAA,EAC/B,kCAAkC;AAAA,EAClC,wCAAwC;AAAA,EACxC,yCAAyC;AAAA,EACzC,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,qCAAqC;AAAA,EACrC,2BAA2B;AAAA,EAC3B,+BAA+B;AAAA,EAC/B,mCAAmC;AAAA,EACnC,wCAAwC;AAAA,EACxC,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,2CAA2C;AAAA,EAC3C,uCAAuC;AAAA,EACvC,+BAA+B;AAAA,EAC/B,oCAAoC;AAAA,EACpC,qCAAqC;AAAA,EACrC,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,gDAAgD;AAAA,EAChD,4CAA4C;AAAA,EAC5C,iCAAiC;AAAA,EACjC,sCAAsC;AAAA,EACtC,gCAAgC;AAAA,EAChC,2CAA2C;AAAA,EAC3C,yCAAyC;AAAA,EACzC,0CAA0C;AAAA,EAC1C,0CAA0C;AAAA,EAC1C,4CAA4C;AAAA,EAC5C,qCAAqC;AAAA,EACrC,uCAAuC;AAAA,EACvC,gCAAgC;AAAA,EAChC,kCAAkC;AAAA,EAClC,+BAA+B;AAAA,EAC/B,8BAA8B;AAAA,EAC9B,8CAA8C;AAAA,EAC9C,kDAAkD;AAAA,EAClD,yCAAyC;AAAA,EACzC,gCAAgC;AAAA,EAChC,4CAA4C;AAAA,EAC5C,gDAAgD;AAAA,EAChD,gCAAgC;AAAA,EAChC,oCAAoC;AAAA,EACpC,+BAA+B;AAAA,EAC/B,4CAA4C;AAAA,EAC5C,wCAAwC;AAAA,EACxC,0CAA0C;AAAA,EAC1C,8CAA8C;AAAA,EAC9C,wCAAwC;AAAA,EACxC,sDAAsD;AAAA,EACtD,gDAAgD;AAAA,EAChD,mDAAmD;AAAA,EACnD,2CAA2C;AAAA,EAC3C,iCAAiC;AAAA,EACjC,+CAA+C;AAAA,EAC/C,6CAA6C;AAAA,EAC7C,gCAAgC;AAAA,EAChC,uCAAuC;AAAA,EACvC,4CAA4C;AAAA,EAC5C,kCAAkC;AAAA,EAClC,sDAAsD;AACvD;AAEO,MAAM,uBAAuB;AAAA,EACnC,YACkB,IACA,QACA,mBACA,WAChB;AAJgB,SAAA,KAAA;AACA,SAAA,SAAA;AACA,SAAA,oBAAA;AACA,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,IAAI,QAA6C;AAC7D,UAAM,0BAA0B,KAAK,IAAI,CAAA,YAAW,OAAO,YAAY,WAAW,OAAO,KAAK,OAAO,IAAI,OAAO,MAAM,OAAO,CAAC;AAC9H,UAAM,aAAa,WAAW,aAAa,KAAK,IAAI,CAAA,QAAO,OAAO,MAAM,GAAG,CAAC;AAC5E,UAAM,SAAS,MAAM,WAAW,MAAM,OAAMA,gBAAc;AACzD,YAAM,qBAAqB,IAAI,0BAA0B,UAAU,UAAU;AAE7E,YAAM,cAAc,IAAIC,iBAAwCD,aAAY,KAAK,QAAQ,kBAAkB;AAC3G,aAAO,MAAM,YAAY,QAAQ,aAAW,OAAO,KAAK,OAAO,GAAG;AAAA,QACjE,gBAAgB,aAAa;AAAA,UAC5B,gBAAgB,KAAK,kBAAkB,aAAa,iBAAiB,KAAK,kBAAkB,UAAU,IAAI;AAAA,UAC1G,eAAe,KAAK,kBAAkB,kBACjC,KAAK,kBAAkB,YAAY,iBAAiB,KAAK,kBAAkB,SAAS,IAAI;AAAA,UAC7F,WAAW,KAAK,kBAAkB;AAAA,UAClC,sBAAsB,KAAK,kBAAkB,eAAe,MAAM,KAAK,UAAU,OAAO,KAAK,kBAAkB,YAAY,IAAI;AAAA,QAAA;AAAA,QAEhI,WAAW,KAAK;AAAA,MAAA,CAChB;AAAA,IACF,CAAC;AACD,UAAM,WAAW,IAAA;AACjB,WAAO;AAAA,EACR;AACD;"}

package/dist/production/src/migrations/snapshot.cjs CHANGED Viewed

@@ -202,7 +202,8 @@ CREATE TABLE "identity_provider" (
     "exclusive" boolean DEFAULT false,
     "init_returns_config" boolean DEFAULT false NOT NULL,
     "require_verified_email" boolean DEFAULT false NOT NULL,
-    "assume_email_verified" boolean DEFAULT false NOT NULL
+    "assume_email_verified" boolean DEFAULT false NOT NULL,
+    "disable_local_authentication" boolean DEFAULT false NOT NULL
 );
 CREATE TABLE "idp_session" (
     "id" "uuid" NOT NULL,

