@contember/engine-tenant-api 2.2.0-alpha.7 → 2.2.0-alpha.8

package/dist/development/src/model/service/idp/IdpSessionRevalidator.js

@@ -9,9 +9,10 @@ import { CreateAuthLogEntryCommand } from "../../commands/authLog/CreateAuthLogE
 import { REVALIDATION_DEFAULT_SOFT_THRESHOLD, REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL } from "./IDPRevalidation.js";
 import { parseClaimMapping } from "./ClaimMapping.js";
 class IdpSessionRevalidator {
-  constructor(idpRegistry, claimSyncService) {
+  constructor(idpRegistry, claimSyncService, logger) {
     this.idpRegistry = idpRegistry;
     this.claimSyncService = claimSyncService;
+    this.logger = logger;
   }
   async revalidate(dbContext, readDbContext, apiKeyRow, requestInfo) {
     const row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers));
@@ -37,7 +38,8 @@ class IdpSessionRevalidator {
     let claimed;
     try {
       claimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval));
-    } catch {
+    } catch (e) {
+      this.logger.warn(e, { message: "IdP session revalidation: claim failed", idpSessionId: row.id });
       return "valid";
     }
     if (!claimed) {
@@ -47,7 +49,8 @@ class IdpSessionRevalidator {
       return await this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo);
     }
     setImmediate(() => {
-      this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {
+      this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch((e) => {
+        this.logger.error(e, { message: "IdP session revalidation: background run failed", idpSessionId: row.id });
       });
     });
     return "valid";
@@ -75,14 +78,16 @@ class IdpSessionRevalidator {
     let config;
     try {
       config = handler.validateConfiguration(row.providerConfiguration);
-    } catch {
+    } catch (e) {
+      this.logger.warn(e, { message: "IdP session revalidation: stored configuration is invalid", idpSessionId: row.id });
       await this.logRevalidationFailed(dbContext, apiKeyRow, row, "config_invalid", requestInfo);
       return "valid";
     }
     let result;
     try {
       result = await handler.revalidate(config, row.session);
-    } catch {
+    } catch (e) {
+      this.logger.warn(e, { message: "IdP session revalidation: identity provider call failed", idpSessionId: row.id });
       await this.logRevalidationFailed(dbContext, apiKeyRow, row, "revalidation_error", requestInfo);
       return "valid";
     }
@@ -94,7 +99,8 @@ class IdpSessionRevalidator {
       try {
         await dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession));
         await this.logRevalidated(dbContext, apiKeyRow, row, requestInfo);
-      } catch {
+      } catch (e) {
+        this.logger.error(e, { message: "IdP session revalidation: persisting the rotated session failed", idpSessionId: row.id });
       }
     }
     if (result.claims) {
@@ -125,7 +131,8 @@ class IdpSessionRevalidator {
       if (droppedUnsafeRules) {
         await this.logRoleMapping(dbContext, apiKeyRow, row, "idp_role_mapping_failed", void 0, requestInfo);
       }
-    } catch {
+    } catch (e) {
+      this.logger.warn(e, { message: "IdP session revalidation: claim mapping sync failed", idpSessionId: row.id });
       await this.logRoleMapping(dbContext, apiKeyRow, row, "idp_role_mapping_failed", void 0, requestInfo);
     }
   }
@@ -141,14 +148,14 @@ class IdpSessionRevalidator {
           // (consistent with the project_membership_* audit events).
           targetPersonId: apiKeyRow.person_id ?? void 0,
           identityProviderId: row.identityProviderId,
-          personTokenId: apiKeyRow.id,
           success: true,
           eventData,
           ipAddress: requestInfo?.ip,
           userAgent: requestInfo?.userAgent
         })
       );
-    } catch {
+    } catch (e) {
+      this.logger.error(e, { message: `IdP session revalidation: writing the ${type} audit entry failed`, idpSessionId: row.id });
     }
   }
   async logRevalidated(dbContext, apiKeyRow, row, requestInfo) {
@@ -158,10 +165,10 @@ class IdpSessionRevalidator {
         invokedById: apiKeyRow.identity_id,
         personId: apiKeyRow.person_id ?? void 0,
         identityProviderId: row.identityProviderId,
-        personTokenId: apiKeyRow.id,
         success: true,
         ipAddress: requestInfo?.ip,
-        userAgent: requestInfo?.userAgent
+        userAgent: requestInfo?.userAgent,
+        eventData: { apiKeyId: apiKeyRow.id }
       })
     );
   }
@@ -180,37 +187,41 @@ class IdpSessionRevalidator {
           invokedById: apiKeyRow.identity_id,
           personId: apiKeyRow.person_id ?? void 0,
           identityProviderId: row.identityProviderId,
-          personTokenId: apiKeyRow.id,
           // not a security failure (the session is kept) — a fail-open marker the operator
           // can alert on. `success: true` keeps it out of the failed-login funnels.
           success: true,
           errorCode,
           ipAddress: requestInfo?.ip,
-          userAgent: requestInfo?.userAgent
+          userAgent: requestInfo?.userAgent,
+          eventData: { apiKeyId: apiKeyRow.id }
         })
       );
-    } catch {
+    } catch (e) {
+      this.logger.error(e, { message: "IdP session revalidation: writing the idp_session_revalidation_failed audit entry failed", idpSessionId: row.id });
     }
   }
   async revoke(dbContext, apiKeyRow, row, reason, requestInfo) {
     await dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id));
-    await dbContext.commandBus.execute(
-      new CreateAuthLogEntryCommand({
-        type: "idp_session_revoked",
-        invokedById: apiKeyRow.identity_id,
-        personId: apiKeyRow.person_id ?? void 0,
-        identityProviderId: row.identityProviderId,
-        personTokenId: apiKeyRow.id,
-        success: false,
-        errorCode: reason,
-        ipAddress: requestInfo?.ip,
-        userAgent: requestInfo?.userAgent,
-        // the action payload belongs in `event_data` (where every other audit event puts
-        // it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for
-        // transport context (forwarder IP/UA).
-        eventData: { reason }
-      })
-    );
+    try {
+      await dbContext.commandBus.execute(
+        new CreateAuthLogEntryCommand({
+          type: "idp_session_revoked",
+          invokedById: apiKeyRow.identity_id,
+          personId: apiKeyRow.person_id ?? void 0,
+          identityProviderId: row.identityProviderId,
+          success: false,
+          errorCode: reason,
+          ipAddress: requestInfo?.ip,
+          userAgent: requestInfo?.userAgent,
+          // the action payload belongs in `event_data` (where every other audit event puts
+          // it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for
+          // transport context (forwarder IP/UA).
+          eventData: { reason, apiKeyId: apiKeyRow.id }
+        })
+      );
+    } catch (e) {
+      this.logger.error(e, { message: "IdP session revalidation: writing the idp_session_revoked audit entry failed", idpSessionId: row.id });
+    }
   }
   resolveConfig(configuration) {
     const raw = configuration.revalidation ?? {};

package/dist/development/src/model/service/idp/IdpSessionRevalidator.js.map

@@ -1 +1 @@
-{"version":3,"file":"IdpSessionRevalidator.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdpSessionRevalidator.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from '../../commands/index.js'\nimport { ApiKeyRow } from '../../queries/apiKey/ApiKeyQuery.js'\nimport { IdpSessionByApiKeyQuery, IdpSessionRow } from '../../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { ClaimIdpRevalidationCommand } from '../../commands/idp/ClaimIdpRevalidationCommand.js'\nimport { UpdateIdpSessionCommand } from '../../commands/idp/UpdateIdpSessionCommand.js'\nimport { DisableApiKeyCommand } from '../../commands/index.js'\nimport { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from './IDPRevalidation.js'\nimport { IdentityProviderHandler, RevalidationResult } from './IdentityProviderHandler.js'\nimport { IDPClaimSyncService } from './IDPClaimSyncService.js'\nimport { parseClaimMapping } from './ClaimMapping.js'\nimport { JSONValue } from '@contember/schema'\n\nexport type RevalidationOutcome = 'valid' | 'revoked'\n\ntype ResolvedRevalidationConfig = {\n\tenabled: boolean\n\tsoftThreshold: number\n\tminInterval: string\n\tfallbackInterval: string\n\tmode: 'auto' | 'blocking'\n}\n\n/**\n * Decision for the current request: whether to attempt a revalidation, and if so whether it\n * must block the request. `claimInterval` is the single-flight floor for the atomic claim.\n */\ntype Decision = null | { blocking: boolean; claimInterval: string }\n\n/**\n * Re-validates IdP-backed sessions against their identity provider on the verify hot path\n * (A24). Invoked from `ApiKeyManager.verifyAndProlong`. Operates entirely through the supplied\n * database contexts and the command bus, so it does not depend on `ApiKeyManager` (no DI cycle).\n *\n * The cadence is driven by the **access-token lifetime**, not a fixed interval:\n *   - while the token is fresh (before `softRefreshThreshold` of its lifetime) → skip, free;\n *   - past the threshold but not yet expired → a proactive **background (SWR)** refresh, so the\n *     request keeps zero added latency and the token is renewed before it dies;\n *   - once the token has actually expired → a **blocking** refresh (we can't serve a dead token).\n * `mode: 'blocking'` forces every revalidation synchronous (zero revocation lag). When the IdP\n * returns no token expiry, falls back to a plain `fallbackInterval` background throttle.\n */\nexport class IdpSessionRevalidator {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t\tprivate readonly claimSyncService: IDPClaimSyncService,\n\t) {\n\t}\n\n\tasync revalidate(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tconst row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers))\n\t\tif (!row) {\n\t\t\t// not a federated session (password / IdP without revalidation) — fast no-op\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst config = this.resolveConfig(row.providerConfiguration)\n\t\tif (!config.enabled) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// A disabled IdP no longer vouches for its sessions.\n\t\tif (row.providerDisabledAt) {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, 'idp_disabled', requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(row.providerType)\n\t\tif (!handler?.revalidate) {\n\t\t\t// provider can't actively re-validate (e.g. SAML) — rely on expiry / SLO\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst decision = this.decide(row, config, dbContext.providers.now())\n\t\tif (!decision) {\n\t\t\t// token still fresh — vouched for, no IdP call\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// Atomic claim = single-flight. Loser (within the floor window, or lost the race) serves stale.\n\t\tlet claimed: boolean\n\t\ttry {\n\t\t\tclaimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval))\n\t\t} catch {\n\t\t\t// invalid interval string or transient DB error — fail open, retry next request\n\t\t\treturn 'valid'\n\t\t}\n\t\tif (!claimed) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (decision.blocking) {\n\t\t\treturn await this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo)\n\t\t}\n\n\t\t// SWR: serve this request from the (still valid) token, refresh after the response.\n\t\t// The work runs detached (after the response is sent), so any rejection — a transient\n\t\t// DB error in the revoke / persist writes, a corrupt-config throw — must be swallowed\n\t\t// here; otherwise it becomes an unhandledRejection and can take the worker down. The\n\t\t// session is simply kept and re-tried on a later request (the claim floor throttles).\n\t\tsetImmediate(() => {\n\t\t\tthis.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(() => {})\n\t\t})\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in\n\t * JS (the claim handles intervals in SQL). Returns null to skip.\n\t */\n\tprivate decide(row: IdpSessionRow, config: ResolvedRevalidationConfig, now: Date): Decision {\n\t\tconst expiresAt = row.session.expiresAt\n\t\tconst obtainedAt = row.tokenObtainedAt\n\n\t\t// No lifetime info from the IdP → plain background throttle on fallbackInterval.\n\t\tif (!expiresAt || !obtainedAt) {\n\t\t\treturn { blocking: config.mode === 'blocking', claimInterval: config.fallbackInterval }\n\t\t}\n\n\t\tconst lifetimeMs = expiresAt.getTime() - obtainedAt.getTime()\n\t\tconst softAtMs = obtainedAt.getTime() + lifetimeMs * config.softThreshold\n\t\tconst nowMs = now.getTime()\n\n\t\tif (nowMs < softAtMs) {\n\t\t\treturn null // still within the trusted window\n\t\t}\n\n\t\tconst expired = nowMs >= expiresAt.getTime()\n\t\treturn { blocking: config.mode === 'blocking' || expired, claimInterval: config.minInterval }\n\t}\n\n\tprivate async runRevalidation(\n\t\tdbContext: DatabaseContext,\n\t\thandler: IdentityProviderHandler<{}>,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(row.providerConfiguration)\n\t\t} catch {\n\t\t\t// corrupt stored config — must NOT revoke; keep the session and retry later. Audit\n\t\t\t// it so the operator can tell \"vouched for\" apart from \"silently broken\" (without an\n\t\t\t// entry, a config typo disables re-validation invisibly for the life of every session).\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'config_invalid', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tlet result: RevalidationResult\n\t\ttry {\n\t\t\tresult = await handler.revalidate!(config, row.session)\n\t\t} catch {\n\t\t\t// transient failure (network / IdP down) — must NOT revoke; keep the session and retry\n\t\t\t// on a later request (the claim floor prevents hammering the IdP). Audited (throttled\n\t\t\t// to one entry per claim window) so a prolonged IdP outage is visible rather than a\n\t\t\t// silent fail-open.\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'revalidation_error', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (result.status === 'revoked') {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, result.reason, requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\t// Still valid — persist the rotated token (resets the lifetime reference) / refreshed\n\t\t// expiry. A rotation is a real, low-frequency event (token-lifetime cadence), so we\n\t\t// audit it as `idp_session_revalidated`; the no-op userinfo/introspection probes\n\t\t// (no rotated session) are intentionally NOT logged to keep the audit log usable.\n\t\t//\n\t\t// The IdP has already vouched for the session, so these post-success writes are pure\n\t\t// best-effort bookkeeping (they only reset the SWR cadence reference). A transient DB\n\t\t// error or an `encrypt()` throw here must NOT fail the request — otherwise a blocking\n\t\t// revalidation fails closed on a successful refresh, contradicting \"fail open\" (the SWR\n\t\t// path already swallows this). Keep the existing row; the claim floor throttles a retry.\n\t\tif (result.idpSession) {\n\t\t\ttry {\n\t\t\t\tawait dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession))\n\t\t\t\tawait this.logRevalidated(dbContext, apiKeyRow, row, requestInfo)\n\t\t\t} catch {\n\t\t\t\t// fall through — session stays valid, persist retried on a later request\n\t\t\t}\n\t\t}\n\n\t\t// A09 — re-apply the IdP's claim mapping when the refresh returned fresh claims, so an `always`\n\t\t// mapping keeps an established session's project memberships in sync with the IdP's current claims\n\t\t// without requiring a full re-login. `sticky` mappings self-skip (the sync passes isNewPerson=false).\n\t\t// `claimsComplete` tells the sync whether the refresh rebuilt sign-in's full claim surface, so it can\n\t\t// reconcile (incl. `unmatched: \"remove\"`) exactly like sign-in. Strictly fail-open — see `syncClaims`.