package/dist/production/src/migrations/snapshot.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"snapshot.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout',\n 'idp_role_mapped',\n 'idp_role_mapping_failed',\n 'person_enable'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n \"panel_global_roles\" \"text\"[] DEFAULT '{super_admin,project_admin}'::\"text\"[] NOT NULL,\n \"panel_project_roles\" \"text\"[] DEFAULT '{admin}'::\"text\"[] NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":["createCredentials"],"mappings":";;AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAocZ;AAEA,QAAMA,kBAAAA,kBAAkB,SAAS,IAAI;AACtC;;"}
1	+ {"version":3,"file":"snapshot.cjs","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout',\n 'idp_role_mapped',\n 'idp_role_mapping_failed',\n 'person_enable'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n \"panel_global_roles\" \"text\"[] DEFAULT '{super_admin,project_admin}'::\"text\"[] NOT NULL,\n \"panel_project_roles\" \"text\"[] DEFAULT '{admin}'::\"text\"[] NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL,\n \"disable_local_authentication\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":["createCredentials"],"mappings":";;AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAqcZ;AAEA,QAAMA,kBAAAA,kBAAkB,SAAS,IAAI;AACtC;;"}

package/dist/production/src/migrations/snapshot.js CHANGED Viewed

@@ -201,7 +201,8 @@ CREATE TABLE "identity_provider" (
     "exclusive" boolean DEFAULT false,
     "init_returns_config" boolean DEFAULT false NOT NULL,
     "require_verified_email" boolean DEFAULT false NOT NULL,
-    "assume_email_verified" boolean DEFAULT false NOT NULL
+    "assume_email_verified" boolean DEFAULT false NOT NULL,
+    "disable_local_authentication" boolean DEFAULT false NOT NULL
 );
 CREATE TABLE "idp_session" (
     "id" "uuid" NOT NULL,

package/dist/production/src/migrations/snapshot.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout',\n 'idp_role_mapped',\n 'idp_role_mapping_failed',\n 'person_enable'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n \"panel_global_roles\" \"text\"[] DEFAULT '{super_admin,project_admin}'::\"text\"[] NOT NULL,\n \"panel_project_roles\" \"text\"[] DEFAULT '{admin}'::\"text\"[] NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAocZ;AAEA,QAAM,kBAAkB,SAAS,IAAI;AACtC;"}
1	+ {"version":3,"file":"snapshot.js","sources":["../../../../../packages/engine-tenant-api/src/migrations/snapshot.ts"],"sourcesContent":["import { MigrationBuilder } from '@contember/database-migrations'\nimport { TenantMigrationArgs } from './types.js'\nimport { createCredentials } from './tenantCredentials.js'\n\nexport default async function(builder: MigrationBuilder, args: TenantMigrationArgs) {\n\tbuilder.sql(`\nCREATE TYPE \"auth_log_type\" AS ENUM (\n 'login',\n 'create_session_token',\n 'idp_login',\n 'password_reset_init',\n 'password_reset',\n 'password_change',\n 'email_change',\n '2fa_disable',\n '2fa_enable',\n 'passwordless_login_init',\n 'passwordless_login_exchange',\n 'passwordless_login',\n 'person_disable',\n 'session_revoked_by_user',\n 'forced_sign_out',\n 'global_role_grant',\n 'global_role_revoke',\n 'project_membership_create',\n 'project_membership_update',\n 'project_membership_remove',\n 'api_key_create',\n 'api_key_disable',\n 'idp_create',\n 'idp_update',\n 'idp_disable',\n 'idp_enable',\n 'project_create',\n 'project_update',\n 'project_secret_change',\n 'mail_template_change',\n 'tenant_config_change',\n 'person_invite',\n 'backup_code_generated',\n 'backup_code_used',\n 'backup_code_regenerated',\n 'email_otp_sent',\n 'mfa_enrollment_required',\n 'mfa_reset',\n 'session_expired_idle',\n 'session_policy_applied',\n 'auth_policy_change',\n 'email_verify_init',\n 'email_verify_complete',\n 'email_change_init',\n 'email_change_complete',\n 'idp_session_revalidated',\n 'idp_session_revoked',\n 'idp_session_revalidation_failed',\n 'unusual_login_detected',\n 'step_up_required',\n 'idp_logout_initiated',\n 'idp_backchannel_logout',\n 'idp_role_mapped',\n 'idp_role_mapping_failed',\n 'person_enable'\n);\nCREATE TYPE \"config_policy\" AS ENUM (\n 'always',\n 'never',\n 'optIn',\n 'optOut'\n);\nCREATE TYPE \"config_singleton\" AS ENUM (\n 'singleton'\n);\nCREATE TYPE \"person_token_type\" AS ENUM (\n 'password_reset',\n 'passwordless',\n 'mfa_email_otp',\n 'email_verification',\n 'email_change'\n);\nCREATE FUNCTION \"project_deleted\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tPERFORM pg_notify('project_updated', old.id::text);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_secret_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tUPDATE project SET updated_at = 'now' WHERE id = COALESCE(new.project_id, old.project_id);\n\tPERFORM pg_notify('project_updated', COALESCE(new.project_id, old.project_id)::TEXT);\n\tRETURN NULL;\nEND;\n$$;\nCREATE FUNCTION \"project_updated\"() RETURNS \"trigger\"\n LANGUAGE \"plpgsql\"\n AS $$\nBEGIN\n\tNEW.updated_at = 'now';\n\tPERFORM pg_notify('project_updated', new.id::text);\n\tRETURN new;\nEND;\n$$;\nCREATE TABLE \"api_key\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone NOT NULL,\n \"expiration\" integer,\n \"disabled_at\" timestamp with time zone,\n \"last_ip\" \"inet\",\n \"last_user_agent\" \"text\",\n \"last_used_at\" timestamp with time zone,\n \"created_ip\" \"inet\",\n \"created_user_agent\" \"text\",\n \"trust_forwarded_info\" boolean DEFAULT false NOT NULL,\n \"issued_at\" timestamp with time zone,\n \"idle_timeout\" interval,\n \"max_expires_at\" timestamp with time zone\n);\nCREATE TABLE \"auth_policy\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"project_id\" \"uuid\",\n \"roles\" \"text\"[] NOT NULL,\n \"mfa_required\" boolean,\n \"token_expiration\" interval,\n \"idle_timeout\" interval,\n \"remember_me_allowed\" boolean,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"grace_duration\" interval\n);\nCREATE TABLE \"config\" (\n \"id\" \"config_singleton\" DEFAULT 'singleton'::\"config_singleton\" NOT NULL,\n \"passwordless_enabled\" \"config_policy\" DEFAULT 'never'::\"config_policy\" NOT NULL,\n \"passwordless_url\" \"text\",\n \"passwordless_expiration\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"password_min_length\" integer DEFAULT 8 NOT NULL,\n \"password_require_uppercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_lowercase\" integer DEFAULT 1 NOT NULL,\n \"password_require_digit\" integer DEFAULT 1 NOT NULL,\n \"password_require_special\" integer DEFAULT 0 NOT NULL,\n \"password_pattern\" \"text\",\n \"password_check_blacklist\" boolean DEFAULT true NOT NULL,\n \"login_base_backoff\" interval DEFAULT '00:00:01'::interval NOT NULL,\n \"login_max_backoff\" interval DEFAULT '00:01:00'::interval NOT NULL,\n \"login_attempt_window\" interval DEFAULT '00:05:00'::interval NOT NULL,\n \"login_reveal_user_exits\" boolean DEFAULT true NOT NULL,\n \"login_default_token_expiration\" interval DEFAULT '00:30:00'::interval NOT NULL,\n \"login_max_token_expiration\" interval DEFAULT '6 mons'::interval,\n \"password_check_hibp\" boolean DEFAULT false NOT NULL,\n \"captcha_provider\" \"text\",\n \"captcha_secret\" \"bytea\",\n \"captcha_secret_version\" integer,\n \"captcha_threshold\" double precision,\n \"rate_limit_sign_up_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_sign_up_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_login_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_login_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_password_reset_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_password_reset_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"rate_limit_passwordless_init_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_passwordless_init_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"login_reveal_login_method\" boolean DEFAULT true NOT NULL,\n \"login_mfa_grace_duration\" interval DEFAULT '00:00:00'::interval NOT NULL,\n \"rate_limit_email_otp_per_person_limit\" integer DEFAULT 10 NOT NULL,\n \"rate_limit_email_otp_per_person_window\" interval DEFAULT '00:10:00'::interval NOT NULL,\n \"signup_require_email_verification\" boolean DEFAULT false NOT NULL,\n \"require_email_change_verification\" boolean DEFAULT false NOT NULL,\n \"rate_limit_email_verification_per_ip_limit\" integer DEFAULT 0 NOT NULL,\n \"rate_limit_email_verification_per_ip_window\" interval DEFAULT '01:00:00'::interval NOT NULL,\n \"captcha_protect_sign_up\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_password_reset\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_passwordless_init\" boolean DEFAULT true NOT NULL,\n \"captcha_protect_email_verification\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_detection_enabled\" boolean DEFAULT false NOT NULL,\n \"login_anomaly_history_size\" integer DEFAULT 10 NOT NULL,\n \"login_anomaly_email_threshold\" integer DEFAULT 1 NOT NULL,\n \"login_anomaly_step_up_threshold\" integer DEFAULT 3 NOT NULL,\n \"panel_global_roles\" \"text\"[] DEFAULT '{super_admin,project_admin}'::\"text\"[] NOT NULL,\n \"panel_project_roles\" \"text\"[] DEFAULT '{admin}'::\"text\"[] NOT NULL,\n CONSTRAINT \"config_captcha_complete\" CHECK (((\"captcha_provider\" IS NULL) OR ((\"captcha_secret\" IS NOT NULL) AND (\"captcha_secret_version\" IS NOT NULL)))),\n CONSTRAINT \"config_captcha_provider_check\" CHECK (((\"captcha_provider\" IS NULL) OR (\"captcha_provider\" = ANY (ARRAY['turnstile'::\"text\", 'hcaptcha'::\"text\", 'recaptchaV3'::\"text\"]))))\n);\nCREATE TABLE \"identity\" (\n \"id\" \"uuid\" NOT NULL,\n \"parent_id\" \"uuid\",\n \"roles\" \"jsonb\" NOT NULL,\n \"description\" \"text\",\n \"created_at\" timestamp with time zone NOT NULL\n);\nCREATE TABLE \"identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"type\" \"text\" NOT NULL,\n \"configuration\" \"jsonb\" NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"auto_sign_up\" boolean DEFAULT false NOT NULL,\n \"exclusive\" boolean DEFAULT false,\n \"init_returns_config\" boolean DEFAULT false NOT NULL,\n \"require_verified_email\" boolean DEFAULT false NOT NULL,\n \"assume_email_verified\" boolean DEFAULT false NOT NULL,\n \"disable_local_authentication\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"idp_session\" (\n \"id\" \"uuid\" NOT NULL,\n \"api_key_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"idp_session_id\" \"text\",\n \"tokens\" \"bytea\",\n \"tokens_version\" integer,\n \"idp_expires_at\" timestamp with time zone,\n \"token_obtained_at\" timestamp with time zone,\n \"last_validated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"mail_template\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\",\n \"mail_type\" \"text\" NOT NULL,\n \"variant\" \"text\" NOT NULL,\n \"subject\" \"text\" NOT NULL,\n \"content\" \"text\" NOT NULL,\n \"use_layout\" boolean NOT NULL,\n \"reply_to\" \"text\"\n);\nCREATE TABLE \"person\" (\n \"id\" \"uuid\" NOT NULL,\n \"email\" \"text\",\n \"password_hash\" \"text\",\n \"identity_id\" \"uuid\" NOT NULL,\n \"name\" \"text\",\n \"idp_only\" boolean DEFAULT false NOT NULL,\n \"disabled_at\" timestamp with time zone,\n \"passwordless_enabled\" boolean,\n \"mfa_grace_until\" timestamp with time zone,\n \"email_verified_at\" timestamp with time zone,\n \"email_verification_required\" boolean DEFAULT false NOT NULL,\n CONSTRAINT \"idp_only_no_email\" CHECK (((\"idp_only\" = false) OR ((\"idp_only\" = true) AND (\"email\" IS NULL))))\n);\nCREATE TABLE \"person_auth_log\" (\n \"id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"invoked_by_id\" \"uuid\",\n \"person_id\" \"uuid\",\n \"person_token_id\" \"uuid\",\n \"person_input_identifier\" \"text\",\n \"type\" \"auth_log_type\" NOT NULL,\n \"success\" boolean NOT NULL,\n \"error_code\" \"text\",\n \"error_message\" \"text\",\n \"ip_address\" \"inet\",\n \"user_agent\" \"text\",\n \"identity_provider_id\" \"uuid\",\n \"metadata\" \"jsonb\",\n \"target_person_id\" \"uuid\",\n \"event_data\" \"jsonb\",\n \"geo_country\" \"text\",\n \"device_fingerprint\" \"text\"\n);\nCREATE TABLE \"person_backup_code\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"code_hash\" \"text\" NOT NULL,\n \"used_at\" timestamp with time zone,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"person_identity_provider\" (\n \"id\" \"uuid\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"identity_provider_id\" \"uuid\" NOT NULL,\n \"created_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL,\n \"external_identifier\" \"text\" NOT NULL\n);\nCREATE TABLE \"person_mfa\" (\n \"person_id\" \"uuid\" NOT NULL,\n \"totp_secret\" \"bytea\",\n \"totp_secret_version\" integer,\n \"totp_activated_at\" timestamp with time zone,\n \"totp_pending_secret\" \"bytea\",\n \"totp_pending_version\" integer,\n \"totp_pending_created_at\" timestamp with time zone,\n \"email_otp_enabled\" boolean DEFAULT false NOT NULL\n);\nCREATE TABLE \"person_token\" (\n \"id\" \"uuid\" NOT NULL,\n \"token_hash\" \"text\" NOT NULL,\n \"person_id\" \"uuid\" NOT NULL,\n \"expires_at\" timestamp with time zone NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"used_at\" timestamp with time zone,\n \"type\" \"person_token_type\" DEFAULT 'password_reset'::\"person_token_type\" NOT NULL,\n \"otp_hash\" \"text\",\n \"otp_attempts\" integer DEFAULT 0 NOT NULL,\n \"meta\" \"jsonb\"\n);\nCREATE TABLE \"project\" (\n \"id\" \"uuid\" NOT NULL,\n \"name\" \"text\" NOT NULL,\n \"slug\" \"text\" NOT NULL,\n \"config\" \"jsonb\" DEFAULT '{}'::\"jsonb\" NOT NULL,\n \"updated_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nCREATE TABLE \"project_membership\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"identity_id\" \"uuid\" NOT NULL,\n \"role\" \"text\" NOT NULL\n);\nCREATE TABLE \"project_membership_variable\" (\n \"id\" \"uuid\" NOT NULL,\n \"membership_id\" \"uuid\" NOT NULL,\n \"variable\" \"text\" NOT NULL,\n \"value\" \"jsonb\" NOT NULL\n);\nCREATE TABLE \"project_secret\" (\n \"id\" \"uuid\" NOT NULL,\n \"project_id\" \"uuid\" NOT NULL,\n \"key\" \"text\" NOT NULL,\n \"created_at\" timestamp with time zone NOT NULL,\n \"updated_at\" timestamp with time zone NOT NULL,\n \"value\" \"bytea\" NOT NULL,\n \"version\" smallint NOT NULL\n);\nCREATE TABLE \"rate_limit_event\" (\n \"id\" \"uuid\" NOT NULL,\n \"scope\" \"text\" NOT NULL,\n \"key_hash\" \"bytea\" NOT NULL,\n \"occurred_at\" timestamp with time zone DEFAULT \"now\"() NOT NULL\n);\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"config\"\n ADD CONSTRAINT \"config_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"email_unique\" UNIQUE (\"email\");\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"identity_provider\"\n ADD CONSTRAINT \"identity_provider_slug_key\" UNIQUE (\"slug\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_key\" UNIQUE (\"identity_id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_pkey\" PRIMARY KEY (\"person_id\");\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project\"\n ADD CONSTRAINT \"project_id\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_unique\" UNIQUE (\"membership_id\", \"variable\");\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_pkey\" PRIMARY KEY (\"id\");\nALTER TABLE ONLY \"rate_limit_event\"\n ADD CONSTRAINT \"rate_limit_event_pkey\" PRIMARY KEY (\"id\");\nCREATE INDEX \"api_key_identity_id\" ON \"api_key\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"api_key_token_hash\" ON \"api_key\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"auth_policy_project_id_idx\" ON \"auth_policy\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"identity_parent_id\" ON \"identity\" USING \"btree\" (\"parent_id\");\nCREATE UNIQUE INDEX \"idp_session_api_key_id\" ON \"idp_session\" USING \"btree\" (\"api_key_id\");\nCREATE INDEX \"idp_session_sid\" ON \"idp_session\" USING \"btree\" (\"identity_provider_id\", \"idp_session_id\");\nCREATE UNIQUE INDEX \"mail_template_identifier\" ON \"mail_template\" USING \"btree\" (\"project_id\", \"mail_type\", \"variant\") WHERE (\"project_id\" IS NOT NULL);\nCREATE UNIQUE INDEX \"mail_template_identifier_global\" ON \"mail_template\" USING \"btree\" (\"mail_type\", \"variant\") WHERE (\"project_id\" IS NULL);\nCREATE INDEX \"mail_template_project_index\" ON \"mail_template\" USING \"btree\" (\"project_id\");\nCREATE INDEX \"person_auth_log_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_auth_log_person_input_identifier_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"person_input_identifier\", \"created_at\" DESC) WHERE ((\"type\" = 'login'::\"auth_log_type\") AND (\"success\" = false));\nCREATE INDEX \"person_auth_log_target_person_id_created_at_idx\" ON \"person_auth_log\" USING \"btree\" (\"target_person_id\", \"created_at\" DESC);\nCREATE INDEX \"person_backup_code_person_id_idx\" ON \"person_backup_code\" USING \"btree\" (\"person_id\");\nCREATE INDEX \"person_identity_id\" ON \"person\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"person_identity_provider_identifier\" ON \"person_identity_provider\" USING \"btree\" (\"identity_provider_id\", \"external_identifier\");\nCREATE INDEX \"person_identity_provider_person_id\" ON \"person_identity_provider\" USING \"btree\" (\"person_id\");\nCREATE UNIQUE INDEX \"person_password_reset_token\" ON \"person_token\" USING \"btree\" (\"token_hash\");\nCREATE INDEX \"project_alias\" ON \"project\" USING \"gin\" (((\"config\" -> 'alias'::\"text\")));\nCREATE INDEX \"project_membership_identity_index\" ON \"project_membership\" USING \"btree\" (\"identity_id\");\nCREATE UNIQUE INDEX \"project_membership_unique\" ON \"project_membership\" USING \"btree\" (\"project_id\", \"identity_id\", \"role\");\nCREATE INDEX \"project_secret_project_index\" ON \"project_secret\" USING \"btree\" (\"project_id\");\nCREATE UNIQUE INDEX \"project_secret_unique\" ON \"project_secret\" USING \"btree\" (\"project_id\", \"key\");\nCREATE UNIQUE INDEX \"project_slug\" ON \"project\" USING \"btree\" (\"slug\");\nCREATE INDEX \"rate_limit_event_lookup\" ON \"rate_limit_event\" USING \"btree\" (\"scope\", \"key_hash\", \"occurred_at\" DESC);\nCREATE INDEX \"rate_limit_event_occurred_at_brin\" ON \"rate_limit_event\" USING \"brin\" (\"occurred_at\");\nCREATE TRIGGER \"project_deleted\" AFTER DELETE ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_deleted\"();\nCREATE TRIGGER \"project_secret_updated\" AFTER INSERT OR DELETE OR UPDATE ON \"project_secret\" FOR EACH ROW EXECUTE FUNCTION \"project_secret_updated\"();\nCREATE TRIGGER \"project_updated\" BEFORE INSERT OR UPDATE OF \"name\", \"slug\", \"config\" ON \"project\" FOR EACH ROW EXECUTE FUNCTION \"project_updated\"();\nALTER TABLE ONLY \"api_key\"\n ADD CONSTRAINT \"api_key_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"auth_policy\"\n ADD CONSTRAINT \"auth_policy_project_id_fkey\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"identity\"\n ADD CONSTRAINT \"identity_parent_id_fkey\" FOREIGN KEY (\"parent_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_api_key\" FOREIGN KEY (\"api_key_id\") REFERENCES \"api_key\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"idp_session\"\n ADD CONSTRAINT \"idp_session_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"mail_template\"\n ADD CONSTRAINT \"mail_template_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_identity_provider_id_fkey\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_invoked_by_id_fkey\" FOREIGN KEY (\"invoked_by_id\") REFERENCES \"identity\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_person_token_id_fkey\" FOREIGN KEY (\"person_token_id\") REFERENCES \"person_token\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_auth_log\"\n ADD CONSTRAINT \"person_auth_log_target_person_id_fkey\" FOREIGN KEY (\"target_person_id\") REFERENCES \"person\"(\"id\") ON DELETE SET NULL;\nALTER TABLE ONLY \"person_backup_code\"\n ADD CONSTRAINT \"person_backup_code_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person\"\n ADD CONSTRAINT \"person_identity_id_fkey\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\");\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_idp\" FOREIGN KEY (\"identity_provider_id\") REFERENCES \"identity_provider\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_identity_provider\"\n ADD CONSTRAINT \"person_identity_provider_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_mfa\"\n ADD CONSTRAINT \"person_mfa_person_id_fkey\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"person_token\"\n ADD CONSTRAINT \"person_password_reset_person\" FOREIGN KEY (\"person_id\") REFERENCES \"person\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_identity\" FOREIGN KEY (\"identity_id\") REFERENCES \"identity\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership\"\n ADD CONSTRAINT \"project_membership_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_membership_variable\"\n ADD CONSTRAINT \"project_membership_variable_membership\" FOREIGN KEY (\"membership_id\") REFERENCES \"project_membership\"(\"id\") ON DELETE CASCADE;\nALTER TABLE ONLY \"project_secret\"\n ADD CONSTRAINT \"project_secret_project\" FOREIGN KEY (\"project_id\") REFERENCES \"project\"(\"id\") ON DELETE CASCADE;\nINSERT INTO \"config\" (id)\nVALUES (DEFAULT);\n\nDO LANGUAGE plpgsql\n$$\n\tBEGIN\n\t\tEXECUTE FORMAT('ALTER FUNCTION project_secret_updated() SET SEARCH_PATH = %s', QUOTE_IDENT(CURRENT_SCHEMA()));\n\tEND\n$$;\n`)\n\n\tawait createCredentials(builder, args)\n}\n"],"names":[],"mappings":";AAIA,eAAA,SAA8B,SAA2B,MAA2B;AACnF,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAqcZ;AAEA,QAAM,kBAAkB,SAAS,IAAI;AACtC;"}