\n\t\tif (result.claims) {\n\t\t\tawait this.syncClaims(dbContext, row, apiKeyRow, result.claims, result.claimsComplete === true, requestInfo)\n\t\t}\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Re-apply the claim mapping on a successful refresh. Runs in its own transaction (atomic apply of\n\t * the membership changes) and never throws: the IdP has already vouched for the session, so a\n\t * malformed mapping or a transient apply error must not revoke or fail it. A real membership change\n\t * is audited as `idp_role_mapped`; a failure is audited as `idp_role_mapping_failed` (fail-open\n\t * marker), mirroring the sign-in path. `claimsComplete` carries whether the refresh rebuilt sign-in's\n\t * full claim surface (so removal reconciliation is safe) — see `allowRemoval` below.\n\t */\n\tprivate async syncClaims(\n\t\tdbContext: DatabaseContext,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\tclaims: Record<string, unknown>,\n\t\tclaimsComplete: boolean,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tconst mapping = parseClaimMapping(row.providerConfiguration)\n\t\t\tif (!mapping) {\n\t\t\t\treturn\n\t\t\t}\n\t\t\t// Atomic apply in its own transaction (the verify path has no surrounding one). `always`-only:\n\t\t\t// the sync passes isNewPerson=false, so a `sticky` mapping self-skips and returns a null audit.\n\t\t\t// Refresh mirrors sign-in as closely as the claim surface allows: when the provider returned its\n\t\t\t// COMPLETE surface (`claimsComplete` — `method: \"refresh\"` rebuilding sign-in's id-token + userinfo\n\t\t\t// merge), `unmatched: \"remove\"` reconciliation runs here too. A partial surface (a userinfo-only\n\t\t\t// probe, or a refresh whose userinfo fetch failed) passes `allowRemoval: false`, so refresh stays\n\t\t\t// additive-only and a membership the IdP still asserts is never stripped off an incomplete surface.\n\t\t\tconst { audit, droppedUnsafeRules } = await dbContext.transaction(db =>\n\t\t\t\tthis.claimSyncService.sync(db, mapping, claims, { id: apiKeyRow.identity_id }, false, { allowRemoval: claimsComplete })\n\t\t\t)\n\t\t\tif (audit) {\n\t\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapped', audit, requestInfo)\n\t\t\t}\n\t\t\t// The apply-time safety backstop dropped a configured rule — emit the fail-open marker so a broken\n\t\t\t// mapping is visible on the refresh path too, mirroring sign-in (the marker carries no claim values).\n\t\t\tif (droppedUnsafeRules) {\n\t\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)\n\t\t\t}\n\t\t} catch {\n\t\t\t// Strictly fail-open: a malformed mapping or a transient apply error must never revoke or\n\t\t\t// fail an already-vouched-for session. The transaction rolls back any partial apply.\n\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)\n\t\t}\n\t}\n\n\tprivate async logRoleMapping(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\ttype: 'idp_role_mapped' | 'idp_role_mapping_failed',\n\t\teventData: JSONValue | undefined,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype,\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\t// The membership change affects this session's own person — record it as the target too,\n\t\t\t\t\t// so an admin querying membership changes by target_person_id sees IdP-driven grants/revokes\n\t\t\t\t\t// (consistent with the project_membership_* audit events).\n\t\t\t\t\ttargetPersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\teventData,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort audit — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async logRevalidated(dbContext: DatabaseContext, apiKeyRow: ApiKeyRow, row: IdpSessionRow, requestInfo?: ApiKeyRequestInfo): Promise<void> {\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revalidated',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: true,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is\n\t * corrupt, so we kept the session rather than revoking it. Naturally throttled to one entry\n\t * per claim window (we only reach here after a successful claim, which bumps\n\t * `last_validated_at`). The write is best-effort and self-contained — a failure to audit must\n\t * never propagate and fail a blocking verify request (the whole point of failing open).\n\t */\n\tprivate async logRevalidationFailed(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\terrorCode: 'config_invalid' | 'revalidation_error',\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\t\t// not a security failure (the session is kept) — a fail-open marker the operator\n\t\t\t\t\t// can alert on. `success: true` keeps it out of the failed-login funnels.\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\terrorCode,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch {\n\t\t\t// best-effort observability — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async revoke(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\treason: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revoked',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tpersonTokenId: apiKeyRow.id,\n\t\t\t\tsuccess: false,\n\t\t\t\terrorCode: reason,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t// the action payload belongs in `event_data` (where every other audit event puts\n\t\t\t\t// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for\n\t\t\t\t// transport context (forwarder IP/UA).\n\t\t\t\teventData: { reason },\n\t\t\t}),\n\t\t)\n\t}\n\n\tprivate resolveConfig(configuration: Record<string, unknown>): ResolvedRevalidationConfig {\n\t\tconst raw = (configuration.revalidation ?? {}) as Record<string, unknown>\n\t\tconst threshold = typeof raw.softRefreshThreshold === 'number' && raw.softRefreshThreshold > 0 && raw.softRefreshThreshold <= 1\n\t\t\t? raw.softRefreshThreshold\n\t\t\t: REVALIDATION_DEFAULT_SOFT_THRESHOLD\n\t\treturn {\n\t\t\tenabled: raw.enabled === true,\n\t\t\tsoftThreshold: threshold,\n\t\t\tminInterval: typeof raw.minInterval === 'string' ? raw.minInterval : REVALIDATION_DEFAULT_MIN_INTERVAL,\n\t\t\tfallbackInterval: typeof raw.fallbackInterval === 'string' ? raw.fallbackInterval : REVALIDATION_DEFAULT_FALLBACK_INTERVAL,\n\t\t\tmode: raw.mode === 'blocking' ? 'blocking' : 'auto',\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;AA4CO,MAAM,sBAAsB;AAAA,EAClC,YACkB,aACA,kBAChB;AAFgB,SAAA,cAAA;AACA,SAAA,mBAAA;AAAA,EAElB;AAAA,EAEA,MAAM,WACL,WACA,eACA,WACA,aAC+B;AAC/B,UAAM,MAAM,MAAM,cAAc,aAAa,MAAM,IAAI,wBAAwB,UAAU,IAAI,cAAc,SAAS,CAAC;AACrH,QAAI,CAAC,KAAK;AAET,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,KAAK,cAAc,IAAI,qBAAqB;AAC3D,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO;AAAA,IACR;AAGA,QAAI,IAAI,oBAAoB;AAC3B,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,gBAAgB,WAAW;AACxE,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,IAAI,YAAY;AAClE,QAAI,CAAC,SAAS,YAAY;AAEzB,aAAO;AAAA,IACR;AAEA,UAAM,WAAW,KAAK,OAAO,KAAK,QAAQ,UAAU,UAAU,KAAK;AACnE,QAAI,CAAC,UAAU;AAEd,aAAO;AAAA,IACR;AAGA,QAAI;AACJ,QAAI;AACH,gBAAU,MAAM,UAAU,WAAW,QAAQ,IAAI,4BAA4B,IAAI,IAAI,SAAS,aAAa,CAAC;AAAA,IAC7G,QAAQ;AAEP,aAAO;AAAA,IACR;AACA,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AAEA,QAAI,SAAS,UAAU;AACtB,aAAO,MAAM,KAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW;AAAA,IAClF;AAOA,iBAAa,MAAM;AAClB,WAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrF,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,OAAO,KAAoB,QAAoC,KAAqB;AAC3F,UAAM,YAAY,IAAI,QAAQ;AAC9B,UAAM,aAAa,IAAI;AAGvB,QAAI,CAAC,aAAa,CAAC,YAAY;AAC9B,aAAO,EAAE,UAAU,OAAO,SAAS,YAAY,eAAe,OAAO,iBAAA;AAAA,IACtE;AAEA,UAAM,aAAa,UAAU,QAAA,IAAY,WAAW,QAAA;AACpD,UAAM,WAAW,WAAW,QAAA,IAAY,aAAa,OAAO;AAC5D,UAAM,QAAQ,IAAI,QAAA;AAElB,QAAI,QAAQ,UAAU;AACrB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,SAAS,UAAU,QAAA;AACnC,WAAO,EAAE,UAAU,OAAO,SAAS,cAAc,SAAS,eAAe,OAAO,YAAA;AAAA,EACjF;AAAA,EAEA,MAAc,gBACb,WACA,SACA,KACA,WACA,aAC+B;AAC/B,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,IAAI,qBAAqB;AAAA,IACjE,QAAQ;AAIP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,kBAAkB,WAAW;AACzF,aAAO;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,WAAY,QAAQ,IAAI,OAAO;AAAA,IACvD,QAAQ;AAKP,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,sBAAsB,WAAW;AAC7F,aAAO;AAAA,IACR;AAEA,QAAI,OAAO,WAAW,WAAW;AAChC,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,OAAO,QAAQ,WAAW;AACvE,aAAO;AAAA,IACR;AAYA,QAAI,OAAO,YAAY;AACtB,UAAI;AACH,cAAM,UAAU,WAAW,QAAQ,IAAI,wBAAwB,IAAI,IAAI,OAAO,UAAU,CAAC;AACzF,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,WAAW;AAAA,MACjE,QAAQ;AAAA,MAER;AAAA,IACD;AAOA,QAAI,OAAO,QAAQ;AAClB,YAAM,KAAK,WAAW,WAAW,KAAK,WAAW,OAAO,QAAQ,OAAO,mBAAmB,MAAM,WAAW;AAAA,IAC5G;AACA,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,WACb,WACA,KACA,WACA,QACA,gBACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,kBAAkB,IAAI,qBAAqB;AAC3D,UAAI,CAAC,SAAS;AACb;AAAA,MACD;AAQA,YAAM,EAAE,OAAO,uBAAuB,MAAM,UAAU;AAAA,QAAY,QACjE,KAAK,iBAAiB,KAAK,IAAI,SAAS,QAAQ,EAAE,IAAI,UAAU,eAAe,OAAO,EAAE,cAAc,gBAAgB;AAAA,MAAA;AAEvH,UAAI,OAAO;AACV,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,mBAAmB,OAAO,WAAW;AAAA,MAC3F;AAGA,UAAI,oBAAoB;AACvB,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,2BAA2B,QAAW,WAAW;AAAA,MACvG;AAAA,IACD,QAAQ;AAGP,YAAM,KAAK,eAAe,WAAW,WAAW,KAAK,2BAA2B,QAAW,WAAW;AAAA,IACvG;AAAA,EACD;AAAA,EAEA,MAAc,eACb,WACA,WACA,KACA,MACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAI,0BAA0B;AAAA,UAC7B;AAAA,UACA,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA;AAAA;AAAA;AAAA,UAIjC,gBAAgB,UAAU,aAAa;AAAA,UACvC,oBAAoB,IAAI;AAAA,UACxB,eAAe,UAAU;AAAA,UACzB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,QAAA,CACxB;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AAAA,EAEA,MAAc,eAAe,WAA4B,WAAsB,KAAoB,aAAgD;AAClJ,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAI,0BAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA,MAAA,CACxB;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,sBACb,WACA,WACA,KACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAI,0BAA0B;AAAA,UAC7B,MAAM;AAAA,UACN,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA,UACjC,oBAAoB,IAAI;AAAA,UACxB,eAAe,UAAU;AAAA;AAAA;AAAA,UAGzB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,QAAA,CACxB;AAAA,MAAA;AAAA,IAEH,QAAQ;AAAA,IAER;AAAA,EACD;AAAA,EAEA,MAAc,OACb,WACA,WACA,KACA,QACA,aACgB;AAChB,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,UAAU,EAAE,CAAC;AACzE,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAI,0BAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,eAAe,UAAU;AAAA,QACzB,SAAS;AAAA,QACT,WAAW;AAAA,QACX,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA;AAAA;AAAA;AAAA,QAIxB,WAAW,EAAE,OAAA;AAAA,MAAO,CACpB;AAAA,IAAA;AAAA,EAEH;AAAA,EAEQ,cAAc,eAAoE;AACzF,UAAM,MAAO,cAAc,gBAAgB,CAAA;AAC3C,UAAM,YAAY,OAAO,IAAI,yBAAyB,YAAY,IAAI,uBAAuB,KAAK,IAAI,wBAAwB,IAC3H,IAAI,uBACJ;AACH,WAAO;AAAA,MACN,SAAS,IAAI,YAAY;AAAA,MACzB,eAAe;AAAA,MACf,aAAa,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAc;AAAA,MACrE,kBAAkB,OAAO,IAAI,qBAAqB,WAAW,IAAI,mBAAmB;AAAA,MACpF,MAAM,IAAI,SAAS,aAAa,aAAa;AAAA,IAAA;AAAA,EAE/C;AACD;"}
+{"version":3,"file":"IdpSessionRevalidator.js","sources":["../../../../../../../packages/engine-tenant-api/src/model/service/idp/IdpSessionRevalidator.ts"],"sourcesContent":["import { DatabaseContext } from '../../utils/index.js'\nimport { ApiKeyRequestInfo } from '../../commands/index.js'\nimport { ApiKeyRow } from '../../queries/apiKey/ApiKeyQuery.js'\nimport { IdpSessionByApiKeyQuery, IdpSessionRow } from '../../queries/idp/IdpSessionByApiKeyQuery.js'\nimport { IDPHandlerRegistry } from './IDPHandlerRegistry.js'\nimport { ClaimIdpRevalidationCommand } from '../../commands/idp/ClaimIdpRevalidationCommand.js'\nimport { UpdateIdpSessionCommand } from '../../commands/idp/UpdateIdpSessionCommand.js'\nimport { DisableApiKeyCommand } from '../../commands/index.js'\nimport { CreateAuthLogEntryCommand } from '../../commands/authLog/CreateAuthLogEntryCommand.js'\nimport { REVALIDATION_DEFAULT_FALLBACK_INTERVAL, REVALIDATION_DEFAULT_MIN_INTERVAL, REVALIDATION_DEFAULT_SOFT_THRESHOLD } from './IDPRevalidation.js'\nimport { IdentityProviderHandler, RevalidationResult } from './IdentityProviderHandler.js'\nimport { IDPClaimSyncService } from './IDPClaimSyncService.js'\nimport { Logger } from '@contember/logger'\nimport { parseClaimMapping } from './ClaimMapping.js'\nimport { JSONValue } from '@contember/schema'\n\nexport type RevalidationOutcome = 'valid' | 'revoked'\n\ntype ResolvedRevalidationConfig = {\n\tenabled: boolean\n\tsoftThreshold: number\n\tminInterval: string\n\tfallbackInterval: string\n\tmode: 'auto' | 'blocking'\n}\n\n/**\n * Decision for the current request: whether to attempt a revalidation, and if so whether it\n * must block the request. `claimInterval` is the single-flight floor for the atomic claim.\n */\ntype Decision = null | { blocking: boolean; claimInterval: string }\n\n/**\n * Re-validates IdP-backed sessions against their identity provider on the verify hot path\n * (A24). Invoked from `ApiKeyManager.verifyAndProlong`. Operates entirely through the supplied\n * database contexts and the command bus, so it does not depend on `ApiKeyManager` (no DI cycle).\n *\n * The cadence is driven by the **access-token lifetime**, not a fixed interval:\n *   - while the token is fresh (before `softRefreshThreshold` of its lifetime) → skip, free;\n *   - past the threshold but not yet expired → a proactive **background (SWR)** refresh, so the\n *     request keeps zero added latency and the token is renewed before it dies;\n *   - once the token has actually expired → a **blocking** refresh (we can't serve a dead token).\n * `mode: 'blocking'` forces every revalidation synchronous (zero revocation lag). When the IdP\n * returns no token expiry, falls back to a plain `fallbackInterval` background throttle.\n */\nexport class IdpSessionRevalidator {\n\tconstructor(\n\t\tprivate readonly idpRegistry: IDPHandlerRegistry,\n\t\tprivate readonly claimSyncService: IDPClaimSyncService,\n\t\tprivate readonly logger: Logger,\n\t) {\n\t}\n\n\tasync revalidate(\n\t\tdbContext: DatabaseContext,\n\t\treadDbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tconst row = await readDbContext.queryHandler.fetch(new IdpSessionByApiKeyQuery(apiKeyRow.id, readDbContext.providers))\n\t\tif (!row) {\n\t\t\t// not a federated session (password / IdP without revalidation) — fast no-op\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst config = this.resolveConfig(row.providerConfiguration)\n\t\tif (!config.enabled) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// A disabled IdP no longer vouches for its sessions.\n\t\tif (row.providerDisabledAt) {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, 'idp_disabled', requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\tconst handler = this.idpRegistry.getHandlerOrNull(row.providerType)\n\t\tif (!handler?.revalidate) {\n\t\t\t// provider can't actively re-validate (e.g. SAML) — rely on expiry / SLO\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tconst decision = this.decide(row, config, dbContext.providers.now())\n\t\tif (!decision) {\n\t\t\t// token still fresh — vouched for, no IdP call\n\t\t\treturn 'valid'\n\t\t}\n\n\t\t// Atomic claim = single-flight. Loser (within the floor window, or lost the race) serves stale.\n\t\tlet claimed: boolean\n\t\ttry {\n\t\t\tclaimed = await dbContext.commandBus.execute(new ClaimIdpRevalidationCommand(row.id, decision.claimInterval))\n\t\t} catch (e) {\n\t\t\tthis.logger.warn(e, { message: 'IdP session revalidation: claim failed', idpSessionId: row.id })\n\t\t\t// invalid interval string or transient DB error — fail open, retry next request\n\t\t\treturn 'valid'\n\t\t}\n\t\tif (!claimed) {\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (decision.blocking) {\n\t\t\treturn await this.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo)\n\t\t}\n\n\t\t// SWR: serve this request from the (still valid) token, refresh after the response.\n\t\t// The work runs detached (after the response is sent), so any rejection — a transient\n\t\t// DB error in the revoke / persist writes, a corrupt-config throw — must be swallowed\n\t\t// here; otherwise it becomes an unhandledRejection and can take the worker down. The\n\t\t// session is simply kept and re-tried on a later request (the claim floor throttles).\n\t\tsetImmediate(() => {\n\t\t\tthis.runRevalidation(dbContext, handler, row, apiKeyRow, requestInfo).catch(e => {\n\t\t\t\tthis.logger.error(e, { message: 'IdP session revalidation: background run failed', idpSessionId: row.id })\n\t\t\t})\n\t\t})\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Decide whether (and how) to revalidate, purely from timestamps — no interval parsing in\n\t * JS (the claim handles intervals in SQL). Returns null to skip.\n\t */\n\tprivate decide(row: IdpSessionRow, config: ResolvedRevalidationConfig, now: Date): Decision {\n\t\tconst expiresAt = row.session.expiresAt\n\t\tconst obtainedAt = row.tokenObtainedAt\n\n\t\t// No lifetime info from the IdP → plain background throttle on fallbackInterval.\n\t\tif (!expiresAt || !obtainedAt) {\n\t\t\treturn { blocking: config.mode === 'blocking', claimInterval: config.fallbackInterval }\n\t\t}\n\n\t\tconst lifetimeMs = expiresAt.getTime() - obtainedAt.getTime()\n\t\tconst softAtMs = obtainedAt.getTime() + lifetimeMs * config.softThreshold\n\t\tconst nowMs = now.getTime()\n\n\t\tif (nowMs < softAtMs) {\n\t\t\treturn null // still within the trusted window\n\t\t}\n\n\t\tconst expired = nowMs >= expiresAt.getTime()\n\t\treturn { blocking: config.mode === 'blocking' || expired, claimInterval: config.minInterval }\n\t}\n\n\tprivate async runRevalidation(\n\t\tdbContext: DatabaseContext,\n\t\thandler: IdentityProviderHandler<{}>,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<RevalidationOutcome> {\n\t\tlet config: {}\n\t\ttry {\n\t\t\tconfig = handler.validateConfiguration(row.providerConfiguration)\n\t\t} catch (e) {\n\t\t\tthis.logger.warn(e, { message: 'IdP session revalidation: stored configuration is invalid', idpSessionId: row.id })\n\t\t\t// corrupt stored config — must NOT revoke; keep the session and retry later. Audit\n\t\t\t// it so the operator can tell \"vouched for\" apart from \"silently broken\" (without an\n\t\t\t// entry, a config typo disables re-validation invisibly for the life of every session).\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'config_invalid', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tlet result: RevalidationResult\n\t\ttry {\n\t\t\tresult = await handler.revalidate!(config, row.session)\n\t\t} catch (e) {\n\t\t\tthis.logger.warn(e, { message: 'IdP session revalidation: identity provider call failed', idpSessionId: row.id })\n\t\t\t// transient failure (network / IdP down) — must NOT revoke; keep the session and retry\n\t\t\t// on a later request (the claim floor prevents hammering the IdP). Audited (throttled\n\t\t\t// to one entry per claim window) so a prolonged IdP outage is visible rather than a\n\t\t\t// silent fail-open.\n\t\t\tawait this.logRevalidationFailed(dbContext, apiKeyRow, row, 'revalidation_error', requestInfo)\n\t\t\treturn 'valid'\n\t\t}\n\n\t\tif (result.status === 'revoked') {\n\t\t\tawait this.revoke(dbContext, apiKeyRow, row, result.reason, requestInfo)\n\t\t\treturn 'revoked'\n\t\t}\n\n\t\t// Still valid — persist the rotated token (resets the lifetime reference) / refreshed\n\t\t// expiry. A rotation is a real, low-frequency event (token-lifetime cadence), so we\n\t\t// audit it as `idp_session_revalidated`; the no-op userinfo/introspection probes\n\t\t// (no rotated session) are intentionally NOT logged to keep the audit log usable.\n\t\t//\n\t\t// The IdP has already vouched for the session, so these post-success writes are pure\n\t\t// best-effort bookkeeping (they only reset the SWR cadence reference). A transient DB\n\t\t// error or an `encrypt()` throw here must NOT fail the request — otherwise a blocking\n\t\t// revalidation fails closed on a successful refresh, contradicting \"fail open\" (the SWR\n\t\t// path already swallows this). Keep the existing row; the claim floor throttles a retry.\n\t\tif (result.idpSession) {\n\t\t\ttry {\n\t\t\t\tawait dbContext.commandBus.execute(new UpdateIdpSessionCommand(row.id, result.idpSession))\n\t\t\t\tawait this.logRevalidated(dbContext, apiKeyRow, row, requestInfo)\n\t\t\t} catch (e) {\n\t\t\t\tthis.logger.error(e, { message: 'IdP session revalidation: persisting the rotated session failed', idpSessionId: row.id })\n\t\t\t\t// fall through — session stays valid, persist retried on a later request\n\t\t\t}\n\t\t}\n\n\t\t// A09 — re-apply the IdP's claim mapping when the refresh returned fresh claims, so an `always`\n\t\t// mapping keeps an established session's project memberships in sync with the IdP's current claims\n\t\t// without requiring a full re-login. `sticky` mappings self-skip (the sync passes isNewPerson=false).\n\t\t// `claimsComplete` tells the sync whether the refresh rebuilt sign-in's full claim surface, so it can\n\t\t// reconcile (incl. `unmatched: \"remove\"`) exactly like sign-in. Strictly fail-open — see `syncClaims`.\n\t\tif (result.claims) {\n\t\t\tawait this.syncClaims(dbContext, row, apiKeyRow, result.claims, result.claimsComplete === true, requestInfo)\n\t\t}\n\t\treturn 'valid'\n\t}\n\n\t/**\n\t * Re-apply the claim mapping on a successful refresh. Runs in its own transaction (atomic apply of\n\t * the membership changes) and never throws: the IdP has already vouched for the session, so a\n\t * malformed mapping or a transient apply error must not revoke or fail it. A real membership change\n\t * is audited as `idp_role_mapped`; a failure is audited as `idp_role_mapping_failed` (fail-open\n\t * marker), mirroring the sign-in path. `claimsComplete` carries whether the refresh rebuilt sign-in's\n\t * full claim surface (so removal reconciliation is safe) — see `allowRemoval` below.\n\t */\n\tprivate async syncClaims(\n\t\tdbContext: DatabaseContext,\n\t\trow: IdpSessionRow,\n\t\tapiKeyRow: ApiKeyRow,\n\t\tclaims: Record<string, unknown>,\n\t\tclaimsComplete: boolean,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tconst mapping = parseClaimMapping(row.providerConfiguration)\n\t\t\tif (!mapping) {\n\t\t\t\treturn\n\t\t\t}\n\t\t\t// Atomic apply in its own transaction (the verify path has no surrounding one). `always`-only:\n\t\t\t// the sync passes isNewPerson=false, so a `sticky` mapping self-skips and returns a null audit.\n\t\t\t// Refresh mirrors sign-in as closely as the claim surface allows: when the provider returned its\n\t\t\t// COMPLETE surface (`claimsComplete` — `method: \"refresh\"` rebuilding sign-in's id-token + userinfo\n\t\t\t// merge), `unmatched: \"remove\"` reconciliation runs here too. A partial surface (a userinfo-only\n\t\t\t// probe, or a refresh whose userinfo fetch failed) passes `allowRemoval: false`, so refresh stays\n\t\t\t// additive-only and a membership the IdP still asserts is never stripped off an incomplete surface.\n\t\t\tconst { audit, droppedUnsafeRules } = await dbContext.transaction(db =>\n\t\t\t\tthis.claimSyncService.sync(db, mapping, claims, { id: apiKeyRow.identity_id }, false, { allowRemoval: claimsComplete })\n\t\t\t)\n\t\t\tif (audit) {\n\t\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapped', audit, requestInfo)\n\t\t\t}\n\t\t\t// The apply-time safety backstop dropped a configured rule — emit the fail-open marker so a broken\n\t\t\t// mapping is visible on the refresh path too, mirroring sign-in (the marker carries no claim values).\n\t\t\tif (droppedUnsafeRules) {\n\t\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)\n\t\t\t}\n\t\t} catch (e) {\n\t\t\tthis.logger.warn(e, { message: 'IdP session revalidation: claim mapping sync failed', idpSessionId: row.id })\n\t\t\t// Strictly fail-open: a malformed mapping or a transient apply error must never revoke or\n\t\t\t// fail an already-vouched-for session. The transaction rolls back any partial apply.\n\t\t\tawait this.logRoleMapping(dbContext, apiKeyRow, row, 'idp_role_mapping_failed', undefined, requestInfo)\n\t\t}\n\t}\n\n\tprivate async logRoleMapping(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\ttype: 'idp_role_mapped' | 'idp_role_mapping_failed',\n\t\teventData: JSONValue | undefined,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype,\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\t// The membership change affects this session's own person — record it as the target too,\n\t\t\t\t\t// so an admin querying membership changes by target_person_id sees IdP-driven grants/revokes\n\t\t\t\t\t// (consistent with the project_membership_* audit events).\n\t\t\t\t\ttargetPersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\teventData,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch (e) {\n\t\t\tthis.logger.error(e, { message: `IdP session revalidation: writing the ${type} audit entry failed`, idpSessionId: row.id })\n\t\t\t// best-effort audit — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async logRevalidated(dbContext: DatabaseContext, apiKeyRow: ApiKeyRow, row: IdpSessionRow, requestInfo?: ApiKeyRequestInfo): Promise<void> {\n\t\tawait dbContext.commandBus.execute(\n\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\ttype: 'idp_session_revalidated',\n\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\tsuccess: true,\n\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\teventData: { apiKeyId: apiKeyRow.id },\n\t\t\t}),\n\t\t)\n\t}\n\n\t/**\n\t * Audit a fail-open: the IdP couldn't be consulted (transient outage) or the stored config is\n\t * corrupt, so we kept the session rather than revoking it. Naturally throttled to one entry\n\t * per claim window (we only reach here after a successful claim, which bumps\n\t * `last_validated_at`). The write is best-effort and self-contained — a failure to audit must\n\t * never propagate and fail a blocking verify request (the whole point of failing open).\n\t */\n\tprivate async logRevalidationFailed(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\terrorCode: 'config_invalid' | 'revalidation_error',\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_session_revalidation_failed',\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\t// not a security failure (the session is kept) — a fail-open marker the operator\n\t\t\t\t\t// can alert on. `success: true` keeps it out of the failed-login funnels.\n\t\t\t\t\tsuccess: true,\n\t\t\t\t\terrorCode,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t\teventData: { apiKeyId: apiKeyRow.id },\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch (e) {\n\t\t\tthis.logger.error(e, { message: 'IdP session revalidation: writing the idp_session_revalidation_failed audit entry failed', idpSessionId: row.id })\n\t\t\t// best-effort observability — never fail the request because the audit write failed\n\t\t}\n\t}\n\n\tprivate async revoke(\n\t\tdbContext: DatabaseContext,\n\t\tapiKeyRow: ApiKeyRow,\n\t\trow: IdpSessionRow,\n\t\treason: string,\n\t\trequestInfo?: ApiKeyRequestInfo,\n\t): Promise<void> {\n\t\tawait dbContext.commandBus.execute(new DisableApiKeyCommand(apiKeyRow.id))\n\t\ttry {\n\t\t\tawait dbContext.commandBus.execute(\n\t\t\t\tnew CreateAuthLogEntryCommand({\n\t\t\t\t\ttype: 'idp_session_revoked',\n\t\t\t\t\tinvokedById: apiKeyRow.identity_id,\n\t\t\t\t\tpersonId: apiKeyRow.person_id ?? undefined,\n\t\t\t\t\tidentityProviderId: row.identityProviderId,\n\t\t\t\t\tsuccess: false,\n\t\t\t\t\terrorCode: reason,\n\t\t\t\t\tipAddress: requestInfo?.ip,\n\t\t\t\t\tuserAgent: requestInfo?.userAgent,\n\t\t\t\t\t// the action payload belongs in `event_data` (where every other audit event puts\n\t\t\t\t\t// it and where the admin UI / AuthLogQueryResolver reads it); `metadata` is for\n\t\t\t\t\t// transport context (forwarder IP/UA).\n\t\t\t\t\teventData: { reason, apiKeyId: apiKeyRow.id },\n\t\t\t\t}),\n\t\t\t)\n\t\t} catch (e) {\n\t\t\tthis.logger.error(e, { message: 'IdP session revalidation: writing the idp_session_revoked audit entry failed', idpSessionId: row.id })\n\t\t\t// best-effort audit: the key is already disabled, so the request must still be answered\n\t\t\t// as revoked rather than fail on the audit write\n\t\t}\n\t}\n\n\tprivate resolveConfig(configuration: Record<string, unknown>): ResolvedRevalidationConfig {\n\t\tconst raw = (configuration.revalidation ?? {}) as Record<string, unknown>\n\t\tconst threshold = typeof raw.softRefreshThreshold === 'number' && raw.softRefreshThreshold > 0 && raw.softRefreshThreshold <= 1\n\t\t\t? raw.softRefreshThreshold\n\t\t\t: REVALIDATION_DEFAULT_SOFT_THRESHOLD\n\t\treturn {\n\t\t\tenabled: raw.enabled === true,\n\t\t\tsoftThreshold: threshold,\n\t\t\tminInterval: typeof raw.minInterval === 'string' ? raw.minInterval : REVALIDATION_DEFAULT_MIN_INTERVAL,\n\t\t\tfallbackInterval: typeof raw.fallbackInterval === 'string' ? raw.fallbackInterval : REVALIDATION_DEFAULT_FALLBACK_INTERVAL,\n\t\t\tmode: raw.mode === 'blocking' ? 'blocking' : 'auto',\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;;;;;;;;AA6CO,MAAM,sBAAsB;AAAA,EAClC,YACkB,aACA,kBACA,QAChB;AAHgB,SAAA,cAAA;AACA,SAAA,mBAAA;AACA,SAAA,SAAA;AAAA,EAElB;AAAA,EAEA,MAAM,WACL,WACA,eACA,WACA,aAC+B;AAC/B,UAAM,MAAM,MAAM,cAAc,aAAa,MAAM,IAAI,wBAAwB,UAAU,IAAI,cAAc,SAAS,CAAC;AACrH,QAAI,CAAC,KAAK;AAET,aAAO;AAAA,IACR;AAEA,UAAM,SAAS,KAAK,cAAc,IAAI,qBAAqB;AAC3D,QAAI,CAAC,OAAO,SAAS;AACpB,aAAO;AAAA,IACR;AAGA,QAAI,IAAI,oBAAoB;AAC3B,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,gBAAgB,WAAW;AACxE,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,KAAK,YAAY,iBAAiB,IAAI,YAAY;AAClE,QAAI,CAAC,SAAS,YAAY;AAEzB,aAAO;AAAA,IACR;AAEA,UAAM,WAAW,KAAK,OAAO,KAAK,QAAQ,UAAU,UAAU,KAAK;AACnE,QAAI,CAAC,UAAU;AAEd,aAAO;AAAA,IACR;AAGA,QAAI;AACJ,QAAI;AACH,gBAAU,MAAM,UAAU,WAAW,QAAQ,IAAI,4BAA4B,IAAI,IAAI,SAAS,aAAa,CAAC;AAAA,IAC7G,SAAS,GAAG;AACX,WAAK,OAAO,KAAK,GAAG,EAAE,SAAS,0CAA0C,cAAc,IAAI,IAAI;AAE/F,aAAO;AAAA,IACR;AACA,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AAEA,QAAI,SAAS,UAAU;AACtB,aAAO,MAAM,KAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW;AAAA,IAClF;AAOA,iBAAa,MAAM;AAClB,WAAK,gBAAgB,WAAW,SAAS,KAAK,WAAW,WAAW,EAAE,MAAM,CAAA,MAAK;AAChF,aAAK,OAAO,MAAM,GAAG,EAAE,SAAS,mDAAmD,cAAc,IAAI,IAAI;AAAA,MAC1G,CAAC;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,OAAO,KAAoB,QAAoC,KAAqB;AAC3F,UAAM,YAAY,IAAI,QAAQ;AAC9B,UAAM,aAAa,IAAI;AAGvB,QAAI,CAAC,aAAa,CAAC,YAAY;AAC9B,aAAO,EAAE,UAAU,OAAO,SAAS,YAAY,eAAe,OAAO,iBAAA;AAAA,IACtE;AAEA,UAAM,aAAa,UAAU,QAAA,IAAY,WAAW,QAAA;AACpD,UAAM,WAAW,WAAW,QAAA,IAAY,aAAa,OAAO;AAC5D,UAAM,QAAQ,IAAI,QAAA;AAElB,QAAI,QAAQ,UAAU;AACrB,aAAO;AAAA,IACR;AAEA,UAAM,UAAU,SAAS,UAAU,QAAA;AACnC,WAAO,EAAE,UAAU,OAAO,SAAS,cAAc,SAAS,eAAe,OAAO,YAAA;AAAA,EACjF;AAAA,EAEA,MAAc,gBACb,WACA,SACA,KACA,WACA,aAC+B;AAC/B,QAAI;AACJ,QAAI;AACH,eAAS,QAAQ,sBAAsB,IAAI,qBAAqB;AAAA,IACjE,SAAS,GAAG;AACX,WAAK,OAAO,KAAK,GAAG,EAAE,SAAS,6DAA6D,cAAc,IAAI,IAAI;AAIlH,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,kBAAkB,WAAW;AACzF,aAAO;AAAA,IACR;AAEA,QAAI;AACJ,QAAI;AACH,eAAS,MAAM,QAAQ,WAAY,QAAQ,IAAI,OAAO;AAAA,IACvD,SAAS,GAAG;AACX,WAAK,OAAO,KAAK,GAAG,EAAE,SAAS,2DAA2D,cAAc,IAAI,IAAI;AAKhH,YAAM,KAAK,sBAAsB,WAAW,WAAW,KAAK,sBAAsB,WAAW;AAC7F,aAAO;AAAA,IACR;AAEA,QAAI,OAAO,WAAW,WAAW;AAChC,YAAM,KAAK,OAAO,WAAW,WAAW,KAAK,OAAO,QAAQ,WAAW;AACvE,aAAO;AAAA,IACR;AAYA,QAAI,OAAO,YAAY;AACtB,UAAI;AACH,cAAM,UAAU,WAAW,QAAQ,IAAI,wBAAwB,IAAI,IAAI,OAAO,UAAU,CAAC;AACzF,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,WAAW;AAAA,MACjE,SAAS,GAAG;AACX,aAAK,OAAO,MAAM,GAAG,EAAE,SAAS,mEAAmE,cAAc,IAAI,IAAI;AAAA,MAE1H;AAAA,IACD;AAOA,QAAI,OAAO,QAAQ;AAClB,YAAM,KAAK,WAAW,WAAW,KAAK,WAAW,OAAO,QAAQ,OAAO,mBAAmB,MAAM,WAAW;AAAA,IAC5G;AACA,WAAO;AAAA,EACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,WACb,WACA,KACA,WACA,QACA,gBACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,kBAAkB,IAAI,qBAAqB;AAC3D,UAAI,CAAC,SAAS;AACb;AAAA,MACD;AAQA,YAAM,EAAE,OAAO,uBAAuB,MAAM,UAAU;AAAA,QAAY,QACjE,KAAK,iBAAiB,KAAK,IAAI,SAAS,QAAQ,EAAE,IAAI,UAAU,eAAe,OAAO,EAAE,cAAc,gBAAgB;AAAA,MAAA;AAEvH,UAAI,OAAO;AACV,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,mBAAmB,OAAO,WAAW;AAAA,MAC3F;AAGA,UAAI,oBAAoB;AACvB,cAAM,KAAK,eAAe,WAAW,WAAW,KAAK,2BAA2B,QAAW,WAAW;AAAA,MACvG;AAAA,IACD,SAAS,GAAG;AACX,WAAK,OAAO,KAAK,GAAG,EAAE,SAAS,uDAAuD,cAAc,IAAI,IAAI;AAG5G,YAAM,KAAK,eAAe,WAAW,WAAW,KAAK,2BAA2B,QAAW,WAAW;AAAA,IACvG;AAAA,EACD;AAAA,EAEA,MAAc,eACb,WACA,WACA,KACA,MACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAI,0BAA0B;AAAA,UAC7B;AAAA,UACA,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA;AAAA;AAAA;AAAA,UAIjC,gBAAgB,UAAU,aAAa;AAAA,UACvC,oBAAoB,IAAI;AAAA,UACxB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,QAAA,CACxB;AAAA,MAAA;AAAA,IAEH,SAAS,GAAG;AACX,WAAK,OAAO,MAAM,GAAG,EAAE,SAAS,yCAAyC,IAAI,uBAAuB,cAAc,IAAI,GAAA,CAAI;AAAA,IAE3H;AAAA,EACD;AAAA,EAEA,MAAc,eAAe,WAA4B,WAAsB,KAAoB,aAAgD;AAClJ,UAAM,UAAU,WAAW;AAAA,MAC1B,IAAI,0BAA0B;AAAA,QAC7B,MAAM;AAAA,QACN,aAAa,UAAU;AAAA,QACvB,UAAU,UAAU,aAAa;AAAA,QACjC,oBAAoB,IAAI;AAAA,QACxB,SAAS;AAAA,QACT,WAAW,aAAa;AAAA,QACxB,WAAW,aAAa;AAAA,QACxB,WAAW,EAAE,UAAU,UAAU,GAAA;AAAA,MAAG,CACpC;AAAA,IAAA;AAAA,EAEH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,sBACb,WACA,WACA,KACA,WACA,aACgB;AAChB,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAI,0BAA0B;AAAA,UAC7B,MAAM;AAAA,UACN,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA,UACjC,oBAAoB,IAAI;AAAA;AAAA;AAAA,UAGxB,SAAS;AAAA,UACT;AAAA,UACA,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA,UACxB,WAAW,EAAE,UAAU,UAAU,GAAA;AAAA,QAAG,CACpC;AAAA,MAAA;AAAA,IAEH,SAAS,GAAG;AACX,WAAK,OAAO,MAAM,GAAG,EAAE,SAAS,4FAA4F,cAAc,IAAI,IAAI;AAAA,IAEnJ;AAAA,EACD;AAAA,EAEA,MAAc,OACb,WACA,WACA,KACA,QACA,aACgB;AAChB,UAAM,UAAU,WAAW,QAAQ,IAAI,qBAAqB,UAAU,EAAE,CAAC;AACzE,QAAI;AACH,YAAM,UAAU,WAAW;AAAA,QAC1B,IAAI,0BAA0B;AAAA,UAC7B,MAAM;AAAA,UACN,aAAa,UAAU;AAAA,UACvB,UAAU,UAAU,aAAa;AAAA,UACjC,oBAAoB,IAAI;AAAA,UACxB,SAAS;AAAA,UACT,WAAW;AAAA,UACX,WAAW,aAAa;AAAA,UACxB,WAAW,aAAa;AAAA;AAAA;AAAA;AAAA,UAIxB,WAAW,EAAE,QAAQ,UAAU,UAAU,GAAA;AAAA,QAAG,CAC5C;AAAA,MAAA;AAAA,IAEH,SAAS,GAAG;AACX,WAAK,OAAO,MAAM,GAAG,EAAE,SAAS,gFAAgF,cAAc,IAAI,IAAI;AAAA,IAGvI;AAAA,EACD;AAAA,EAEQ,cAAc,eAAoE;AACzF,UAAM,MAAO,cAAc,gBAAgB,CAAA;AAC3C,UAAM,YAAY,OAAO,IAAI,yBAAyB,YAAY,IAAI,uBAAuB,KAAK,IAAI,wBAAwB,IAC3H,IAAI,uBACJ;AACH,WAAO;AAAA,MACN,SAAS,IAAI,YAAY;AAAA,MACzB,eAAe;AAAA,MACf,aAAa,OAAO,IAAI,gBAAgB,WAAW,IAAI,cAAc;AAAA,MACrE,kBAAkB,OAAO,IAAI,qBAAqB,WAAW,IAAI,mBAAmB;AAAA,MACpF,MAAM,IAAI,SAAS,aAAa,aAAa;AAAA,IAAA;AAAA,EAE/C;AACD;"}