package/dist/production/src/model/commands/idp/ClaimIdpRevalidationCommand.cjs CHANGED Viewed

@@ -1,18 +1,14 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const Database = require("@contember/database");
 class ClaimIdpRevalidationCommand {
   constructor(id, interval) {
     this.id = id;
     this.interval = interval;
   }
   async execute({ db }) {
-    const result = await db.query(
-      `UPDATE "idp_session"
-			 SET "last_validated_at" = now()
-			 WHERE "id" = ? AND "last_validated_at" <= now() - ?::interval`,
-      [this.id, this.interval]
-    );
-    return (result.rowCount ?? 0) > 0;
+    const qb = Database.UpdateBuilder.create().table("idp_session").where({ id: this.id }).where((expr) => expr.raw('"last_validated_at" <= now() - ?::interval', this.interval)).values({ last_validated_at: (expr) => expr.raw("now()") });
+    return await qb.execute(db) > 0;
   }
 }
 exports.ClaimIdpRevalidationCommand = ClaimIdpRevalidationCommand;

package/dist/production/src/model/commands/idp/ClaimIdpRevalidationCommand.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ClaimIdpRevalidationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\n\n/*\n Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n \n This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst ~~result~~ = ~~await db~~.~~query~~(\n\t\t\t~~`UPDATE \"~~idp_session\"\n\t\t\t ~~SET~~ ~~\"last_validated_at\"~~ ~~= now(~~)\n\t\t\t ~~WHERE~~ \"~~id\" = ? AND \"~~last_validated_at\" <= now() - ?::interval~~`,\~~n\t\t\t~~[this~~.~~id,~~ ~~this~~.~~interval],\n\t\t~~)\n\t\treturn (~~result~~.~~rowCount ?? 0~~) > 0\n\t}\n}\n"],"names":[],"mappings":"~~;;AAWO~~,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,~~SAAS~~,MAAM,~~GAAG;AAAA~~,~~MACvB;AAAA;AAAA;AAAA~~,~~MAGA~~,~~CAAC~~,KAAK,IAAI,KAAK,QAAQ~~;AAAA~~,~~IAAA;AAExB~~,~~YAAQ~~,OAAO,~~YAAY~~,KAAK;AAAA,EACjC;AACD;;"}
1	+ {"version":3,"file":"ClaimIdpRevalidationCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { UpdateBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\n\n/*\n Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n \n This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('idp_session')\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.raw('\"last_validated_at\" <= now() - ?::interval', this.interval))\n\t\t\t.values({ last_validated_at: expr => expr.raw('now()') })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAYO,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,SAAAA,cAAc,OAAA,EACvB,MAAM,aAAa,EACnB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,IAAI,8CAA8C,KAAK,QAAQ,CAAC,EACnF,OAAO,EAAE,mBAAmB,CAAA,SAAQ,KAAK,IAAI,OAAO,GAAG;AAEzD,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;;"}

package/dist/production/src/model/commands/idp/ClaimIdpRevalidationCommand.js CHANGED Viewed

@@ -1,16 +1,12 @@
+import { UpdateBuilder as UpdateBuilder$1 } from "@contember/database";
 class ClaimIdpRevalidationCommand {
   constructor(id, interval) {
     this.id = id;
     this.interval = interval;
   }
   async execute({ db }) {
-    const result = await db.query(
-      `UPDATE "idp_session"
-			 SET "last_validated_at" = now()
-			 WHERE "id" = ? AND "last_validated_at" <= now() - ?::interval`,
-      [this.id, this.interval]
-    );
-    return (result.rowCount ?? 0) > 0;
+    const qb = UpdateBuilder$1.create().table("idp_session").where({ id: this.id }).where((expr) => expr.raw('"last_validated_at" <= now() - ?::interval', this.interval)).values({ last_validated_at: (expr) => expr.raw("now()") });
+    return await qb.execute(db) > 0;
   }
 }
 export {