package/dist/production/src/TenantContainer.cjs

@@ -153,7 +153,10 @@ class TenantContainerFactory {
       idpRegistry.registerHandler("facebook", new FacebookProvider.FacebookProvider());
       idpRegistry.registerHandler("apple", new AppleProvider.AppleProvider());
       return idpRegistry;
-    }).addService("idpClaimSyncService", ({ projectSchemaResolver }) => new IDPClaimSyncService.IDPClaimSyncService(projectSchemaResolver)).addService("idpSessionRevalidator", ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator.IdpSessionRevalidator(idpRegistry, idpClaimSyncService)).addService("backchannelLogoutManager", ({ idpRegistry }) => new BackchannelLogoutManager.BackchannelLogoutManager(idpRegistry)).addService("unpersistedApiKeyManager", () => UnpersistedApiKeyManager.UnpersistedApiKeyManager.createForRootTokens({
+    }).addService("idpClaimSyncService", ({ projectSchemaResolver }) => new IDPClaimSyncService.IDPClaimSyncService(projectSchemaResolver)).addService(
+      "idpSessionRevalidator",
+      ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator.IdpSessionRevalidator(idpRegistry, idpClaimSyncService, args.logger)
+    ).addService("backchannelLogoutManager", ({ idpRegistry }) => new BackchannelLogoutManager.BackchannelLogoutManager(idpRegistry)).addService("unpersistedApiKeyManager", () => UnpersistedApiKeyManager.UnpersistedApiKeyManager.createForRootTokens({
       tokens: args.tenantCredentials.rootTokens,
       tokenHashes: args.tenantCredentials.rootTokenHashes
     })).addService(
@@ -180,7 +183,7 @@ class TenantContainerFactory {
       ({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) => new EmailChangeManager.EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory)
     ).addService(
       "idpSignInManager",
-      ({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager.IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService)
+      ({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager.IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService, args.logger)
     ).addService("idpManager", ({ idpRegistry, projectSchemaResolver }) => new IDPManager.IDPManager(idpRegistry, projectSchemaResolver)).addService("personIdentityProviderManager", () => new PersonIdentityProviderManager.PersonIdentityProviderManager()).addService("otpAuthenticator", ({ providers }) => new OtpAuthenticator.OtpAuthenticator(providers)).addService("otpManager", ({ otpAuthenticator, providers }) => new OtpManager.OtpManager(otpAuthenticator, providers)).addService("backupCodeManager", ({ providers, userMailer }) => new BackupCodeManager.BackupCodeManager(userMailer, providers)).addService("emailOtpManager", ({ userMailer, providers, rateLimiter }) => new EmailOtpManager.EmailOtpManager(userMailer, providers, rateLimiter)).addService("authPolicyManager", ({ projectManager }) => new AuthPolicyManager.AuthPolicyManager(projectManager)).addService(
       "signInManager",
       ({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) => new SignInManager.SignInManager(

package/dist/production/src/TenantContainer.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"TenantContainer.cjs","sources":["../../../../packages/engine-tenant-api/src/TenantContainer.ts"],"sourcesContent":["import { AccessEvaluator, Authorizator } from '@contember/authorization'\nimport { Connection, DatabaseConfig } from '@contember/database'\nimport { Builder } from '@contember/dic'\nimport {\n\tAclSchemaAccessNodeFactory,\n\tApiKeyManager,\n\tApiKeyService,\n\tAppleProvider,\n\tAuthPolicyManager,\n\tAuthPolicyResolver,\n\tBackchannelLogoutManager,\n\tBackupCodeManager,\n\tCaptchaValidator,\n\tDatabaseContext,\n\tEmailChangeManager,\n\tEmailOtpManager,\n\tEmailValidator,\n\tEmailVerificationManager,\n\tFacebookProvider,\n\tHCaptchaProvider,\n\tIdentity,\n\tIdentityFactory,\n\tIDPClaimSyncService,\n\tIDPHandlerRegistry,\n\tIDPManager,\n\tIdpSessionRevalidator,\n\tIDPSignInManager,\n\tInviteManager,\n\tLoginRiskAnalyzer,\n\tMailTemplateManager,\n\tMembershipValidator,\n\tOIDCProvider,\n\tOtpAuthenticator,\n\tOtpManager,\n\tPanelAccessResolver,\n\tPasswordChangeManager,\n\tPasswordResetManager,\n\tPermissionContextFactory,\n\tPermissionsFactory,\n\tPersonAccessManager,\n\tPersonIdentityProviderManager,\n\tPersonManager,\n\tProjectInitializer,\n\tProjectManager,\n\tProjectMemberManager,\n\tProjectSchemaResolver,\n\tProjectScopeFactory,\n\tProviders,\n\tRateLimiter,\n\tRecaptchaV3Provider,\n\tRolesManager,\n\tSecretsManager,\n\tSignInManager,\n\tSignOutManager,\n\tSignUpManager,\n\tTurnstileProvider,\n\tUnpersistedApiKeyManager,\n\tUserMailer,\n} from './model/index.js'\nimport { HibpChecker, HttpHibpChecker, NoopHibpChecker } from './model/service/HibpChecker.js'\nimport {\n\tAddIDPMutationResolver,\n\tAddProjectMemberMutationResolver,\n\tChangePasswordMutationResolver,\n\tChangeProfileMutationResolver,\n\tCreateApiKeyMutationResolver,\n\tCreateProjectMutationResolver,\n\tDisableApiKeyMutationResolver,\n\tDisableIDPMutationResolver,\n\tDisconnectMyIdentityProviderMutationResolver,\n\tEmailOtpMutationResolver,\n\tEmailVerificationMutationResolver,\n\tEnableIDPMutationResolver,\n\tIdentityGlobalRolesMutationResolver,\n\tIdentityTypeResolver,\n\tIDPMutationResolver,\n\tInviteMutationResolver,\n\tMailTemplateMutationResolver,\n\tMeQueryResolver,\n\tOtpMutationResolver,\n\tPersonQueryResolver,\n\tPersonTypeResolver,\n\tProjectMembersQueryResolver,\n\tProjectQueryResolver,\n\tProjectTypeResolver,\n\tRegenerateBackupCodesMutationResolver,\n\tRemoveProjectMemberMutationResolver,\n\tResetPasswordMutationResolver,\n\tResolverFactory,\n\tSetProjectSecretMutationResolver,\n\tSignInMutationResolver,\n\tSignOutMutationResolver,\n\tSignUpMutationResolver,\n\tTenantResolverContextFactory,\n\tUpdateProjectMemberMutationResolver,\n\tUpdateProjectMutationResolver,\n} from './resolvers/index.js'\nimport * as Schema from './schema/index.js'\nimport { createMailer, MailerOptions, TemplateRenderer } from './utils/index.js'\nimport { IdentityFetcher } from './bridges/system/IdentityFetcher.js'\nimport { SignInResponseFactory } from './resolvers/responseHelpers/SignInResponseFactory.js'\nimport { IDPQueryResolver } from './resolvers/query/IDPQueryResolver.js'\nimport { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver.js'\nimport { TenantCredentials, TenantMigrationsRunner } from './migrations/index.js'\nimport { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver.js'\nimport { EnablePersonMutationResolver } from './resolvers/mutation/person/EnablePersonMutationResolver.js'\nimport { ForceSignOutMutationResolver } from './resolvers/mutation/person/ForceSignOutMutationResolver.js'\nimport { RevokeSessionMutationResolver } from './resolvers/mutation/person/RevokeSessionMutationResolver.js'\nimport { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver.js'\nimport { ConfigurationManager } from './model/service/ConfigurationManager.js'\nimport { ConfigurationMutationResolver } from './resolvers/mutation/configuration/ConfigurationMutationResolver.js'\nimport { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQueryResolver.js'\nimport { AuthPolicyMutationResolver } from './resolvers/mutation/configuration/AuthPolicyMutationResolver.js'\nimport { AuthPolicyQueryResolver } from './resolvers/query/AuthPolicyQueryResolver.js'\nimport { ResetPersonMfaMutationResolver } from './resolvers/mutation/person/ResetPersonMfaMutationResolver.js'\nimport { AuthLogQueryResolver } from './resolvers/query/AuthLogQueryResolver.js'\nimport { ApiKeyQueryResolver } from './resolvers/query/ApiKeyQueryResolver.js'\nimport { PasswordlessMutationResolver } from './resolvers/mutation/person/PasswordlessMutationResolver.js'\nimport { PasswordlessSignInManager } from './model/service/PasswordlessSignInManager.js'\nimport { TogglePasswordlessMutationResolver } from './resolvers/mutation/person/TogglePasswordlessMutationResolver.js'\nimport { PasswordStrengthValidator } from './model/service/PasswordStrengthValidator.js'\nimport { AuthLogService } from './model/service/AuthLogService.js'\n\nexport interface TenantContainer {\n\tprojectMemberManager: ProjectMemberManager\n\tapiKeyManager: ApiKeyManager\n\tbackchannelLogoutManager: BackchannelLogoutManager\n\tsignUpManager: SignUpManager\n\tprojectManager: ProjectManager\n\tpanelAccessResolver: PanelAccessResolver\n\tresolvers: Schema.Resolvers\n\tresolverContextFactory: TenantResolverContextFactory\n\tauthorizator: Authorizator<Identity>\n\tidentityFetcher: IdentityFetcher\n\tdatabaseContext: DatabaseContext\n\treadDatabaseContext: DatabaseContext\n\tmigrationsRunner: TenantMigrationsRunner\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n}\n\nexport interface TenantContainerArgs {\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n\tdbCredentials: DatabaseConfig\n\tmailOptions: MailerOptions\n\tprojectSchemaResolver: ProjectSchemaResolver\n\tprojectInitializer: ProjectInitializer\n\ttenantCredentials: TenantCredentials\n\tcryptoProviders: Pick<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>\n}\n\nexport class TenantContainerFactory {\n\tconstructor(\n\t\tprivate readonly providers: Omit<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>,\n\t) {}\n\n\tcreate(args: TenantContainerArgs): TenantContainer {\n\t\treturn this.createBuilder(args)\n\t\t\t.build()\n\t\t\t.pick(\n\t\t\t\t'apiKeyManager',\n\t\t\t\t'backchannelLogoutManager',\n\t\t\t\t'projectMemberManager',\n\t\t\t\t'projectManager',\n\t\t\t\t'panelAccessResolver',\n\t\t\t\t'signUpManager',\n\t\t\t\t'resolvers',\n\t\t\t\t'authorizator',\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t'identityFetcher',\n\t\t\t\t'databaseContext',\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t'migrationsRunner',\n\t\t\t\t'connection',\n\t\t\t\t'readConnection',\n\t\t\t)\n\t}\n\n\tcreateBuilder(args: TenantContainerArgs) {\n\t\treturn new Builder({})\n\t\t\t.addService('providers', () => ({ ...this.providers, ...args.cryptoProviders }))\n\t\t\t.addService('mailer', () => createMailer(args.mailOptions))\n\t\t\t.addService('projectSchemaResolver', () => args.projectSchemaResolver)\n\t\t\t.addService('templateRenderer', () => new TemplateRenderer())\n\t\t\t.addService('accessEvaluator', ({}) => new AccessEvaluator.PermissionEvaluator(new PermissionsFactory().create()))\n\t\t\t.addService('authorizator', ({ accessEvaluator }) => new Authorizator.Default(accessEvaluator))\n\t\t\t.addService('userMailer', ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer))\n\t\t\t.addService('apiKeyService', () => new ApiKeyService())\n\t\t\t.addService('authPolicyResolver', () => new AuthPolicyResolver())\n\t\t\t.addService('panelAccessResolver', ({ providers }) => new PanelAccessResolver(providers))\n\t\t\t.addService('authLogService', () => new AuthLogService())\n\t\t\t.addService('loginRiskAnalyzer', ({ providers }) => new LoginRiskAnalyzer(providers.hash))\n\t\t\t.addService('idpRegistry', () => {\n\t\t\t\tconst idpRegistry = new IDPHandlerRegistry()\n\t\t\t\tidpRegistry.registerHandler('oidc', new OIDCProvider())\n\t\t\t\tidpRegistry.registerHandler('facebook', new FacebookProvider())\n\t\t\t\tidpRegistry.registerHandler('apple', new AppleProvider())\n\t\t\t\treturn idpRegistry\n\t\t\t})\n\t\t\t.addService('idpClaimSyncService', ({ projectSchemaResolver }) => new IDPClaimSyncService(projectSchemaResolver))\n\t\t\t.addService('idpSessionRevalidator', ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService))\n\t\t\t.addService('backchannelLogoutManager', ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry))\n\t\t\t.addService('unpersistedApiKeyManager', () =>\n\t\t\t\tUnpersistedApiKeyManager.createForRootTokens({\n\t\t\t\t\ttokens: args.tenantCredentials.rootTokens,\n\t\t\t\t\ttokenHashes: args.tenantCredentials.rootTokenHashes,\n\t\t\t\t}))\n\t\t\t.addService(\n\t\t\t\t'apiKeyManager',\n\t\t\t\t({ apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator }) =>\n\t\t\t\t\tnew ApiKeyManager(apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator),\n\t\t\t)\n\t\t\t.addService('signOutManager', ({ apiKeyManager, idpRegistry }) => new SignOutManager(apiKeyManager, idpRegistry))\n\t\t\t.addService('emailValidator', () => new EmailValidator())\n\t\t\t.addService('hibpChecker', (): HibpChecker => new HttpHibpChecker())\n\t\t\t.addService('noopHibpChecker', (): HibpChecker => new NoopHibpChecker())\n\t\t\t.addService('passwordStrengthValidator', ({ hibpChecker }) => new PasswordStrengthValidator(hibpChecker))\n\t\t\t.addService('captchaValidator', () =>\n\t\t\t\tnew CaptchaValidator({\n\t\t\t\t\tturnstile: new TurnstileProvider(),\n\t\t\t\t\thcaptcha: new HCaptchaProvider(),\n\t\t\t\t\trecaptchaV3: new RecaptchaV3Provider(),\n\t\t\t\t}))\n\t\t\t.addService('rateLimiter', ({ providers }) => new RateLimiter(providers))\n\t\t\t.addService(\n\t\t\t\t'signUpManager',\n\t\t\t\t({ emailValidator, passwordStrengthValidator }) => new SignUpManager(emailValidator, passwordStrengthValidator),\n\t\t\t)\n\t\t\t.addService('passwordChangeManager', ({ providers, passwordStrengthValidator }) => new PasswordChangeManager(providers, passwordStrengthValidator))\n\t\t\t.addService('projectMemberManager', () => new ProjectMemberManager())\n\t\t\t.addService('identityFactory', ({ projectMemberManager }) => new IdentityFactory(projectMemberManager))\n\t\t\t.addService('projectScopeFactory', () => new ProjectScopeFactory(new AclSchemaAccessNodeFactory()))\n\t\t\t.addService(\n\t\t\t\t'permissionContextFactory',\n\t\t\t\t({ authorizator, identityFactory, projectScopeFactory, projectSchemaResolver }) =>\n\t\t\t\t\tnew PermissionContextFactory(authorizator, identityFactory, projectScopeFactory, projectSchemaResolver),\n\t\t\t)\n\t\t\t.addService('secretManager', ({ providers }) => new SecretsManager(providers))\n\t\t\t.addService('projectManager', ({ secretManager, apiKeyService }) => new ProjectManager(secretManager, args.projectInitializer, apiKeyService))\n\t\t\t.addService('personAccessManager', ({ apiKeyManager }) => new PersonAccessManager(apiKeyManager))\n\t\t\t.addService('personManager', ({ emailValidator }) => new PersonManager(emailValidator))\n\t\t\t.addService(\n\t\t\t\t'passwordResetManager',\n\t\t\t\t({ userMailer, projectManager, passwordStrengthValidator }) => new PasswordResetManager(userMailer, projectManager, passwordStrengthValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailVerificationManager',\n\t\t\t\t({ userMailer, projectManager }) => new EmailVerificationManager(userMailer, projectManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailChangeManager',\n\t\t\t\t({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) =>\n\t\t\t\t\tnew EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'idpSignInManager',\n\t\t\t\t({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService),\n\t\t\t)\n\t\t\t.addService('idpManager', ({ idpRegistry, projectSchemaResolver }) => new IDPManager(idpRegistry, projectSchemaResolver))\n\t\t\t.addService('personIdentityProviderManager', () => new PersonIdentityProviderManager())\n\t\t\t.addService('otpAuthenticator', ({ providers }) => new OtpAuthenticator(providers))\n\t\t\t.addService('otpManager', ({ otpAuthenticator, providers }) => new OtpManager(otpAuthenticator, providers))\n\t\t\t.addService('backupCodeManager', ({ providers, userMailer }) => new BackupCodeManager(userMailer, providers))\n\t\t\t.addService('emailOtpManager', ({ userMailer, providers, rateLimiter }) => new EmailOtpManager(userMailer, providers, rateLimiter))\n\t\t\t.addService('authPolicyManager', ({ projectManager }) => new AuthPolicyManager(projectManager))\n\t\t\t.addService(\n\t\t\t\t'signInManager',\n\t\t\t\t({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) =>\n\t\t\t\t\tnew SignInManager(\n\t\t\t\t\t\tapiKeyManager,\n\t\t\t\t\t\tproviders,\n\t\t\t\t\t\totpManager,\n\t\t\t\t\t\tbackupCodeManager,\n\t\t\t\t\t\temailOtpManager,\n\t\t\t\t\t\tauthPolicyResolver,\n\t\t\t\t\t\tloginRiskAnalyzer,\n\t\t\t\t\t\tuserMailer,\n\t\t\t\t\t),\n\t\t\t)\n\t\t\t.addService('membershipValidator', ({ projectSchemaResolver }) => new MembershipValidator(projectSchemaResolver))\n\t\t\t.addService('inviteManager', ({ providers, userMailer, projectSchemaResolver }) => new InviteManager(providers, userMailer, projectSchemaResolver))\n\t\t\t.addService('mailTemplateManager', () => new MailTemplateManager())\n\t\t\t.addService('rolesManager', () => new RolesManager())\n\t\t\t.addService('configurationManager', () => new ConfigurationManager())\n\t\t\t.addService(\n\t\t\t\t'passwordlessSignInManager',\n\t\t\t\t({ apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager }) =>\n\t\t\t\t\tnew PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'identityTypeResolver',\n\t\t\t\t({ projectMemberManager, projectManager, permissionContextFactory }) =>\n\t\t\t\t\tnew IdentityTypeResolver(projectMemberManager, projectManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'projectTypeResolver',\n\t\t\t\t({ projectMemberManager, projectSchemaResolver, secretManager }) =>\n\t\t\t\t\tnew ProjectTypeResolver(projectMemberManager, projectSchemaResolver, secretManager),\n\t\t\t)\n\t\t\t.addService('personTypeResolver', ({ personIdentityProviderManager }) => new PersonTypeResolver(personIdentityProviderManager))\n\t\t\t.addService(\n\t\t\t\t'signInResponseFactory',\n\t\t\t\t({ permissionContextFactory, identityTypeResolver }) => new SignInResponseFactory(permissionContextFactory, identityTypeResolver),\n\t\t\t)\n\t\t\t.addService('meQueryResolver', () => new MeQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'personQueryResolver',\n\t\t\t\t({ personManager, projectManager, projectMemberManager }) => new PersonQueryResolver(personManager, projectManager, projectMemberManager),\n\t\t\t)\n\t\t\t.addService('idpQueryResolver', ({ idpManager }) => new IDPQueryResolver(idpManager))\n\t\t\t.addService('projectQueryResolver', ({ projectManager }) => new ProjectQueryResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'projectMembersQueryResolver',\n\t\t\t\t({ projectManager, projectMemberManager }) => new ProjectMembersQueryResolver(projectManager, projectMemberManager),\n\t\t\t)\n\t\t\t.addService('mailTemplateQueryResolver', () => new MailTemplateQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'signUpMutationResolver',\n\t\t\t\t({ signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory }) =>\n\t\t\t\t\tnew SignUpMutationResolver(signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'signInMutationResolver',\n\t\t\t\t({ signInManager, signInResponseFactory, rateLimiter }) => new SignInMutationResolver(signInManager, signInResponseFactory, rateLimiter),\n\t\t\t)\n\t\t\t.addService('signOutMutationResolver', ({ signOutManager }) => new SignOutMutationResolver(signOutManager))\n\t\t\t.addService(\n\t\t\t\t'changeProfileMutationResolver',\n\t\t\t\t({ personManager, emailChangeManager, permissionContextFactory }) =>\n\t\t\t\t\tnew ChangeProfileMutationResolver(personManager, emailChangeManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailVerificationMutationResolver',\n\t\t\t\t({ emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew EmailVerificationMutationResolver(emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService('changePasswordMutationResolver', ({ passwordChangeManager }) => new ChangePasswordMutationResolver(passwordChangeManager))\n\t\t\t.addService(\n\t\t\t\t'resetPasswordMutationResolver',\n\t\t\t\t({ passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew ResetPasswordMutationResolver(passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'inviteMutationResolver',\n\t\t\t\t({ inviteManager, projectManager, membershipValidator }) => new InviteMutationResolver(inviteManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'addProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew AddProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'updateProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew UpdateProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'removeProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager }) => new RemoveProjectMemberMutationResolver(projectMemberManager, projectManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'createApiKeyMutationResolver',\n\t\t\t\t({ apiKeyManager, projectManager, membershipValidator }) => new CreateApiKeyMutationResolver(apiKeyManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService('disableApiKeyMutationResolver', ({ apiKeyManager }) => new DisableApiKeyMutationResolver(apiKeyManager))\n\t\t\t.addService(\n\t\t\t\t'otpMutationResolver',\n\t\t\t\t({ otpManager, backupCodeManager, authPolicyResolver }) => new OtpMutationResolver(otpManager, backupCodeManager, authPolicyResolver),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailOtpMutationResolver',\n\t\t\t\t({ emailOtpManager, backupCodeManager, authPolicyResolver }) =>\n\t\t\t\t\tnew EmailOtpMutationResolver(emailOtpManager, backupCodeManager, authPolicyResolver),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'regenerateBackupCodesMutationResolver',\n\t\t\t\t({ backupCodeManager }) => new RegenerateBackupCodesMutationResolver(backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'mailTemplateMutationResolver',\n\t\t\t\t({ projectManager, mailTemplateManager }) => new MailTemplateMutationResolver(projectManager, mailTemplateManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'idpMutationResolver',\n\t\t\t\t({ idpSignInManager, signInResponseFactory }) => new IDPMutationResolver(idpSignInManager, signInResponseFactory),\n\t\t\t)\n\t\t\t.addService('registerIdpMutationResolver', ({ idpManager }) => new AddIDPMutationResolver(idpManager))\n\t\t\t.addService('updateIdpMutationResolver', ({ idpManager }) => new UpdateIDPMutationResolver(idpManager))\n\t\t\t.addService('disableIdpMutationResolver', ({ idpManager }) => new DisableIDPMutationResolver(idpManager))\n\t\t\t.addService('enableIdpMutationResolver', ({ idpManager }) => new EnableIDPMutationResolver(idpManager))\n\t\t\t.addService(\n\t\t\t\t'disconnectMyIdentityProviderMutationResolver',\n\t\t\t\t({ personIdentityProviderManager }) => new DisconnectMyIdentityProviderMutationResolver(personIdentityProviderManager),\n\t\t\t)\n\t\t\t.addService('createProjectMutationResolver', ({ projectManager }) => new CreateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'disablePersonMutationResolver',\n\t\t\t\t({ personAccessManager, personManager }) => new DisablePersonMutationResolver(personAccessManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'enablePersonMutationResolver',\n\t\t\t\t({ personAccessManager, personManager }) => new EnablePersonMutationResolver(personAccessManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'forceSignOutMutationResolver',\n\t\t\t\t({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'resetPersonMfaMutationResolver',\n\t\t\t\t({ personManager, backupCodeManager }) => new ResetPersonMfaMutationResolver(personManager, backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'revokeSessionMutationResolver',\n\t\t\t\t({ apiKeyManager }) => new RevokeSessionMutationResolver(apiKeyManager),\n\t\t\t)\n\t\t\t.addService('updateProjectMutationResolver', ({ projectManager }) => new UpdateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'setProjectSecretMutationResolver',\n\t\t\t\t({ projectManager, secretManager }) => new SetProjectSecretMutationResolver(projectManager, secretManager),\n\t\t\t)\n\t\t\t.addService('identityGlobalRolesMutationResolver', ({ rolesManager }) => new IdentityGlobalRolesMutationResolver(rolesManager))\n\t\t\t.addService('configurationMutationResolver', ({ configurationManager }) => new ConfigurationMutationResolver(configurationManager))\n\t\t\t.addService('configurationQueryResolver', ({ configurationManager }) => new ConfigurationQueryResolver(configurationManager))\n\t\t\t.addService('authPolicyMutationResolver', ({ authPolicyManager }) => new AuthPolicyMutationResolver(authPolicyManager))\n\t\t\t.addService('authPolicyQueryResolver', ({ authPolicyManager }) => new AuthPolicyQueryResolver(authPolicyManager))\n\t\t\t.addService('authLogQueryResolver', () => new AuthLogQueryResolver())\n\t\t\t.addService('apiKeyQueryResolver', () => new ApiKeyQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'passwordlessMutationResolver',\n\t\t\t\t({ passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'togglePasswordlessMutationResolver',\n\t\t\t\t({ configurationManager, personManager }) => new TogglePasswordlessMutationResolver(configurationManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t({ permissionContextFactory, authLogService, loginRiskAnalyzer }) =>\n\t\t\t\t\tnew TenantResolverContextFactory(permissionContextFactory, authLogService, loginRiskAnalyzer),\n\t\t\t)\n\t\t\t.addService('resolvers', container => new ResolverFactory(container).create())\n\t\t\t.addService('connection', () => args.connection)\n\t\t\t.addService('readConnection', () => args.readConnection)\n\t\t\t.addService(\n\t\t\t\t'databaseContext',\n\t\t\t\t({ connection, providers }) => new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t({ readConnection, providers }) => new DatabaseContext(readConnection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService('identityFetcher', ({ databaseContext }) => new IdentityFetcher(databaseContext.client))\n\t\t\t.addService('migrationsRunner', ({ providers }) => new TenantMigrationsRunner(args.dbCredentials, 'tenant', args.tenantCredentials, providers))\n\t}\n}\n"],"names":["Builder","createMailer","TemplateRenderer","AccessEvaluator","PermissionsFactory","Authorizator","UserMailer","ApiKeyService","AuthPolicyResolver","PanelAccessResolver","AuthLogService","LoginRiskAnalyzer","IDPHandlerRegistry","OIDCProvider","FacebookProvider","AppleProvider","IDPClaimSyncService","IdpSessionRevalidator","BackchannelLogoutManager","UnpersistedApiKeyManager","ApiKeyManager","SignOutManager","EmailValidator","HttpHibpChecker","NoopHibpChecker","PasswordStrengthValidator","CaptchaValidator","TurnstileProvider","HCaptchaProvider","RecaptchaV3Provider","RateLimiter","SignUpManager","PasswordChangeManager","ProjectMemberManager","IdentityFactory","ProjectScopeFactory","AclSchemaAccessNodeFactory","PermissionContextFactory","SecretsManager","ProjectManager","PersonAccessManager","PersonManager","PasswordResetManager","EmailVerificationManager","EmailChangeManager","IDPSignInManager","IDPManager","PersonIdentityProviderManager","OtpAuthenticator","OtpManager","BackupCodeManager","EmailOtpManager","AuthPolicyManager","SignInManager","MembershipValidator","InviteManager","MailTemplateManager","RolesManager","ConfigurationManager","PasswordlessSignInManager","IdentityTypeResolver","ProjectTypeResolver","PersonTypeResolver","SignInResponseFactory","MeQueryResolver","PersonQueryResolver","IDPQueryResolver","ProjectQueryResolver","ProjectMembersQueryResolver","MailTemplateQueryResolver","SignUpMutationResolver","SignInMutationResolver","SignOutMutationResolver","ChangeProfileMutationResolver","EmailVerificationMutationResolver","ChangePasswordMutationResolver","ResetPasswordMutationResolver","InviteMutationResolver","AddProjectMemberMutationResolver","UpdateProjectMemberMutationResolver","RemoveProjectMemberMutationResolver","CreateApiKeyMutationResolver","DisableApiKeyMutationResolver","OtpMutationResolver","EmailOtpMutationResolver","RegenerateBackupCodesMutationResolver","MailTemplateMutationResolver","IDPMutationResolver","AddIDPMutationResolver","UpdateIDPMutationResolver","DisableIDPMutationResolver","EnableIDPMutationResolver","DisconnectMyIdentityProviderMutationResolver","CreateProjectMutationResolver","DisablePersonMutationResolver","EnablePersonMutationResolver","ForceSignOutMutationResolver","ResetPersonMfaMutationResolver","RevokeSessionMutationResolver","UpdateProjectMutationResolver","SetProjectSecretMutationResolver","IdentityGlobalRolesMutationResolver","ConfigurationMutationResolver","ConfigurationQueryResolver","AuthPolicyMutationResolver","AuthPolicyQueryResolver","AuthLogQueryResolver","ApiKeyQueryResolver","PasswordlessMutationResolver","TogglePasswordlessMutationResolver","TenantResolverContextFactory","ResolverFactory","DatabaseContext","IdentityFetcher","TenantMigrationsRunner"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwJO,MAAM,uBAAuB;AAAA,EACnC,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,OAAO,MAA4C;AAClD,WAAO,KAAK,cAAc,IAAI,EAC5B,QACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEA,cAAc,MAA2B;AACxC,WAAO,IAAIA,IAAAA,QAAQ,CAAA,CAAE,EACnB,WAAW,aAAa,OAAO,EAAE,GAAG,KAAK,WAAW,GAAG,KAAK,gBAAA,EAAkB,EAC9E,WAAW,UAAU,MAAMC,OAAAA,aAAa,KAAK,WAAW,CAAC,EACzD,WAAW,yBAAyB,MAAM,KAAK,qBAAqB,EACpE,WAAW,oBAAoB,MAAM,IAAIC,iBAAAA,iBAAA,CAAkB,EAC3D,WAAW,mBAAmB,CAAC,CAAA,MAAO,IAAIC,cAAAA,gBAAgB,oBAAoB,IAAIC,sCAAA,EAAqB,OAAA,CAAQ,CAAC,EAChH,WAAW,gBAAgB,CAAC,EAAE,sBAAsB,IAAIC,2BAAa,QAAQ,eAAe,CAAC,EAC7F,WAAW,cAAc,CAAC,EAAE,QAAQ,uBAAuB,IAAIC,sBAAW,QAAQ,gBAAgB,CAAC,EACnG,WAAW,iBAAiB,MAAM,IAAIC,cAAAA,eAAe,EACrD,WAAW,sBAAsB,MAAM,IAAIC,sCAAA,CAAoB,EAC/D,WAAW,uBAAuB,CAAC,EAAE,UAAA,MAAgB,IAAIC,oBAAAA,oBAAoB,SAAS,CAAC,EACvF,WAAW,kBAAkB,MAAM,IAAIC,eAAAA,gBAAgB,EACvD,WAAW,qBAAqB,CAAC,EAAE,UAAA,MAAgB,IAAIC,kBAAAA,kBAAkB,UAAU,IAAI,CAAC,EACxF,WAAW,eAAe,MAAM;AAChC,YAAM,cAAc,IAAIC,sCAAA;AACxB,kBAAY,gBAAgB,QAAQ,IAAIC,aAAAA,aAAA,CAAc;AACtD,kBAAY,gBAAgB,YAAY,IAAIC,iBAAAA,iBAAA,CAAkB;AAC9D,kBAAY,gBAAgB,SAAS,IAAIC,cAAAA,cAAA,CAAe;AACxD,aAAO;AAAA,IACR,CAAC,EACA,WAAW,uBAAuB,CAAC,EAAE,4BAA4B,IAAIC,oBAAAA,oBAAoB,qBAAqB,CAAC,EAC/G,WAAW,yBAAyB,CAAC,EAAE,aAAa,0BAA0B,IAAIC,sBAAAA,sBAAsB,aAAa,mBAAmB,CAAC,EACzI,WAAW,4BAA4B,CAAC,EAAE,YAAA,MAAkB,IAAIC,yBAAAA,yBAAyB,WAAW,CAAC,EACrG,WAAW,4BAA4B,MACvCC,yBAAAA,yBAAyB,oBAAoB;AAAA,MAC5C,QAAQ,KAAK,kBAAkB;AAAA,MAC/B,aAAa,KAAK,kBAAkB;AAAA,IAAA,CACpC,CAAC,EACF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,oBAAoB,gBAAgB,0BAA0B,sBAAA,MAC/E,IAAIC,cAAAA,cAAc,eAAe,oBAAoB,gBAAgB,0BAA0B,qBAAqB;AAAA,IAAA,EAErH,WAAW,kBAAkB,CAAC,EAAE,eAAe,YAAA,MAAkB,IAAIC,eAAAA,eAAe,eAAe,WAAW,CAAC,EAC/G,WAAW,kBAAkB,MAAM,IAAIC,eAAAA,gBAAgB,EACvD,WAAW,eAAe,MAAmB,IAAIC,YAAAA,iBAAiB,EAClE,WAAW,mBAAmB,MAAmB,IAAIC,YAAAA,iBAAiB,EACtE,WAAW,6BAA6B,CAAC,EAAE,kBAAkB,IAAIC,0BAAAA,0BAA0B,WAAW,CAAC,EACvG,WAAW,oBAAoB,MAC/B,IAAIC,kCAAiB;AAAA,MACpB,WAAW,IAAIC,kBAAAA,kBAAA;AAAA,MACf,UAAU,IAAIC,iBAAAA,iBAAA;AAAA,MACd,aAAa,IAAIC,oBAAAA,oBAAA;AAAA,IAAoB,CACrC,CAAC,EACF,WAAW,eAAe,CAAC,EAAE,UAAA,MAAgB,IAAIC,YAAAA,YAAY,SAAS,CAAC,EACvE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,0BAAA,MAAgC,IAAIC,cAAAA,cAAc,gBAAgB,yBAAyB;AAAA,IAAA,EAE9G,WAAW,yBAAyB,CAAC,EAAE,WAAW,gCAAgC,IAAIC,sBAAAA,sBAAsB,WAAW,yBAAyB,CAAC,EACjJ,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE,WAAW,mBAAmB,CAAC,EAAE,2BAA2B,IAAIC,gBAAAA,gBAAgB,oBAAoB,CAAC,EACrG,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAoB,IAAIC,2BAAAA,2BAAA,CAA4B,CAAC,EACjG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,cAAc,iBAAiB,qBAAqB,sBAAA,MACtD,IAAIC,yBAAAA,yBAAyB,cAAc,iBAAiB,qBAAqB,qBAAqB;AAAA,IAAA,EAEvG,WAAW,iBAAiB,CAAC,EAAE,UAAA,MAAgB,IAAIC,eAAAA,eAAe,SAAS,CAAC,EAC5E,WAAW,kBAAkB,CAAC,EAAE,eAAe,oBAAoB,IAAIC,eAAAA,eAAe,eAAe,KAAK,oBAAoB,aAAa,CAAC,EAC5I,WAAW,uBAAuB,CAAC,EAAE,cAAA,MAAoB,IAAIC,oBAAAA,oBAAoB,aAAa,CAAC,EAC/F,WAAW,iBAAiB,CAAC,EAAE,eAAA,MAAqB,IAAIC,4BAAc,cAAc,CAAC,EACrF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,gBAAgB,0BAAA,MAAgC,IAAIC,0CAAqB,YAAY,gBAAgB,yBAAyB;AAAA,IAAA,EAE7I;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,eAAA,MAAqB,IAAIC,yBAAAA,yBAAyB,YAAY,cAAc;AAAA,IAAA,EAE3F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,gBAAgB,gBAAgB,eAAe,yBAAA,MAC7D,IAAIC,mBAAAA,mBAAmB,YAAY,gBAAgB,gBAAgB,eAAe,wBAAwB;AAAA,IAAA,EAE3G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,aAAa,oBAAA,MAA0B,IAAIC,kCAAiB,eAAe,aAAa,mBAAmB;AAAA,IAAA,EAE7H,WAAW,cAAc,CAAC,EAAE,aAAa,sBAAA,MAA4B,IAAIC,WAAAA,WAAW,aAAa,qBAAqB,CAAC,EACvH,WAAW,iCAAiC,MAAM,IAAIC,8BAAAA,8BAAA,CAA+B,EACrF,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAIC,iBAAAA,iBAAiB,SAAS,CAAC,EACjF,WAAW,cAAc,CAAC,EAAE,kBAAkB,UAAA,MAAgB,IAAIC,WAAAA,WAAW,kBAAkB,SAAS,CAAC,EACzG,WAAW,qBAAqB,CAAC,EAAE,WAAW,WAAA,MAAiB,IAAIC,kBAAAA,kBAAkB,YAAY,SAAS,CAAC,EAC3G,WAAW,mBAAmB,CAAC,EAAE,YAAY,WAAW,YAAA,MAAkB,IAAIC,gBAAAA,gBAAgB,YAAY,WAAW,WAAW,CAAC,EACjI,WAAW,qBAAqB,CAAC,EAAE,eAAA,MAAqB,IAAIC,kBAAAA,kBAAkB,cAAc,CAAC,EAC7F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,WAAW,YAAY,mBAAmB,iBAAiB,oBAAoB,mBAAmB,WAAA,MACnH,IAAIC,cAAAA;AAAAA,QACH;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IACD,EAED,WAAW,uBAAuB,CAAC,EAAE,sBAAA,MAA4B,IAAIC,oBAAAA,oBAAoB,qBAAqB,CAAC,EAC/G,WAAW,iBAAiB,CAAC,EAAE,WAAW,YAAY,sBAAA,MAA4B,IAAIC,cAAAA,cAAc,WAAW,YAAY,qBAAqB,CAAC,EACjJ,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAA,CAAqB,EACjE,WAAW,gBAAgB,MAAM,IAAIC,aAAAA,aAAA,CAAc,EACnD,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,YAAY,gBAAgB,YAAY,kBAAA,MACzD,IAAIC,0BAAAA,0BAA0B,eAAe,YAAY,gBAAgB,YAAY,iBAAiB;AAAA,IAAA,EAEvG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,yBAAA,MACxC,IAAIC,0CAAqB,sBAAsB,gBAAgB,wBAAwB;AAAA,IAAA,EAExF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,uBAAuB,cAAA,MAC/C,IAAIC,wCAAoB,sBAAsB,uBAAuB,aAAa;AAAA,IAAA,EAEnF,WAAW,sBAAsB,CAAC,EAAE,8BAAA,MAAoC,IAAIC,mBAAAA,mBAAmB,6BAA6B,CAAC,EAC7H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,qBAAA,MAA2B,IAAIC,sBAAAA,sBAAsB,0BAA0B,oBAAoB;AAAA,IAAA,EAEhI,WAAW,mBAAmB,MAAM,IAAIC,gBAAAA,gBAAA,CAAiB,EACzD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,qBAAA,MAA2B,IAAIC,wCAAoB,eAAe,gBAAgB,oBAAoB;AAAA,IAAA,EAExI,WAAW,oBAAoB,CAAC,EAAE,WAAA,MAAiB,IAAIC,iBAAAA,iBAAiB,UAAU,CAAC,EACnF,WAAW,wBAAwB,CAAC,EAAE,eAAA,MAAqB,IAAIC,0CAAqB,cAAc,CAAC,EACnG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,qBAAA,MAA2B,IAAIC,4BAAAA,4BAA4B,gBAAgB,oBAAoB;AAAA,IAAA,EAElH,WAAW,6BAA6B,MAAM,IAAIC,0BAAAA,0BAAA,CAA2B,EAC7E;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,eAAe,kBAAkB,aAAa,0BAA0B,yBAAA,MACzF,IAAIC,uBAAAA,uBAAuB,eAAe,eAAe,kBAAkB,aAAa,0BAA0B,wBAAwB;AAAA,IAAA,EAE3I;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,uBAAuB,YAAA,MAAkB,IAAIC,8CAAuB,eAAe,uBAAuB,WAAW;AAAA,IAAA,EAEvI,WAAW,2BAA2B,CAAC,EAAE,eAAA,MAAqB,IAAIC,wBAAAA,wBAAwB,cAAc,CAAC,EACzG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,oBAAoB,yBAAA,MACrC,IAAIC,4DAA8B,eAAe,oBAAoB,wBAAwB;AAAA,IAAA,EAE9F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,0BAA0B,kBAAkB,YAAA,MACxE,IAAIC,kCAAAA,kCAAkC,0BAA0B,0BAA0B,kBAAkB,WAAW;AAAA,IAAA,EAExH,WAAW,kCAAkC,CAAC,EAAE,sBAAA,MAA4B,IAAIC,+BAAAA,+BAA+B,qBAAqB,CAAC,EACrI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,0BAA0B,kBAAkB,YAAA,MACpE,IAAIC,8BAAAA,8BAA8B,sBAAsB,0BAA0B,kBAAkB,WAAW;AAAA,IAAA,EAEhH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAIC,8CAAuB,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAEzI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAIC,kEAAiC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAE/F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAIC,wEAAoC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAElG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,eAAA,MAAqB,IAAIC,oCAAAA,oCAAoC,sBAAsB,cAAc;AAAA,IAAA,EAE1H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAIC,0DAA6B,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAE/I,WAAW,iCAAiC,CAAC,EAAE,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,aAAa,CAAC,EACnH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,mBAAmB,mBAAA,MAAyB,IAAIC,wCAAoB,YAAY,mBAAmB,kBAAkB;AAAA,IAAA,EAEpI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,iBAAiB,mBAAmB,mBAAA,MACtC,IAAIC,kDAAyB,iBAAiB,mBAAmB,kBAAkB;AAAA,IAAA,EAEpF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,kBAAA,MAAwB,IAAIC,sCAAAA,sCAAsC,iBAAiB;AAAA,IAAA,EAEtF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,oBAAA,MAA0B,IAAIC,6BAAAA,6BAA6B,gBAAgB,mBAAmB;AAAA,IAAA,EAEjH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,kBAAkB,sBAAA,MAA4B,IAAIC,oBAAAA,oBAAoB,kBAAkB,qBAAqB;AAAA,IAAA,EAEhH,WAAW,+BAA+B,CAAC,EAAE,WAAA,MAAiB,IAAIC,uBAAAA,uBAAuB,UAAU,CAAC,EACpG,WAAW,6BAA6B,CAAC,EAAE,iBAAiB,IAAIC,0BAAAA,0BAA0B,UAAU,CAAC,EACrG,WAAW,8BAA8B,CAAC,EAAE,WAAA,MAAiB,IAAIC,2BAAAA,2BAA2B,UAAU,CAAC,EACvG,WAAW,6BAA6B,CAAC,EAAE,WAAA,MAAiB,IAAIC,0BAAAA,0BAA0B,UAAU,CAAC,EACrG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,8BAAA,MAAoC,IAAIC,6CAAAA,6CAA6C,6BAA6B;AAAA,IAAA,EAErH,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAIC,8BAAAA,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,qBAAqB,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,qBAAqB,aAAa;AAAA,IAAA,EAEhH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,qBAAqB,cAAA,MAAoB,IAAIC,6BAAAA,6BAA6B,qBAAqB,aAAa;AAAA,IAAA,EAE/G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,eAAe,WAAA,MAAiB,IAAIC,0DAA6B,eAAe,eAAe,UAAU;AAAA,IAAA,EAE3H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,kBAAA,MAAwB,IAAIC,+BAAAA,+BAA+B,eAAe,iBAAiB;AAAA,IAAA,EAE7G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,aAAa;AAAA,IAAA,EAEtE,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAIC,8BAAAA,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,cAAA,MAAoB,IAAIC,iCAAAA,iCAAiC,gBAAgB,aAAa;AAAA,IAAA,EAEzG,WAAW,uCAAuC,CAAC,EAAE,aAAA,MAAmB,IAAIC,gEAAoC,YAAY,CAAC,EAC7H,WAAW,iCAAiC,CAAC,EAAE,2BAA2B,IAAIC,4DAA8B,oBAAoB,CAAC,EACjI,WAAW,8BAA8B,CAAC,EAAE,2BAA2B,IAAIC,sDAA2B,oBAAoB,CAAC,EAC3H,WAAW,8BAA8B,CAAC,EAAE,wBAAwB,IAAIC,2BAAAA,2BAA2B,iBAAiB,CAAC,EACrH,WAAW,2BAA2B,CAAC,EAAE,wBAAwB,IAAIC,wBAAAA,wBAAwB,iBAAiB,CAAC,EAC/G,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAA,CAAqB,EACjE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,2BAA2B,uBAAuB,kBAAkB,YAAA,MACtE,IAAIC,6BAAAA,6BAA6B,2BAA2B,uBAAuB,kBAAkB,WAAW;AAAA,IAAA,EAEjH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,cAAA,MAAoB,IAAIC,mCAAAA,mCAAmC,sBAAsB,aAAa;AAAA,IAAA,EAEvH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,gBAAgB,kBAAA,MAC5C,IAAIC,0DAA6B,0BAA0B,gBAAgB,iBAAiB;AAAA,IAAA,EAE7F,WAAW,aAAa,CAAA,cAAa,IAAIC,gBAAAA,gBAAgB,SAAS,EAAE,OAAA,CAAQ,EAC5E,WAAW,cAAc,MAAM,KAAK,UAAU,EAC9C,WAAW,kBAAkB,MAAM,KAAK,cAAc,EACtD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,UAAA,MAAgB,IAAIC,gBAAAA,gBAAgB,WAAW,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAErH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,UAAA,MAAgB,IAAIA,gBAAAA,gBAAgB,eAAe,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAE7H,WAAW,mBAAmB,CAAC,EAAE,gBAAA,MAAsB,IAAIC,gBAAAA,gBAAgB,gBAAgB,MAAM,CAAC,EAClG,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAIC,OAAAA,uBAAuB,KAAK,eAAe,UAAU,KAAK,mBAAmB,SAAS,CAAC;AAAA,EAChJ;AACD;;"}
+{"version":3,"file":"TenantContainer.cjs","sources":["../../../../packages/engine-tenant-api/src/TenantContainer.ts"],"sourcesContent":["import { Logger } from '@contember/logger'\nimport { AccessEvaluator, Authorizator } from '@contember/authorization'\nimport { Connection, DatabaseConfig } from '@contember/database'\nimport { Builder } from '@contember/dic'\nimport {\n\tAclSchemaAccessNodeFactory,\n\tApiKeyManager,\n\tApiKeyService,\n\tAppleProvider,\n\tAuthPolicyManager,\n\tAuthPolicyResolver,\n\tBackchannelLogoutManager,\n\tBackupCodeManager,\n\tCaptchaValidator,\n\tDatabaseContext,\n\tEmailChangeManager,\n\tEmailOtpManager,\n\tEmailValidator,\n\tEmailVerificationManager,\n\tFacebookProvider,\n\tHCaptchaProvider,\n\tIdentity,\n\tIdentityFactory,\n\tIDPClaimSyncService,\n\tIDPHandlerRegistry,\n\tIDPManager,\n\tIdpSessionRevalidator,\n\tIDPSignInManager,\n\tInviteManager,\n\tLoginRiskAnalyzer,\n\tMailTemplateManager,\n\tMembershipValidator,\n\tOIDCProvider,\n\tOtpAuthenticator,\n\tOtpManager,\n\tPanelAccessResolver,\n\tPasswordChangeManager,\n\tPasswordResetManager,\n\tPermissionContextFactory,\n\tPermissionsFactory,\n\tPersonAccessManager,\n\tPersonIdentityProviderManager,\n\tPersonManager,\n\tProjectInitializer,\n\tProjectManager,\n\tProjectMemberManager,\n\tProjectSchemaResolver,\n\tProjectScopeFactory,\n\tProviders,\n\tRateLimiter,\n\tRecaptchaV3Provider,\n\tRolesManager,\n\tSecretsManager,\n\tSignInManager,\n\tSignOutManager,\n\tSignUpManager,\n\tTurnstileProvider,\n\tUnpersistedApiKeyManager,\n\tUserMailer,\n} from './model/index.js'\nimport { HibpChecker, HttpHibpChecker, NoopHibpChecker } from './model/service/HibpChecker.js'\nimport {\n\tAddIDPMutationResolver,\n\tAddProjectMemberMutationResolver,\n\tChangePasswordMutationResolver,\n\tChangeProfileMutationResolver,\n\tCreateApiKeyMutationResolver,\n\tCreateProjectMutationResolver,\n\tDisableApiKeyMutationResolver,\n\tDisableIDPMutationResolver,\n\tDisconnectMyIdentityProviderMutationResolver,\n\tEmailOtpMutationResolver,\n\tEmailVerificationMutationResolver,\n\tEnableIDPMutationResolver,\n\tIdentityGlobalRolesMutationResolver,\n\tIdentityTypeResolver,\n\tIDPMutationResolver,\n\tInviteMutationResolver,\n\tMailTemplateMutationResolver,\n\tMeQueryResolver,\n\tOtpMutationResolver,\n\tPersonQueryResolver,\n\tPersonTypeResolver,\n\tProjectMembersQueryResolver,\n\tProjectQueryResolver,\n\tProjectTypeResolver,\n\tRegenerateBackupCodesMutationResolver,\n\tRemoveProjectMemberMutationResolver,\n\tResetPasswordMutationResolver,\n\tResolverFactory,\n\tSetProjectSecretMutationResolver,\n\tSignInMutationResolver,\n\tSignOutMutationResolver,\n\tSignUpMutationResolver,\n\tTenantResolverContextFactory,\n\tUpdateProjectMemberMutationResolver,\n\tUpdateProjectMutationResolver,\n} from './resolvers/index.js'\nimport * as Schema from './schema/index.js'\nimport { createMailer, MailerOptions, TemplateRenderer } from './utils/index.js'\nimport { IdentityFetcher } from './bridges/system/IdentityFetcher.js'\nimport { SignInResponseFactory } from './resolvers/responseHelpers/SignInResponseFactory.js'\nimport { IDPQueryResolver } from './resolvers/query/IDPQueryResolver.js'\nimport { UpdateIDPMutationResolver } from './resolvers/mutation/idp/UpdateIDPMutationResolver.js'\nimport { TenantCredentials, TenantMigrationsRunner } from './migrations/index.js'\nimport { DisablePersonMutationResolver } from './resolvers/mutation/person/DisablePersonMutationResolver.js'\nimport { EnablePersonMutationResolver } from './resolvers/mutation/person/EnablePersonMutationResolver.js'\nimport { ForceSignOutMutationResolver } from './resolvers/mutation/person/ForceSignOutMutationResolver.js'\nimport { RevokeSessionMutationResolver } from './resolvers/mutation/person/RevokeSessionMutationResolver.js'\nimport { MailTemplateQueryResolver } from './resolvers/query/MailTemplateQueryResolver.js'\nimport { ConfigurationManager } from './model/service/ConfigurationManager.js'\nimport { ConfigurationMutationResolver } from './resolvers/mutation/configuration/ConfigurationMutationResolver.js'\nimport { ConfigurationQueryResolver } from './resolvers/query/ConfigurationQueryResolver.js'\nimport { AuthPolicyMutationResolver } from './resolvers/mutation/configuration/AuthPolicyMutationResolver.js'\nimport { AuthPolicyQueryResolver } from './resolvers/query/AuthPolicyQueryResolver.js'\nimport { ResetPersonMfaMutationResolver } from './resolvers/mutation/person/ResetPersonMfaMutationResolver.js'\nimport { AuthLogQueryResolver } from './resolvers/query/AuthLogQueryResolver.js'\nimport { ApiKeyQueryResolver } from './resolvers/query/ApiKeyQueryResolver.js'\nimport { PasswordlessMutationResolver } from './resolvers/mutation/person/PasswordlessMutationResolver.js'\nimport { PasswordlessSignInManager } from './model/service/PasswordlessSignInManager.js'\nimport { TogglePasswordlessMutationResolver } from './resolvers/mutation/person/TogglePasswordlessMutationResolver.js'\nimport { PasswordStrengthValidator } from './model/service/PasswordStrengthValidator.js'\nimport { AuthLogService } from './model/service/AuthLogService.js'\n\nexport interface TenantContainer {\n\tprojectMemberManager: ProjectMemberManager\n\tapiKeyManager: ApiKeyManager\n\tbackchannelLogoutManager: BackchannelLogoutManager\n\tsignUpManager: SignUpManager\n\tprojectManager: ProjectManager\n\tpanelAccessResolver: PanelAccessResolver\n\tresolvers: Schema.Resolvers\n\tresolverContextFactory: TenantResolverContextFactory\n\tauthorizator: Authorizator<Identity>\n\tidentityFetcher: IdentityFetcher\n\tdatabaseContext: DatabaseContext\n\treadDatabaseContext: DatabaseContext\n\tmigrationsRunner: TenantMigrationsRunner\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n}\n\nexport interface TenantContainerArgs {\n\tconnection: Connection.ConnectionType\n\treadConnection: Connection.ConnectionType\n\tdbCredentials: DatabaseConfig\n\tmailOptions: MailerOptions\n\tprojectSchemaResolver: ProjectSchemaResolver\n\tprojectInitializer: ProjectInitializer\n\ttenantCredentials: TenantCredentials\n\tcryptoProviders: Pick<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>\n\tlogger: Logger\n}\n\nexport class TenantContainerFactory {\n\tconstructor(\n\t\tprivate readonly providers: Omit<Providers, 'encrypt' | 'decrypt' | 'encryptionEnabled'>,\n\t) {}\n\n\tcreate(args: TenantContainerArgs): TenantContainer {\n\t\treturn this.createBuilder(args)\n\t\t\t.build()\n\t\t\t.pick(\n\t\t\t\t'apiKeyManager',\n\t\t\t\t'backchannelLogoutManager',\n\t\t\t\t'projectMemberManager',\n\t\t\t\t'projectManager',\n\t\t\t\t'panelAccessResolver',\n\t\t\t\t'signUpManager',\n\t\t\t\t'resolvers',\n\t\t\t\t'authorizator',\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t'identityFetcher',\n\t\t\t\t'databaseContext',\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t'migrationsRunner',\n\t\t\t\t'connection',\n\t\t\t\t'readConnection',\n\t\t\t)\n\t}\n\n\tcreateBuilder(args: TenantContainerArgs) {\n\t\treturn new Builder({})\n\t\t\t.addService('providers', () => ({ ...this.providers, ...args.cryptoProviders }))\n\t\t\t.addService('mailer', () => createMailer(args.mailOptions))\n\t\t\t.addService('projectSchemaResolver', () => args.projectSchemaResolver)\n\t\t\t.addService('templateRenderer', () => new TemplateRenderer())\n\t\t\t.addService('accessEvaluator', ({}) => new AccessEvaluator.PermissionEvaluator(new PermissionsFactory().create()))\n\t\t\t.addService('authorizator', ({ accessEvaluator }) => new Authorizator.Default(accessEvaluator))\n\t\t\t.addService('userMailer', ({ mailer, templateRenderer }) => new UserMailer(mailer, templateRenderer))\n\t\t\t.addService('apiKeyService', () => new ApiKeyService())\n\t\t\t.addService('authPolicyResolver', () => new AuthPolicyResolver())\n\t\t\t.addService('panelAccessResolver', ({ providers }) => new PanelAccessResolver(providers))\n\t\t\t.addService('authLogService', () => new AuthLogService())\n\t\t\t.addService('loginRiskAnalyzer', ({ providers }) => new LoginRiskAnalyzer(providers.hash))\n\t\t\t.addService('idpRegistry', () => {\n\t\t\t\tconst idpRegistry = new IDPHandlerRegistry()\n\t\t\t\tidpRegistry.registerHandler('oidc', new OIDCProvider())\n\t\t\t\tidpRegistry.registerHandler('facebook', new FacebookProvider())\n\t\t\t\tidpRegistry.registerHandler('apple', new AppleProvider())\n\t\t\t\treturn idpRegistry\n\t\t\t})\n\t\t\t.addService('idpClaimSyncService', ({ projectSchemaResolver }) => new IDPClaimSyncService(projectSchemaResolver))\n\t\t\t.addService(\n\t\t\t\t'idpSessionRevalidator',\n\t\t\t\t({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService, args.logger),\n\t\t\t)\n\t\t\t.addService('backchannelLogoutManager', ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry))\n\t\t\t.addService('unpersistedApiKeyManager', () =>\n\t\t\t\tUnpersistedApiKeyManager.createForRootTokens({\n\t\t\t\t\ttokens: args.tenantCredentials.rootTokens,\n\t\t\t\t\ttokenHashes: args.tenantCredentials.rootTokenHashes,\n\t\t\t\t}))\n\t\t\t.addService(\n\t\t\t\t'apiKeyManager',\n\t\t\t\t({ apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator }) =>\n\t\t\t\t\tnew ApiKeyManager(apiKeyService, authPolicyResolver, authLogService, unpersistedApiKeyManager, idpSessionRevalidator),\n\t\t\t)\n\t\t\t.addService('signOutManager', ({ apiKeyManager, idpRegistry }) => new SignOutManager(apiKeyManager, idpRegistry))\n\t\t\t.addService('emailValidator', () => new EmailValidator())\n\t\t\t.addService('hibpChecker', (): HibpChecker => new HttpHibpChecker())\n\t\t\t.addService('noopHibpChecker', (): HibpChecker => new NoopHibpChecker())\n\t\t\t.addService('passwordStrengthValidator', ({ hibpChecker }) => new PasswordStrengthValidator(hibpChecker))\n\t\t\t.addService('captchaValidator', () =>\n\t\t\t\tnew CaptchaValidator({\n\t\t\t\t\tturnstile: new TurnstileProvider(),\n\t\t\t\t\thcaptcha: new HCaptchaProvider(),\n\t\t\t\t\trecaptchaV3: new RecaptchaV3Provider(),\n\t\t\t\t}))\n\t\t\t.addService('rateLimiter', ({ providers }) => new RateLimiter(providers))\n\t\t\t.addService(\n\t\t\t\t'signUpManager',\n\t\t\t\t({ emailValidator, passwordStrengthValidator }) => new SignUpManager(emailValidator, passwordStrengthValidator),\n\t\t\t)\n\t\t\t.addService('passwordChangeManager', ({ providers, passwordStrengthValidator }) => new PasswordChangeManager(providers, passwordStrengthValidator))\n\t\t\t.addService('projectMemberManager', () => new ProjectMemberManager())\n\t\t\t.addService('identityFactory', ({ projectMemberManager }) => new IdentityFactory(projectMemberManager))\n\t\t\t.addService('projectScopeFactory', () => new ProjectScopeFactory(new AclSchemaAccessNodeFactory()))\n\t\t\t.addService(\n\t\t\t\t'permissionContextFactory',\n\t\t\t\t({ authorizator, identityFactory, projectScopeFactory, projectSchemaResolver }) =>\n\t\t\t\t\tnew PermissionContextFactory(authorizator, identityFactory, projectScopeFactory, projectSchemaResolver),\n\t\t\t)\n\t\t\t.addService('secretManager', ({ providers }) => new SecretsManager(providers))\n\t\t\t.addService('projectManager', ({ secretManager, apiKeyService }) => new ProjectManager(secretManager, args.projectInitializer, apiKeyService))\n\t\t\t.addService('personAccessManager', ({ apiKeyManager }) => new PersonAccessManager(apiKeyManager))\n\t\t\t.addService('personManager', ({ emailValidator }) => new PersonManager(emailValidator))\n\t\t\t.addService(\n\t\t\t\t'passwordResetManager',\n\t\t\t\t({ userMailer, projectManager, passwordStrengthValidator }) => new PasswordResetManager(userMailer, projectManager, passwordStrengthValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailVerificationManager',\n\t\t\t\t({ userMailer, projectManager }) => new EmailVerificationManager(userMailer, projectManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailChangeManager',\n\t\t\t\t({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) =>\n\t\t\t\t\tnew EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'idpSignInManager',\n\t\t\t\t({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService, args.logger),\n\t\t\t)\n\t\t\t.addService('idpManager', ({ idpRegistry, projectSchemaResolver }) => new IDPManager(idpRegistry, projectSchemaResolver))\n\t\t\t.addService('personIdentityProviderManager', () => new PersonIdentityProviderManager())\n\t\t\t.addService('otpAuthenticator', ({ providers }) => new OtpAuthenticator(providers))\n\t\t\t.addService('otpManager', ({ otpAuthenticator, providers }) => new OtpManager(otpAuthenticator, providers))\n\t\t\t.addService('backupCodeManager', ({ providers, userMailer }) => new BackupCodeManager(userMailer, providers))\n\t\t\t.addService('emailOtpManager', ({ userMailer, providers, rateLimiter }) => new EmailOtpManager(userMailer, providers, rateLimiter))\n\t\t\t.addService('authPolicyManager', ({ projectManager }) => new AuthPolicyManager(projectManager))\n\t\t\t.addService(\n\t\t\t\t'signInManager',\n\t\t\t\t({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) =>\n\t\t\t\t\tnew SignInManager(\n\t\t\t\t\t\tapiKeyManager,\n\t\t\t\t\t\tproviders,\n\t\t\t\t\t\totpManager,\n\t\t\t\t\t\tbackupCodeManager,\n\t\t\t\t\t\temailOtpManager,\n\t\t\t\t\t\tauthPolicyResolver,\n\t\t\t\t\t\tloginRiskAnalyzer,\n\t\t\t\t\t\tuserMailer,\n\t\t\t\t\t),\n\t\t\t)\n\t\t\t.addService('membershipValidator', ({ projectSchemaResolver }) => new MembershipValidator(projectSchemaResolver))\n\t\t\t.addService('inviteManager', ({ providers, userMailer, projectSchemaResolver }) => new InviteManager(providers, userMailer, projectSchemaResolver))\n\t\t\t.addService('mailTemplateManager', () => new MailTemplateManager())\n\t\t\t.addService('rolesManager', () => new RolesManager())\n\t\t\t.addService('configurationManager', () => new ConfigurationManager())\n\t\t\t.addService(\n\t\t\t\t'passwordlessSignInManager',\n\t\t\t\t({ apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager }) =>\n\t\t\t\t\tnew PasswordlessSignInManager(apiKeyManager, userMailer, projectManager, otpManager, backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'identityTypeResolver',\n\t\t\t\t({ projectMemberManager, projectManager, permissionContextFactory }) =>\n\t\t\t\t\tnew IdentityTypeResolver(projectMemberManager, projectManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'projectTypeResolver',\n\t\t\t\t({ projectMemberManager, projectSchemaResolver, secretManager }) =>\n\t\t\t\t\tnew ProjectTypeResolver(projectMemberManager, projectSchemaResolver, secretManager),\n\t\t\t)\n\t\t\t.addService('personTypeResolver', ({ personIdentityProviderManager }) => new PersonTypeResolver(personIdentityProviderManager))\n\t\t\t.addService(\n\t\t\t\t'signInResponseFactory',\n\t\t\t\t({ permissionContextFactory, identityTypeResolver }) => new SignInResponseFactory(permissionContextFactory, identityTypeResolver),\n\t\t\t)\n\t\t\t.addService('meQueryResolver', () => new MeQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'personQueryResolver',\n\t\t\t\t({ personManager, projectManager, projectMemberManager }) => new PersonQueryResolver(personManager, projectManager, projectMemberManager),\n\t\t\t)\n\t\t\t.addService('idpQueryResolver', ({ idpManager }) => new IDPQueryResolver(idpManager))\n\t\t\t.addService('projectQueryResolver', ({ projectManager }) => new ProjectQueryResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'projectMembersQueryResolver',\n\t\t\t\t({ projectManager, projectMemberManager }) => new ProjectMembersQueryResolver(projectManager, projectMemberManager),\n\t\t\t)\n\t\t\t.addService('mailTemplateQueryResolver', () => new MailTemplateQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'signUpMutationResolver',\n\t\t\t\t({ signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory }) =>\n\t\t\t\t\tnew SignUpMutationResolver(signUpManager, apiKeyManager, captchaValidator, rateLimiter, emailVerificationManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'signInMutationResolver',\n\t\t\t\t({ signInManager, signInResponseFactory, rateLimiter }) => new SignInMutationResolver(signInManager, signInResponseFactory, rateLimiter),\n\t\t\t)\n\t\t\t.addService('signOutMutationResolver', ({ signOutManager }) => new SignOutMutationResolver(signOutManager))\n\t\t\t.addService(\n\t\t\t\t'changeProfileMutationResolver',\n\t\t\t\t({ personManager, emailChangeManager, permissionContextFactory }) =>\n\t\t\t\t\tnew ChangeProfileMutationResolver(personManager, emailChangeManager, permissionContextFactory),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailVerificationMutationResolver',\n\t\t\t\t({ emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew EmailVerificationMutationResolver(emailVerificationManager, permissionContextFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService('changePasswordMutationResolver', ({ passwordChangeManager }) => new ChangePasswordMutationResolver(passwordChangeManager))\n\t\t\t.addService(\n\t\t\t\t'resetPasswordMutationResolver',\n\t\t\t\t({ passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew ResetPasswordMutationResolver(passwordResetManager, permissionContextFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'inviteMutationResolver',\n\t\t\t\t({ inviteManager, projectManager, membershipValidator }) => new InviteMutationResolver(inviteManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'addProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew AddProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'updateProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager, membershipValidator }) =>\n\t\t\t\t\tnew UpdateProjectMemberMutationResolver(projectMemberManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'removeProjectMemberMutationResolver',\n\t\t\t\t({ projectMemberManager, projectManager }) => new RemoveProjectMemberMutationResolver(projectMemberManager, projectManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'createApiKeyMutationResolver',\n\t\t\t\t({ apiKeyManager, projectManager, membershipValidator }) => new CreateApiKeyMutationResolver(apiKeyManager, projectManager, membershipValidator),\n\t\t\t)\n\t\t\t.addService('disableApiKeyMutationResolver', ({ apiKeyManager }) => new DisableApiKeyMutationResolver(apiKeyManager))\n\t\t\t.addService(\n\t\t\t\t'otpMutationResolver',\n\t\t\t\t({ otpManager, backupCodeManager, authPolicyResolver }) => new OtpMutationResolver(otpManager, backupCodeManager, authPolicyResolver),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'emailOtpMutationResolver',\n\t\t\t\t({ emailOtpManager, backupCodeManager, authPolicyResolver }) =>\n\t\t\t\t\tnew EmailOtpMutationResolver(emailOtpManager, backupCodeManager, authPolicyResolver),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'regenerateBackupCodesMutationResolver',\n\t\t\t\t({ backupCodeManager }) => new RegenerateBackupCodesMutationResolver(backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'mailTemplateMutationResolver',\n\t\t\t\t({ projectManager, mailTemplateManager }) => new MailTemplateMutationResolver(projectManager, mailTemplateManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'idpMutationResolver',\n\t\t\t\t({ idpSignInManager, signInResponseFactory }) => new IDPMutationResolver(idpSignInManager, signInResponseFactory),\n\t\t\t)\n\t\t\t.addService('registerIdpMutationResolver', ({ idpManager }) => new AddIDPMutationResolver(idpManager))\n\t\t\t.addService('updateIdpMutationResolver', ({ idpManager }) => new UpdateIDPMutationResolver(idpManager))\n\t\t\t.addService('disableIdpMutationResolver', ({ idpManager }) => new DisableIDPMutationResolver(idpManager))\n\t\t\t.addService('enableIdpMutationResolver', ({ idpManager }) => new EnableIDPMutationResolver(idpManager))\n\t\t\t.addService(\n\t\t\t\t'disconnectMyIdentityProviderMutationResolver',\n\t\t\t\t({ personIdentityProviderManager }) => new DisconnectMyIdentityProviderMutationResolver(personIdentityProviderManager),\n\t\t\t)\n\t\t\t.addService('createProjectMutationResolver', ({ projectManager }) => new CreateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'disablePersonMutationResolver',\n\t\t\t\t({ personAccessManager, personManager }) => new DisablePersonMutationResolver(personAccessManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'enablePersonMutationResolver',\n\t\t\t\t({ personAccessManager, personManager }) => new EnablePersonMutationResolver(personAccessManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'forceSignOutMutationResolver',\n\t\t\t\t({ apiKeyManager, personManager, userMailer }) => new ForceSignOutMutationResolver(apiKeyManager, personManager, userMailer),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'resetPersonMfaMutationResolver',\n\t\t\t\t({ personManager, backupCodeManager }) => new ResetPersonMfaMutationResolver(personManager, backupCodeManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'revokeSessionMutationResolver',\n\t\t\t\t({ apiKeyManager }) => new RevokeSessionMutationResolver(apiKeyManager),\n\t\t\t)\n\t\t\t.addService('updateProjectMutationResolver', ({ projectManager }) => new UpdateProjectMutationResolver(projectManager))\n\t\t\t.addService(\n\t\t\t\t'setProjectSecretMutationResolver',\n\t\t\t\t({ projectManager, secretManager }) => new SetProjectSecretMutationResolver(projectManager, secretManager),\n\t\t\t)\n\t\t\t.addService('identityGlobalRolesMutationResolver', ({ rolesManager }) => new IdentityGlobalRolesMutationResolver(rolesManager))\n\t\t\t.addService('configurationMutationResolver', ({ configurationManager }) => new ConfigurationMutationResolver(configurationManager))\n\t\t\t.addService('configurationQueryResolver', ({ configurationManager }) => new ConfigurationQueryResolver(configurationManager))\n\t\t\t.addService('authPolicyMutationResolver', ({ authPolicyManager }) => new AuthPolicyMutationResolver(authPolicyManager))\n\t\t\t.addService('authPolicyQueryResolver', ({ authPolicyManager }) => new AuthPolicyQueryResolver(authPolicyManager))\n\t\t\t.addService('authLogQueryResolver', () => new AuthLogQueryResolver())\n\t\t\t.addService('apiKeyQueryResolver', () => new ApiKeyQueryResolver())\n\t\t\t.addService(\n\t\t\t\t'passwordlessMutationResolver',\n\t\t\t\t({ passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter }) =>\n\t\t\t\t\tnew PasswordlessMutationResolver(passwordlessSignInManager, signInResponseFactory, captchaValidator, rateLimiter),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'togglePasswordlessMutationResolver',\n\t\t\t\t({ configurationManager, personManager }) => new TogglePasswordlessMutationResolver(configurationManager, personManager),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'resolverContextFactory',\n\t\t\t\t({ permissionContextFactory, authLogService, loginRiskAnalyzer }) =>\n\t\t\t\t\tnew TenantResolverContextFactory(permissionContextFactory, authLogService, loginRiskAnalyzer),\n\t\t\t)\n\t\t\t.addService('resolvers', container => new ResolverFactory(container).create())\n\t\t\t.addService('connection', () => args.connection)\n\t\t\t.addService('readConnection', () => args.readConnection)\n\t\t\t.addService(\n\t\t\t\t'databaseContext',\n\t\t\t\t({ connection, providers }) => new DatabaseContext(connection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService(\n\t\t\t\t'readDatabaseContext',\n\t\t\t\t({ readConnection, providers }) => new DatabaseContext(readConnection.createClient('tenant', { module: 