package/dist/production/src/model/commands/idp/ClaimIdpRevalidationCommand.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ClaimIdpRevalidationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\n\n/*\n Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n \n This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst ~~result~~ = ~~await db~~.~~query~~(\n\t\t\t~~`UPDATE \"~~idp_session\"\n\t\t\t ~~SET~~ ~~\"last_validated_at\"~~ ~~= now(~~)\n\t\t\t ~~WHERE~~ \"~~id\" = ? AND \"~~last_validated_at\" <= now() - ?::interval~~`,\~~n\t\t\t~~[this~~.~~id,~~ ~~this~~.~~interval],\n\t\t~~)\n\t\treturn (~~result~~.~~rowCount ?? 0~~) > 0\n\t}\n}\n"],"names":[],"mappings":"~~AAWO~~,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,~~SAAS~~,MAAM,~~GAAG;AAAA~~,~~MACvB;AAAA;AAAA;AAAA~~,~~MAGA~~,~~CAAC~~,KAAK,IAAI,KAAK,QAAQ~~;AAAA~~,~~IAAA;AAExB~~,~~YAAQ~~,OAAO,~~YAAY~~,KAAK;AAAA,EACjC;AACD;"}
1	+ {"version":3,"file":"ClaimIdpRevalidationCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/ClaimIdpRevalidationCommand.ts"],"sourcesContent":["import { UpdateBuilder } from '@contember/database'\nimport { Command } from '../Command.js'\n\n/*\n Atomically claim the right to re-validate a federated session: bump `last_validated_at`\n * to now() iff the throttle window has elapsed. Returns true only to the single request\n * that wins the claim, false to everyone else (still inside the window, or lost the race).\n \n This is both the throttle and the single-flight guard — critical for `method: 'refresh'`,\n * where two concurrent revalidations would rotate the refresh token and invalidate each\n * other. The interval is bound as a parameter and cast to `interval`, so it is injection-safe.\n */\nexport class ClaimIdpRevalidationCommand implements Command<boolean> {\n\tconstructor(\n\t\tprivate readonly id: string,\n\t\tprivate readonly interval: string,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<boolean> {\n\t\tconst qb = UpdateBuilder.create()\n\t\t\t.table('idp_session')\n\t\t\t.where({ id: this.id })\n\t\t\t.where(expr => expr.raw('\"last_validated_at\" <= now() - ?::interval', this.interval))\n\t\t\t.values({ last_validated_at: expr => expr.raw('now()') })\n\n\t\treturn (await qb.execute(db)) > 0\n\t}\n}\n"],"names":["UpdateBuilder"],"mappings":";AAYO,MAAM,4BAAwD;AAAA,EACpE,YACkB,IACA,UAChB;AAFgB,SAAA,KAAA;AACA,SAAA,WAAA;AAAA,EAElB;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAsC;AACrD,UAAM,KAAKA,gBAAc,OAAA,EACvB,MAAM,aAAa,EACnB,MAAM,EAAE,IAAI,KAAK,GAAA,CAAI,EACrB,MAAM,CAAA,SAAQ,KAAK,IAAI,8CAA8C,KAAK,QAAQ,CAAC,EACnF,OAAO,EAAE,mBAAmB,CAAA,SAAQ,KAAK,IAAI,OAAO,GAAG;AAEzD,WAAQ,MAAM,GAAG,QAAQ,EAAE,IAAK;AAAA,EACjC;AACD;"}

package/dist/production/src/model/commands/idp/CreateIdpCommand.cjs CHANGED Viewed

@@ -6,7 +6,12 @@ class CreateIdpCommand {
     this.data = data;
   }
   async execute({ db, providers }) {
-    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data;
+    const {
+      configuration,
+      options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
+      slug,
+      type
+    } = this.data;
     await Database.InsertBuilder.create().into("identity_provider").values({
       id: providers.uuid(),
       configuration,
@@ -16,7 +21,8 @@ class CreateIdpCommand {
       exclusive,
       init_returns_config: initReturnsConfig,
       require_verified_email: requireVerifiedEmail,
-      assume_email_verified: assumeEmailVerified
+      assume_email_verified: assumeEmailVerified,
+      disable_local_authentication: disableLocalAuthentication
     }).execute(db);
   }
 }

package/dist/production/src/model/commands/idp/CreateIdpCommand.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"CreateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst { ~~configuration, options~~: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, ~~slug,~~ ~~type~~ } = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,~~EAAE~~,~~eAAe~~,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,~~oBAAA~~,~~GAAuB~~,~~MAAM~~,~~KAAA~~,~~IAAS~~,KAAK;~~AAC7I~~,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,IAAA,~~CACvB~~,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
1	+ {"version":3,"file":"CreateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst {\n\t\t\tconfiguration,\n\t\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },\n\t\t\tslug,\n\t\t\ttype,\n\t\t} = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t\tdisable_local_authentication: disableLocalAuthentication,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM;AAAA,MACL;AAAA,MACA,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,2BAAA;AAAA,MAChG;AAAA,MACA;AAAA,IAAA,IACG,KAAK;AACT,UAAMA,SAAAA,cAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,MACvB,8BAA8B;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}

package/dist/production/src/model/commands/idp/CreateIdpCommand.js CHANGED Viewed

@@ -4,7 +4,12 @@ class CreateIdpCommand {
     this.data = data;
   }
   async execute({ db, providers }) {
-    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, slug, type } = this.data;
+    const {
+      configuration,
+      options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },
+      slug,
+      type
+    } = this.data;
     await InsertBuilder$1.create().into("identity_provider").values({
       id: providers.uuid(),
       configuration,
@@ -14,7 +19,8 @@ class CreateIdpCommand {
       exclusive,
       init_returns_config: initReturnsConfig,
       require_verified_email: requireVerifiedEmail,
-      assume_email_verified: assumeEmailVerified
+      assume_email_verified: assumeEmailVerified,
+      disable_local_authentication: disableLocalAuthentication
     }).execute(db);
   }
 }

package/dist/production/src/model/commands/idp/CreateIdpCommand.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"CreateIdpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst { ~~configuration, options~~: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified }, ~~slug,~~ ~~type~~ } = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM,~~EAAE~~,~~eAAe~~,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,~~oBAAA~~,~~GAAuB~~,~~MAAM~~,~~KAAA~~,~~IAAS~~,KAAK;~~AAC7I~~,UAAMA,gBAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,IAAA,~~CACvB~~,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}
1	+ {"version":3,"file":"CreateIdpCommand.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/CreateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { InsertBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class CreateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate data: IdentityProviderData,\n\t) {\n\t}\n\n\tasync execute({ db, providers }: Command.Args): Promise<void> {\n\t\tconst {\n\t\t\tconfiguration,\n\t\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication },\n\t\t\tslug,\n\t\t\ttype,\n\t\t} = this.data\n\t\tawait InsertBuilder.create()\n\t\t\t.into('identity_provider')\n\t\t\t.values({\n\t\t\t\tid: providers.uuid(),\n\t\t\t\tconfiguration,\n\t\t\t\tslug,\n\t\t\t\ttype,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t\tdisable_local_authentication: disableLocalAuthentication,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n"],"names":["InsertBuilder"],"mappings":";AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,MACP;AADO,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,IAAI,aAA0C;AAC7D,UAAM;AAAA,MACL;AAAA,MACA,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,2BAAA;AAAA,MAChG;AAAA,MACA;AAAA,IAAA,IACG,KAAK;AACT,UAAMA,gBAAc,OAAA,EAClB,KAAK,mBAAmB,EACxB,OAAO;AAAA,MACP,IAAI,UAAU,KAAA;AAAA,MACd;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,MACvB,8BAA8B;AAAA,IAAA,CAC9B,EACA,QAAQ,EAAE;AAAA,EACb;AACD;"}

package/dist/production/src/model/commands/idp/UpdateIdpCommand.cjs CHANGED Viewed

@@ -7,14 +7,18 @@ class UpdateIdpCommand {
     this.data = data;
   }
   async execute({ db }) {
-    const { configuration, options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified } = {} } = this.data;
+    const {
+      configuration,
+      options: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication } = {}
+    } = this.data;
     await Database.UpdateBuilder.create().table("identity_provider").values({
       configuration,
       auto_sign_up: autoSignUp,
       exclusive,
       init_returns_config: initReturnsConfig,
       require_verified_email: requireVerifiedEmail,
-      assume_email_verified: assumeEmailVerified
+      assume_email_verified: assumeEmailVerified,
+      disable_local_authentication: disableLocalAuthentication
     }).where({
       id: this.id
     }).execute(db);

package/dist/production/src/model/commands/idp/UpdateIdpCommand.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UpdateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/UpdateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class UpdateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate id: string,\n\t\tprivate data: UpdateIdpData,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst { ~~configuration, options~~: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified } = {} } = this.data\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('identity_provider')\n\t\t\t.values({\n\t\t\t\tconfiguration,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nexport type UpdateIdpData = {\n\toptions?: Partial<IdentityProviderData['options']>\n\tconfiguration?: IdentityProviderData['configuration']\n\ttype?: string\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,IACA,MACP;AAFO,SAAA,KAAA;AACA,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM,~~EAAE~~,~~eAAe~~,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,~~oBAAA~~,~~IAAwB~~,~~GAAC~~,~~IAAM~~,KAAK;~~AACtI~~,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM,mBAAmB,EACzB,OAAO;AAAA,MACP;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,IAAA,~~CACvB~~,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}
1	+ {"version":3,"file":"UpdateIdpCommand.cjs","sources":["../../../../../../../packages/engine-tenant-api/src/model/commands/idp/UpdateIdpCommand.ts"],"sourcesContent":["import { Command } from '../Command.js'\nimport { UpdateBuilder } from '@contember/database'\nimport { IdentityProviderData } from '../../type/index.js'\n\nexport class UpdateIdpCommand implements Command<void> {\n\tconstructor(\n\t\tprivate id: string,\n\t\tprivate data: UpdateIdpData,\n\t) {\n\t}\n\n\tasync execute({ db }: Command.Args): Promise<void> {\n\t\tconst {\n\t\t\tconfiguration,\n\t\t\toptions: { autoSignUp, exclusive, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication } = {},\n\t\t} = this.data\n\t\tawait UpdateBuilder.create()\n\t\t\t.table('identity_provider')\n\t\t\t.values({\n\t\t\t\tconfiguration,\n\t\t\t\tauto_sign_up: autoSignUp,\n\t\t\t\texclusive,\n\t\t\t\tinit_returns_config: initReturnsConfig,\n\t\t\t\trequire_verified_email: requireVerifiedEmail,\n\t\t\t\tassume_email_verified: assumeEmailVerified,\n\t\t\t\tdisable_local_authentication: disableLocalAuthentication,\n\t\t\t})\n\t\t\t.where({\n\t\t\t\tid: this.id,\n\t\t\t})\n\t\t\t.execute(db)\n\t}\n}\n\nexport type UpdateIdpData = {\n\toptions?: Partial<IdentityProviderData['options']>\n\tconfiguration?: IdentityProviderData['configuration']\n\ttype?: string\n}\n"],"names":["UpdateBuilder"],"mappings":";;;AAIO,MAAM,iBAA0C;AAAA,EACtD,YACS,IACA,MACP;AAFO,SAAA,KAAA;AACA,SAAA,OAAA;AAAA,EAET;AAAA,EAEA,MAAM,QAAQ,EAAE,MAAmC;AAClD,UAAM;AAAA,MACL;AAAA,MACA,SAAS,EAAE,YAAY,WAAW,mBAAmB,sBAAsB,qBAAqB,+BAA+B,CAAA;AAAA,IAAC,IAC7H,KAAK;AACT,UAAMA,SAAAA,cAAc,OAAA,EAClB,MAAM,mBAAmB,EACzB,OAAO;AAAA,MACP;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,MACxB,uBAAuB;AAAA,MACvB,8BAA8B;AAAA,IAAA,CAC9B,EACA,MAAM;AAAA,MACN,IAAI,KAAK;AAAA,IAAA,CACT,EACA,QAAQ,EAAE;AAAA,EACb;AACD;;"}