'tenant' }), providers),\n\t\t\t)\n\t\t\t.addService('identityFetcher', ({ databaseContext }) => new IdentityFetcher(databaseContext.client))\n\t\t\t.addService('migrationsRunner', ({ providers }) => new TenantMigrationsRunner(args.dbCredentials, 'tenant', args.tenantCredentials, providers))\n\t}\n}\n"],"names":["Builder","createMailer","TemplateRenderer","AccessEvaluator","PermissionsFactory","Authorizator","UserMailer","ApiKeyService","AuthPolicyResolver","PanelAccessResolver","AuthLogService","LoginRiskAnalyzer","IDPHandlerRegistry","OIDCProvider","FacebookProvider","AppleProvider","IDPClaimSyncService","IdpSessionRevalidator","BackchannelLogoutManager","UnpersistedApiKeyManager","ApiKeyManager","SignOutManager","EmailValidator","HttpHibpChecker","NoopHibpChecker","PasswordStrengthValidator","CaptchaValidator","TurnstileProvider","HCaptchaProvider","RecaptchaV3Provider","RateLimiter","SignUpManager","PasswordChangeManager","ProjectMemberManager","IdentityFactory","ProjectScopeFactory","AclSchemaAccessNodeFactory","PermissionContextFactory","SecretsManager","ProjectManager","PersonAccessManager","PersonManager","PasswordResetManager","EmailVerificationManager","EmailChangeManager","IDPSignInManager","IDPManager","PersonIdentityProviderManager","OtpAuthenticator","OtpManager","BackupCodeManager","EmailOtpManager","AuthPolicyManager","SignInManager","MembershipValidator","InviteManager","MailTemplateManager","RolesManager","ConfigurationManager","PasswordlessSignInManager","IdentityTypeResolver","ProjectTypeResolver","PersonTypeResolver","SignInResponseFactory","MeQueryResolver","PersonQueryResolver","IDPQueryResolver","ProjectQueryResolver","ProjectMembersQueryResolver","MailTemplateQueryResolver","SignUpMutationResolver","SignInMutationResolver","SignOutMutationResolver","ChangeProfileMutationResolver","EmailVerificationMutationResolver","ChangePasswordMutationResolver","ResetPasswordMutationResolver","InviteMutationResolver","AddProjectMemberMutationResolver","UpdateProjectMemberMutationResolver","RemoveProjectMemberMutationResolver","CreateApiKeyMutationResolver","DisableApiKeyMutationResolver","OtpMutationResolver","EmailOtpMutationResolver","RegenerateBackupCodesMutationResolver","MailTemplateMutationResolver","IDPMutationResolver","AddIDPMutationResolver","UpdateIDPMutationResolver","DisableIDPMutationResolver","EnableIDPMutationResolver","DisconnectMyIdentityProviderMutationResolver","CreateProjectMutationResolver","DisablePersonMutationResolver","EnablePersonMutationResolver","ForceSignOutMutationResolver","ResetPersonMfaMutationResolver","RevokeSessionMutationResolver","UpdateProjectMutationResolver","SetProjectSecretMutationResolver","IdentityGlobalRolesMutationResolver","ConfigurationMutationResolver","ConfigurationQueryResolver","AuthPolicyMutationResolver","AuthPolicyQueryResolver","AuthLogQueryResolver","ApiKeyQueryResolver","PasswordlessMutationResolver","TogglePasswordlessMutationResolver","TenantResolverContextFactory","ResolverFactory","DatabaseContext","IdentityFetcher","TenantMigrationsRunner"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0JO,MAAM,uBAAuB;AAAA,EACnC,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EACf;AAAA,EAEH,OAAO,MAA4C;AAClD,WAAO,KAAK,cAAc,IAAI,EAC5B,QACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IAAA;AAAA,EAEH;AAAA,EAEA,cAAc,MAA2B;AACxC,WAAO,IAAIA,IAAAA,QAAQ,CAAA,CAAE,EACnB,WAAW,aAAa,OAAO,EAAE,GAAG,KAAK,WAAW,GAAG,KAAK,gBAAA,EAAkB,EAC9E,WAAW,UAAU,MAAMC,OAAAA,aAAa,KAAK,WAAW,CAAC,EACzD,WAAW,yBAAyB,MAAM,KAAK,qBAAqB,EACpE,WAAW,oBAAoB,MAAM,IAAIC,iBAAAA,iBAAA,CAAkB,EAC3D,WAAW,mBAAmB,CAAC,CAAA,MAAO,IAAIC,cAAAA,gBAAgB,oBAAoB,IAAIC,sCAAA,EAAqB,OAAA,CAAQ,CAAC,EAChH,WAAW,gBAAgB,CAAC,EAAE,sBAAsB,IAAIC,2BAAa,QAAQ,eAAe,CAAC,EAC7F,WAAW,cAAc,CAAC,EAAE,QAAQ,uBAAuB,IAAIC,sBAAW,QAAQ,gBAAgB,CAAC,EACnG,WAAW,iBAAiB,MAAM,IAAIC,cAAAA,eAAe,EACrD,WAAW,sBAAsB,MAAM,IAAIC,sCAAA,CAAoB,EAC/D,WAAW,uBAAuB,CAAC,EAAE,UAAA,MAAgB,IAAIC,oBAAAA,oBAAoB,SAAS,CAAC,EACvF,WAAW,kBAAkB,MAAM,IAAIC,eAAAA,gBAAgB,EACvD,WAAW,qBAAqB,CAAC,EAAE,UAAA,MAAgB,IAAIC,kBAAAA,kBAAkB,UAAU,IAAI,CAAC,EACxF,WAAW,eAAe,MAAM;AAChC,YAAM,cAAc,IAAIC,sCAAA;AACxB,kBAAY,gBAAgB,QAAQ,IAAIC,aAAAA,aAAA,CAAc;AACtD,kBAAY,gBAAgB,YAAY,IAAIC,iBAAAA,iBAAA,CAAkB;AAC9D,kBAAY,gBAAgB,SAAS,IAAIC,cAAAA,cAAA,CAAe;AACxD,aAAO;AAAA,IACR,CAAC,EACA,WAAW,uBAAuB,CAAC,EAAE,sBAAA,MAA4B,IAAIC,oBAAAA,oBAAoB,qBAAqB,CAAC,EAC/G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,aAAa,0BAA0B,IAAIC,sBAAAA,sBAAsB,aAAa,qBAAqB,KAAK,MAAM;AAAA,IAAA,EAEjH,WAAW,4BAA4B,CAAC,EAAE,kBAAkB,IAAIC,yBAAAA,yBAAyB,WAAW,CAAC,EACrG,WAAW,4BAA4B,MACvCC,yBAAAA,yBAAyB,oBAAoB;AAAA,MAC5C,QAAQ,KAAK,kBAAkB;AAAA,MAC/B,aAAa,KAAK,kBAAkB;AAAA,IAAA,CACpC,CAAC,EACF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,oBAAoB,gBAAgB,0BAA0B,sBAAA,MAC/E,IAAIC,cAAAA,cAAc,eAAe,oBAAoB,gBAAgB,0BAA0B,qBAAqB;AAAA,IAAA,EAErH,WAAW,kBAAkB,CAAC,EAAE,eAAe,YAAA,MAAkB,IAAIC,eAAAA,eAAe,eAAe,WAAW,CAAC,EAC/G,WAAW,kBAAkB,MAAM,IAAIC,eAAAA,gBAAgB,EACvD,WAAW,eAAe,MAAmB,IAAIC,YAAAA,iBAAiB,EAClE,WAAW,mBAAmB,MAAmB,IAAIC,YAAAA,iBAAiB,EACtE,WAAW,6BAA6B,CAAC,EAAE,kBAAkB,IAAIC,0BAAAA,0BAA0B,WAAW,CAAC,EACvG,WAAW,oBAAoB,MAC/B,IAAIC,kCAAiB;AAAA,MACpB,WAAW,IAAIC,kBAAAA,kBAAA;AAAA,MACf,UAAU,IAAIC,iBAAAA,iBAAA;AAAA,MACd,aAAa,IAAIC,oBAAAA,oBAAA;AAAA,IAAoB,CACrC,CAAC,EACF,WAAW,eAAe,CAAC,EAAE,UAAA,MAAgB,IAAIC,YAAAA,YAAY,SAAS,CAAC,EACvE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,0BAAA,MAAgC,IAAIC,cAAAA,cAAc,gBAAgB,yBAAyB;AAAA,IAAA,EAE9G,WAAW,yBAAyB,CAAC,EAAE,WAAW,gCAAgC,IAAIC,sBAAAA,sBAAsB,WAAW,yBAAyB,CAAC,EACjJ,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE,WAAW,mBAAmB,CAAC,EAAE,2BAA2B,IAAIC,gBAAAA,gBAAgB,oBAAoB,CAAC,EACrG,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAoB,IAAIC,2BAAAA,2BAAA,CAA4B,CAAC,EACjG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,cAAc,iBAAiB,qBAAqB,sBAAA,MACtD,IAAIC,yBAAAA,yBAAyB,cAAc,iBAAiB,qBAAqB,qBAAqB;AAAA,IAAA,EAEvG,WAAW,iBAAiB,CAAC,EAAE,UAAA,MAAgB,IAAIC,eAAAA,eAAe,SAAS,CAAC,EAC5E,WAAW,kBAAkB,CAAC,EAAE,eAAe,oBAAoB,IAAIC,eAAAA,eAAe,eAAe,KAAK,oBAAoB,aAAa,CAAC,EAC5I,WAAW,uBAAuB,CAAC,EAAE,cAAA,MAAoB,IAAIC,oBAAAA,oBAAoB,aAAa,CAAC,EAC/F,WAAW,iBAAiB,CAAC,EAAE,eAAA,MAAqB,IAAIC,4BAAc,cAAc,CAAC,EACrF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,gBAAgB,0BAAA,MAAgC,IAAIC,0CAAqB,YAAY,gBAAgB,yBAAyB;AAAA,IAAA,EAE7I;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,eAAA,MAAqB,IAAIC,yBAAAA,yBAAyB,YAAY,cAAc;AAAA,IAAA,EAE3F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,gBAAgB,gBAAgB,eAAe,yBAAA,MAC7D,IAAIC,mBAAAA,mBAAmB,YAAY,gBAAgB,gBAAgB,eAAe,wBAAwB;AAAA,IAAA,EAE3G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,aAAa,0BAA0B,IAAIC,kCAAiB,eAAe,aAAa,qBAAqB,KAAK,MAAM;AAAA,IAAA,EAE1I,WAAW,cAAc,CAAC,EAAE,aAAa,sBAAA,MAA4B,IAAIC,WAAAA,WAAW,aAAa,qBAAqB,CAAC,EACvH,WAAW,iCAAiC,MAAM,IAAIC,8BAAAA,8BAAA,CAA+B,EACrF,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAIC,iBAAAA,iBAAiB,SAAS,CAAC,EACjF,WAAW,cAAc,CAAC,EAAE,kBAAkB,UAAA,MAAgB,IAAIC,WAAAA,WAAW,kBAAkB,SAAS,CAAC,EACzG,WAAW,qBAAqB,CAAC,EAAE,WAAW,WAAA,MAAiB,IAAIC,kBAAAA,kBAAkB,YAAY,SAAS,CAAC,EAC3G,WAAW,mBAAmB,CAAC,EAAE,YAAY,WAAW,YAAA,MAAkB,IAAIC,gBAAAA,gBAAgB,YAAY,WAAW,WAAW,CAAC,EACjI,WAAW,qBAAqB,CAAC,EAAE,eAAA,MAAqB,IAAIC,kBAAAA,kBAAkB,cAAc,CAAC,EAC7F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,WAAW,YAAY,mBAAmB,iBAAiB,oBAAoB,mBAAmB,WAAA,MACnH,IAAIC,cAAAA;AAAAA,QACH;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MAAA;AAAA,IACD,EAED,WAAW,uBAAuB,CAAC,EAAE,sBAAA,MAA4B,IAAIC,oBAAAA,oBAAoB,qBAAqB,CAAC,EAC/G,WAAW,iBAAiB,CAAC,EAAE,WAAW,YAAY,sBAAA,MAA4B,IAAIC,cAAAA,cAAc,WAAW,YAAY,qBAAqB,CAAC,EACjJ,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAA,CAAqB,EACjE,WAAW,gBAAgB,MAAM,IAAIC,aAAAA,aAAA,CAAc,EACnD,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,YAAY,gBAAgB,YAAY,kBAAA,MACzD,IAAIC,0BAAAA,0BAA0B,eAAe,YAAY,gBAAgB,YAAY,iBAAiB;AAAA,IAAA,EAEvG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,yBAAA,MACxC,IAAIC,0CAAqB,sBAAsB,gBAAgB,wBAAwB;AAAA,IAAA,EAExF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,uBAAuB,cAAA,MAC/C,IAAIC,wCAAoB,sBAAsB,uBAAuB,aAAa;AAAA,IAAA,EAEnF,WAAW,sBAAsB,CAAC,EAAE,8BAAA,MAAoC,IAAIC,mBAAAA,mBAAmB,6BAA6B,CAAC,EAC7H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,qBAAA,MAA2B,IAAIC,sBAAAA,sBAAsB,0BAA0B,oBAAoB;AAAA,IAAA,EAEhI,WAAW,mBAAmB,MAAM,IAAIC,gBAAAA,gBAAA,CAAiB,EACzD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,qBAAA,MAA2B,IAAIC,wCAAoB,eAAe,gBAAgB,oBAAoB;AAAA,IAAA,EAExI,WAAW,oBAAoB,CAAC,EAAE,WAAA,MAAiB,IAAIC,iBAAAA,iBAAiB,UAAU,CAAC,EACnF,WAAW,wBAAwB,CAAC,EAAE,eAAA,MAAqB,IAAIC,0CAAqB,cAAc,CAAC,EACnG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,qBAAA,MAA2B,IAAIC,4BAAAA,4BAA4B,gBAAgB,oBAAoB;AAAA,IAAA,EAElH,WAAW,6BAA6B,MAAM,IAAIC,0BAAAA,0BAAA,CAA2B,EAC7E;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,eAAe,kBAAkB,aAAa,0BAA0B,yBAAA,MACzF,IAAIC,uBAAAA,uBAAuB,eAAe,eAAe,kBAAkB,aAAa,0BAA0B,wBAAwB;AAAA,IAAA,EAE3I;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,uBAAuB,YAAA,MAAkB,IAAIC,8CAAuB,eAAe,uBAAuB,WAAW;AAAA,IAAA,EAEvI,WAAW,2BAA2B,CAAC,EAAE,eAAA,MAAqB,IAAIC,wBAAAA,wBAAwB,cAAc,CAAC,EACzG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,oBAAoB,yBAAA,MACrC,IAAIC,4DAA8B,eAAe,oBAAoB,wBAAwB;AAAA,IAAA,EAE9F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,0BAA0B,kBAAkB,YAAA,MACxE,IAAIC,kCAAAA,kCAAkC,0BAA0B,0BAA0B,kBAAkB,WAAW;AAAA,IAAA,EAExH,WAAW,kCAAkC,CAAC,EAAE,sBAAA,MAA4B,IAAIC,+BAAAA,+BAA+B,qBAAqB,CAAC,EACrI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,0BAA0B,kBAAkB,YAAA,MACpE,IAAIC,8BAAAA,8BAA8B,sBAAsB,0BAA0B,kBAAkB,WAAW;AAAA,IAAA,EAEhH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAIC,8CAAuB,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAEzI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAIC,kEAAiC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAE/F;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,gBAAgB,oBAAA,MACxC,IAAIC,wEAAoC,sBAAsB,gBAAgB,mBAAmB;AAAA,IAAA,EAElG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,eAAA,MAAqB,IAAIC,oCAAAA,oCAAoC,sBAAsB,cAAc;AAAA,IAAA,EAE1H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,gBAAgB,oBAAA,MAA0B,IAAIC,0DAA6B,eAAe,gBAAgB,mBAAmB;AAAA,IAAA,EAE/I,WAAW,iCAAiC,CAAC,EAAE,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,aAAa,CAAC,EACnH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,mBAAmB,mBAAA,MAAyB,IAAIC,wCAAoB,YAAY,mBAAmB,kBAAkB;AAAA,IAAA,EAEpI;AAAA,MACA;AAAA,MACA,CAAC,EAAE,iBAAiB,mBAAmB,mBAAA,MACtC,IAAIC,kDAAyB,iBAAiB,mBAAmB,kBAAkB;AAAA,IAAA,EAEpF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,kBAAA,MAAwB,IAAIC,sCAAAA,sCAAsC,iBAAiB;AAAA,IAAA,EAEtF;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,oBAAA,MAA0B,IAAIC,6BAAAA,6BAA6B,gBAAgB,mBAAmB;AAAA,IAAA,EAEjH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,kBAAkB,sBAAA,MAA4B,IAAIC,oBAAAA,oBAAoB,kBAAkB,qBAAqB;AAAA,IAAA,EAEhH,WAAW,+BAA+B,CAAC,EAAE,WAAA,MAAiB,IAAIC,uBAAAA,uBAAuB,UAAU,CAAC,EACpG,WAAW,6BAA6B,CAAC,EAAE,iBAAiB,IAAIC,0BAAAA,0BAA0B,UAAU,CAAC,EACrG,WAAW,8BAA8B,CAAC,EAAE,WAAA,MAAiB,IAAIC,2BAAAA,2BAA2B,UAAU,CAAC,EACvG,WAAW,6BAA6B,CAAC,EAAE,WAAA,MAAiB,IAAIC,0BAAAA,0BAA0B,UAAU,CAAC,EACrG;AAAA,MACA;AAAA,MACA,CAAC,EAAE,8BAAA,MAAoC,IAAIC,6CAAAA,6CAA6C,6BAA6B;AAAA,IAAA,EAErH,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAIC,8BAAAA,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,qBAAqB,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,qBAAqB,aAAa;AAAA,IAAA,EAEhH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,qBAAqB,cAAA,MAAoB,IAAIC,6BAAAA,6BAA6B,qBAAqB,aAAa;AAAA,IAAA,EAE/G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,eAAe,WAAA,MAAiB,IAAIC,0DAA6B,eAAe,eAAe,UAAU;AAAA,IAAA,EAE3H;AAAA,MACA;AAAA,MACA,CAAC,EAAE,eAAe,kBAAA,MAAwB,IAAIC,+BAAAA,+BAA+B,eAAe,iBAAiB;AAAA,IAAA,EAE7G;AAAA,MACA;AAAA,MACA,CAAC,EAAE,cAAA,MAAoB,IAAIC,8BAAAA,8BAA8B,aAAa;AAAA,IAAA,EAEtE,WAAW,iCAAiC,CAAC,EAAE,eAAA,MAAqB,IAAIC,8BAAAA,8BAA8B,cAAc,CAAC,EACrH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,cAAA,MAAoB,IAAIC,iCAAAA,iCAAiC,gBAAgB,aAAa;AAAA,IAAA,EAEzG,WAAW,uCAAuC,CAAC,EAAE,aAAA,MAAmB,IAAIC,gEAAoC,YAAY,CAAC,EAC7H,WAAW,iCAAiC,CAAC,EAAE,2BAA2B,IAAIC,4DAA8B,oBAAoB,CAAC,EACjI,WAAW,8BAA8B,CAAC,EAAE,2BAA2B,IAAIC,sDAA2B,oBAAoB,CAAC,EAC3H,WAAW,8BAA8B,CAAC,EAAE,wBAAwB,IAAIC,2BAAAA,2BAA2B,iBAAiB,CAAC,EACrH,WAAW,2BAA2B,CAAC,EAAE,wBAAwB,IAAIC,wBAAAA,wBAAwB,iBAAiB,CAAC,EAC/G,WAAW,wBAAwB,MAAM,IAAIC,qBAAAA,qBAAA,CAAsB,EACnE,WAAW,uBAAuB,MAAM,IAAIC,oBAAAA,oBAAA,CAAqB,EACjE;AAAA,MACA;AAAA,MACA,CAAC,EAAE,2BAA2B,uBAAuB,kBAAkB,YAAA,MACtE,IAAIC,6BAAAA,6BAA6B,2BAA2B,uBAAuB,kBAAkB,WAAW;AAAA,IAAA,EAEjH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,sBAAsB,cAAA,MAAoB,IAAIC,mCAAAA,mCAAmC,sBAAsB,aAAa;AAAA,IAAA,EAEvH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,0BAA0B,gBAAgB,kBAAA,MAC5C,IAAIC,0DAA6B,0BAA0B,gBAAgB,iBAAiB;AAAA,IAAA,EAE7F,WAAW,aAAa,CAAA,cAAa,IAAIC,gBAAAA,gBAAgB,SAAS,EAAE,OAAA,CAAQ,EAC5E,WAAW,cAAc,MAAM,KAAK,UAAU,EAC9C,WAAW,kBAAkB,MAAM,KAAK,cAAc,EACtD;AAAA,MACA;AAAA,MACA,CAAC,EAAE,YAAY,UAAA,MAAgB,IAAIC,gBAAAA,gBAAgB,WAAW,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAErH;AAAA,MACA;AAAA,MACA,CAAC,EAAE,gBAAgB,UAAA,MAAgB,IAAIA,gBAAAA,gBAAgB,eAAe,aAAa,UAAU,EAAE,QAAQ,SAAA,CAAU,GAAG,SAAS;AAAA,IAAA,EAE7H,WAAW,mBAAmB,CAAC,EAAE,gBAAA,MAAsB,IAAIC,gBAAAA,gBAAgB,gBAAgB,MAAM,CAAC,EAClG,WAAW,oBAAoB,CAAC,EAAE,UAAA,MAAgB,IAAIC,OAAAA,uBAAuB,KAAK,eAAe,UAAU,KAAK,mBAAmB,SAAS,CAAC;AAAA,EAChJ;AACD;;"}

package/dist/production/src/TenantContainer.js

@@ -151,7 +151,10 @@ class TenantContainerFactory {
       idpRegistry.registerHandler("facebook", new FacebookProvider());
       idpRegistry.registerHandler("apple", new AppleProvider());
       return idpRegistry;
-    }).addService("idpClaimSyncService", ({ projectSchemaResolver }) => new IDPClaimSyncService(projectSchemaResolver)).addService("idpSessionRevalidator", ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService)).addService("backchannelLogoutManager", ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry)).addService("unpersistedApiKeyManager", () => UnpersistedApiKeyManager.createForRootTokens({
+    }).addService("idpClaimSyncService", ({ projectSchemaResolver }) => new IDPClaimSyncService(projectSchemaResolver)).addService(
+      "idpSessionRevalidator",
+      ({ idpRegistry, idpClaimSyncService }) => new IdpSessionRevalidator(idpRegistry, idpClaimSyncService, args.logger)
+    ).addService("backchannelLogoutManager", ({ idpRegistry }) => new BackchannelLogoutManager(idpRegistry)).addService("unpersistedApiKeyManager", () => UnpersistedApiKeyManager.createForRootTokens({
       tokens: args.tenantCredentials.rootTokens,
       tokenHashes: args.tenantCredentials.rootTokenHashes
     })).addService(
@@ -178,7 +181,7 @@ class TenantContainerFactory {
       ({ userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory }) => new EmailChangeManager(userMailer, projectManager, emailValidator, apiKeyManager, permissionContextFactory)
     ).addService(
       "idpSignInManager",
-      ({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService)
+      ({ apiKeyManager, idpRegistry, idpClaimSyncService }) => new IDPSignInManager(apiKeyManager, idpRegistry, idpClaimSyncService, args.logger)
     ).addService("idpManager", ({ idpRegistry, projectSchemaResolver }) => new IDPManager(idpRegistry, projectSchemaResolver)).addService("personIdentityProviderManager", () => new PersonIdentityProviderManager()).addService("otpAuthenticator", ({ providers }) => new OtpAuthenticator(providers)).addService("otpManager", ({ otpAuthenticator, providers }) => new OtpManager(otpAuthenticator, providers)).addService("backupCodeManager", ({ providers, userMailer }) => new BackupCodeManager(userMailer, providers)).addService("emailOtpManager", ({ userMailer, providers, rateLimiter }) => new EmailOtpManager(userMailer, providers, rateLimiter)).addService("authPolicyManager", ({ projectManager }) => new AuthPolicyManager(projectManager)).addService(
       "signInManager",
       ({ apiKeyManager, providers, otpManager, backupCodeManager, emailOtpManager, authPolicyResolver, loginRiskAnalyzer, userMailer }) => new SignInManager(